skillcrafter/SKILL.md
Strict, example-driven skill authoring for OpenClaw. Use when creating a new skill from scratch, improving an existing skill's quality, or auditing a skill against quality standards. Triggers on: create a skill, author a skill, improve this skill, review the skill, audit this skill, make a skill better, why isn't this skill working, skill quality check. Unlike the basic skill-creator, skillcrafter enforces strict quality gates, requires concrete usage examples, validates progressive disclosure, and rejects anti-patterns.
npx skillsauth add duriandurino/openclawrino skillcrafterInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Produce high-quality OpenClaw skills. Every skill passes through 5 phases. No shortcuts.
Do NOT skip this. A skill without concrete usage examples is a guess, not a skill.
Ask or research: what will users actually say that should trigger this skill? Collect 3–8 real phrases. If you can't think of any, you don't understand the domain yet.
Good examples are specific:
Store examples in references/examples.md for the skill to reference.
Analyze each example. For each, ask: "What code or data would I re-write every time?"
| Repeated work? | Resource to create |
|---|---|
| Same script code rewritten | A Python/shell script in scripts/ |
| Same reference/docs looked up | A markdown file in references/ |
| Same boilerplate/template output | A template directory in assets/ |
If no resources are needed, that's fine. Never create a resource just to fill a directory.
---
name: hyphen-case-name # REQUIRED — lowercase, hyphens, ≤64 chars
description: "..." # REQUIRED — ≤1024 chars, no angle brackets, triggers + scope
---
Description quality gate — every description must answer:
Optional frontmatter fields:
metadata: # Optional — tool requirements, emoji
{ "openclaw": { "emoji": "☔", "os": ["darwin", "linux"], "requires": { "bins": ["curl"] } } }
Bad description:
"A skill for working with documents"
Good description:
"Create, edit, and analyze PDF documents. Use when: extracting text from PDFs, merging/splitting PDFs, filling forms, or converting PDF formats. NOT for: creating new documents from scratch (use docx skill), viewing PDFs visually, or OCR on scanned images."
Choose ONE structure pattern, then follow it:
Task-based (most common): For skills with distinct operations.
# Skill Name
## [Primary Task 1]
[Instructions + example commands]
## [Primary Task 2]
[Instructions + example commands]
Workflow-based: For sequential multi-step processes.
# Skill Name
## Step 1 — [Action]
## Step 2 — [Action]
## Step 3 — [Action]
Reference-based: For standards/guidelines.
# Skill Name
## Principle 1
## Principle 2
## Specification
curl isreferences/ when approaching this limitKeep SKILL.md lean. Move content out when approaching 500 lines:
| Content type | Where it goes |
|---|---|
| Variant-specific details (AWS vs GCP vs Azure) | references/<variant>.md (e.g. references/aws-example.md) |
| Detailed examples or reference docs | references/<topic>.md (e.g. references/api-ref.md) |
| Long API schemas or data dictionaries | references/<topic>.md with grep hints in SKILL.md |
| Templates, boilerplate, font files | assets/ |
Link references directly from SKILL.md: "For X details, see references/<x-details>.md (loaded on demand)."
All references should be ≤1 level deep from SKILL.md — no nested linking.
## When to Use
✅ **USE this skill when:**
- "User phrase that triggers it"
- Another trigger phrase
- File type or context that needs this skill
## When NOT to Use
❌ **DON'T use this skill when:**
- Alternative tool/ skill handles it
- Out-of-scope scenario
Run validation before packaging. Fix ALL issues.
python3 skillcrafter/scripts/validate_skill.py <skill-directory>
Checks enforced:
name and descriptionOnly after validation passes:
python3 skillcrafter/scripts/package_skill.py <skill-directory> [output-dir]
Creates <skill-name>.skill (zip archive) if all checks pass.
Before considering a skill "done", verify:
See references/anti-patterns.md for full list with examples. Common violations:
scripts/validate_skill.py — Pre-packaging quality validationscripts/package_skill.py — Package validated skill into .skill filescripts/init_skill.py — Initialize new skill directory (from skill-creator)testing
Vulnerability analysis and CVE matching for penetration testing. Use when: user asks to check for vulnerabilities, match CVEs against service versions, analyze scan results for weaknesses, research exploitability, assess risk of discovered services, or identify known vulnerabilities. This is the analysis phase — no exploitation yet. NOT for: active scanning (use enum skill), exploitation (use exploit skill), or post-exploitation (use post skill).
development
Methodology and decision framework for the penetration testing vulnerability phase. Use when: validating scanner output, distinguishing confirmed vulnerabilities from hypotheses, explaining CVE/CWE/CVSS, prioritizing findings with KEV/EPSS/business context, guiding vuln-analysis workflow, or reinforcing evidence-backed reporting during the vulnerability phase. NOT for: initial recon or active enumeration, hands-on exploitation, post-exploitation, or replacing the specialized vuln skill's concrete checks.
development
Great slides need two things: content worth presenting and design worth looking at. #1 on DeepResearch Bench (Feb 2026) — CellCog researches and fills content mindfully from minimal prompts, no filler. State-of-the-art PDF generation for presentations, pitch decks, keynotes, and slideshows you can present as-is. Requires cellcog skill for SDK. If cellcog is unavailable, use gog slides as fallback (Google Workspace).
development
Methodology and quality framework for the penetration testing report phase. Use when: writing or QA-ing pentest reports, improving executive and technical readability, enforcing evidence completeness, adding remediation and retest guidance, including cleanup/restoration and residual risk, or securing report packaging and delivery. NOT for: running phase-specific testing tasks or replacing the specialized reporting implementation/publishing workflow.