{
  "schemaVersion": "1.0",
  "item": {
    "slug": "universal-skills-manager",
    "name": "Universal Skills Manager",
    "source": "tencent",
    "type": "skill",
    "category": "AI 智能",
    "sourceUrl": "https://clawhub.ai/jacob-bd/universal-skills-manager",
    "canonicalUrl": "https://clawhub.ai/jacob-bd/universal-skills-manager",
    "targetPlatform": "OpenClaw"
  },
  "install": {
    "downloadMode": "redirect",
    "downloadUrl": "/downloads/universal-skills-manager",
    "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=universal-skills-manager",
    "sourcePlatform": "tencent",
    "targetPlatform": "OpenClaw",
    "installMethod": "Manual import",
    "extraction": "Extract archive",
    "prerequisites": [
      "OpenClaw"
    ],
    "packageFormat": "ZIP package",
    "includedAssets": [
      "SKILL.md",
      "config.json",
      "scripts/install_skill.py",
      "scripts/scan_skill.py",
      "scripts/validate_frontmatter.py"
    ],
    "primaryDoc": "SKILL.md",
    "quickSetup": [
      "Download the package from Yavira.",
      "Extract the archive and review SKILL.md first.",
      "Import or place the package into your OpenClaw setup."
    ],
    "agentAssist": {
      "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
      "steps": [
        "Download the package from Yavira.",
        "Extract it into a folder your agent can access.",
        "Paste one of the prompts below and point your agent at the extracted folder."
      ],
      "prompts": [
        {
          "label": "New install",
          "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete."
        },
        {
          "label": "Upgrade existing",
          "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run."
        }
      ]
    },
    "sourceHealth": {
      "source": "tencent",
      "status": "healthy",
      "reason": "direct_download_ok",
      "recommendedAction": "download",
      "checkedAt": "2026-04-30T16:55:25.780Z",
      "expiresAt": "2026-05-07T16:55:25.780Z",
      "httpStatus": 200,
      "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=network",
      "contentType": "application/zip",
      "probeMethod": "head",
      "details": {
        "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=network",
        "contentDisposition": "attachment; filename=\"network-1.0.0.zip\"",
        "redirectLocation": null,
        "bodySnippet": null
      },
      "scope": "source",
      "summary": "Source download looks usable.",
      "detail": "Yavira can redirect you to the upstream package for this source.",
      "primaryActionLabel": "Download for OpenClaw",
      "primaryActionHref": "/downloads/universal-skills-manager"
    },
    "validation": {
      "installChecklist": [
        "Use the Yavira download entry.",
        "Review SKILL.md after the package is downloaded.",
        "Confirm the extracted package contains the expected setup assets."
      ],
      "postInstallChecks": [
        "Confirm the extracted package includes the expected docs or setup files.",
        "Validate the skill or prompts are available in your target agent workspace.",
        "Capture any manual follow-up steps the agent could not complete."
      ]
    },
    "downloadPageUrl": "https://openagent3.xyz/downloads/universal-skills-manager",
    "agentPageUrl": "https://openagent3.xyz/skills/universal-skills-manager/agent",
    "manifestUrl": "https://openagent3.xyz/skills/universal-skills-manager/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/universal-skills-manager/agent.md"
  },
  "agentAssist": {
    "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
    "steps": [
      "Download the package from Yavira.",
      "Extract it into a folder your agent can access.",
      "Paste one of the prompts below and point your agent at the extracted folder."
    ],
    "prompts": [
      {
        "label": "New install",
        "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete."
      },
      {
        "label": "Upgrade existing",
        "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run."
      }
    ]
  },
  "documentation": {
    "source": "clawhub",
    "primaryDoc": "SKILL.md",
    "sections": [
      {
        "title": "Universal Skills Manager",
        "body": "This skill empowers the agent to act as a centralized skill manager for AI capabilities. It discovers skills from multiple sources — SkillsMP.com (curated, AI semantic search), SkillHub (community skills, no API key required), and ClawHub (versioned skills, semantic search, no API key required) — and unifies skill management across multiple AI tools (Claude Code, Gemini, Anti-Gravity, OpenCode, Cline, Cursor, etc.), ensuring consistency and synchronization."
      },
      {
        "title": "When to Use This Skill",
        "body": "Activate this skill when the user:\n\nWants to find or search for new skills.\nWants to install a skill (from a search result or local file).\nWants to sync skills between different AI tools (e.g., \"Copy this Gemini skill to OpenCode\").\nAsks to move or copy skills between scopes (User vs. Project).\nMentions \"Google Anti-Gravity\", \"OpenCode\", or \"Gemini\" in the context of skills/extensions.\nWants to package a skill for claude.ai, Claude Desktop, or ChatGPT (ZIP upload)."
      },
      {
        "title": "Supported Ecosystem",
        "body": "This skill manages the following tools and scopes. Always verify these paths exist before acting.\n\nToolUser Scope (Global)Project Scope (Local)Gemini CLI~/.gemini/skills/./.gemini/skills/Google Anti-Gravity~/.gemini/antigravity/skills/./.antigravity/extensions/OpenCode~/.config/opencode/skills/./.opencode/skills/OpenClaw~/.openclaw/workspace/skills/./.openclaw/skills/Claude Code~/.claude/skills/./.claude/skills/OpenAI Codex~/.codex/skills/./.codex/skills/block/goose~/.config/goose/skills/./.goose/agents/Roo Code~/.roo/skills/./.roo/skills/Cursor~/.cursor/skills/./.cursor/skills/Cline~/.cline/skills/./.cline/skills/\n\nCloud Platforms (ZIP Upload Required):\n\nPlatformInstallation Methodclaude.aiUpload ZIP via Settings → Capabilities → Upload SkillClaude DesktopUpload ZIP via Settings → Capabilities → Upload SkillChatGPTUpload ZIP via Profile → Skills → New skill → Upload from your computer\n\nNote: claude.ai, Claude Desktop, and ChatGPT don't have access to local environment variables. Use the \"Package for Cloud Upload\" capability (Section 5) to create a ZIP. Embedding an API key is optional — SkillHub and ClawHub search work without one. If you do include a key, do NOT share the ZIP publicly (see Section 5 for credential safety guidance).\n\nChatGPT Skills are currently in beta and available on Business, Enterprise, Edu, Teachers, and Healthcare plans. Skills are off by default for Enterprise/Edu — workspace admins must enable them in Permissions & roles.\n\nIMPORTANT - Universal Skills Manager Platform Limitations:\n\nThis skill (Universal Skills Manager) requires network access to call the SkillsMP API, SkillHub API, ClawHub API, and GitHub. Handle these scenarios:\n\nIf user asks to package/ZIP the Universal Skills Manager itself for claude.ai or ChatGPT:\nTell the user: \"The Universal Skills Manager won't work on claude.ai or ChatGPT because it requires network access to call the SkillsMP API, SkillHub API, ClawHub API, and GitHub APIs. These platforms' code execution environments don't allow outbound network requests. However, I can package OTHER skills for cloud upload - those will work as long as they don't require network access.\"\n\n\nIf user wants to try the Universal Skills Manager on Claude Desktop:\nTell the user: \"Claude Desktop has network access capabilities, but there is a known bug where custom domains added to the 'Additional allowed domains' setting are not included in the network egress JWT token. This means the skill cannot reach the required APIs even after whitelisting them.\nRequired domains (for when the bug is fixed):\n\nskillsmp.com (for SkillsMP skill searches)\nskills.palebluedot.live (for SkillHub skill searches)\nclawhub.ai (for ClawHub skill searches and direct file downloads)\napi.github.com and raw.githubusercontent.com (for skill downloads from GitHub)\n\nWorkaround: Use Claude Code CLI instead, which has unrestricted network access and works with all three skill sources. You can install via: curl -fsSL https://raw.githubusercontent.com/jacob-bd/universal-skills-manager/main/install.sh | sh -s -- --tools claude\"\n\n(Note: If a tool uses a different directory structure, ask the user to confirm the path, then note it for future reference.)"
      },
      {
        "title": "1. Smart Installation & Synchronization",
        "body": "Trigger: User asks to install a skill (e.g., \"Install the debugging skill\" or \"Install skill ID xyz\").\n\nProcedure:\n\nIdentify Source:\n\nIf from SkillsMP search result: Use the githubUrl from the API response\nIf from SkillHub search result: Fetch skill details via /api/skills/{id} to get skillPath and branch, then construct GitHub tree URL\nIf from ClawHub search result: Use the slug to fetch content via ClawHub's /file endpoint (see Section C below)\nIf from skill name/ID: Search available sources (SkillsMP, SkillHub, and/or ClawHub) to find the skill\nIf local: Identify the source path\n\n\n\nVerify Repository Structure (CRITICAL):\n\nBefore downloading, browse the GitHub repo to confirm the skill folder location\nUse GitHub API to list directory contents: GET /repos/{owner}/{repo}/contents?ref={branch}\nLook for folders containing SKILL.md - this is the actual skill directory\nCommon patterns: skill/, skills/{name}/, root level, or custom folder names\nConfirm the correct path before generating the download URL\n\n\n\nDownload Using Helper Script:\n\nUse install_skill.py (located in this skill's scripts/ folder):\n\npython3 ~/.claude/skills/universal-skills-manager/scripts/install_skill.py \\\n  --url \"https://github.com/{owner}/{repo}/tree/{branch}/{skill-folder}\" \\\n  --dest \"{target-path}\" \\\n  --dry-run  # Preview first, then remove flag to install\n\n\nThe script handles: atomic install, validation, subdirectories, safety checks\nSafety feature: Script will abort (exit code 4) if destination is a root skills directory\nUpdate detection: If skill exists, shows diff and prompts for confirmation\nSecurity scan: The install script automatically scans downloaded skills for security threats (invisible characters, data exfiltration, prompt injection). Review any findings before proceeding.\n\n\n\nDetermine Primary Target:\n\nAsk: \"Should this be installed Globally (User) or Locally (Project)?\"\nDetermine the primary tool (e.g., if user is in Claude Code, Claude is primary)\nIf the user specifies claude.ai, Claude Desktop, or ChatGPT as the target, go to Step 4a instead of Step 5.\n\n4a. Cloud Platform Target Flow (claude.ai / Claude Desktop / ChatGPT):\nIf the user wants the skill for claude.ai, Claude Desktop, or ChatGPT:\n\nValidate frontmatter by running validate_frontmatter.py against the downloaded SKILL.md:\npython3 scripts/validate_frontmatter.py /path/to/downloaded/SKILL.md\n\n\nIf the skill passes validation, package it as a ZIP and provide upload instructions (see Step 6a below).\nIf the skill fails validation, notify the user with the exact issues before doing anything:\n\n\"This skill isn't formatted correctly for cloud upload. I found these issues:\n\n[list each issue from the validator, e.g., 'Unsupported top-level key: version', 'Description uses a YAML block scalar']\n\nI can fix these automatically — unsupported keys will be moved into metadata, block scalars will be converted to inline strings, etc. The skill's functionality won't change.\nWould you like me to fix it and package it?\"\n\n\nIf the user agrees: Run the fix and re-validate:\npython3 scripts/validate_frontmatter.py /path/to/downloaded/SKILL.md --fix\n\nThen package as ZIP (Step 6a).\nIf the user declines: Skip cloud packaging. Offer to install the skill as-is to other locally detected tools instead.\n\n6a. Package and deliver ZIP:\n\nCreate a ZIP containing the skill folder (with fixed SKILL.md if applicable)\nProvide upload instructions based on the target platform:\n\nFor claude.ai / Claude Desktop:\n\"Your skill is packaged and ready. To install:\n\nGo to Settings → Capabilities\nClick 'Upload skill' in the Skills section\nSelect the ZIP file and upload\"\n\nFor ChatGPT:\n\"Your skill is packaged and ready. To install:\n\nClick your profile icon and select Skills (or go to chatgpt.com/skills)\nClick 'New skill'\nSelect 'Upload from your computer'\nSelect the ZIP file and upload\"\n\n\n\nContinue to Step 5 to offer syncing to other local tools as well.\n\n\n\nThe \"Sync Check\" (CRITICAL):\n\nScan: Check if other supported tools are installed on the system (look for their config folders)\nPropose: \"I see you also have OpenCode and Cursor installed. Do you want to sync this skill to them as well?\"\n\n\n\nExecute:\n\nFor each target location, ensure the parent directory exists: mkdir -p {target-skills-dir}\nRun the install script for each target location\nEnsure the standard structure is maintained\n\n\n\nReport Success:\n\nShow installed skill name, author, and location(s)\nDisplay GitHub URL and stars count for reference"
      },
      {
        "title": "2. The \"Updates & Consistency\" Check",
        "body": "Trigger: User modifies a skill or asks to \"sync\" skills.\n\nProcedure:\n\nCompare: Check the modification times or content of the skill across all installed locations.\nReport: \"The 'code-review' skill in Gemini is newer than the one in OpenCode.\"\nAction: Offer to overwrite older versions with the newer version to ensure consistency."
      },
      {
        "title": "3. Skill Discovery (Multi-Source)",
        "body": "Trigger: User searches for skills (e.g., \"Find a debugging skill\" or \"Search for React skills\").\n\nProcedure:\n\nDiscover API Key and Select Source:\n\n\nStep 1 - Environment Variable: Check $SKILLSMP_API_KEY\nprintenv SKILLSMP_API_KEY\n\nIf set and non-empty, use SkillsMP as the primary search source.\nNote: Use printenv (not echo $VAR) — it queries the process environment directly and is more reliable across shell contexts.\n\n\nStep 2 - Config File: Check for config.json in this skill's directory\n# Look for config.json in skill directory (path varies by tool)\ncat ~/.claude/skills/universal-skills-manager/config.json 2>/dev/null\n\nIf skillsmp_api_key field has a non-empty value, use SkillsMP as primary source.\n\n\nStep 3 - Source Selection: If no API key found, present the user with a choice:\n\n\"I don't see a SkillsMP API key configured. You have three options:\nA) Provide your SkillsMP API key (get one at skillsmp.com) — curated skills with AI semantic search\nB) Search SkillHub's open catalog — community skills, no API key needed\nC) Search ClawHub — versioned skills with semantic search, no API key needed\nWhich would you prefer?\"\n\n\nIf user chooses A: Collect key, validate it (see below), store in memory for this session, proceed with SkillsMP\nIf user chooses B: Proceed with SkillHub search (no key needed)\nIf user chooses C: Proceed with ClawHub search (no key needed)\n\n\n\nKey Validation: SkillsMP API keys always start with sk_live_skillsmp_. If the user provides a key that does not match this prefix, reject it immediately:\n\n\"That doesn't look like a valid SkillsMP API key. Keys start with sk_live_skillsmp_. You can get one at https://skillsmp.com — or choose SkillHub/ClawHub search instead (no key needed).\"\n\n\n\nSecurity: Never log, display, or echo the full API key value.\n\n\nNote for claude.ai/Desktop/ChatGPT users: Environment variables are not available. Use the \"Package for Cloud Upload\" capability (Section 5) to create a ZIP with your API key embedded, or provide your key when prompted.\n\n\nExecute Search Based on Selected Source:\nIf using SkillsMP (primary, curated):\n\nChoose method:\n\nKeyword Search (/api/v1/skills/search): For specific terms, exact matches\nAI Semantic Search (/api/v1/skills/ai-search): For natural language queries (e.g., \"help me debug code\")\n\n\nIMPORTANT: Always capture the API key into a local variable first, then use it. Direct $SKILLSMP_API_KEY expansion in curl can fail in some shell contexts.\nIMPORTANT: Always include a User-Agent header. SkillsMP is behind Cloudflare, which blocks bare curl requests (403 Forbidden).\n# Step 1: Capture key (do this once per session)\nAPI_KEY=$(printenv SKILLSMP_API_KEY)\n\n# Step 2: Use ${API_KEY} in curl commands (User-Agent required)\n# Keyword Search\ncurl -X GET \"https://skillsmp.com/api/v1/skills/search?q={query}&limit=20&sortBy=recent\" \\\n  -H \"Authorization: Bearer ${API_KEY}\" \\\n  -H \"User-Agent: Universal-Skills-Manager\"\n\n# AI Semantic Search (for natural language queries)\ncurl -X GET \"https://skillsmp.com/api/v1/skills/ai-search?q={query}\" \\\n  -H \"Authorization: Bearer ${API_KEY}\" \\\n  -H \"User-Agent: Universal-Skills-Manager\"\n\n\nParse: Extract from data.skills[] (keyword) or data.data[] (AI search)\nAvailable fields: id, name, author, description, githubUrl, skillUrl, stars, updatedAt\nNote: SkillsMP requires a q parameter — there is no browse/list endpoint. However, q=* works as a wildcard to surface top skills (combine with sortBy=stars for popularity). For dedicated browsing, use SkillHub or ClawHub instead (both support browsing by stars/downloads).\n\nIf using SkillHub (open catalog, no auth):\n\nExecute:\n# SkillHub Search (no authentication required)\ncurl -X GET \"https://skills.palebluedot.live/api/skills?q={query}&limit=20\" \\\n  -H \"User-Agent: Universal-Skills-Manager\"\n\n\nParse: Extract from skills[] array\nAvailable fields: id, name, description, githubOwner, githubRepo, githubStars, downloadCount, securityScore\nNote: SkillHub does not have an AI semantic search — keyword search only\n\nIf using ClawHub (versioned skills, semantic search, no auth):\n\nChoose method:\n\nSemantic Search (/api/v1/search): For natural language queries — returns results ranked by vector similarity score\nBrowse/List (/api/v1/skills): For browsing by popularity, stars, or recency\n\n\nExecute:\n# Semantic Search (vector/similarity search)\ncurl -X GET \"https://clawhub.ai/api/v1/search?q={query}&limit=20\" \\\n  -H \"User-Agent: Universal-Skills-Manager\"\n\n# Browse by stars, downloads, or trending\ncurl -X GET \"https://clawhub.ai/api/v1/skills?limit=20&sort=stars\" \\\n  -H \"User-Agent: Universal-Skills-Manager\"\n# Other sort options: sort=downloads, sort=trending, sort=updated\n\n\nParse:\n\nSemantic search: Extract from results[] array — each has score, slug, displayName, summary, version, updatedAt\nBrowse: Extract from items[] array — each has slug, displayName, summary, version, stats.stars, stats.downloads\n\n\nNote: ClawHub hosts skill files directly (not on GitHub). Use the slug field when installing — see Section C.\n\n\n\nDisplay Results (Unified Format):\nDisplay results in a consistent table format regardless of source. Include the Source column to indicate origin:\n| # | Skill | Author | Stars | Source | Description |\n|---|-------|--------|-------|--------|-------------|\n| 1 | debugging-strategies | wshobson | 27,021 | SkillHub | Master systematic debugging... |\n| 2 | code-debugging | AuthorX | 15 | SkillsMP | Systematic debugging methodology... |\n| 3 | self-improving-agent | clawhub-user | 42 | ClawHub | Agent that improves itself... |\n\n\nFor SkillsMP AI search: Also show relevance score\nFor SkillHub: Show securityScore if available\nFor ClawHub semantic search: Show similarity score if available\nLimit to top 10-15 results for readability\n\n\n\nSearch More Sources:\nAfter displaying results from any source, offer to search the remaining unsearched sources:\n\nIf 2 sources remain: \"Want to also search {source1} or {source2}? Or both?\"\nIf 1 source remains: \"Want to also search {source}?\"\n\nAvailable sources: SkillsMP (requires API key), SkillHub (no key), ClawHub (no key)\nIf yes:\n\nQuery the selected source(s) with the same search terms\nDeduplicate: Compare results across sources:\n\nSkillsMP ↔ SkillHub: By full skill ID ({owner}/{repo}/{path})\nClawHub ↔ others: By skill name (ClawHub uses slugs, not GitHub paths)\n\n\nAppend unique results to the display, labeled with their source tag\n\n\n\nOffer Installation:\n\nAfter displaying results, ask: \"Which skill would you like to install?\"\nFor SkillsMP results: Note the skill's githubUrl for content fetching\nFor SkillHub results: Note the skill's id for detail fetching (needed to get skillPath and branch)\nFor ClawHub results: Note the skill's slug for direct file fetching via ClawHub's /file endpoint"
      },
      {
        "title": "4. Skill Matrix Report",
        "body": "Trigger: User asks for skill report/overview (e.g., \"Show my skills\", \"What skills do I have?\", \"Skill report\", \"Compare my tools\").\n\nProcedure:\n\nDetect Installed Tools:\nCheck which AI tools are installed by verifying their user-level skills directories exist:\n# Check each tool's skills directory\nls -d ~/.claude/skills 2>/dev/null && echo \"Claude: ✓\"\nls -d ~/.codex/skills 2>/dev/null && echo \"Codex: ✓\"\nls -d ~/.gemini/skills 2>/dev/null && echo \"Gemini: ✓\"\nls -d ~/.gemini/antigravity/skills 2>/dev/null && echo \"Antigravity: ✓\"\nls -d ~/.openclaw/workspace/skills 2>/dev/null && echo \"OpenClaw: ✓\"\nls -d ~/.cursor/skills 2>/dev/null && echo \"Cursor: ✓\"\nls -d ~/.config/opencode/skills 2>/dev/null && echo \"OpenCode: ✓\"\nls -d ~/.roo/skills 2>/dev/null && echo \"Roo: ✓\"\nls -d ~/.config/goose/skills 2>/dev/null && echo \"Goose: ✓\"\nls -d ~/.cline/skills 2>/dev/null && echo \"Cline: ✓\"\n\n\n\nCollect All Skills:\nFor each detected tool, list skill folders:\nfind ~/.{claude,codex,gemini,gemini/antigravity,openclaw/workspace,cursor,config/opencode,config/goose,roo,cline}/skills -maxdepth 1 -type d 2>/dev/null | \\\n  xargs -I{} basename {} | sort -u\n\n\n\nGenerate Matrix Table:\nCreate a markdown table where:\n\nRows = skill names (deduplicated across all tools)\nColumns = only tools that are installed on the system\nCells = ✅ (installed) or ❌ (not installed)\n\nExample output:\n| Skill | Claude | Codex | Gemini |\n|-------|--------|-------|--------|\n| humanizer | ✅ | ❌ | ✅ |\n| skill-creator | ❌ | ✅ | ❌ |\n| using-superpowers | ✅ | ✅ | ✅ |\n\n\n\nShow Summary:\n\nTotal skills across all tools\nSkills unique to one tool\nSkills installed everywhere"
      },
      {
        "title": "5. Package for Cloud Upload (claude.ai / Claude Desktop / ChatGPT)",
        "body": "Trigger: User wants to use this skill in claude.ai, Claude Desktop, or ChatGPT (e.g., \"Package this for claude.ai\", \"Create a ZIP for Claude Desktop\", \"Package for ChatGPT\", \"I want to upload this skill to claude.ai\", \"Prepare skill for web upload\", \"Package this for chatgpt.com\").\n\nProcedure:\n\nExplain the Process:\n\"I'll create a ZIP file with this skill ready for upload to claude.ai, Claude Desktop, or ChatGPT. Since cloud environments don't have access to your local environment variables, I can optionally embed your API key in the package. Note: the API key is optional — SkillHub and ClawHub search work without one.\"\n\n\nValidate Frontmatter Compatibility (CRITICAL — do this BEFORE packaging):\nRun validate_frontmatter.py to check the SKILL.md against the Agent Skills spec (used by both claude.ai/Claude Desktop and ChatGPT):\n# Validate only (report issues)\npython3 scripts/validate_frontmatter.py /path/to/SKILL.md\n\n# Validate and auto-fix (overwrites file)\npython3 scripts/validate_frontmatter.py /path/to/SKILL.md --fix\n\n# Validate a ZIP file\npython3 scripts/validate_frontmatter.py /path/to/skill.zip --fix\n\nThe script checks for unsupported top-level keys, nested metadata, non-string metadata values, and field length violations. With --fix, it automatically moves unsupported keys into metadata, flattens nested objects, and converts values to strings. Tell the user what was fixed. See Operational Rule 5 for the full spec.\n\n\nCollect API Key (Optional):\n\nAsk: \"Would you like to include your SkillsMP API key for curated search? This is optional — SkillHub and ClawHub work without a key. If you skip this, the packaged skill will still work for SkillHub and ClawHub searches.\"\nIf user wants to include a key:\n\nAsk: \"Please provide your SkillsMP API key. You can get one at https://skillsmp.com\"\nWait for user to provide the key\nValidate: Key must start with sk_live_skillsmp_. If invalid, reject and re-prompt or offer to skip.\nSecurity: Do not echo or display the key back to the user\n\n\nIf user skips, create the ZIP without config.json\nCredential safety warning (IMPORTANT — always display this if a key is included):\n\n\"Security note: This ZIP will contain your API key in plain text. Please follow these precautions:\n\nDo NOT share this ZIP publicly, post it online, or commit it to version control\nDo NOT distribute this ZIP to others — each user should package their own\nUse a scoped/least-privilege key if your provider supports it\nRotate your key if you suspect the ZIP was exposed\nThe key is stored locally in config.json inside the ZIP and is only used at runtime to authenticate with the SkillsMP API\"\n\n\n\n\n\n\nCreate Package Contents:\n\nCreate a temporary directory structure:\nuniversal-skills-manager/\n├── SKILL.md          # Copy from current skill\n├── config.json       # Create with embedded API key\n└── scripts/\n    └── install_skill.py  # Copy from current skill\n\n\nGenerate config.json with the user's API key:\n{\n  \"skillsmp_api_key\": \"USER_PROVIDED_KEY_HERE\"\n}\n\n\n\n\n\nCreate ZIP File:\n\nUse Python to create the ZIP:\nimport zipfile\nimport json\nimport tempfile\nfrom pathlib import Path\n\n# Create ZIP in user's Downloads or current directory\nzip_path = Path.home() / \"Downloads\" / \"universal-skills-manager.zip\"\nskill_dir = Path(\"~/.claude/skills/universal-skills-manager\").expanduser()\n\nwith tempfile.TemporaryDirectory() as temp_dir:\n    temp_path = Path(temp_dir)\n    \n    # Copy skill files\n    for file_path in skill_dir.rglob('*'):\n        if file_path.is_file() and file_path.name != 'config.json':\n            rel_path = file_path.relative_to(skill_dir)\n            dest = temp_path / rel_path\n            dest.parent.mkdir(parents=True, exist_ok=True)\n            dest.write_bytes(file_path.read_bytes())\n    \n    # Create config.json with API key\n    config = {\"skillsmp_api_key\": \"USER_API_KEY\"}\n    (temp_path / \"config.json\").write_text(json.dumps(config, indent=2))\n    \n    # Create ZIP\n    with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zf:\n        for file_path in temp_path.rglob('*'):\n            if file_path.is_file():\n                arcname = f\"universal-skills-manager/{file_path.relative_to(temp_path)}\"\n                zf.write(file_path, arcname)\n\n\nAlternatively, provide the ZIP as a downloadable artifact\n\n\n\nProvide Upload Instructions:\n\n\"Your skill package is ready! To use it:\"\nFor claude.ai / Claude Desktop:\n\n\"1. Download the ZIP file\"\n\"2. Go to Settings → Capabilities\"\n\"3. Click 'Upload skill' in the Skills section\"\n\"4. Select the ZIP file and upload\"\n\"5. Enable the skill and start using it!\"\n\n\nFor ChatGPT:\n\n\"1. Download the ZIP file\"\n\"2. Click your profile icon and select Skills (or go to chatgpt.com/skills)\"\n\"3. Click 'New skill'\"\n\"4. Select 'Upload from your computer'\"\n\"5. Select the ZIP file and upload\"\n\"6. The skill is now installed and ChatGPT will use it when relevant!\"\n\n\n\n\n\nSecurity Reminder:\n\nIf a key was embedded: \"This ZIP contains your API key. Do NOT share it publicly, distribute it to others, or commit it to version control. If you need to share the skill, create a key-free version (without config.json) and let each user add their own key.\"\nIf no key was embedded: \"This ZIP is safe to share — it contains no credentials. Recipients can add their own API key later, or use SkillHub/ClawHub search which requires no key.\""
      },
      {
        "title": "Operational Rules",
        "body": "Structure Integrity: When installing, always ensure the skill has its own folder (e.g., .../skills/my-skill/). Do not dump loose files into the root skills directory. Always run mkdir -p on the target path before copying files.\n\n\nConflict Safety: If a skill already exists at a target location, always ask before overwriting, unless the user explicitly requested a \"Force Sync.\"\n\n\nUser-Agent Required: Always include -H \"User-Agent: Universal-Skills-Manager\" in all curl requests. APIs behind Cloudflare (like SkillsMP) return 403 Forbidden for bare curl requests without a User-Agent header.\n\n\nOpenClaw Note: OpenClaw may require a restart to pick up new skills if skills.load.watch is not enabled in openclaw.json. Warn the user of this after installation.\n\n\nCross-Platform Adaptation:\n\nGemini uses SKILL.md.\nCline uses the same SKILL.md format with name and description frontmatter. The name field must match the directory name. No manifest generation required. Note: Cline also reads .claude/skills/ at the project level, so Claude Code project skills work in Cline automatically.\nIf OpenCode or Anti-Gravity require a specific manifest (e.g., manifest.json), generate a basic one based on the SKILL.md frontmatter during installation.\n\n\n\nCloud Platform Frontmatter Compatibility Check (claude.ai / Claude Desktop / ChatGPT):\nWhen a user wants to upload or package a skill for claude.ai, Claude Desktop, or ChatGPT, validate the SKILL.md frontmatter against the Agent Skills specification. All three platforms use strict frontmatter validation that rejects ambiguous YAML constructs like block scalars. Non-compliant skills will be rejected with \"malformed YAML frontmatter\" or \"unexpected key\" errors.\nAllowed top-level frontmatter fields (Agent Skills spec):\nFieldRequiredConstraintsnameYesMax 64 chars, lowercase letters/numbers/hyphens only, must match directory namedescriptionYesMax 1024 chars. No angle brackets (< or >). Avoid literal block scalars (|) — known to fail with blank lines. Folded scalars (>) work but inline strings are safestlicenseNoLicense name or reference to bundled filecompatibilityNoMax 500 chars, environment requirementsmetadataNoFlat key-value pairs only (string keys to string values — no nested objects, no arrays)allowed-toolsNoSpace-delimited list of pre-approved tools (experimental)\nUse the validation script (preferred — avoids manual YAML errors):\n# Validate a SKILL.md\npython3 scripts/validate_frontmatter.py /path/to/SKILL.md\n\n# Validate and auto-fix in place\npython3 scripts/validate_frontmatter.py /path/to/SKILL.md --fix\n\n# Validate and fix a ZIP file (rewrites SKILL.md inside the ZIP)\npython3 scripts/validate_frontmatter.py /path/to/skill.zip --fix\n\nThe script (scripts/validate_frontmatter.py) is zero-dependency Python 3. It checks all constraints and with --fix automatically applies these corrections:\n\nMoves unsupported top-level keys (e.g., version, author, homepage, category) into metadata as string values\nFlattens nested metadata objects (e.g., metadata.clawdbot.requires.bins: [x, y] → metadata.clawdbot-requires-bins: \"x, y\")\nConverts non-string metadata values to quoted strings (e.g., true → \"true\")\nCollapses literal block scalar (|) descriptions to inline quoted strings (known to fail with blank lines). Folded scalars (>) trigger a warning but work in current Claude Desktop\nStrips angle brackets (< >) from description (Anthropic's validator rejects them)\nConverts YAML list-format allowed-tools to space-delimited string\nTruncates description if over 1024 chars\nValidates the fix and reports if any issues remain\n\nIf the script is not available, do the validation manually:\n\nRead the SKILL.md frontmatter\nCheck all top-level keys are in the allowed set: name, description, license, compatibility, metadata, allowed-tools\nIf metadata is present, verify all values are strings (no nested objects or arrays)\nVerify name is lowercase with hyphens only, max 64 chars\nVerify description is max 1024 chars\n\nIf validation fails, tell the user exactly what's wrong and offer to fix it (run the script with --fix, or apply the fixes manually)."
      },
      {
        "title": "Available Tools",
        "body": "bash (curl): Make API calls to SkillsMP.com, SkillHub (skills.palebluedot.live), and ClawHub (clawhub.ai); fetch skill content from GitHub or ClawHub directly.\nweb_fetch: Fetch skill content from GitHub raw URLs, SkillHub API, or ClawHub API (alternative to curl).\nread_file / write_file: Manage local skill files.\nglob: Find existing skills in local directories."
      },
      {
        "title": "Skill Structure",
        "body": "Skills typically contain:\n\nSKILL.md (required): Main instructions with frontmatter.\nReference docs: Additional documentation files.\nScripts: Helper scripts (Python, shell, etc.).\nConfig files: JSON, YAML configurations."
      },
      {
        "title": "Installation Logic",
        "body": "A. Installing from SkillsMP API\n\nFetch Skill Content:\n\nConvert githubUrl to raw content URL:\nInput:  https://github.com/{user}/{repo}/tree/{branch}/{path}\nOutput: https://raw.githubusercontent.com/{user}/{repo}/{branch}/{path}/SKILL.md\n\n\nFetch the SKILL.md content using curl or web_fetch\n\n\n\nCreate Directory:\n\nUse skill name from API response for directory: .../skills/{skill-name}/\nExample: .../skills/code-debugging/\n\n\n\nSave SKILL.md:\n\nWrite the fetched content to SKILL.md in the new directory\nPreserve the original YAML frontmatter and content\n\n\n\nHandle Additional Files (Optional):\n\nCheck if GitHub repo has additional files (reference docs, scripts)\nOptionally fetch and save them to maintain complete skill package\n\n\n\nConfirm:\n\nReport: \"Installed '{name}' by {author} to {path}\"\nShow GitHub URL and stars count\nOffer sync to other AI tools\n\nB. Installing from SkillHub\n\nFetch Skill Details:\n\nUse the skill's id from the search result to get full details:\ncurl -X GET \"https://skills.palebluedot.live/api/skills/{id}\"\n\n\nIMPORTANT: The id field (e.g., wshobson/agents/debugging-strategies) does NOT map to the file path within the repo. You MUST use the detail endpoint to get the actual skillPath and branch.\nExtract from response: githubOwner, githubRepo, branch, skillPath\n\n\n\nConstruct GitHub URL:\n\nBuild the GitHub tree URL from the detail response:\nhttps://github.com/{githubOwner}/{githubRepo}/tree/{branch}/{skillPath}\n\n\nExample: https://github.com/wshobson/agents/tree/main/plugins/developer-essentials/skills/debugging-strategies\n\n\n\nDownload Using Helper Script:\n\nFrom this point, the flow is identical to SkillsMP installation:\npython3 ~/.claude/skills/universal-skills-manager/scripts/install_skill.py \\\n  --url \"https://github.com/{githubOwner}/{githubRepo}/tree/{branch}/{skillPath}\" \\\n  --dest \"{target-path}\"\n\n\n\n\n\nConfirm:\n\nReport: \"Installed '{name}' from SkillHub to {path}\"\nShow GitHub URL and stars count\nOffer sync to other AI tools\n\nC. Installing from ClawHub\n\nClawHub hosts skill files directly (not on GitHub), so the install flow bypasses install_skill.py and fetches content via ClawHub's API.\n\nFetch SKILL.md Content:\n\nUse ClawHub's file endpoint to get the raw SKILL.md:\ncurl -s \"https://clawhub.ai/api/v1/skills/{slug}/file?path=SKILL.md\" \\\n  -H \"User-Agent: Universal-Skills-Manager\" \\\n  -o /tmp/clawhub-{slug}/SKILL.md\n\n\nIMPORTANT: This endpoint returns raw text/plain content, NOT JSON. Save the response body directly as the file.\nThe x-content-sha256 response header can be used to verify file integrity.\n\n\n\nHandle Multi-File Skills (if applicable):\n\nIf the skill has additional files (scripts, configs), use ClawHub's download endpoint:\ncurl -s \"https://clawhub.ai/api/v1/download?slug={slug}\" \\\n  -H \"User-Agent: Universal-Skills-Manager\" \\\n  -o /tmp/clawhub-{slug}.zip\nunzip -o /tmp/clawhub-{slug}.zip -d /tmp/clawhub-{slug}/\n\n\nTo check if a skill has multiple files, inspect the detail response from GET /api/v1/skills/{slug} — the latestVersion object may indicate file count.\n\n\n\nRun Security Scan:\n\nSince install_skill.py is bypassed, run the security scanner manually:\npython3 ~/.claude/skills/universal-skills-manager/scripts/scan_skill.py /tmp/clawhub-{slug}/\n\n\nReview any findings before proceeding. ClawHub has VirusTotal integration but our scan provides an additional layer.\n\n\n\nValidate YAML Frontmatter:\n\nVerify the SKILL.md has valid YAML frontmatter (name, description fields).\nIf invalid, warn the user and ask whether to proceed.\n\n\n\nCreate Directory and Install:\n\nCreate the target directory: .../skills/{slug}/\nCopy all files from the temp directory to the destination:\nmkdir -p {target-path}/{slug}\ncp -r /tmp/clawhub-{slug}/* {target-path}/{slug}/\n\n\n\n\n\nConfirm:\n\nReport: \"Installed '{displayName}' (v{version}) from ClawHub to {path}\"\nShow version info and stars count\nOffer sync to other AI tools\n\n\n\nCleanup:\n\nRemove the temporary directory:\nrm -rf /tmp/clawhub-{slug}/ /tmp/clawhub-{slug}.zip\n\nD. Installing from Local Source (Sync/Copy)\n\nRetrieve: Read all files from the source directory.\nCreate Directory: Create the target directory .../skills/{slug}/.\nSave Files: Copy all files to the new location, preserving filenames."
      },
      {
        "title": "SkillsMP API Configuration",
        "body": "Base URL: https://skillsmp.com/api/v1\n\nAuthentication:\n\nAuthorization: Bearer $SKILLSMP_API_KEY\n\nAvailable Endpoints:\n\nGET /api/v1/skills/search?q={query}&page={1}&limit={20}&sortBy={recent|stars}\nGET /api/v1/skills/ai-search?q={query}\n\nResponse Format (Keyword Search):\n\n{\n  \"success\": true,\n  \"data\": {\n    \"skills\": [\n      {\n        \"id\": \"...\",\n        \"name\": \"skill-name\",\n        \"author\": \"AuthorName\",\n        \"description\": \"...\",\n        \"githubUrl\": \"https://github.com/user/repo/tree/main/path\",\n        \"skillUrl\": \"https://skillsmp.com/skills/...\",\n        \"stars\": 10,\n        \"updatedAt\": 1768838561\n      }\n    ],\n    \"pagination\": {\n      \"page\": 1,\n      \"limit\": 20,\n      \"total\": 3601,\n      \"totalPages\": 1801,\n      \"hasNext\": true\n    }\n  }\n}\n\nResponse Format (AI Search):\n\n{\n  \"success\": true,\n  \"data\": {\n    \"search_query\": \"...\",\n    \"data\": [\n      {\n        \"file_id\": \"...\",\n        \"filename\": \"...\",\n        \"score\": 0.656,\n        \"skill\": {\n          \"id\": \"...\",\n          \"name\": \"...\",\n          \"author\": \"...\",\n          \"description\": \"...\",\n          \"githubUrl\": \"...\",\n          \"skillUrl\": \"...\",\n          \"stars\": 0,\n          \"updatedAt\": 1769542668\n        }\n      }\n    ]\n  }\n}\n\nError Handling:\n\n401: Invalid or missing API key\n400: Missing required query parameter\n500: Internal server error"
      },
      {
        "title": "SkillHub API Configuration",
        "body": "Base URL: https://skills.palebluedot.live/api\n\nAuthentication: None required (open API)\n\nAvailable Endpoints:\n\nGET /api/skills?q={query}&limit={20} — Search skills by keyword\nGET /api/skills/{id} — Get full skill details (includes skillPath, branch, rawContent)\nGET /api/categories — List skill categories\nGET /api/health — Health check\n\nSearch Response Format:\n\n{\n  \"skills\": [\n    {\n      \"id\": \"wshobson/agents/debugging-strategies\",\n      \"name\": \"debugging-strategies\",\n      \"description\": \"Master systematic debugging...\",\n      \"githubOwner\": \"wshobson\",\n      \"githubRepo\": \"agents\",\n      \"githubStars\": 27021,\n      \"downloadCount\": 0,\n      \"securityScore\": 100,\n      \"securityStatus\": null,\n      \"rating\": 0,\n      \"isVerified\": false,\n      \"compatibility\": { \"platforms\": [] }\n    }\n  ],\n  \"pagination\": {\n    \"page\": 1,\n    \"limit\": 20,\n    \"total\": 1000,\n    \"totalPages\": 50\n  },\n  \"searchEngine\": \"meilisearch\",\n  \"processingTimeMs\": 10\n}\n\nDetail Response Format (GET /api/skills/{id}):\n\n{\n  \"id\": \"wshobson/agents/debugging-strategies\",\n  \"name\": \"debugging-strategies\",\n  \"description\": \"...\",\n  \"githubOwner\": \"wshobson\",\n  \"githubRepo\": \"agents\",\n  \"skillPath\": \"plugins/developer-essentials/skills/debugging-strategies\",\n  \"branch\": \"main\",\n  \"githubStars\": 27021,\n  \"rawContent\": \"---\\nname: debugging-strategies\\n...\"\n}\n\nKey Fields for Installation:\n\nskillPath: The actual directory path within the GitHub repo (CRITICAL — the id does NOT match the file path)\nbranch: The branch name (e.g., main)\ngithubOwner + githubRepo: Used to construct the GitHub URL\nrawContent: Full SKILL.md content (can be used as fallback if GitHub is unreachable)\n\nError Handling:\n\n404: Skill not found\n500: Internal server error"
      },
      {
        "title": "ClawHub API Configuration",
        "body": "Base URL: https://clawhub.ai/api/v1\n\nAuthentication: None required (open API)\n\nRate Limits: 120 reads/min per IP (shown in x-ratelimit-remaining and x-ratelimit-reset response headers)\n\nAvailable Endpoints:\n\nGET /api/v1/search?q={query}&limit={20} — Semantic/vector search (ranked by similarity score)\nGET /api/v1/skills?limit={20}&sort={stars|downloads|updated|trending}&cursor={cursor} — Browse/list with cursor pagination\nGET /api/v1/skills/{slug} — Get full skill details (owner, version, moderation status)\nGET /api/v1/skills/{slug}/file?path={filepath}&version={ver} — Get raw file content (text/plain, NOT JSON)\nGET /api/v1/download?slug={slug}&version={ver} — Download full skill as ZIP\n\nSearch Response Format (GET /api/v1/search):\n\n{\n  \"results\": [\n    {\n      \"score\": 0.82,\n      \"slug\": \"self-improving-agent\",\n      \"displayName\": \"Self-Improving Agent\",\n      \"summary\": \"An agent that iteratively improves itself...\",\n      \"version\": \"1.0.0\",\n      \"updatedAt\": \"2026-01-15T10:30:00Z\"\n    }\n  ]\n}\n\nBrowse Response Format (GET /api/v1/skills):\n\n{\n  \"items\": [\n    {\n      \"slug\": \"self-improving-agent\",\n      \"displayName\": \"Self-Improving Agent\",\n      \"summary\": \"...\",\n      \"version\": \"1.0.0\",\n      \"stats\": {\n        \"stars\": 42,\n        \"downloads\": 150\n      }\n    }\n  ],\n  \"nextCursor\": \"eyJ...\"\n}\n\nDetail Response Format (GET /api/v1/skills/{slug}):\n\n{\n  \"skill\": {\n    \"slug\": \"self-improving-agent\",\n    \"displayName\": \"Self-Improving Agent\",\n    \"summary\": \"...\",\n    \"version\": \"1.0.0\"\n  },\n  \"owner\": {\n    \"handle\": \"username\",\n    \"displayName\": \"User Name\"\n  },\n  \"latestVersion\": \"1.0.0\",\n  \"moderation\": \"approved\"\n}\n\nFile Endpoint (GET /api/v1/skills/{slug}/file?path=SKILL.md):\n\nReturns raw text/plain content (NOT JSON)\nResponse headers include x-content-sha256 (integrity hash) and x-content-size (byte count)\nUse version query param to fetch a specific version (defaults to latest)\n\nKey Differences from SkillsMP/SkillHub:\n\nDirect hosting: ClawHub hosts skill files directly — no GitHub URL construction needed\nVersioned skills: Each skill has explicit version numbers; use version param to pin\nSlug-based IDs: Skills are identified by slug (e.g., self-improving-agent), not GitHub paths\nSemantic search built-in: The /search endpoint uses vector similarity, not keyword matching\nVirusTotal integration: ClawHub scans skills via VirusTotal partnership; moderation field indicates status\n\nError Handling:\n\n404: Skill or file not found\n429: Rate limit exceeded (120 reads/min)\n500: Internal server error"
      },
      {
        "title": "Guidelines",
        "body": "Multi-Source Search: Use SkillsMP as the primary source when an API key is available. Offer SkillHub and ClawHub as alternative or additional sources.\nPrefer AI/Semantic Search: For natural language queries, use SkillsMP /ai-search or ClawHub /search (both support semantic matching). SkillHub only supports keyword search.\nSource Labeling: Always label results with their source ([SkillsMP], [SkillHub], or [ClawHub]) so users can distinguish between sources.\nSkillHub Detail Lookup: When installing from SkillHub, always fetch the detail endpoint first to get the correct skillPath and branch. Never try to parse the id field as a file path.\nClawHub Direct Hosting: ClawHub hosts skill files directly — use the /file endpoint to fetch content. No GitHub URL construction is needed. Use the slug field as the skill identifier.\nClawHub Versioning: ClawHub skills have explicit version numbers. Show the version in install confirmations. Use the version query param to pin a specific version if needed.\nDeduplication: When showing results from multiple sources, deduplicate: SkillsMP ↔ SkillHub by full skill ID ({owner}/{repo}/{path}); ClawHub ↔ others by skill name (since ClawHub uses slugs, not GitHub paths).\nVerify Content: After fetching from any source, verify the SKILL.md has valid YAML frontmatter.\nStructure Integrity: Maintain the .../skills/{skill-name}/SKILL.md structure.\nSyncing: After installing a skill, offer to sync (copy) it to other detected AI tools.\nGitHub URLs: For SkillsMP/SkillHub installs, always convert tree URLs to raw.githubusercontent.com URLs for content fetching.\nSecurity: Security scanning runs on all installs regardless of source (SkillsMP, SkillHub, or ClawHub). SkillHub's securityScore and ClawHub's VirusTotal moderation status are informational only — our own scan_skill.py at install time is authoritative."
      }
    ],
    "body": "<!-- Version: 1.7.0 -->\nUniversal Skills Manager\n\nThis skill empowers the agent to act as a centralized skill manager for AI capabilities. It discovers skills from multiple sources — SkillsMP.com (curated, AI semantic search), SkillHub (community skills, no API key required), and ClawHub (versioned skills, semantic search, no API key required) — and unifies skill management across multiple AI tools (Claude Code, Gemini, Anti-Gravity, OpenCode, Cline, Cursor, etc.), ensuring consistency and synchronization.\n\nWhen to Use This Skill\n\nActivate this skill when the user:\n\nWants to find or search for new skills.\nWants to install a skill (from a search result or local file).\nWants to sync skills between different AI tools (e.g., \"Copy this Gemini skill to OpenCode\").\nAsks to move or copy skills between scopes (User vs. Project).\nMentions \"Google Anti-Gravity\", \"OpenCode\", or \"Gemini\" in the context of skills/extensions.\nWants to package a skill for claude.ai, Claude Desktop, or ChatGPT (ZIP upload).\nSupported Ecosystem\n\nThis skill manages the following tools and scopes. Always verify these paths exist before acting.\n\nTool\tUser Scope (Global)\tProject Scope (Local)\nGemini CLI\t~/.gemini/skills/\t./.gemini/skills/\nGoogle Anti-Gravity\t~/.gemini/antigravity/skills/\t./.antigravity/extensions/\nOpenCode\t~/.config/opencode/skills/\t./.opencode/skills/\nOpenClaw\t~/.openclaw/workspace/skills/\t./.openclaw/skills/\nClaude Code\t~/.claude/skills/\t./.claude/skills/\nOpenAI Codex\t~/.codex/skills/\t./.codex/skills/\nblock/goose\t~/.config/goose/skills/\t./.goose/agents/\nRoo Code\t~/.roo/skills/\t./.roo/skills/\nCursor\t~/.cursor/skills/\t./.cursor/skills/\nCline\t~/.cline/skills/\t./.cline/skills/\n\nCloud Platforms (ZIP Upload Required):\n\nPlatform\tInstallation Method\nclaude.ai\tUpload ZIP via Settings → Capabilities → Upload Skill\nClaude Desktop\tUpload ZIP via Settings → Capabilities → Upload Skill\nChatGPT\tUpload ZIP via Profile → Skills → New skill → Upload from your computer\n\nNote: claude.ai, Claude Desktop, and ChatGPT don't have access to local environment variables. Use the \"Package for Cloud Upload\" capability (Section 5) to create a ZIP. Embedding an API key is optional — SkillHub and ClawHub search work without one. If you do include a key, do NOT share the ZIP publicly (see Section 5 for credential safety guidance).\n\nChatGPT Skills are currently in beta and available on Business, Enterprise, Edu, Teachers, and Healthcare plans. Skills are off by default for Enterprise/Edu — workspace admins must enable them in Permissions & roles.\n\nIMPORTANT - Universal Skills Manager Platform Limitations:\n\nThis skill (Universal Skills Manager) requires network access to call the SkillsMP API, SkillHub API, ClawHub API, and GitHub. Handle these scenarios:\n\nIf user asks to package/ZIP the Universal Skills Manager itself for claude.ai or ChatGPT: Tell the user: \"The Universal Skills Manager won't work on claude.ai or ChatGPT because it requires network access to call the SkillsMP API, SkillHub API, ClawHub API, and GitHub APIs. These platforms' code execution environments don't allow outbound network requests. However, I can package OTHER skills for cloud upload - those will work as long as they don't require network access.\"\n\nIf user wants to try the Universal Skills Manager on Claude Desktop: Tell the user: \"Claude Desktop has network access capabilities, but there is a known bug where custom domains added to the 'Additional allowed domains' setting are not included in the network egress JWT token. This means the skill cannot reach the required APIs even after whitelisting them.\n\nRequired domains (for when the bug is fixed):\n\nskillsmp.com (for SkillsMP skill searches)\nskills.palebluedot.live (for SkillHub skill searches)\nclawhub.ai (for ClawHub skill searches and direct file downloads)\napi.github.com and raw.githubusercontent.com (for skill downloads from GitHub)\n\nWorkaround: Use Claude Code CLI instead, which has unrestricted network access and works with all three skill sources. You can install via: curl -fsSL https://raw.githubusercontent.com/jacob-bd/universal-skills-manager/main/install.sh | sh -s -- --tools claude\"\n\n(Note: If a tool uses a different directory structure, ask the user to confirm the path, then note it for future reference.)\n\nCore Capabilities\n1. Smart Installation & Synchronization\n\nTrigger: User asks to install a skill (e.g., \"Install the debugging skill\" or \"Install skill ID xyz\").\n\nProcedure:\n\nIdentify Source:\n\nIf from SkillsMP search result: Use the githubUrl from the API response\nIf from SkillHub search result: Fetch skill details via /api/skills/{id} to get skillPath and branch, then construct GitHub tree URL\nIf from ClawHub search result: Use the slug to fetch content via ClawHub's /file endpoint (see Section C below)\nIf from skill name/ID: Search available sources (SkillsMP, SkillHub, and/or ClawHub) to find the skill\nIf local: Identify the source path\n\nVerify Repository Structure (CRITICAL):\n\nBefore downloading, browse the GitHub repo to confirm the skill folder location\nUse GitHub API to list directory contents: GET /repos/{owner}/{repo}/contents?ref={branch}\nLook for folders containing SKILL.md - this is the actual skill directory\nCommon patterns: skill/, skills/{name}/, root level, or custom folder names\nConfirm the correct path before generating the download URL\n\nDownload Using Helper Script:\n\nUse install_skill.py (located in this skill's scripts/ folder):\npython3 ~/.claude/skills/universal-skills-manager/scripts/install_skill.py \\\n  --url \"https://github.com/{owner}/{repo}/tree/{branch}/{skill-folder}\" \\\n  --dest \"{target-path}\" \\\n  --dry-run  # Preview first, then remove flag to install\n\nThe script handles: atomic install, validation, subdirectories, safety checks\nSafety feature: Script will abort (exit code 4) if destination is a root skills directory\nUpdate detection: If skill exists, shows diff and prompts for confirmation\nSecurity scan: The install script automatically scans downloaded skills for security threats (invisible characters, data exfiltration, prompt injection). Review any findings before proceeding.\n\nDetermine Primary Target:\n\nAsk: \"Should this be installed Globally (User) or Locally (Project)?\"\nDetermine the primary tool (e.g., if user is in Claude Code, Claude is primary)\nIf the user specifies claude.ai, Claude Desktop, or ChatGPT as the target, go to Step 4a instead of Step 5.\n\n4a. Cloud Platform Target Flow (claude.ai / Claude Desktop / ChatGPT): If the user wants the skill for claude.ai, Claude Desktop, or ChatGPT:\n\nValidate frontmatter by running validate_frontmatter.py against the downloaded SKILL.md:\npython3 scripts/validate_frontmatter.py /path/to/downloaded/SKILL.md\n\nIf the skill passes validation, package it as a ZIP and provide upload instructions (see Step 6a below).\nIf the skill fails validation, notify the user with the exact issues before doing anything:\n\n\"This skill isn't formatted correctly for cloud upload. I found these issues:\n\n[list each issue from the validator, e.g., 'Unsupported top-level key: version', 'Description uses a YAML block scalar']\n\nI can fix these automatically — unsupported keys will be moved into metadata, block scalars will be converted to inline strings, etc. The skill's functionality won't change.\n\nWould you like me to fix it and package it?\"\n\nIf the user agrees: Run the fix and re-validate:\npython3 scripts/validate_frontmatter.py /path/to/downloaded/SKILL.md --fix\n\nThen package as ZIP (Step 6a).\nIf the user declines: Skip cloud packaging. Offer to install the skill as-is to other locally detected tools instead.\n\n6a. Package and deliver ZIP:\n\nCreate a ZIP containing the skill folder (with fixed SKILL.md if applicable)\nProvide upload instructions based on the target platform:\n\nFor claude.ai / Claude Desktop: \"Your skill is packaged and ready. To install:\n\nGo to Settings → Capabilities\nClick 'Upload skill' in the Skills section\nSelect the ZIP file and upload\"\n\nFor ChatGPT: \"Your skill is packaged and ready. To install:\n\nClick your profile icon and select Skills (or go to chatgpt.com/skills)\nClick 'New skill'\nSelect 'Upload from your computer'\nSelect the ZIP file and upload\"\nContinue to Step 5 to offer syncing to other local tools as well.\n\nThe \"Sync Check\" (CRITICAL):\n\nScan: Check if other supported tools are installed on the system (look for their config folders)\nPropose: \"I see you also have OpenCode and Cursor installed. Do you want to sync this skill to them as well?\"\n\nExecute:\n\nFor each target location, ensure the parent directory exists: mkdir -p {target-skills-dir}\nRun the install script for each target location\nEnsure the standard structure is maintained\n\nReport Success:\n\nShow installed skill name, author, and location(s)\nDisplay GitHub URL and stars count for reference\n2. The \"Updates & Consistency\" Check\n\nTrigger: User modifies a skill or asks to \"sync\" skills.\n\nProcedure:\n\nCompare: Check the modification times or content of the skill across all installed locations.\nReport: \"The 'code-review' skill in Gemini is newer than the one in OpenCode.\"\nAction: Offer to overwrite older versions with the newer version to ensure consistency.\n3. Skill Discovery (Multi-Source)\n\nTrigger: User searches for skills (e.g., \"Find a debugging skill\" or \"Search for React skills\").\n\nProcedure:\n\nDiscover API Key and Select Source:\n\nStep 1 - Environment Variable: Check $SKILLSMP_API_KEY\n\nprintenv SKILLSMP_API_KEY\n\n\nIf set and non-empty, use SkillsMP as the primary search source. Note: Use printenv (not echo $VAR) — it queries the process environment directly and is more reliable across shell contexts.\n\nStep 2 - Config File: Check for config.json in this skill's directory\n\n# Look for config.json in skill directory (path varies by tool)\ncat ~/.claude/skills/universal-skills-manager/config.json 2>/dev/null\n\n\nIf skillsmp_api_key field has a non-empty value, use SkillsMP as primary source.\n\nStep 3 - Source Selection: If no API key found, present the user with a choice:\n\n\"I don't see a SkillsMP API key configured. You have three options:\n\nA) Provide your SkillsMP API key (get one at skillsmp.com) — curated skills with AI semantic search\n\nB) Search SkillHub's open catalog — community skills, no API key needed\n\nC) Search ClawHub — versioned skills with semantic search, no API key needed\n\nWhich would you prefer?\"\n\nIf user chooses A: Collect key, validate it (see below), store in memory for this session, proceed with SkillsMP\nIf user chooses B: Proceed with SkillHub search (no key needed)\nIf user chooses C: Proceed with ClawHub search (no key needed)\n\nKey Validation: SkillsMP API keys always start with sk_live_skillsmp_. If the user provides a key that does not match this prefix, reject it immediately:\n\n\"That doesn't look like a valid SkillsMP API key. Keys start with sk_live_skillsmp_. You can get one at https://skillsmp.com — or choose SkillHub/ClawHub search instead (no key needed).\"\n\nSecurity: Never log, display, or echo the full API key value.\n\nNote for claude.ai/Desktop/ChatGPT users: Environment variables are not available. Use the \"Package for Cloud Upload\" capability (Section 5) to create a ZIP with your API key embedded, or provide your key when prompted.\n\nExecute Search Based on Selected Source:\n\nIf using SkillsMP (primary, curated):\n\nChoose method:\nKeyword Search (/api/v1/skills/search): For specific terms, exact matches\nAI Semantic Search (/api/v1/skills/ai-search): For natural language queries (e.g., \"help me debug code\")\nIMPORTANT: Always capture the API key into a local variable first, then use it. Direct $SKILLSMP_API_KEY expansion in curl can fail in some shell contexts.\nIMPORTANT: Always include a User-Agent header. SkillsMP is behind Cloudflare, which blocks bare curl requests (403 Forbidden).\n# Step 1: Capture key (do this once per session)\nAPI_KEY=$(printenv SKILLSMP_API_KEY)\n\n# Step 2: Use ${API_KEY} in curl commands (User-Agent required)\n# Keyword Search\ncurl -X GET \"https://skillsmp.com/api/v1/skills/search?q={query}&limit=20&sortBy=recent\" \\\n  -H \"Authorization: Bearer ${API_KEY}\" \\\n  -H \"User-Agent: Universal-Skills-Manager\"\n\n# AI Semantic Search (for natural language queries)\ncurl -X GET \"https://skillsmp.com/api/v1/skills/ai-search?q={query}\" \\\n  -H \"Authorization: Bearer ${API_KEY}\" \\\n  -H \"User-Agent: Universal-Skills-Manager\"\n\nParse: Extract from data.skills[] (keyword) or data.data[] (AI search)\nAvailable fields: id, name, author, description, githubUrl, skillUrl, stars, updatedAt\nNote: SkillsMP requires a q parameter — there is no browse/list endpoint. However, q=* works as a wildcard to surface top skills (combine with sortBy=stars for popularity). For dedicated browsing, use SkillHub or ClawHub instead (both support browsing by stars/downloads).\n\nIf using SkillHub (open catalog, no auth):\n\nExecute:\n# SkillHub Search (no authentication required)\ncurl -X GET \"https://skills.palebluedot.live/api/skills?q={query}&limit=20\" \\\n  -H \"User-Agent: Universal-Skills-Manager\"\n\nParse: Extract from skills[] array\nAvailable fields: id, name, description, githubOwner, githubRepo, githubStars, downloadCount, securityScore\nNote: SkillHub does not have an AI semantic search — keyword search only\n\nIf using ClawHub (versioned skills, semantic search, no auth):\n\nChoose method:\nSemantic Search (/api/v1/search): For natural language queries — returns results ranked by vector similarity score\nBrowse/List (/api/v1/skills): For browsing by popularity, stars, or recency\nExecute:\n# Semantic Search (vector/similarity search)\ncurl -X GET \"https://clawhub.ai/api/v1/search?q={query}&limit=20\" \\\n  -H \"User-Agent: Universal-Skills-Manager\"\n\n# Browse by stars, downloads, or trending\ncurl -X GET \"https://clawhub.ai/api/v1/skills?limit=20&sort=stars\" \\\n  -H \"User-Agent: Universal-Skills-Manager\"\n# Other sort options: sort=downloads, sort=trending, sort=updated\n\nParse:\nSemantic search: Extract from results[] array — each has score, slug, displayName, summary, version, updatedAt\nBrowse: Extract from items[] array — each has slug, displayName, summary, version, stats.stars, stats.downloads\nNote: ClawHub hosts skill files directly (not on GitHub). Use the slug field when installing — see Section C.\n\nDisplay Results (Unified Format): Display results in a consistent table format regardless of source. Include the Source column to indicate origin:\n\n| # | Skill | Author | Stars | Source | Description |\n|---|-------|--------|-------|--------|-------------|\n| 1 | debugging-strategies | wshobson | 27,021 | SkillHub | Master systematic debugging... |\n| 2 | code-debugging | AuthorX | 15 | SkillsMP | Systematic debugging methodology... |\n| 3 | self-improving-agent | clawhub-user | 42 | ClawHub | Agent that improves itself... |\n\nFor SkillsMP AI search: Also show relevance score\nFor SkillHub: Show securityScore if available\nFor ClawHub semantic search: Show similarity score if available\nLimit to top 10-15 results for readability\n\nSearch More Sources: After displaying results from any source, offer to search the remaining unsearched sources:\n\nIf 2 sources remain: \"Want to also search {source1} or {source2}? Or both?\"\nIf 1 source remains: \"Want to also search {source}?\"\n\nAvailable sources: SkillsMP (requires API key), SkillHub (no key), ClawHub (no key)\n\nIf yes:\n\nQuery the selected source(s) with the same search terms\nDeduplicate: Compare results across sources:\nSkillsMP ↔ SkillHub: By full skill ID ({owner}/{repo}/{path})\nClawHub ↔ others: By skill name (ClawHub uses slugs, not GitHub paths)\nAppend unique results to the display, labeled with their source tag\n\nOffer Installation:\n\nAfter displaying results, ask: \"Which skill would you like to install?\"\nFor SkillsMP results: Note the skill's githubUrl for content fetching\nFor SkillHub results: Note the skill's id for detail fetching (needed to get skillPath and branch)\nFor ClawHub results: Note the skill's slug for direct file fetching via ClawHub's /file endpoint\n4. Skill Matrix Report\n\nTrigger: User asks for skill report/overview (e.g., \"Show my skills\", \"What skills do I have?\", \"Skill report\", \"Compare my tools\").\n\nProcedure:\n\nDetect Installed Tools: Check which AI tools are installed by verifying their user-level skills directories exist:\n\n# Check each tool's skills directory\nls -d ~/.claude/skills 2>/dev/null && echo \"Claude: ✓\"\nls -d ~/.codex/skills 2>/dev/null && echo \"Codex: ✓\"\nls -d ~/.gemini/skills 2>/dev/null && echo \"Gemini: ✓\"\nls -d ~/.gemini/antigravity/skills 2>/dev/null && echo \"Antigravity: ✓\"\nls -d ~/.openclaw/workspace/skills 2>/dev/null && echo \"OpenClaw: ✓\"\nls -d ~/.cursor/skills 2>/dev/null && echo \"Cursor: ✓\"\nls -d ~/.config/opencode/skills 2>/dev/null && echo \"OpenCode: ✓\"\nls -d ~/.roo/skills 2>/dev/null && echo \"Roo: ✓\"\nls -d ~/.config/goose/skills 2>/dev/null && echo \"Goose: ✓\"\nls -d ~/.cline/skills 2>/dev/null && echo \"Cline: ✓\"\n\n\nCollect All Skills: For each detected tool, list skill folders:\n\nfind ~/.{claude,codex,gemini,gemini/antigravity,openclaw/workspace,cursor,config/opencode,config/goose,roo,cline}/skills -maxdepth 1 -type d 2>/dev/null | \\\n  xargs -I{} basename {} | sort -u\n\n\nGenerate Matrix Table: Create a markdown table where:\n\nRows = skill names (deduplicated across all tools)\nColumns = only tools that are installed on the system\nCells = ✅ (installed) or ❌ (not installed)\n\nExample output:\n\n| Skill | Claude | Codex | Gemini |\n|-------|--------|-------|--------|\n| humanizer | ✅ | ❌ | ✅ |\n| skill-creator | ❌ | ✅ | ❌ |\n| using-superpowers | ✅ | ✅ | ✅ |\n\n\nShow Summary:\n\nTotal skills across all tools\nSkills unique to one tool\nSkills installed everywhere\n5. Package for Cloud Upload (claude.ai / Claude Desktop / ChatGPT)\n\nTrigger: User wants to use this skill in claude.ai, Claude Desktop, or ChatGPT (e.g., \"Package this for claude.ai\", \"Create a ZIP for Claude Desktop\", \"Package for ChatGPT\", \"I want to upload this skill to claude.ai\", \"Prepare skill for web upload\", \"Package this for chatgpt.com\").\n\nProcedure:\n\nExplain the Process: \"I'll create a ZIP file with this skill ready for upload to claude.ai, Claude Desktop, or ChatGPT. Since cloud environments don't have access to your local environment variables, I can optionally embed your API key in the package. Note: the API key is optional — SkillHub and ClawHub search work without one.\"\n\nValidate Frontmatter Compatibility (CRITICAL — do this BEFORE packaging): Run validate_frontmatter.py to check the SKILL.md against the Agent Skills spec (used by both claude.ai/Claude Desktop and ChatGPT):\n\n# Validate only (report issues)\npython3 scripts/validate_frontmatter.py /path/to/SKILL.md\n\n# Validate and auto-fix (overwrites file)\npython3 scripts/validate_frontmatter.py /path/to/SKILL.md --fix\n\n# Validate a ZIP file\npython3 scripts/validate_frontmatter.py /path/to/skill.zip --fix\n\n\nThe script checks for unsupported top-level keys, nested metadata, non-string metadata values, and field length violations. With --fix, it automatically moves unsupported keys into metadata, flattens nested objects, and converts values to strings. Tell the user what was fixed. See Operational Rule 5 for the full spec.\n\nCollect API Key (Optional):\n\nAsk: \"Would you like to include your SkillsMP API key for curated search? This is optional — SkillHub and ClawHub work without a key. If you skip this, the packaged skill will still work for SkillHub and ClawHub searches.\"\nIf user wants to include a key:\nAsk: \"Please provide your SkillsMP API key. You can get one at https://skillsmp.com\"\nWait for user to provide the key\nValidate: Key must start with sk_live_skillsmp_. If invalid, reject and re-prompt or offer to skip.\nSecurity: Do not echo or display the key back to the user\nIf user skips, create the ZIP without config.json\nCredential safety warning (IMPORTANT — always display this if a key is included):\n\n\"Security note: This ZIP will contain your API key in plain text. Please follow these precautions:\n\nDo NOT share this ZIP publicly, post it online, or commit it to version control\nDo NOT distribute this ZIP to others — each user should package their own\nUse a scoped/least-privilege key if your provider supports it\nRotate your key if you suspect the ZIP was exposed\nThe key is stored locally in config.json inside the ZIP and is only used at runtime to authenticate with the SkillsMP API\"\n\nCreate Package Contents:\n\nCreate a temporary directory structure:\nuniversal-skills-manager/\n├── SKILL.md          # Copy from current skill\n├── config.json       # Create with embedded API key\n└── scripts/\n    └── install_skill.py  # Copy from current skill\n\nGenerate config.json with the user's API key:\n{\n  \"skillsmp_api_key\": \"USER_PROVIDED_KEY_HERE\"\n}\n\n\nCreate ZIP File:\n\nUse Python to create the ZIP:\nimport zipfile\nimport json\nimport tempfile\nfrom pathlib import Path\n\n# Create ZIP in user's Downloads or current directory\nzip_path = Path.home() / \"Downloads\" / \"universal-skills-manager.zip\"\nskill_dir = Path(\"~/.claude/skills/universal-skills-manager\").expanduser()\n\nwith tempfile.TemporaryDirectory() as temp_dir:\n    temp_path = Path(temp_dir)\n    \n    # Copy skill files\n    for file_path in skill_dir.rglob('*'):\n        if file_path.is_file() and file_path.name != 'config.json':\n            rel_path = file_path.relative_to(skill_dir)\n            dest = temp_path / rel_path\n            dest.parent.mkdir(parents=True, exist_ok=True)\n            dest.write_bytes(file_path.read_bytes())\n    \n    # Create config.json with API key\n    config = {\"skillsmp_api_key\": \"USER_API_KEY\"}\n    (temp_path / \"config.json\").write_text(json.dumps(config, indent=2))\n    \n    # Create ZIP\n    with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zf:\n        for file_path in temp_path.rglob('*'):\n            if file_path.is_file():\n                arcname = f\"universal-skills-manager/{file_path.relative_to(temp_path)}\"\n                zf.write(file_path, arcname)\n\nAlternatively, provide the ZIP as a downloadable artifact\n\nProvide Upload Instructions:\n\n\"Your skill package is ready! To use it:\"\nFor claude.ai / Claude Desktop:\n\"1. Download the ZIP file\"\n\"2. Go to Settings → Capabilities\"\n\"3. Click 'Upload skill' in the Skills section\"\n\"4. Select the ZIP file and upload\"\n\"5. Enable the skill and start using it!\"\nFor ChatGPT:\n\"1. Download the ZIP file\"\n\"2. Click your profile icon and select Skills (or go to chatgpt.com/skills)\"\n\"3. Click 'New skill'\"\n\"4. Select 'Upload from your computer'\"\n\"5. Select the ZIP file and upload\"\n\"6. The skill is now installed and ChatGPT will use it when relevant!\"\n\nSecurity Reminder:\n\nIf a key was embedded: \"This ZIP contains your API key. Do NOT share it publicly, distribute it to others, or commit it to version control. If you need to share the skill, create a key-free version (without config.json) and let each user add their own key.\"\nIf no key was embedded: \"This ZIP is safe to share — it contains no credentials. Recipients can add their own API key later, or use SkillHub/ClawHub search which requires no key.\"\nOperational Rules\n\nStructure Integrity: When installing, always ensure the skill has its own folder (e.g., .../skills/my-skill/). Do not dump loose files into the root skills directory. Always run mkdir -p on the target path before copying files.\n\nConflict Safety: If a skill already exists at a target location, always ask before overwriting, unless the user explicitly requested a \"Force Sync.\"\n\nUser-Agent Required: Always include -H \"User-Agent: Universal-Skills-Manager\" in all curl requests. APIs behind Cloudflare (like SkillsMP) return 403 Forbidden for bare curl requests without a User-Agent header.\n\nOpenClaw Note: OpenClaw may require a restart to pick up new skills if skills.load.watch is not enabled in openclaw.json. Warn the user of this after installation.\n\nCross-Platform Adaptation:\n\nGemini uses SKILL.md.\nCline uses the same SKILL.md format with name and description frontmatter. The name field must match the directory name. No manifest generation required. Note: Cline also reads .claude/skills/ at the project level, so Claude Code project skills work in Cline automatically.\nIf OpenCode or Anti-Gravity require a specific manifest (e.g., manifest.json), generate a basic one based on the SKILL.md frontmatter during installation.\n\nCloud Platform Frontmatter Compatibility Check (claude.ai / Claude Desktop / ChatGPT): When a user wants to upload or package a skill for claude.ai, Claude Desktop, or ChatGPT, validate the SKILL.md frontmatter against the Agent Skills specification. All three platforms use strict frontmatter validation that rejects ambiguous YAML constructs like block scalars. Non-compliant skills will be rejected with \"malformed YAML frontmatter\" or \"unexpected key\" errors.\n\nAllowed top-level frontmatter fields (Agent Skills spec):\n\nField\tRequired\tConstraints\nname\tYes\tMax 64 chars, lowercase letters/numbers/hyphens only, must match directory name\ndescription\tYes\tMax 1024 chars. No angle brackets (< or >). Avoid literal block scalars (|) — known to fail with blank lines. Folded scalars (>) work but inline strings are safest\nlicense\tNo\tLicense name or reference to bundled file\ncompatibility\tNo\tMax 500 chars, environment requirements\nmetadata\tNo\tFlat key-value pairs only (string keys to string values — no nested objects, no arrays)\nallowed-tools\tNo\tSpace-delimited list of pre-approved tools (experimental)\n\nUse the validation script (preferred — avoids manual YAML errors):\n\n# Validate a SKILL.md\npython3 scripts/validate_frontmatter.py /path/to/SKILL.md\n\n# Validate and auto-fix in place\npython3 scripts/validate_frontmatter.py /path/to/SKILL.md --fix\n\n# Validate and fix a ZIP file (rewrites SKILL.md inside the ZIP)\npython3 scripts/validate_frontmatter.py /path/to/skill.zip --fix\n\n\nThe script (scripts/validate_frontmatter.py) is zero-dependency Python 3. It checks all constraints and with --fix automatically applies these corrections:\n\nMoves unsupported top-level keys (e.g., version, author, homepage, category) into metadata as string values\nFlattens nested metadata objects (e.g., metadata.clawdbot.requires.bins: [x, y] → metadata.clawdbot-requires-bins: \"x, y\")\nConverts non-string metadata values to quoted strings (e.g., true → \"true\")\nCollapses literal block scalar (|) descriptions to inline quoted strings (known to fail with blank lines). Folded scalars (>) trigger a warning but work in current Claude Desktop\nStrips angle brackets (< >) from description (Anthropic's validator rejects them)\nConverts YAML list-format allowed-tools to space-delimited string\nTruncates description if over 1024 chars\nValidates the fix and reports if any issues remain\n\nIf the script is not available, do the validation manually:\n\nRead the SKILL.md frontmatter\nCheck all top-level keys are in the allowed set: name, description, license, compatibility, metadata, allowed-tools\nIf metadata is present, verify all values are strings (no nested objects or arrays)\nVerify name is lowercase with hyphens only, max 64 chars\nVerify description is max 1024 chars\n\nIf validation fails, tell the user exactly what's wrong and offer to fix it (run the script with --fix, or apply the fixes manually).\n\nAvailable Tools\nbash (curl): Make API calls to SkillsMP.com, SkillHub (skills.palebluedot.live), and ClawHub (clawhub.ai); fetch skill content from GitHub or ClawHub directly.\nweb_fetch: Fetch skill content from GitHub raw URLs, SkillHub API, or ClawHub API (alternative to curl).\nread_file / write_file: Manage local skill files.\nglob: Find existing skills in local directories.\nImplementation Details\nSkill Structure\n\nSkills typically contain:\n\nSKILL.md (required): Main instructions with frontmatter.\nReference docs: Additional documentation files.\nScripts: Helper scripts (Python, shell, etc.).\nConfig files: JSON, YAML configurations.\nInstallation Logic\nA. Installing from SkillsMP API\n\nFetch Skill Content:\n\nConvert githubUrl to raw content URL:\nInput:  https://github.com/{user}/{repo}/tree/{branch}/{path}\nOutput: https://raw.githubusercontent.com/{user}/{repo}/{branch}/{path}/SKILL.md\n\nFetch the SKILL.md content using curl or web_fetch\n\nCreate Directory:\n\nUse skill name from API response for directory: .../skills/{skill-name}/\nExample: .../skills/code-debugging/\n\nSave SKILL.md:\n\nWrite the fetched content to SKILL.md in the new directory\nPreserve the original YAML frontmatter and content\n\nHandle Additional Files (Optional):\n\nCheck if GitHub repo has additional files (reference docs, scripts)\nOptionally fetch and save them to maintain complete skill package\n\nConfirm:\n\nReport: \"Installed '{name}' by {author} to {path}\"\nShow GitHub URL and stars count\nOffer sync to other AI tools\nB. Installing from SkillHub\n\nFetch Skill Details:\n\nUse the skill's id from the search result to get full details:\ncurl -X GET \"https://skills.palebluedot.live/api/skills/{id}\"\n\nIMPORTANT: The id field (e.g., wshobson/agents/debugging-strategies) does NOT map to the file path within the repo. You MUST use the detail endpoint to get the actual skillPath and branch.\nExtract from response: githubOwner, githubRepo, branch, skillPath\n\nConstruct GitHub URL:\n\nBuild the GitHub tree URL from the detail response:\nhttps://github.com/{githubOwner}/{githubRepo}/tree/{branch}/{skillPath}\n\nExample: https://github.com/wshobson/agents/tree/main/plugins/developer-essentials/skills/debugging-strategies\n\nDownload Using Helper Script:\n\nFrom this point, the flow is identical to SkillsMP installation:\npython3 ~/.claude/skills/universal-skills-manager/scripts/install_skill.py \\\n  --url \"https://github.com/{githubOwner}/{githubRepo}/tree/{branch}/{skillPath}\" \\\n  --dest \"{target-path}\"\n\n\nConfirm:\n\nReport: \"Installed '{name}' from SkillHub to {path}\"\nShow GitHub URL and stars count\nOffer sync to other AI tools\nC. Installing from ClawHub\n\nClawHub hosts skill files directly (not on GitHub), so the install flow bypasses install_skill.py and fetches content via ClawHub's API.\n\nFetch SKILL.md Content:\n\nUse ClawHub's file endpoint to get the raw SKILL.md:\ncurl -s \"https://clawhub.ai/api/v1/skills/{slug}/file?path=SKILL.md\" \\\n  -H \"User-Agent: Universal-Skills-Manager\" \\\n  -o /tmp/clawhub-{slug}/SKILL.md\n\nIMPORTANT: This endpoint returns raw text/plain content, NOT JSON. Save the response body directly as the file.\nThe x-content-sha256 response header can be used to verify file integrity.\n\nHandle Multi-File Skills (if applicable):\n\nIf the skill has additional files (scripts, configs), use ClawHub's download endpoint:\ncurl -s \"https://clawhub.ai/api/v1/download?slug={slug}\" \\\n  -H \"User-Agent: Universal-Skills-Manager\" \\\n  -o /tmp/clawhub-{slug}.zip\nunzip -o /tmp/clawhub-{slug}.zip -d /tmp/clawhub-{slug}/\n\nTo check if a skill has multiple files, inspect the detail response from GET /api/v1/skills/{slug} — the latestVersion object may indicate file count.\n\nRun Security Scan:\n\nSince install_skill.py is bypassed, run the security scanner manually:\npython3 ~/.claude/skills/universal-skills-manager/scripts/scan_skill.py /tmp/clawhub-{slug}/\n\nReview any findings before proceeding. ClawHub has VirusTotal integration but our scan provides an additional layer.\n\nValidate YAML Frontmatter:\n\nVerify the SKILL.md has valid YAML frontmatter (name, description fields).\nIf invalid, warn the user and ask whether to proceed.\n\nCreate Directory and Install:\n\nCreate the target directory: .../skills/{slug}/\nCopy all files from the temp directory to the destination:\nmkdir -p {target-path}/{slug}\ncp -r /tmp/clawhub-{slug}/* {target-path}/{slug}/\n\n\nConfirm:\n\nReport: \"Installed '{displayName}' (v{version}) from ClawHub to {path}\"\nShow version info and stars count\nOffer sync to other AI tools\n\nCleanup:\n\nRemove the temporary directory:\nrm -rf /tmp/clawhub-{slug}/ /tmp/clawhub-{slug}.zip\n\nD. Installing from Local Source (Sync/Copy)\nRetrieve: Read all files from the source directory.\nCreate Directory: Create the target directory .../skills/{slug}/.\nSave Files: Copy all files to the new location, preserving filenames.\nSkillsMP API Configuration\n\nBase URL: https://skillsmp.com/api/v1\n\nAuthentication:\n\nAuthorization: Bearer $SKILLSMP_API_KEY\n\n\nAvailable Endpoints:\n\nGET /api/v1/skills/search?q={query}&page={1}&limit={20}&sortBy={recent|stars}\nGET /api/v1/skills/ai-search?q={query}\n\nResponse Format (Keyword Search):\n\n{\n  \"success\": true,\n  \"data\": {\n    \"skills\": [\n      {\n        \"id\": \"...\",\n        \"name\": \"skill-name\",\n        \"author\": \"AuthorName\",\n        \"description\": \"...\",\n        \"githubUrl\": \"https://github.com/user/repo/tree/main/path\",\n        \"skillUrl\": \"https://skillsmp.com/skills/...\",\n        \"stars\": 10,\n        \"updatedAt\": 1768838561\n      }\n    ],\n    \"pagination\": {\n      \"page\": 1,\n      \"limit\": 20,\n      \"total\": 3601,\n      \"totalPages\": 1801,\n      \"hasNext\": true\n    }\n  }\n}\n\n\nResponse Format (AI Search):\n\n{\n  \"success\": true,\n  \"data\": {\n    \"search_query\": \"...\",\n    \"data\": [\n      {\n        \"file_id\": \"...\",\n        \"filename\": \"...\",\n        \"score\": 0.656,\n        \"skill\": {\n          \"id\": \"...\",\n          \"name\": \"...\",\n          \"author\": \"...\",\n          \"description\": \"...\",\n          \"githubUrl\": \"...\",\n          \"skillUrl\": \"...\",\n          \"stars\": 0,\n          \"updatedAt\": 1769542668\n        }\n      }\n    ]\n  }\n}\n\n\nError Handling:\n\n401: Invalid or missing API key\n400: Missing required query parameter\n500: Internal server error\nSkillHub API Configuration\n\nBase URL: https://skills.palebluedot.live/api\n\nAuthentication: None required (open API)\n\nAvailable Endpoints:\n\nGET /api/skills?q={query}&limit={20} — Search skills by keyword\nGET /api/skills/{id} — Get full skill details (includes skillPath, branch, rawContent)\nGET /api/categories — List skill categories\nGET /api/health — Health check\n\nSearch Response Format:\n\n{\n  \"skills\": [\n    {\n      \"id\": \"wshobson/agents/debugging-strategies\",\n      \"name\": \"debugging-strategies\",\n      \"description\": \"Master systematic debugging...\",\n      \"githubOwner\": \"wshobson\",\n      \"githubRepo\": \"agents\",\n      \"githubStars\": 27021,\n      \"downloadCount\": 0,\n      \"securityScore\": 100,\n      \"securityStatus\": null,\n      \"rating\": 0,\n      \"isVerified\": false,\n      \"compatibility\": { \"platforms\": [] }\n    }\n  ],\n  \"pagination\": {\n    \"page\": 1,\n    \"limit\": 20,\n    \"total\": 1000,\n    \"totalPages\": 50\n  },\n  \"searchEngine\": \"meilisearch\",\n  \"processingTimeMs\": 10\n}\n\n\nDetail Response Format (GET /api/skills/{id}):\n\n{\n  \"id\": \"wshobson/agents/debugging-strategies\",\n  \"name\": \"debugging-strategies\",\n  \"description\": \"...\",\n  \"githubOwner\": \"wshobson\",\n  \"githubRepo\": \"agents\",\n  \"skillPath\": \"plugins/developer-essentials/skills/debugging-strategies\",\n  \"branch\": \"main\",\n  \"githubStars\": 27021,\n  \"rawContent\": \"---\\nname: debugging-strategies\\n...\"\n}\n\n\nKey Fields for Installation:\n\nskillPath: The actual directory path within the GitHub repo (CRITICAL — the id does NOT match the file path)\nbranch: The branch name (e.g., main)\ngithubOwner + githubRepo: Used to construct the GitHub URL\nrawContent: Full SKILL.md content (can be used as fallback if GitHub is unreachable)\n\nError Handling:\n\n404: Skill not found\n500: Internal server error\nClawHub API Configuration\n\nBase URL: https://clawhub.ai/api/v1\n\nAuthentication: None required (open API)\n\nRate Limits: 120 reads/min per IP (shown in x-ratelimit-remaining and x-ratelimit-reset response headers)\n\nAvailable Endpoints:\n\nGET /api/v1/search?q={query}&limit={20} — Semantic/vector search (ranked by similarity score)\nGET /api/v1/skills?limit={20}&sort={stars|downloads|updated|trending}&cursor={cursor} — Browse/list with cursor pagination\nGET /api/v1/skills/{slug} — Get full skill details (owner, version, moderation status)\nGET /api/v1/skills/{slug}/file?path={filepath}&version={ver} — Get raw file content (text/plain, NOT JSON)\nGET /api/v1/download?slug={slug}&version={ver} — Download full skill as ZIP\n\nSearch Response Format (GET /api/v1/search):\n\n{\n  \"results\": [\n    {\n      \"score\": 0.82,\n      \"slug\": \"self-improving-agent\",\n      \"displayName\": \"Self-Improving Agent\",\n      \"summary\": \"An agent that iteratively improves itself...\",\n      \"version\": \"1.0.0\",\n      \"updatedAt\": \"2026-01-15T10:30:00Z\"\n    }\n  ]\n}\n\n\nBrowse Response Format (GET /api/v1/skills):\n\n{\n  \"items\": [\n    {\n      \"slug\": \"self-improving-agent\",\n      \"displayName\": \"Self-Improving Agent\",\n      \"summary\": \"...\",\n      \"version\": \"1.0.0\",\n      \"stats\": {\n        \"stars\": 42,\n        \"downloads\": 150\n      }\n    }\n  ],\n  \"nextCursor\": \"eyJ...\"\n}\n\n\nDetail Response Format (GET /api/v1/skills/{slug}):\n\n{\n  \"skill\": {\n    \"slug\": \"self-improving-agent\",\n    \"displayName\": \"Self-Improving Agent\",\n    \"summary\": \"...\",\n    \"version\": \"1.0.0\"\n  },\n  \"owner\": {\n    \"handle\": \"username\",\n    \"displayName\": \"User Name\"\n  },\n  \"latestVersion\": \"1.0.0\",\n  \"moderation\": \"approved\"\n}\n\n\nFile Endpoint (GET /api/v1/skills/{slug}/file?path=SKILL.md):\n\nReturns raw text/plain content (NOT JSON)\nResponse headers include x-content-sha256 (integrity hash) and x-content-size (byte count)\nUse version query param to fetch a specific version (defaults to latest)\n\nKey Differences from SkillsMP/SkillHub:\n\nDirect hosting: ClawHub hosts skill files directly — no GitHub URL construction needed\nVersioned skills: Each skill has explicit version numbers; use version param to pin\nSlug-based IDs: Skills are identified by slug (e.g., self-improving-agent), not GitHub paths\nSemantic search built-in: The /search endpoint uses vector similarity, not keyword matching\nVirusTotal integration: ClawHub scans skills via VirusTotal partnership; moderation field indicates status\n\nError Handling:\n\n404: Skill or file not found\n429: Rate limit exceeded (120 reads/min)\n500: Internal server error\nGuidelines\nMulti-Source Search: Use SkillsMP as the primary source when an API key is available. Offer SkillHub and ClawHub as alternative or additional sources.\nPrefer AI/Semantic Search: For natural language queries, use SkillsMP /ai-search or ClawHub /search (both support semantic matching). SkillHub only supports keyword search.\nSource Labeling: Always label results with their source ([SkillsMP], [SkillHub], or [ClawHub]) so users can distinguish between sources.\nSkillHub Detail Lookup: When installing from SkillHub, always fetch the detail endpoint first to get the correct skillPath and branch. Never try to parse the id field as a file path.\nClawHub Direct Hosting: ClawHub hosts skill files directly — use the /file endpoint to fetch content. No GitHub URL construction is needed. Use the slug field as the skill identifier.\nClawHub Versioning: ClawHub skills have explicit version numbers. Show the version in install confirmations. Use the version query param to pin a specific version if needed.\nDeduplication: When showing results from multiple sources, deduplicate: SkillsMP ↔ SkillHub by full skill ID ({owner}/{repo}/{path}); ClawHub ↔ others by skill name (since ClawHub uses slugs, not GitHub paths).\nVerify Content: After fetching from any source, verify the SKILL.md has valid YAML frontmatter.\nStructure Integrity: Maintain the .../skills/{skill-name}/SKILL.md structure.\nSyncing: After installing a skill, offer to sync (copy) it to other detected AI tools.\nGitHub URLs: For SkillsMP/SkillHub installs, always convert tree URLs to raw.githubusercontent.com URLs for content fetching.\nSecurity: Security scanning runs on all installs regardless of source (SkillsMP, SkillHub, or ClawHub). SkillHub's securityScore and ClawHub's VirusTotal moderation status are informational only — our own scan_skill.py at install time is authoritative."
  },
  "trust": {
    "sourceLabel": "tencent",
    "provenanceUrl": "https://clawhub.ai/jacob-bd/universal-skills-manager",
    "publisherUrl": "https://clawhub.ai/jacob-bd/universal-skills-manager",
    "owner": "jacob-bd",
    "version": "1.7.0",
    "license": null,
    "verificationStatus": "Indexed source record"
  },
  "links": {
    "detailUrl": "https://openagent3.xyz/skills/universal-skills-manager",
    "downloadUrl": "https://openagent3.xyz/downloads/universal-skills-manager",
    "agentUrl": "https://openagent3.xyz/skills/universal-skills-manager/agent",
    "manifestUrl": "https://openagent3.xyz/skills/universal-skills-manager/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/universal-skills-manager/agent.md"
  }
}