OpenClaw Master Skills is a curated, regularly updated collection of skills that extends an AI personal assistant platform with capabilities such as research, browser automation, presentation creation, and prompt work. It is intended for people using OpenClaw or MyClaw.ai to give their agents additional tasks and workflows. The catalogue contains many skills and agents from this collection.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add LeoYeAI/openclaw-master-skills --skill ai-auto-devgit clone --depth 1 https://github.com/LeoYeAI/openclaw-master-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/leoyeai/openclaw-master-skills/ai-auto-dev)<a href="https://agentmods.dev/skills/leoyeai/openclaw-master-skills/ai-auto-dev"><img src="https://agentmods.dev/badge/skills/leoyeai/openclaw-master-skills/ai-auto-dev/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/leoyeai/openclaw-master-skills/ai-auto-dev"><img src="https://agentmods.dev/badge/skills/leoyeai/openclaw-master-skills/ai-auto-dev.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Agent Snooping · line 26 Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
- high Agent Snooping · line 803 Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
- medium MCP Rug Pull · line 115 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.08372 |
| Opus 5 | $0.00023 | $0.04186 |
| Sonnet 5 | $0.00009 | $0.01674 |
| Haiku 4.5 | $0.00005 | $0.00837 |
Grade B, and why
ai-auto-dev scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
cat >> ~/.claude/windtunnel/experiments/$(date '+%Y-%m-%d')-log.md << 'EOF' How it starts
The opening of the file, as written. The whole thing — 844 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AI 全自动化编程 (ai-auto-dev) v2.2
Claude Code 作为项目经理，Builder 作为执行者的全自动化编程流程。
v2.2 更新（2026-02-22）：新增中断恢复机制（FlowPilot 启发）、依赖图自动分析（替代手动 [P] 标记）
前置条件
选择一个 Builder（AI 编程执行工具），推荐以下任一：
| Builder | 安装 | 执行命令 |
|---|---|---|
| Codex CLI | npm i -g @openai/codex |
codex exec --skip-git-repo-check "$(cat spec.md)" |
| Claude Code | 已内置 | 直接在对话中执行 |
| Aider | pip install aider-chat |
aider --message "$(cat spec.md)" |
关键要求：Builder 必须有完整文件系统访问权限，能执行 npx/node/tsc 等命令。
以 Codex 为例，~/.codex/config.toml 需配置：
ask_for_approval = "never"
sandbox_mode = "danger-full-access"
⚠️ 重要：必须使用完整访问权限模式，受限模式会阻止 npx/node/tsc 等命令，导致三重纠错无法执行，Token 浪费 60%。
工作流程
第零步：会话暖场（每次必做）
目的：建立 Claude Code 会话信任，避免后续 Bash 后台任务需要确认
操作：
echo "Warmup at $(date '+%Y-%m-%d %H:%M:%S')" && sleep 2 && echo "Ready"
要求：
- 每次调用
/ai-auto-dev都必须先执行暖场 - 使用
run_in_background: true参数 - 等待完成通知（约 2-3 秒）
- 完成后进入第一步
原理：
- Claude Code 的会话信任机制存储在内存中
- 重启电脑后会清除，需要重新建立
- 首次后台任务需要确认，后续任务无需确认
- 暖场任务快速完成（<5 秒），建立信任后一整天无需确认
第一步：需求对齐
- 用户提出需求
- Claude Code 与用户反复讨论，直到完全理解
- Claude Code 复述需求给用户确认，必须包含：
- 要做什么：功能描述
- 技术栈和约束：语言、框架、依赖
- 目录结构：文件放在哪里
- 交付物清单：具体的文件名列表
- 测试要求：需要什么样的测试
- 用户确认后才进入下一步
- 禁止跳过此步：需求不清就开始执行 = 浪费 Token
第二步：生成 Spec MD
使用新模板（v2.0 核心改进）：
- 复制
specs/SPEC-TEMPLATE.md为specs/TASK-{id}-{name}.md - 参考
specs/SPEC-TEMPLATE-GUIDE.md填写 - Spec 必须包含以下 5 个核心改进：
改进 1：NEEDS CLARIFICATION 机制
- 最多 3 个问题（优先级：范围 > 安全/隐私 > 用户体验 > 技术细节）
- 其他不确定的地方用假设替代，记录在
## Assumptions章节 - 格式：
[假设: 具体内容] - 价值：减少执行时的犹豫，消除"猜测-验证"循环
改进 2：User Stories 结构
### US1: 功能名称 (Priority: P1)
作为[角色]，我需要[功能]，以便[价值]。
**Acceptance Scenarios:**
- **Given** [前置条件]，**When** [操作]，**Then** [预期结果]
**Test Criteria:**
- [ ] {具体可测试的标准}
改进 3：[P][US] 标记
[P]= 可与其他 [P] 步骤并行执行[US1][US2]= 关联到对应用户故事- 格式：
### Step 1: 创建模块 [P] [US1]
改进 4：Self-Check Requirements（三重纠错）
Spec 中必须包含此章节，Builder 执行后强制运行：
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 844 lines · 46 tokens per session scan B 437fe2369dde
ai-auto-dev is a skill published in the GitHub repository LeoYeAI/openclaw-master-skills (2,141 stars, last pushed 1mo ago), licensed MIT. It adds 46 tokens to every session and 8,372 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
add-github
Add GitHub channel integration via Chat SDK. PR and issue comment threads as conversations.
add-linear
Add Linear channel integration via Chat SDK. Issue comment threads as conversations.
teamharness-task-execution
Use when a Worker receives TASKASSIGNED, acknowledges the task, works inside shared/tasks/{task-id}/, submits with taskflow submittask, publishes deliverables through submittask, and reports TASKCOMPLETED or blockers in the Task room.
team-management
Use when admin requests creating a team, importing a team, managing team composition, adding/removing workers from a team, or delegating tasks to a Team Leader.
project-participation
Use when you are invited to a Project Room or assigned a task within a multi-worker project. Covers project plan reading, task coordination with other Workers, and git author config.
cocoharvest
Decompose an approved plan into parallel workstreams, assign specialist personas, classify stages as HITL or AFK (CocoLens), generate flow.json stages with checkpoints and dual-file state, and create per-stage prompt files. Includes adaptive parallelism, stall detection, shell identity injection, and consecutive…