$ ~/registry/skill/openclaw-spike

SKILL

spike

Name: spike
Author: openclaw

Build quick throwaway prototypes to validate options and deliver a verdict.

Stars

★ 382,582

Source

GitHub

Updated

2026-07-11

// securityLow risk

Prompt only, no code
Open source
Community-trusted· 377.5k

Summary

The material indicates this is an open-source, prompt-only skill for prototyping, with no declared secrets, remote endpoints, or bundled executable component, so the overall risk is low. Its instructions may guide a host agent to create temporary prototypes and files, but that reflects host-agent usage rather than high-risk behavior embedded in the skill itself.

CredentialsLow risk

The material explicitly states there are no required secrets or environment variables, and the README does not request login, API tokens, or credential injection. No direct credential collection, storage, or abuse indicators are present.

Network egressLow risk

No remote endpoints are declared. The README only mentions reading docs/source and checking dependency health, without specifying any data egress destination or describing transmission of user data to third-party services.

Code executionLow risk

This is a prompt-only skill rather than a bundled executable. Although the documentation encourages building the 'smallest runnable artifact' and CLI prototypes, it does not ship local execution components or request extra system privileges; any execution depends on the host agent's capabilities.

Data accessLow risk

The README suggests writing by default to `.tmp/openclaw-spikes/<slug>` or, if requested by the user, to `spikes/<NNN-slug>/`. The described access scope is relatively constrained, with no request to read sensitive directories, bulk collect data, or obtain excessive permissions.

Supply chainLow risk

The source is an open GitHub repository with extremely high community adoption (about 377k stars), both of which are strong risk-reducing signals. The missing license declaration and unknown maintenance status are minor information gaps, but not enough on their own to raise the risk level.

Recommendations

Treat this skill as a prompt template and verify the host agent's boundaries for file writes and command execution.
If repo-local output is enabled, restrict it to a dedicated `spikes/` directory and avoid overwriting production code.
Before using external dependencies in a prototype, verify their license, recent commits, and release status.

Audited by: gpt-5.4 · 2026-06-16

// install

Copy the install command and let the AI configure it · recommended for beginners

Please install the "spike" skill from askskill:
1. Download https://raw.githubusercontent.com/openclaw/openclaw/main/skills/spike/SKILL.md
2. Save it as ~/.claude/skills/spike/SKILL.md
3. Reload skills and tell me it's ready

// download

Download SKILL.mdInstall manifest ↗

// examples

Compare two technical approaches

Prompt

For an image upload service, create minimal runnable prototypes in Node.js and Go. Each should support upload, size limits, and error handling. Compare development speed, performance, maintainability, and deployment complexity, then give a recommendation.

Expected

Descriptions of two workable prototypes, a comparison table, and a clear recommendation with reasons.

Validate whether a new feature is worth building

Prompt

Design a quick validation prototype for a document summarization feature with minimal code: upload a document, call an LLM to generate a summary, and display the result. Evaluate implementation difficulty, cost, latency, and user value, then decide whether it should move to full development.

Expected

A lightweight validation prototype plan with risk assessment and a go/no-go recommendation.

Test a third-party service for feasibility

Prompt

Run a spike for a candidate OCR API: write a minimal test script to evaluate Chinese recognition accuracy, API reliability, latency, pricing, and error handling experience. Summarize the findings and decide whether it fits the current product.

Expected

A test script approach, summarized validation results, pros and cons, and an integration decision.

// docs

Spike

Use when the user wants to test an idea before committing to a real build: "spike this", "quick prototype", "is this possible", "compare A/B", "before we build".

Do not use when reading docs/code can answer the question, or when the user clearly asked for production implementation.

Loop

Question: state the concrete feasibility question.
Research: read enough docs/source to choose credible approach.
Build: create the smallest runnable artifact that validates or invalidates the idea.
Stress: try one edge case or failure mode.
Verdict: VALIDATED, PARTIAL, or INVALIDATED.

Output shape

Default workspace: .tmp/openclaw-spikes/<slug> unless user asks for a tracked repo-local path.
Repo-local option: spikes/<NNN-slug>/ with README.md and minimal code.
Prefer runnable CLI, tiny HTML, one endpoint, or focused test.
Avoid package sprawl, Docker, env files, app frameworks, and production cleanup.

Multi-spike ideas

Split into 2-5 independent questions.
Run the riskiest question first.
For A/B comparisons, keep inputs equal and measure the same dimensions.
Ask before building all variants if the work is more than a small prototype.

Verdict format

## Verdict: VALIDATED | PARTIAL | INVALIDATED

Question: ...
Evidence: exact command/output/measurement.
What worked: ...
What failed or surprised us: ...
Recommendation: ship / adjust / avoid, with the next production step.

Rules

An invalidated spike is useful when it rules out a path with evidence.
Do not merge spike code into production without rewriting it normally.
If external dependencies are evaluated, check health: recent release/commit, docs, license, install friction.