1. Start with the task
The current router recognizes a small, editorially maintained vocabulary of workflows, including interface review, debugging, research, spreadsheets, presentations, and browser automation. It matches those tasks and exact terms against catalog names and descriptions. This version does not use an LLM, embeddings, or semantic search.
Some one-off text tasks can use built-in agent capabilities. Tasks involving accounts or recurring work can require a connection, MCP server, CLI, or schedule. The directory currently indexes skills; connection suggestions describe missing capabilities, not verified plugin listings.
2. Check eligibility first
A selected platform must appear in the catalog’s platform list. These records are source-derived and are not execution tests. A missing platform means support has not been established here.
Recorded high or critical security findings exclude a skill before ranking. Medium findings remain visible. Most records currently have no security assessment: they are labeled “Security not audited” and require source review. A verified SKILL.md means the file was found; it does not mean the content is safe.
3. Prefer a small setup
Known task-specific sources and keyword fit determine candidate order. Catalog publisher status and adoption can break ties. Each selected skill must cover an additional matched capability, with at most three recommendations. This is a practical heuristic, not a mathematical guarantee of the globally smallest setup.
Skill names supplied as already installed, or detected in recognized project folders, are used to avoid redundant recommendations. Similar alternatives are shown as replacements. We explain exclusions and leave uncovered capabilities visible.
4. Keep evidence in its original scope
ClawHub downloads and stars refer to the skill’s registry record. GitHub stars refer to the entire repository, which can contain many skills. They are never added together or displayed as an individual skill’s install count. Metric dates and source links accompany recommendations; adoption only breaks ties between records from the same source.
Source update dates are not proof of meaningful maintenance. Context size, script contents, permission requirements, runtime compatibility, and install success have not been independently measured.
5. Inspect a public project
The project advisor reads the default branch’s file tree and root package.json at a fixed commit. It detects known dependency declarations, Cloudflare config files, AGENTS.md and CLAUDE.md paths, and SKILL.md files in recognized skill folders. It does not execute code or read local credentials.
Monorepo dependency coverage is limited to the root manifest. A GitHub API limit, large or truncated tree, private repository, or unreadable file can limit the result. Account access and machine-level agent setup cannot be inferred from repository files.
6. Learn from explicit feedback
Source clicks, copied commands, and helpful/not-helpful responses can be stored with capability IDs, platform, and a skill slug. Copying a command is not counted as an installation, and helpful feedback is not proof that a task succeeded. These events do not currently affect ranking.
We do not store task text or repository URLs in the recommendation event table. Tasks submitted through the website appear in the page URL and browser history, so do not include secrets. External result links receive no task-page referrer. Public project analysis sends the repository identifier to GitHub.
For agent integrations
The same recommendation logic is available through GET /api/search/?query=… or POST /api/search/. Send a JSON object with task, optional platform, and optional installed skill slugs. The response includes recommended skills, alternatives, scoped evidence, missing capabilities, security status, and installation commands when supported.
{
"task": "Review my React app for accessibility and performance",
"platform": "Codex",
"installed": []
}