ClawHub Web Only Publish

Publish skills to ClawHub via web dashboard only. No CLI login, no device flow. Reuse existing browser session.

Security Scan

The skill's instructions and requirements are internally consistent with its stated purpose (publishing via the ClawHub web dashboard); nothing requested or instructed appears disproportionate or unrelated.

Purpose & Capability

Name/description claim web-only publishing and the SKILL.md contains step-by-step browser upload instructions. No unexpected binaries, env vars, or permissions are requested; required actions align with the stated purpose.

Instruction Scope

Instructions are mostly limited to interacting with clawhub.ai via a browser and optionally running `clawhub publish` if an existing CLI token is present. One minor ambiguity: the execution criteria include 'No `clawhub login` in history' which could be interpreted as requiring a check of shell history (a privacy-sensitive action). The SKILL.md does not explicitly instruct reading system files, but the criteria are vague and could encourage agents to inspect local history or config files.

Install Mechanism

Instruction-only skill; no install steps, downloads, or extracted archives. Lowest-risk installation profile.

Credentials

The skill declares no environment variables or credentials, which is appropriate for a web-dashboard workflow. However, the fallback relies on an existing CLI token (not declared or explained where it is stored), which is reasonable but under-specified — the SKILL.md does not state where the token lives or how to access it safely.

Persistence & Privilege

No persistent installation, always:false, and no modifications to other skills or system-wide settings are requested.

Assessment

This skill is coherent with its stated purpose (manual web upload to ClawHub). Before using it: 1) Ensure your browser session on https://clawhub.ai is legitimate and not a shared account. 2) Do not upload files containing API keys, tokens, or secrets — the SKILL.md advises scanning but you should confirm manually. 3) Be cautious about the fallback: if you use `clawhub publish` it will rely on an existing CLI token — verify where that token is stored (CLI config or environment) and avoid granting the agent blanket read access to config or shell history. 4) If you want the agent to perform the publish automatically, explicitly limit which local files it may read; otherwise perform the browser steps yourself. If you want greater assurance, ask the skill author to clarify how the CLI token is obtained and to remove or clarify the 'history' verification criterion.

Publish to ClawHub via web dashboard. No CLI login.

Problem

CLI login causes:

• Auth loop failures
• Token expiration issues
• Device flow complexity
• Session management overhead

Workflow

1. Prerequisites

• Browser already logged in to https://clawhub.ai
• Skill folder contains SKILL.md
• No secrets in skill files

2. Web Publish Steps

1. Navigate to https://clawhub.ai/upload
2. Verify logged in (username visible)
3. Fill form:
   • Slug: skill-name
   • Display name: Skill Name
   • Version: 1.0.0
4. Click "Choose folder" -> Select skill directory
5. Wait for validation (SKILL.md recognized)
6. (Optional) Add changelog
7. Click "Publish skill"
8. Capture result URL

3. Fallback (No CLI Login)

If browser upload fails:

• Use existing CLI token (if already authenticated)
• Run: clawhub publish <path> --version 1.0.0
• Do NOT run clawhub login

Executable Completion Criteria

Criteria	Verification
Skill URL accessible	Navigate to URL, 200 OK
Name matches SKILL.md	Frontmatter name = listing name
Version correct	URL shows v1.0.0
No CLI login used	No clawhub login in history

Privacy/Safety

• No credentials in skill files
• Scan for apiKey/token/secret before publish
• Use relative paths only

Self-Use Trigger

Use when:

• Publishing any skill to ClawHub
• CLI login fails or unavailable
• Browser session already active

---

Web first. No login loops.