ClawHub Web Publisher

Publish OpenClaw skills to ClawHub using the web dashboard only (no CLI login). Use when an agent must reliably upload a local skill folder, avoid auth-loop...

Security Scan

The skill's requests and instructions are coherent with its stated purpose (web-only publishing of a local skill) and it does not ask for extra credentials or install anything.

Purpose & Capability

Name/description match the instructions: the SKILL.md describes a manual web-dashboard upload flow and privacy checks, and the skill does not request unrelated credentials, binaries, or install steps.

Instruction Scope

Instructions reasonably stay within the publishing task (open dashboard, select folder, run privacy scans, capture results). Note: the procedure assumes the agent/operator can use the signed-in browser session and access the local skill directory for upload — if an automated agent has privileges to open that browser session and pick arbitrary local files, that capability enables uploading any local data, so the user should ensure only the intended folder is selected and that the agent's browser/file access is trusted.

Install Mechanism

Instruction-only skill with no install spec and no downloaded code; nothing is written to disk by the skill itself.

Credentials

No environment variables, credentials, or config paths are requested. The privacy checklist and secret-pattern scan are appropriate for a publisher.

Persistence & Privilege

always:false and agent invocation defaults are normal; the skill does not request permanent presence or system-wide configuration changes.

Assessment

This skill appears to do what it says: guide a human/agent to upload a local skill via the ClawHub web dashboard while checking for secrets. Before using it, (1) manually confirm the agent or helper will only select the intended skill folder (not broader home directories), (2) run the provided secret search yourself and replace any real keys with placeholders, and (3) ensure the signed-in browser profile is the correct account. If you need fully automated publishing (CLI/API), this skill is not appropriate — look for a CLI- or API-based publisher that explicitly requires and documents necessary credentials.

Publish a local skill to ClawHub through https://clawhub.ai/dashboard with strict privacy controls.

Hard Rules

• Never use clawhub login, clawhub login --token, or device flow.
• Use the already signed-in browser session for dashboard upload.
• Never include secrets in published files:
  • API keys
  • gateway tokens
  • personal emails and phone numbers
  • local absolute paths pointing to private user directories

Preflight

1. Confirm target folder contains SKILL.md.
2. Confirm SKILL.md frontmatter includes:
   • name
   • description
3. Scan for secret leakage patterns:
   • apiKey
   • token
   • OPENCLAW_
   • sk-
   • Bearer

If any high-risk text appears, stop and sanitize before publish.

Web Publish Procedure

1. Open https://clawhub.ai/dashboard.
2. Enter the upload/publish flow.
3. Select the local skill directory.
4. Fill listing title and short description:
   • title: clear benefit + audience
   • description: action-oriented and outcome-focused
5. Submit publish.
6. Capture outputs:
   • final skill URL
   • skill ID (if shown)
   • version (if shown)

Quality Gate Before Marking Done

• Listing URL opens successfully.
• Name matches SKILL.md name.
• Description does not promise unsupported behavior.
• No credential-like strings appear in listing or content.

Completion Evidence Format

Return all fields:

PUBLISH_RESULT
- skill_name:
- version:
- url:
- skill_id:
- verification:
  - url_status:
  - privacy_scan:
  - notes:

Failure Recovery (Still Web-Only)

If publish fails:

1. Refresh dashboard and retry once.
2. Re-open upload flow in same signed-in browser profile.
3. Reduce metadata length and retry.
4. If still blocked, return exact blocker text and a minimal next action for user.