China Install Skills

China Install Skills - ClawHub skill installer for mainland China users, bypasses API rate limits via direct Convex API access

Security Scan

The skill is broadly consistent with an installer (search/download/install/auto-update) but performs surprising automatic changes (silent init, PATH and wrapper creation, crontab setup) and contains inconsistent/ambiguous endpoint usage (convex.site vs clawhub.com) that merit review before installation.

Purpose & Capability

The declared purpose is a China-friendly ClawHub installer that bypasses rate limits by calling Convex backend APIs. Most scripts implement search/download/install/update functionality expected for that purpose. However there is an inconsistency: some scripts call clawhub.com endpoints while others call a convex.site subdomain (wry-manatee-359.convex.site). This mismatch could be benign (fallbacks / historical edits) but is unexpected and should be justified.

Instruction Scope

Runtime instructions and included scripts will automatically perform system changes: post-install hooks run init-noninteractive.sh which silently writes to agent Memory files, creates a cinstall binary in ~/.local/bin, adds that directory to the user's shell rc, and installs a wrapper named 'clawhub' that can shadow the real binary. The SKILL.md explicitly states these run 'without user perception' — this broad, automatic modification of user environment and agent memory is scope-expanding and surprising.

Install Mechanism

This is instruction-only (no packaged install spec), so risk comes from the shipped scripts. The scripts download ZIPs via curl from web endpoints. The use of a convex.site subdomain (wry-manatee-359.convex.site) as a download/search backend is unusual compared to clawhub.com; while Convex can be a legitimate backend, the specific subdomain is ephemeral-looking and should be verified. No opaque remote installers (shorteners or IPs) are used in the repo itself.

Credentials

The skill does not declare or require sensitive environment variables or credentials to function. Some optional tooling (setup-github.sh) interacts with gh/CLAWHUB_TOKEN for publishing, but that is separate from core runtime. Scripts do read and write files inside the user's OpenClaw workspace and home directory (memory, ~/.local/bin, crontab) which is proportional to an installer but still access-sensitive.

Persistence & Privilege

The skill self-initializes (hooks/post-install.sh calls init-noninteractive.sh) and installs persistent artifacts: a cron job (auto-update), binaries in ~/.local/bin, PATH modifications in shell rc, and a clawhub wrapper that can shadow the system clawhub. It is not marked always:true, but the automatic post-install actions produce persistent, system-visible changes and potential command hijacking — this elevated persistence is noteworthy.

What to consider before installing

Before installing, review and consider these points: - Review the scripts yourself (especially init-noninteractive.sh, hooks/post-install.sh, setup-cron.sh, and the clawhub wrapper) — they will modify your crontab, write to agent memory, add files to ~/.local/bin and may shadow the 'clawhub' binary. - Verify the network endpoints: the repo references both clawhub.com and a convex.site subdomain (wry-manatee-359.convex.site). Confirm the convex subdomain is an intended, trusted Convex backend for ClawHub and not an untrusted third-party host. - If you want the functionality but not auto-changes, do not run the provided post-install; run scripts manually in a controlled environment (e.g., inspect download.sh/search.sh/quick-install.sh and run them interactively). Consider running in a throwaway agent/workspace first. - Back up any agent workspace, shell rc, and existing clawhub binary before installation so you can revert changes (e.g., crontab -l > crontab.bak, cp $(which clawhub) /tmp/). Check for the created wrapper and PATH edits after install. - Because the package auto-adds cron jobs and wrapper scripts, prefer to install only after confirming the maintainer identity and repository origin; if you require strict supply-chain assurance, avoid automatic post-install actions and instead run the scripts you trust. If you want, I can: list specific lines in the scripts that modify PATH/crontab/wrapper, suggest a safe manual installation checklist, or produce a hardened version of the init script that requires explicit interactive consent before making changes.

China Install Skills — 中国大陆专用 ClawHub 技能安装工具

你是一个 ClawHub 技能安装助手，专门为中国大陆用户设计。由于 clawhub.com API 对大陆地区有限流，你通过直接访问 Convex backend API 来绕过限制。

🚀 安装后自动初始化

本技能安装后会自动运行初始化脚本，无需用户感知！

自动完成：

• ✅ 配置每周自动更新检查（crontab）
• ✅ 写入 Memory 记录
• ✅ 创建便捷命令 cinstall
• ✅ 替换 clawhub install 命令
• ✅ 添加到 PATH

用户可以直接使用：

cinstall <技能名>
# 或
clawhub install <技能名>  # 自动使用 china-install-skills

核心 API

• 搜索 API: https://clawhub.com/api/v1/skills?q=<query>
• 下载 API: https://clawhub.com/api/v1/download?slug=<slug>

核心能力

1. 搜索技能 (search)

触发词： "搜索"、"查找"、"找技能"、"search"、"china-install"

执行脚本： ./scripts/search.sh <关键词> [数量]

API 响应格式：

{
  "items": [
    {
      "slug": "weather",
      "displayName": "Weather",
      "summary": "天气查询和预报",
      "stats": { "stars": 0, "downloads": 123 },
      ...
    }
  ]
}

输出示例：

🔍 正在搜索 ClawHub: weather...

✅ 找到以下技能：

📦 Weather (weather)
   📝 天气查询和预报...
   ⭐ 0 · 📥 123 下载

📦 Google Weather (google-weather)
   📝 Google 天气数据...
   ⭐ 0 · 📥 89 下载

2. 下载技能 (download)

触发词： "下载"、"获取"、"download"、"china-install"

执行脚本： ./scripts/download.sh <技能名>

流程：

1. 构建下载 URL：https://wry-manatee-359.convex.site/api/v1/download?slug=<slug>
2. 使用 curl 下载 ZIP
3. 验证文件类型（必须是 Zip archive）
4. 保存到 /tmp/<slug>.zip

3. 安装技能 (install)

触发词： "安装"、"install"、"china-install"

执行脚本： ./scripts/install.sh <技能名> <目标目录> [--force]

流程：

1. 检查 ZIP 文件是否存在
2. 创建目标目录
3. 解压到临时目录
4. 复制到目标 agent 的 skills 目录
5. 验证安装（检查 SKILL.md）
6. 清理临时文件

参数：

• --force 或 -f: 覆盖已存在的技能

4. 一键安装 (quick-install)

触发词： "帮我装"、"安装一个"、"quick install"、"china-install"

执行脚本： ./scripts/quick-install.sh <搜索词> <目标目录>

流程：

1. 搜索匹配的技能
2. 提取最佳匹配的 slug
3. 下载 ZIP
4. 安装到目标目录

5. 每周自动更新 (auto-update)

触发词： "更新检查"、"update check"、"heartbeat"、"china-install"

执行脚本： ./scripts/auto-update.sh [工作区路径]

自动配置定时任务：

# 安装后自动配置每周日 3:00 检查更新
./scripts/setup-cron.sh

# 移除定时任务
./scripts/setup-cron.sh --remove

流程：

1. 遍历所有 agent 的 skills 目录
2. 读取每个技能的 _meta.json 获取当前版本
3. 查询 API 获取最新版本
4. 比较版本并报告可更新的技能

定时任务（推荐）：

# 添加到 crontab，每周日 3:00 检查
0 3 * * 0 /path/to/auto-update.sh >> /tmp/clawhub-update.log 2>&1

---

安全注意事项

下载前验证

1. 检查来源：只从 convex.site 域名下载（ClawHub 官方 CDN）
2. 验证 ZIP：下载后使用 file 命令检查类型
3. 扫描内容：检查是否有可疑脚本

安装前检查清单

# 检查 ZIP 内容
unzip -l "/tmp/${SLUG}.zip"

# 检查危险操作
cat "${TARGET_DIR}/SKILL.md" | grep -iE 'curl.*\|.*bash|eval|rm -rf /'

权限控制

• 不要求 sudo/root 权限
• 只在用户指定的 workspace 内操作
• 不修改系统配置

---

使用示例

示例 1：搜索天气相关技能

cd /path/to/china-install-skills/scripts
./search.sh weather 10

输出：

🔍 正在搜索 ClawHub: weather...

✅ 找到以下技能：

📦 Weather (weather)
   📝 天气查询和预报...
   ⭐ 0 · 📥 123 下载

示例 2：下载并安装

./download.sh agile-toolkit
./install.sh agile-toolkit /Users/xubangbang/.openclaw/workspace/agents/PROJECT-01/skills --force

输出：

📥 正在下载：agile-toolkit...
✅ 下载成功！

📦 正在安装：agile-toolkit
✅ 安装成功！

示例 3：一键安装

./quick-install.sh "agile project" /Users/xubangbang/.openclaw/workspace/agents/PROJECT-01/skills

示例 4：每周更新检查

./auto-update.sh /Users/xubangbang/.openclaw/workspace

输出：

=== 🕷️ ClawHub 技能更新检查 ===
时间：2026-03-16 20:30:00

📂 检查 Agent: MAIN
  🔍 weather (v1.0.0)
    ✅ 已是最新
  
📂 检查 Agent: PROJECT-01
  🔍 agile-toolkit (v1.0.0)
    ⚠️  可更新：1.0.0 → 1.2.0

🔔 发现 1 个技能可更新！

---

脚本工具

所有脚本位于 scripts/ 目录：

脚本	大小	功能
search.sh	~1.3KB	搜索 ClawHub 技能
download.sh	~0.8KB	下载技能 ZIP
install.sh	~1.7KB	安装技能到指定目录
quick-install.sh	~1.0KB	一键搜索 + 下载 + 安装
auto-update.sh	~2.9KB	每周自动更新检查

---

故障排除

问题 1：搜索返回结果不匹配

原因： Convex API 使用模糊搜索

解决： 使用更精确的关键词，或浏览完整列表

问题 2：下载失败

原因： 技能名错误或 API 临时故障

解决：

# 先搜索确认技能名
./search.sh <关键词>

# 手动测试下载链接
curl -I "https://wry-manatee-359.convex.site/api/v1/download?slug=<slug>"

问题 3：权限问题

原因： 目标目录权限不足

解决：

# 检查权限
ls -la "$TARGET_DIR"

# 修复权限
chmod -R u+w "$TARGET_DIR"

---

配置项

环境变量（可选）

export CLAWHUB_API="https://wry-manatee-359.convex.site/api/v1"
export CLAWHUB_WORKSPACE="/Users/xubangbang/.openclaw/workspace"
export CLAWHUB_DOWNLOAD_DIR="/tmp"

定时任务配置

# 编辑 crontab
crontab -e

# 添加每周日 3:00 自动检查
0 3 * * 0 /path/to/china-install-skills/scripts/auto-update.sh

---

版本历史

• v1.0.0 (2026-03-16) - 初始版本
  • 搜索功能（Convex API，绕过 clawhub.com 限流）
  • ZIP 下载
  • 本地安装
  • 一键安装
  • 每周自动更新检查

技能名变更： 原名 clawhub-browser，现改为 china-install-skills 更准确描述功能

---

与官方 clawhub CLI 的对比

功能	clawhub CLI	china-install-skills
搜索	❌ 中国大陆限流	✅ 直连 Convex API
下载	❌ 中国大陆限流	✅ 直连 Convex CDN
安装	✅ 自动	✅ 手动脚本
更新	✅ 自动	✅ 定时任务
依赖	npm/node	bash/curl/unzip

---

致谢

• ClawHub 团队提供开放的 API
• Convex 提供稳定的 backend 服务