ClawHub

Clawhub Skill Creator

v1.0.0

Create and update skills for clawhub registry; optimize structure, validate metadata, and ensure compatibility for AI agent usage.

⭐ 2· 594·3 current·4 all-time
by@erview
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name and description match the included content: a comprehensive SKILL.md, references, and two utility scripts to initialize and package skills. The files provided (init and package scripts, metadata guidance, validation checklist, token guidance, versioning) are all appropriate for a 'skill creator' tool.
ℹ
Instruction Scope
SKILL.md stays within the stated purpose (authoring, structuring, validating, and publishing skills). It tells the operator to run local scripts and clawhub CLI commands, which is expected. Minor inconsistency: SKILL.md references a ./scripts/validate.sh in Phase 8, but the repo contains init-skill.sh and package-skill.sh (no validate.sh). This is likely a documentation mismatch rather than malicious behavior; review before running.
✓
Install Mechanism
No install spec — instruction-only with two small shell scripts. No downloads from external URLs or archives. Low install risk. The packaging script relies on standard tools (jq, zip, grep/sed) which are typical for local packaging.
✓
Credentials
No required environment variables, no credentials requested in _meta.json or SKILL.md. The guidance to use 'clawhub publish' is appropriate for this tool and explains where network interaction would happen (the registrar).
✓
Persistence & Privilege
Skill is not marked always:true and does not request system-wide persistence or modify other skills' configs. Scripts create local files and produce a package; they do not store tokens or alter global agent settings.
Assessment
This skill appears coherent and low-risk for its purpose, but review before running: (1) The documentation refers to a validate.sh that isn't included — do not assume missing scripts exist. (2) Inspect scripts/init-skill.sh and scripts/package-skill.sh to ensure they do only what you expect (they create files, validate local structure, and zip the directory). (3) Packaging requires standard tools (jq, zip); ensure those are available or run in a controlled environment. (4) Publishing via 'clawhub publish' sends content to the registry — verify you intend to upload the skill. (5) Because the skill can be invoked by an agent, avoid granting additional credentials or env vars unless strictly needed. If you want higher assurance, run the scripts in a sandbox or container and confirm their outputs before publishing.

Like a lobster shell, security has layers — review code before you run it.

latestvk97323h7ezkxkn0mvzy96sbx0s81mb9v

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments