ClawHub 发布助手
v2.0.0将本地技能发布到 ClawHub 技能市场。自动检查技能目录结构、生成版本号、 构建 changelog，执行发布命令并验证结果。 **触发场景**：用户说"发布技能"、"发布到 ClawHub"、"上传技能"等。
⭐ 0· 62·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill's name/description (publish local skill to ClawHub) matches the instructions: it runs clawhub CLI commands, checks local SKILL.md, builds changelog/version, and publishes. Requiring local filesystem access and the clawhub CLI is appropriate for this purpose.
Instruction Scope
Instructions explicitly tell the agent to run shell commands (clawhub whoami/login/publish) and to read/write the local skill file. This is expected, but the SKILL.md uses a hard-coded absolute path (/home/fslong/.copaw/workspaces/default/active_skills/<技能名>/SKILL.md). That will not be correct for many users and implies the agent will try to read a specific user workspace. The doc also promises '自动生成版本号' but gives no deterministic algorithm — most actions require user confirmation, so some claimed automation is underspecified.
Install Mechanism
Instruction-only skill with no install spec and no code files; nothing is downloaded or written by an installer. This is the lowest-risk install model.
Credentials
No environment variables or external credentials are requested in the manifest. The runtime instructions call the local clawhub CLI and its login flow (browser auth), which is proportional to publishing to ClawHub. There are no unrelated credential requests.
Persistence & Privilege
always is false and the skill is user-invocable. It does request Read/Write/ExecuteShellCommand in allowed-tools (in SKILL.md), which is necessary for its task but does grant the agent permission to run shell commands and edit local files — expected for a publish helper but worth noting.
Assessment
This skill is coherent for publishing a local skill via the clawhub CLI, but check a few things before installing/using it: 1) The SKILL.md references a hard-coded path (/home/fslong/.copaw/...), so confirm or update it to your workspace path — otherwise the agent may fail or read the wrong files. 2) The skill expects the clawhub CLI to be installed and will run shell commands and read/write SKILL.md; only allow this if you trust the CLI and the skill's author. 3) The slug naming rules here are unusually strict (no '-' or '_'); confirm those requirements with ClawHub if you rely on other slug formats. 4) The skill triggers browser-based login (clawhub login) which will store credentials locally via the CLI — be aware of where those tokens are stored. If any of these items are unexpected in your environment, do not enable the skill until you adjust the instructions or verify the path/CLI behavior.Like a lobster shell, security has layers — review code before you run it.
clawhubvk971jrt5e5azst9aj76mc0622184s41hlatestvk971jrt5e5azst9aj76mc0622184s41hmanagementvk971jrt5e5azst9aj76mc0622184s41hpublishvk971jrt5e5azst9aj76mc0622184s41hskillvk971jrt5e5azst9aj76mc0622184s41htoolvk971jrt5e5azst9aj76mc0622184s41h
License
MIT-0
Free to use, modify, and redistribute. No attribution required.