Scan To Skill

QR-based skill installer for ClawHub. Decodes QR images (Telegram uploads, screenshots, camera captures), extracts a valid skill slug or install command, and installs automatically via ClawHub CLI. Use for "scan to install" flows, especially when users send a QR image and want immediate one-step skill installation with result feedback.

Install skills from QR codes in one flow: decode -> parse slug -> install -> verify.

Trigger

When a user sends an image and asks to install from QR:

1. Detect image attachment in the current message.
2. Run scripts/install_from_qr.py <image> (dry run by default).
3. Show the decoded text and parsed slug to the user.
4. Prompt the user: "Decoded skill: <slug>. Do you want me to install it?"
5. If the user confirms, run scripts/install_from_qr.py <image> --confirm to execute the install.
6. Show the install result and suggest next steps.

Workflow

1. Get QR input image
   • Use uploaded image, screenshot, or camera snapshot.
2. Decode QR content
   • Prefer scripts/install_from_qr.py --decode-only <image>.
3. Parse install target
   • Accept:
     • direct slug (skill-feed)
     • ClawHub URL (https://clawhub.ai/<owner>/<slug> or https://clawhub.ai/<slug>)
     • install command text (clawhub install <slug>)
4. Install with ClawHub CLI
   • Run install command generated by script.
5. Verify installation
   • Check with clawhub list.

Commands

• Decode only (no install attempt):
  • python3 scripts/install_from_qr.py --decode-only <image_path>
• Dry run (decode + show install command, but do not install):
  • python3 scripts/install_from_qr.py <image_path>
• Install after user confirms:
  • python3 scripts/install_from_qr.py <image_path> --confirm
• Install to custom dir:
  • python3 scripts/install_from_qr.py <image_path> --confirm --dir skills

Safety

• The script defaults to dry run. Install only executes when --confirm is explicitly passed.
• The agent must never pass --confirm without the user's explicit approval.
• Only accept URLs from verified ClawHub domains (clawhub.ai, clawhub.com and their www. variants).
• URLs from non-ClawHub domains are rejected by the script (exit code 4).
• Plain slugs and clawhub install commands are accepted as trusted sources.
• For any slug the user hasn't seen before, recommend checking the skill page on ClawHub before installing.

Output format

• Decoded QR: <raw_text>
• Parsed slug: <slug>
• Install command: <command>
• Result: success/failure + reason
• Next step: open skill page or run quick test

References

• Parsing rules and examples: references/slug-parsing.md