ClawHub Publish
ReviewAudited by ClawScan on May 10, 2026.
Overview
This looks like a legitimate ClawHub publishing helper, but it can rewrite skill files and publish or batch-publish them publicly using the logged-in account without explicit confirmation safeguards.
Use this only if you intentionally want the agent to publish to ClawHub. Before running it, replace the hard-coded paths and profile URL with your own, verify the logged-in ClawHub account, require a diff before any file changes, and approve each publish separately rather than allowing automatic batch publishing.
Findings (6)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent could change a local skill and publish or update it publicly under the logged-in ClawHub account before the user has reviewed the final result.
The workflow combines file mutation with public marketplace publishing, and the batch path repeats those actions, but the artifact does not require a final user approval, diff review, or per-skill confirmation.
If Korean or personal info is found: ... Rewrite SKILL.md fully in English ... Write with UTF-8 ... clawhub publish ./skills/<skill-name> ... Batch Publish ... run steps 1–4 for each in sequence.
Require the user to select the exact folder, slug, version, and changelog; show a diff before file writes; and ask for explicit confirmation before each publish, especially in batch mode.
One bad assumption or edit could affect several marketplace listings and make cleanup harder.
A translation, sanitization, versioning, or slug mistake could be repeated across multiple public skill publishes without containment.
To publish multiple skills at once, run steps 1–4 for each in sequence.
Disable automatic batch publishing by default, process one skill at a time, and require per-skill validation and confirmation.
Actions will use whichever ClawHub account is currently logged in.
The skill relies on the user's authenticated ClawHub session, which is expected for publishing but grants account-level authority to create or update marketplace entries.
Logged in: `clawhub whoami` (if not: `clawhub login` via PTY + browser)
Run `clawhub whoami` yourself before publishing and confirm the account is correct.
Users must trust the npm package and the installed CLI because it performs the actual publish operation.
The skill depends on a globally installed npm CLI, which is purpose-aligned but not represented in the install specification or required binaries.
clawhub CLI installed: `npm i -g clawhub`
Install only the official ClawHub CLI, verify the package source, and keep the CLI updated.
Incorrect publish records could be reused later and mislead future planning or automation.
The workflow writes publish status into persistent local memory/dashboard files, which may influence later agent context.
After successful publish, update both: `C:\MAIBOT\memory\marketplace-strategy.md` ... Obsidian `_DASHBOARD.md`
Review persistent record updates before saving them and keep them limited to the intended workspace.
A user could mistakenly verify the wrong profile or expect the workflow to fit their environment when it is tailored to someone else's setup.
The skill is presented as a general ClawHub publishing helper but contains user-specific paths and a specific profile URL.
Target skill folder exists under `C:\MAIBOT\skills\<skill-name>\` ... Then check: https://clawhub.ai/u/jini92
Replace hard-coded paths, suffixes, and profile URLs with user-specific placeholders before using the skill.