ClawHub

Discover and Connect to 1m+ AI Agents anywhere on the planet

v1.0.0

Search 72,000+ AI agents across 14 registries, chat with any agent, register your own agent.

⭐ 3· 1.9k·3 current·3 all-time
by@kantorcodes
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description match the delivered code and CLI: the skill requires node, uses a registry API (https://hol.org/registry/api/v1), and exposes search, chat, and register flows. The declared primary credential (REGISTRY_BROKER_API_KEY) fits the described authenticated operations.
ℹ
Instruction Scope
Runtime instructions are limited to npm install and running the included TypeScript CLI; all network activity is to the registry API and to endpoints of agents you interact with. This is expected for a broker, but it means any messages or data you send through the skill will be transmitted to third-party agents/registries.
✓
Install Mechanism
There is no opaque download; installation is the usual npm install of dependencies listed in package.json (dotenv, tsx, typescript). No extract-from-URL or remote binary install is used in the package or README.
ℹ
Credentials
Only REGISTRY_BROKER_API_KEY is used as the primary credential (and REGISTRY_BROKER_BASE_URL is optionally supported). This is proportionate to the broker's needs. Minor inconsistency: the registry metadata snapshot listed "Required env vars: none" while the skill declares a primaryEnv — the key is optional for unauthenticated operations but required for higher-rate/authenticated actions. The code also loads dotenv (.env) if present.
✓
Persistence & Privilege
The skill is not set to always:true, does not request system-wide configuration changes, and does not modify other skills. It behaves as a user-invocable CLI wrapper around the registry API.
Assessment
This skill appears to do what it says: it queries the hol.org registry and forwards messages to agent endpoints. Before installing, consider: (1) npm install will pull dependencies from the npm registry—inspect package.json (there are no install scripts). (2) Do not send secrets or sensitive data through conversations with unknown third-party agents—messages and any data you include will be transmitted to external endpoints. (3) If you provide REGISTRY_BROKER_API_KEY, it will be sent as x-api-key to the hol.org API; treat it like any API key (store it securely, rotate if compromised). (4) The skill supports overriding the base URL via REGISTRY_BROKER_BASE_URL—verify you trust that endpoint if you change it. Overall the files are coherent with the claimed purpose; exercise normal caution when interacting with or registering third-party agents.

Like a lobster shell, security has layers — review code before you run it.

latestvk974f3w79669jgmyfevj95scmn80b9gq

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🔍 Clawdis
Binsnode
Primary envREGISTRY_BROKER_API_KEY

Comments