ClawHub

Test Clone

v1.0.0

Use the ClawHub CLI to search, install, update, and publish agent skills from clawhub.com. Use when you need to fetch new skills on the fly, sync installed s...

⭐ 0· 98·0 current·0 all-time
by@krischristen-hash·duplicate of @vassiliylakhonin/vassili-clawhub-cli
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the declared requirements: the skill needs the 'clawhub' binary and offers npm-based installation of the 'clawhub' package. No unrelated binaries or credentials are requested.
ℹ
Instruction Scope
SKILL.md only instructs use of the clawhub CLI (search, install, update, publish, login). Publishing and updating operate on local skill folders (e.g., ./my-skill or ./skills) which is expected, but means the CLI will read local files. The docs mention optional env vars (CLAWHUB_REGISTRY, CLAWHUB_WORKDIR) that are not listed as required — this is normal but worth noting because those env vars can change where data is sent or which workdir is used.
✓
Install Mechanism
Install uses npm to install the 'clawhub' package and create the 'clawhub' binary. npm is an expected mechanism for a Node-based CLI; this is a moderate-risk but standard install method (no ad-hoc downloads or obscure URLs).
ℹ
Credentials
The skill declares no required environment variables, which is reasonable. However, the CLI supports/mentions optional env vars (CLAWHUB_REGISTRY, CLAWHUB_WORKDIR) and an interactive 'clawhub login' flow for publishing — these imply credentials may be provided at runtime or stored by the CLI even though none are pre-declared. This is expected for a publishable CLI but users should be aware the tool will request/store auth for the registry.
✓
Persistence & Privilege
The skill is not always-enabled and does not request elevated persistence. Installing the npm package will create a CLI binary (normal). The skill does not modify other skills' configs or system-wide settings beyond installing the CLI.
Assessment
This skill is a thin wrapper around the ClawHub CLI and is coherent with its purpose. Before installing: (1) be aware npm i -g runs package code on your system — verify the 'clawhub' package provenance and trustworthiness; (2) using 'clawhub publish' will read local skill folders and upload them to the configured registry (default https://clawhub.com or whatever CLAWHUB_REGISTRY you set), so don't publish secrets or sensitive files; (3) the CLI uses an interactive login and may store credentials locally—review where it stores tokens if you need strict credential control; (4) if you plan to override CLAWHUB_REGISTRY, ensure the registry URL is trusted to avoid pointing the CLI to a malicious registry.

Like a lobster shell, security has layers — review code before you run it.

latestvk979xvvy34kmarre41brds241s83h91y

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Binsclawhub

Install

Install ClawHub CLI (npm)
Bins: clawhub
npm i -g clawhub

Comments