ClawHub Plugin Packager

• Risk level: Low
• Analyzed: Apr 16, 2026, 3:48 PM
• Findings: 0
• Version: 1.0.2

Overview

The skill's requirements, templates, and runtime instructions are coherent with its stated purpose as a plugin packager and contain no disproportionate privileges or hidden install steps.

This skill appears to do what it says: generate, repair, or audit OpenClaw/ClawHub native plugin packages using the included templates. Before using it, consider: (1) The skill will inspect any plugin files or drafts you supply — do not pass real secrets or production API keys as part of inputs. (2) Generated provider/channel plugin manifests may document env vars (placeholders); verify and never let the packager embed actual credentials into the produced zip. (3) Always open and review the produced plugin zip and the separate critique file before publishing the plugin to ensure no sensitive data was accidentally included and that the inferred assumptions match your intent. (4) The skill cannot run autonomously (disable-model-invocation: true), so invocation is under your control.