Clawdhub Copy

Use the ClawdHub CLI to search, install, update, and publish agent skills from clawdhub.com. Use when you need to fetch new skills on the fly, sync installed skills to latest or a specific version, or publish new/updated skill folders with the npm-installed clawdhub CLI.

Security Scan

The skill is coherent with its stated purpose (a wrapper for the ClawdHub CLI) but its instructions allow fetching, installing, and publishing third‑party code which can exfiltrate or execute local files; those capabilities materially increase risk and require user caution.

Purpose & Capability

Name/description match the instructions: the SKILL.md documents installing and using an npm-installed 'clawdhub' CLI to search, install, update, list, and publish skills. Declared binaries and the suggested npm install are proportionate to that purpose.

Instruction Scope

Instructions include 'clawdhub install' (downloads and places remote skill code into a workdir) and 'clawdhub publish ./my-skill' (uploads local skill folders). Those operations can cause code execution (installing new skills) or data exfiltration (publishing local files). SKILL.md also notes defaults (cwd, ./skills) which could cause the agent to operate on the current workspace without explicit user confirmation. There is no guidance about verifying downloaded skill provenance or signing.

Install Mechanism

No install spec in the skill bundle (instruction-only), but SKILL.md recommends 'npm i -g clawdhub' (standard npm registry mechanism). Using npm is typical and traceable, but global npm installs affect the host environment and pull arbitrary package code from the registry.

Credentials

The skill does not require extra environment variables or credentials in the manifest. SKILL.md mentions optional overrides (CLAWDHUB_REGISTRY, CLAWDHUB_WORKDIR) and uses interactive 'clawdhub login' for publishing; the requested privileges are consistent with a package manager CLI. No unrelated credentials are requested.

Persistence & Privilege

always is false, but autonomous invocation is allowed (default). Because the skill enables the agent to fetch and install arbitrary third-party skills at runtime, its use can expand the agent's capabilities and attack surface. Publishing also lets the agent send local folders to an external registry. Those powers increase blast radius if the agent is allowed to act without explicit human confirmation.

What to consider before installing

This instruction-only skill is internally consistent for managing a ClawdHub CLI, but it enables the agent to download and install third‑party skills and to upload local skill folders to an external registry. Before installing or giving the agent permission to use it: 1) Verify the ClawdHub CLI package and registry (is https://clawdhub.com legitimate and trusted?). 2) Avoid global installs as an elevated user; prefer sandboxed environments. 3) Require explicit user confirmation before any 'install', 'update', or 'publish' operation — these actions can execute code or exfiltrate files. 4) Review downloaded skill code before enabling it and restrict agent autonomy if you do not want it installing packages without human approval.

ClawdHub CLI

Install

npm i -g clawdhub

Auth (publish)

clawdhub login
clawdhub whoami

Search

clawdhub search "postgres backups"

Install

clawdhub install my-skill
clawdhub install my-skill --version 1.2.3

Update (hash-based match + upgrade)

clawdhub update my-skill
clawdhub update my-skill --version 1.2.3
clawdhub update --all
clawdhub update my-skill --force
clawdhub update --all --no-input --force

List

clawdhub list

Publish

clawdhub publish ./my-skill --slug my-skill --name "My Skill" --version 1.2.0 --changelog "Fixes + docs"

Notes

• Default registry: https://clawdhub.com (override with CLAWDHUB_REGISTRY or --registry)
• Default workdir: cwd (falls back to Clawdbot workspace); install dir: ./skills (override with --workdir / --dir / CLAWDHUB_WORKDIR)
• Update command hashes local files, resolves matching version, and upgrades to latest unless --version is set