ClawHub Publishing Workflow

Manages publishing, distribution, and versioning of OpenClaw skills via ClawHub registry with CLI authentication and batch sync support.

Security Scan

The SKILL.md clearly expects a local 'clawhub' CLI, scripts, environment variables, and token files to publish skills, but the skill metadata declares no required binaries, env vars, or install steps — a mismatch that warrants caution.

Purpose & Capability

The skill description (ClawHub publishing) matches the instructions, but the metadata lists no required binaries, env vars, or config paths while the SKILL.md repeatedly references a 'clawhub' CLI, ~/.openclaw workspace scripts (publish-to-clawhub.sh), environment variables (CLAWHUB_SITE, CLAWHUB_REGISTRY, CLAWHUB_WORKDIR), and a token path (~/.config/clawhub/token). Those are functional requirements that should have been declared. The absence of a homepage/source also makes it harder to verify the origin of the CLI and scripts.

Instruction Scope

Runtime instructions tell the agent (or a user) to run the clawhub CLI and local publishing scripts that package and upload entire skill directories (~/.openclaw/skills). That is coherent with a publishing workflow, but it means the operation will read and transmit local files. The doc asks publishers to avoid sensitive data but does not provide automated sanitization or explicit checks — leaving room for accidental exposure during batch sync/publish.

Install Mechanism

This is instruction-only with no install spec (lowest formal risk). However, the instructions assume the presence of an external 'clawhub' CLI and custom scripts in ~/.openclaw/workspace; because there is no declared install source (e.g., package repository or release URL) the provenance and integrity of those binaries/scripts is unknown and should be verified before use.

Credentials

The SKILL.md references environment variables and an authentication token file but the skill metadata lists no required env vars or primary credential. Requiring an authentication token and site URL is reasonable for a registry client, but not declaring them is an omission that reduces transparency. Also, publishing scripts that tar and upload directories can accidentally include secrets if not carefully validated, so the power to read and transmit local skill directories is non-trivial.

Persistence & Privilege

The skill does not request always:true or other elevated platform privileges. It describes writing .clawhub/origin.json and metadata files under the user's ~/.openclaw, which is expected for a publishing client and is scoped to the user's home area.

What to consider before installing

This skill's instructions are coherent for a publishing tool, but the metadata omits important declarations (required CLI, env vars, script locations, token file). Before installing or using it: 1) verify the origin of the 'clawhub' CLI and the publish-to-clawhub.sh script (get them from an official release or inspect the script contents), 2) confirm CLAWHUB_SITE/REGISTRY URLs are correct and trustworthy, 3) inspect the publish script to ensure it doesn't include unintended file globs (to avoid uploading secrets), 4) ensure ~/.config/clawhub/token is stored securely, and 5) ask the author/registry to add explicit install steps and required env vars to the skill metadata so the requirements are transparent. If you can't validate the CLI/scripts, treat uploads (especially batch sync) as potentially risky.

CLAWHUB SKILL

Name: clawhub
Description: ClawHub registry integration for OpenClaw skills publishing and distribution
Version: 1.0.0
Status: ACTIVE

---

🎯 MISIÓN

Enable seamless publishing, distribution, and management of OpenClaw skills through ClawHub registry.

---

🔧 CONFIGURACIÓN

Authentication

# Login to ClawHub (opens browser)
clawhub login

# Verify authentication
clawhub whoami

# Logout
clawhub logout

Environment Variables

export CLAWHUB_SITE="https://clawhub.ai"
export CLAWHUB_REGISTRY="https://clawhub.ai"
export CLAWHUB_WORKDIR="$HOME/.openclaw"

---

📦 PUBLISHING WORKFLOW

Quick Publish

# Single skill
clawhub publish ~/.openclaw/skills/my-skill \
  --slug "my-skill" \
  --version "1.0.0" \
  --changelog "Initial release" \
  --tags "latest,openclaw,automation"

# Using publish script
~/.openclaw/workspace/scripts/publish-to-clawhub.sh publish \
  ~/.openclaw/skills/my-skill

Batch Sync

# Publish all valid skills
~/.openclaw/workspace/scripts/publish-to-clawhub.sh sync \
  ~/.openclaw/skills

Validation Requirements

Before publishing, ensure:

• ✅ SKILL.md exists with Name and Description
• ✅ No sensitive data (API keys, credentials)
• ✅ Version follows semver (e.g., 1.0.0)
• ✅ Unique slug (check existing: clawhub search <slug>)

---

📊 METADATA STRUCTURE

_meta.json (Auto-generated)

{
  "ownerId": "<auto-assigned>",
  "slug": "skill-slug",
  "version": "1.0.0",
  "publishedAt": 1774384644739
}

.clawhub/origin.json (After publish)

{
  "version": 1,
  "registry": "https://clawhub.ai",
  "slug": "skill-slug",
  "installedVersion": "1.0.0",
  "installedAt": 1774384644739
}

---

🛠️ CLI COMMANDS

Search & Discover

# Search skills
clawhub search "crypto trading"

# Explore latest
clawhub explore

# Inspect without install
clawhub inspect deep-scraper

Install & Update

# Install skill
clawhub install <slug>

# Update installed skills
clawhub update [slug]

# List installed
clawhub list

# Uninstall
clawhub uninstall <slug>

Publish & Manage

# Publish new skill
clawhub publish <path> [options]

# Update existing
clawhub publish <path> --version "1.1.0" --changelog "Bug fixes"

# Delete (moderator only)
clawhub delete <slug>

# Hide/Unhide
clawhub hide <slug>
clawhub unhide <slug>

---

📋 CATALOG MANAGEMENT

Skill Discovery Pipeline

1. Browse → clawhub explore (latest updates)
2. Search → clawhub search <query> (vector search)
3. Inspect → clawhub inspect <slug> (preview metadata)
4. Install → clawhub install <slug> (download + configure)
5. Update → clawhub update (sync latest versions)

Quality Standards

Published skills must:

• ✅ Have clear purpose and trigger conditions
• ✅ Include usage examples
• ✅ Document dependencies
• ✅ Follow naming conventions (kebab-case slugs)
• ✅ Be tested and functional

---

🔗 INTEGRATION POINTS

With OpenClaw

# Skills auto-discovered from ~/.openclaw/skills/
# Published skills available via:
openclaw skill run <slug> "<task>"

With Publishing Script

# Full workflow automation
./publish-to-clawhub.sh validate <path>   # Check structure
./publish-to-clawhub.sh package <path>    # Create tarball
./publish-to-clawhub.sh publish <path>    # Upload to registry
./publish-to-clawhub.sh sync <dir>        # Batch publish

---

📁 FILES

• ~/.openclaw/skills/clawhub/SKILL.md (this file)
• ~/.openclaw/workspace/scripts/publish-to-clawhub.sh (publishing automation)
• ~/.openclaw/workspace/docs/clawhub-publishing-guide.md (documentation)
• ~/.config/clawhub/token (authentication token)

---

✅ VERIFICATION

# Check CLI installed
which clawhub
clawhub --version

# Verify auth
clawhub whoami

# Test search
clawhub search "openclaw" | head -10

# List published skills (your account)
clawhub list --mine 2>/dev/null || echo "Check web dashboard"

---

🐛 TROUBLESHOOTING

Common Errors

"Not logged in"

clawhub login

"Slug already exists"

# Increment version
clawhub publish <path> --version "1.1.0"

"Missing SKILL.md"

# Ensure skill has required files
ls -la <skill-path>/SKILL.md

"Validation failed"

# Run validation first
./publish-to-clawhub.sh validate <skill-path>

---

📈 METRICS

Metric	Target	Status
Skills Published	5+ (test batch)	IN PROGRESS
Publishing Time	<2 min/skill	✅ Automated
Validation Rate	100%	✅ Pre-check enabled

---

Version: 1.0.0
Created: 2026-03-31
Registry: https://clawhub.ai
Owner: Hybrid Labs