来了

Use the ClawHub CLI to search, install, update, and publish agent skills from clawhub.com. Use when you need to fetch new skills on the fly, sync installed s...

Security Scan

The skill is internally consistent: it is a thin wrapper around the ClawHub CLI and only requires the clawhub binary / npm package, which aligns with its stated purpose.

Purpose & Capability

Name/description match the declared requirements: the skill needs the 'clawhub' CLI and the install spec installs the npm 'clawhub' package. There are no unrelated binaries, env vars, or config paths requested.

Instruction Scope

SKILL.md instructs the agent to run clawhub commands (search, install, update, publish) and suggests npm -g install. These commands legitimately operate on local skill folders and the OpenClaw workspace. Note: publishing and installing will read and write local skill directories and can transfer code to/from the registry, so the agent will have the ability to fetch and install arbitrary skill packages from the registry and to publish local folders (avoid exposing secrets in those folders).

Install Mechanism

Install uses the public npm package 'clawhub' (npm i -g clawhub). This is an expected mechanism but carries the usual npm risks: the package maintainer controls the code that runs on install and when the CLI is invoked. Global install modifies the environment (PATH) and may require elevated permissions on some systems.

Credentials

No required environment variables or credentials are declared. The docs mention optional overrides (CLAWHUB_REGISTRY, CLAWHUB_WORKDIR) which are reasonable and not required. The skill does involve logging into the ClawHub registry (clawhub login) when publishing, which is expected behavior.

Persistence & Privilege

always: false and no special privileges are requested. The skill's install step creates a global CLI binary (normal for a CLI helper). Note: the agent can invoke this skill autonomously by default (platform default); if you do not want the agent to auto-install or update packages, restrict autonomous invocation or require explicit user actions.

Assessment

This skill is a simple wrapper for the ClawHub CLI and is coherent with its description, but it carries the normal risks of installing and running third-party CLI software. Before installing: 1) Verify the npm 'clawhub' package source and maintainer reputation. 2) Be aware that npm i -g will install code that can run on your system and may require elevated permissions. 3) When publishing, do not include secrets or unrelated files in the skill folder. 4) If you don’t want the agent to autonomously install or update packages, restrict autonomous invocation or run clawhub commands manually in a controlled environment (e.g., a sandbox or CI job).

ClawHub CLI

Install

npm i -g clawhub

Auth (publish)

clawhub login
clawhub whoami

Search

clawhub search "postgres backups"

Install

clawhub install my-skill
clawhub install my-skill --version 1.2.3

Update (hash-based match + upgrade)

clawhub update my-skill
clawhub update my-skill --version 1.2.3
clawhub update --all
clawhub update my-skill --force
clawhub update --all --no-input --force

List

clawhub list

Publish

clawhub publish ./my-skill --slug my-skill --name "My Skill" --version 1.2.0 --changelog "Fixes + docs"

Notes

• Default registry: https://clawhub.com (override with CLAWHUB_REGISTRY or --registry)
• Default workdir: cwd (falls back to OpenClaw workspace); install dir: ./skills (override with --workdir / --dir / CLAWHUB_WORKDIR)
• Update command hashes local files, resolves matching version, and upgrades to latest unless --version is set