ClawHub Publish Smoke Check

Verify ClawHub login, dry-run sync state, one-off publish success, and cleanup for a local skill workspace.

Security Scan

Instruction-only checklist that coherently guides a user through verifying clawhub login, dry-run sync, publishing a temporary test skill, and cleaning it up — it requests no extra credentials or installs and stays within its stated purpose.

Purpose & Capability

The name/description match the runtime instructions: the skill is a procedural checklist for testing the ClawHub publish path. It does not request unrelated binaries, env vars, or access.

Instruction Scope

The SKILL.md instructs the operator to run clawhub CLI commands, create a temporary skill directory, publish it, then hide or delete it. This stays within the described purpose, but publishing creates a real registry artifact — cleanup may not immediately remove all traces (caches, mirrors, audit logs), so follow the documented cleanup steps and verify removal.

Install Mechanism

There is no install spec and no code files. This is instruction-only, so nothing will be written to disk by the skill itself.

Credentials

The skill declares no required environment variables or credentials. The instructions assume the user has a clawhub login token already, which is appropriate for the task.

Persistence & Privilege

The skill does not request always:true or other elevated persistence. Default autonomous invocation is allowed by platform policy but the skill itself does not request persistent or system-level changes.

Assessment

This skill is a simple, coherent checklist for using your local clawhub CLI to smoke-test publish behavior. Before using it: ensure you really want to publish a temporary artifact from your account (use a throwaway account or a clearly-named test slug), avoid including any sensitive data in the temporary skill contents, choose a unique slug, and verify the registry entry is removed after cleanup (hiding/deleting may not purge all caches or audit traces immediately). Because the skill is instruction-only and requests no secrets, there is low intrinsic risk, but publishing to a public registry is an action that affects your account and may be visible to others — proceed deliberately.

What This Skill Does

Use this skill when you need to confirm the ClawHub publishing path works end to end from a local workspace without touching existing production skills.

It focuses on four checks:

1. Confirm the current clawhub login identity.
2. Inspect whether the current workspace would upload anything with clawhub sync --dry-run.
3. Publish a separate test skill with a unique slug.
4. Clean up the temporary skill after verification.

When To Use

• You just ran clawhub login and want to verify the token is valid.
• clawhub sync --dry-run shows existing skills that should not be published blindly.
• You need a smoke test for upload and publish behavior.
• You want a safe fallback that does not mutate public versions of real skills.

Recommended Flow

1. Verify Identity

Run:

clawhub whoami

The command should return the expected handle. If it fails, re-run clawhub login.

2. Inspect Sync State

Run:

clawhub sync --dry-run

If this proposes updates for installed third-party skills, do not publish them directly. Use a temporary test skill instead.

3. Publish a Temporary Skill

Prepare a dedicated folder with a unique slug and meaningful documentation, then publish it:

clawhub publish ./tmp/my-test-skill \
  --slug my-unique-test-skill \
  --name "My Unique Test Skill" \
  --version 0.0.1 \
  --changelog "Smoke-test publish"

A successful publish proves that authentication, upload, and registry validation all work.

4. Verify and Clean Up

After publish, inspect the skill page or query the registry, then hide or delete the temporary slug if it should not remain public:

clawhub hide my-unique-test-skill --yes

or

clawhub delete my-unique-test-skill --yes

Failure Modes

Not Logged In

Symptom: Not logged in. Run: clawhub login

Action: run clawhub login, complete browser auth, then repeat clawhub whoami.

Rate Limit Or External API Delay

Symptom: publish reports a short cooldown or API rate limit reset window.

Action: wait for the reset window, then retry once.

Content Quality Rejection

Symptom: publish says the content is too thin or templated.

Action: expand the skill with concrete purpose, steps, commands, and failure handling. Generic placeholder text is usually rejected.

Success Criteria

This smoke check passes only if all of the following are true:

• clawhub whoami succeeds.
• clawhub publish returns a successful result for the temporary slug.
• The published slug is reachable or inspectable.
• Cleanup succeeds if cleanup was requested.