Clawhub

Install, search, update, and manage skills from ClawHub (the public OpenClaw skill registry). Use when the user wants to install a skill by slug (e.g. "clawh...

Security Scan

The skill is an instruction-only wrapper that tells the agent how to use an external 'clawhub' CLI to install and manage skills; its requirements and actions are generally consistent with that purpose but there are a few minor ambiguities the user should note before allowing installations.

Purpose & Capability

The name/description match the instructions: the SKILL.md simply documents using the external 'clawhub' CLI to install/search/update skills. It does not request unrelated credentials, binaries, or config paths.

Instruction Scope

Instructions direct the agent to run shell commands (cd into ~/.openclaw/workspace and run 'clawhub' commands) and optionally to install the CLI via 'npm i -g clawhub'. This scope is appropriate for a CLI wrapper, but there's a minor inconsistency: the doc says 'Do not auto-install without user confirmation' yet also states 'The agent will handle CLI installation and confirm when the skill is ready' (which could be read as implying autonomous installation). The SKILL.md does not instruct the agent to read unrelated files or env vars.

Install Mechanism

No install spec is included (instruction-only), which is low-risk. The only install action mentioned is a user-confirmed 'npm i -g clawhub' recommendation — installing a global npm package can execute arbitrary code from the registry, so the user should confirm the package's provenance before allowing installation.

Credentials

The skill declares no required environment variables or credentials and the instructions do not reference any secrets. Access to the user's workspace path (~/.openclaw/workspace) is necessary and expected for installing skills.

Persistence & Privilege

The skill is not always-enabled and does not request elevated or persistent platform privileges. It does not modify other skills' configurations in the instructions.

Assessment

This skill is mostly documentation for using the external 'clawhub' CLI. Before allowing it to install or run commands, confirm: (1) that 'clawhub' comes from a trusted source (review the npm package or official project site), (2) you are comfortable running a global npm install (it can run arbitrary code), and (3) the agent should ask for explicit user confirmation before performing installations or changing files in ~/.openclaw/workspace. If you prefer, manually install 'clawhub' yourself and run the documented commands instead of granting the agent permission to do so. Also review any third-party skills you install — the SKILL.md correctly reminds you they are untrusted by default.

ClawHub Skill Manager

Install and manage skills from ClawHub, the public skill registry for OpenClaw.

Prerequisites

The clawhub CLI must be available on PATH. Verify with which clawhub. If missing, ask the user to install it manually:

npm i -g clawhub

Do not auto-install without user confirmation.

Commands

Install a skill

cd ~/.openclaw/workspace && clawhub install <slug>

• <slug> is the skill identifier from ClawHub (e.g. summarize, weather, coding-agent)
• Skills are installed into ./skills/ under the workspace
• A new OpenClaw session is needed to pick up the skill

Search for skills

clawhub search "<query>"

Update skills

# Update a specific skill
clawhub update <slug>

# Update all installed skills
clawhub update --all

Other useful commands

clawhub info <slug>       # Show skill details
clawhub list              # List installed skills
clawhub --help            # Full CLI reference

Workflow

1. Ensure clawhub CLI is installed (check with which clawhub, install if missing)
2. cd to the workspace directory: ~/.openclaw/workspace
3. Run the appropriate clawhub command
4. Inform the user to start a new session (or restart gateway) for the skill to take effect

Installing via WhatsApp

Users can install skills by messaging the OpenClaw agent on WhatsApp:

clawhub install <slug>

Example: clawhub install summarize

The agent will handle CLI installation and confirm when the skill is ready.

Notes

• All ClawHub skills are public and open
• Treat third-party skills as untrusted — review before enabling
• Workspace skills (<workspace>/skills/) take highest precedence over managed and bundled skills