Test Clone

Use the ClawHub CLI to search, install, update, and publish agent skills from clawhub.com. Use when you need to fetch new skills on the fly, sync installed s...

Security Scan

The skill is internally consistent with its stated purpose (wrapping the ClawHub CLI to manage skills) and its requirements (the clawhub binary / npm package) are proportionate.

Purpose & Capability

Name/description match the declared requirements: the skill needs the 'clawhub' binary and offers npm-based installation of the 'clawhub' package. No unrelated binaries or credentials are requested.

Instruction Scope

SKILL.md only instructs use of the clawhub CLI (search, install, update, publish, login). Publishing and updating operate on local skill folders (e.g., ./my-skill or ./skills) which is expected, but means the CLI will read local files. The docs mention optional env vars (CLAWHUB_REGISTRY, CLAWHUB_WORKDIR) that are not listed as required — this is normal but worth noting because those env vars can change where data is sent or which workdir is used.

Install Mechanism

Install uses npm to install the 'clawhub' package and create the 'clawhub' binary. npm is an expected mechanism for a Node-based CLI; this is a moderate-risk but standard install method (no ad-hoc downloads or obscure URLs).

Credentials

The skill declares no required environment variables, which is reasonable. However, the CLI supports/mentions optional env vars (CLAWHUB_REGISTRY, CLAWHUB_WORKDIR) and an interactive 'clawhub login' flow for publishing — these imply credentials may be provided at runtime or stored by the CLI even though none are pre-declared. This is expected for a publishable CLI but users should be aware the tool will request/store auth for the registry.

Persistence & Privilege

The skill is not always-enabled and does not request elevated persistence. Installing the npm package will create a CLI binary (normal). The skill does not modify other skills' configs or system-wide settings beyond installing the CLI.

Assessment

This skill is a thin wrapper around the ClawHub CLI and is coherent with its purpose. Before installing: (1) be aware npm i -g runs package code on your system — verify the 'clawhub' package provenance and trustworthiness; (2) using 'clawhub publish' will read local skill folders and upload them to the configured registry (default https://clawhub.com or whatever CLAWHUB_REGISTRY you set), so don't publish secrets or sensitive files; (3) the CLI uses an interactive login and may store credentials locally—review where it stores tokens if you need strict credential control; (4) if you plan to override CLAWHUB_REGISTRY, ensure the registry URL is trusted to avoid pointing the CLI to a malicious registry.

ClawHub CLI

Install

npm i -g clawhub

Auth (publish)

clawhub login
clawhub whoami

Search

clawhub search "postgres backups"

Install

clawhub install my-skill
clawhub install my-skill --version 1.2.3

Update (hash-based match + upgrade)

clawhub update my-skill
clawhub update my-skill --version 1.2.3
clawhub update --all
clawhub update my-skill --force
clawhub update --all --no-input --force

List

clawhub list

Publish

clawhub publish ./my-skill --slug my-skill --name "My Skill" --version 1.2.0 --changelog "Fixes + docs"

Notes

• Default registry: https://clawhub.com (override with CLAWHUB_REGISTRY or --registry)
• Default workdir: cwd (falls back to OpenClaw workspace); install dir: ./skills (override with --workdir / --dir / CLAWHUB_WORKDIR)
• Update command hashes local files, resolves matching version, and upgrades to latest unless --version is set