ClawHub Publish Official

• Risk level: Low
• Analyzed: Apr 8, 2026, 10:22 PM
• Findings: 0
• Version: 1.0.0

Overview

The skill is internally consistent: it simply wraps the ClawHub CLI (npm package 'clawhub') and its instructions match the stated marketplace/publish purpose.

This skill is a thin wrapper around the ClawHub CLI and looks coherent. Before installing: verify the 'clawhub' npm package source (check the package page, author, and downloads), avoid running batch update/publish commands unattended (e.g., 'update --all --no-input --force'), and be careful what you publish — the publish command uploads local files, so remove secrets or private files from the directory. If you plan to override the registry (CLAWHUB_REGISTRY), only point it at trusted endpoints. Finally, note 'clawhub login' will create stored auth tokens on your machine; review where they are stored and revoke them if needed.