ClawHub

Cross-Platform App Builder

v1.0.4

Use this skill when the user asks to create, build, or preview a cross-platform mobile app. Powered by Kuikly — a Kotlin Multiplatform UI framework supportin...

⭐ 1· 226·0 current·0 all-time
by@wwwcg
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
The required binaries (node, java, adb, xcodegen, pod, xcrun) and env vars (ANDROID_HOME, JAVA_HOME) are appropriate for a tool that scaffolds, builds, and previews Android/iOS apps. Commands listed (npx, gradlew, adb, xcrun, pod) align with the stated purpose.
ℹ
Instruction Scope
The SKILL.md claims strict scoping to the project directory and a read-only reference clone, and the explicit commands generally respect that. However, build tools (Gradle, CocoaPods, npm) can execute arbitrary code defined in project build scripts or dependencies during a build/install step—so running 'gradlew' or 'pod install' can have side effects beyond simple compilation. The skill promises only to modify .kt files in shared/src when auto-fixing, but that guarantee is a policy in prose and cannot be enforced by static instructions alone; the user should review any proposed fixes before applying them.
ℹ
Install Mechanism
Registry-level metadata reported no install spec, but SKILL.md contains metadata suggesting an npm package 'create-kuikly-app' as an install option. This is not a high-risk install pattern, but there's an inconsistency between the registry install metadata and the SKILL.md embedded metadata that you may want to verify. No downloads from untrusted personal URLs are present in the instructions.
✓
Credentials
Only ANDROID_HOME and JAVA_HOME are required, which are reasonable and expected for Android/iOS cross-builds. No unrelated credentials, tokens, or secret environment variables are requested.
✓
Persistence & Privilege
The skill is not always-enabled and does not request system-level privileges. It interacts with connected devices/simulators (adb, xcrun), which is necessary for previewing apps; this requires user consent to connect devices but is consistent with its purpose.
Assessment
This skill appears to be what it claims, but take these precautions before use: (1) Verify you trust the npm package 'create-kuikly-app' (if you choose to install it) and the GitHub repo being cloned. (2) Run the workflow in a dedicated/isolated directory (or VM/container) because Gradle, npm, and CocoaPods can execute arbitrary scripts during builds. (3) Review any automatic code edits the skill proposes before accepting them. (4) Be prepared to grant device/simulator access for adb/xcrun actions and ensure connected devices are those you control. (5) Note the small inconsistency: the SKILL.md includes an npm install suggestion while the registry shows no install spec—confirm how the skill will be installed/used in your environment.

Like a lobster shell, security has layers — review code before you run it.

latestvk97evhffrda121s9v3y7d79g4d82v617

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📱 Clawdis
Binsnode, java, adb, xcodegen, pod, xcrun
EnvANDROID_HOME, JAVA_HOME

Comments