ClawhHub Skill Publisher

PassAudited by ClawScan on May 10, 2026.

Overview

This is a straightforward ClawHub publishing helper, but users should verify the CLI and account before confirming a public release.

Before installing or using this skill, make sure the `clawhub` CLI is trustworthy and that you are logged into the intended account. Review the selected skill folder, slug, version, changelog, and final confirmation carefully before allowing it to publish.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

A confirmed action can publish or update a marketplace skill under the user's ClawHub account.

Why it was flagged

The skill instructs the agent to run a CLI command that publishes a skill, but it is purpose-aligned and explicitly requires confirmation before execution.

Skill content

After confirmation, run:
```bash
clawhub publish <folder-path> \
  --slug <slug> \
  --name "<name>" \
  --version <version> \
  --changelog "<changelog>" \
  --tags latest
```

Recommendation

Only confirm publishing after checking the selected folder, slug, version, changelog, and tags.

Low

#ASI03: Identity and Privilege Abuse

What this means

The publish command will act as whichever ClawHub user is logged in locally.

Why it was flagged

Publishing depends on the user's authenticated ClawHub CLI session; this is expected for the stated purpose but affects the user's account.

Skill content

Not logged in → run `clawhub login`

Recommendation

Run `clawhub whoami` or otherwise verify the active account before publishing important releases.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users must supply and trust their own `clawhub` CLI installation.

Why it was flagged

The workflow relies on the external `clawhub` CLI, but the registry metadata does not declare that binary or its provenance.

Skill content

Required binaries (all must exist): none ... No install spec — this is an instruction-only skill.

Recommendation

Install or use the ClawHub CLI only from an official, trusted source and keep it updated.