ClawHub Skill Creator Guide
v1.0.0Create and publish ClawHub skills with the correct format. Includes YAML frontmatter template, _meta.json structure, and step-by-step publishing guide.
⭐ 0· 44·0 current·0 all-time
by@yejay7
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description match the instructions: the document is a publishing/format guide for ClawHub skills. However, the SKILL.md shows commands that require Node/npm (npx) and a browser for OAuth callbacks, yet the registry metadata lists no required binaries—this omission is inconsistent but not malicious.
Instruction Scope
Instructions are scoped to skill creation and publishing (creating SKILL.md and _meta.json, verifying fields, running 'npx clawhub login' and 'npx clawhub publish'). These commands will perform network operations and open a browser for authentication; the guide uses absolute path examples (e.g., /mnt/data/...) but does not instruct reading unrelated system files or exfiltrating data.
Install Mechanism
No install spec and no code files are present. Being instruction-only minimizes installation risk.
Credentials
The skill requests no environment variables or credentials in metadata. The guide does require a GitHub account for CLI auth (not declared as an env var), which is appropriate for publishing.
Persistence & Privilege
No 'always' privilege, no modifications to other skills, and autonomous invocation defaults are unchanged. The guide doesn't request persistent system privileges.
Assessment
This guide appears to do what it says: format and publish ClawHub skills. Before using it, note these practical points: (1) SKILL.md examples assume you have Node.js/npm (npx) and a browser available—those are required but not listed in the metadata; (2) 'npx clawhub login' will open a browser and perform an OAuth-style login tied to your GitHub account (the guide requires a GitHub account >14 days old); (3) 'npx' executes packages fetched from npm at run time—if you have any doubt about the 'clawhub' package, inspect its source (or install it from a trusted release) before running; (4) double-check absolute paths and that the SKILL.md/_meta.json content is correct before publishing since publishing is a networked action that will make the skill public; (5) treat publishing credentials and tokens carefully and publish only from a trusted machine and account. These are cautionary operational notes, not signs of malicious intent.Like a lobster shell, security has layers — review code before you run it.
clawhubvk973bx7ksrmamqpn3092a5dxh98404ncguidevk973bx7ksrmamqpn3092a5dxh98404nclatestvk973bx7ksrmamqpn3092a5dxh98404ncpublishingvk973bx7ksrmamqpn3092a5dxh98404ncskill-creatorvk973bx7ksrmamqpn3092a5dxh98404nctemplatevk973bx7ksrmamqpn3092a5dxh98404nc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.