Description

Use the ClawdHub CLI to search, install, update, and publish agent skills from clawdhub.com. Use when you need to fetch new skills on the fly, sync installed skills to latest or a specific version, or publish new/updated skill folders with the npm-installed clawdhub CLI.

README (SKILL.md)

ClawdHub CLI

Name: Clawdhub Copy
Author: jk50505k

Install

npm i -g clawdhub

Auth (publish)

clawdhub login
clawdhub whoami

Search

clawdhub search "postgres backups"

Install

clawdhub install my-skill
clawdhub install my-skill --version 1.2.3

Update (hash-based match + upgrade)

clawdhub update my-skill
clawdhub update my-skill --version 1.2.3
clawdhub update --all
clawdhub update my-skill --force
clawdhub update --all --no-input --force

List

clawdhub list

Publish

clawdhub publish ./my-skill --slug my-skill --name "My Skill" --version 1.2.0 --changelog "Fixes + docs"

Notes

Default registry: https://clawdhub.com (override with CLAWDHUB_REGISTRY or --registry)
Default workdir: cwd (falls back to Clawdbot workspace); install dir: ./skills (override with --workdir / --dir / CLAWDHUB_WORKDIR)
Update command hashes local files, resolves matching version, and upgrades to latest unless --version is set

Usage Guidance

This instruction-only skill is internally consistent for managing a ClawdHub CLI, but it enables the agent to download and install third‑party skills and to upload local skill folders to an external registry. Before installing or giving the agent permission to use it: 1) Verify the ClawdHub CLI package and registry (is https://clawdhub.com legitimate and trusted?). 2) Avoid global installs as an elevated user; prefer sandboxed environments. 3) Require explicit user confirmation before any 'install', 'update', or 'publish' operation — these actions can execute code or exfiltrate files. 4) Review downloaded skill code before enabling it and restrict agent autonomy if you do not want it installing packages without human approval.

Capability Analysis

Type: OpenClaw Skill Name: clawdhub-copy Version: 1.0.0 The skill's primary function is to install the `clawdhub` CLI via `npm i -g clawdhub` as instructed in `SKILL.md`'s metadata. This command downloads and executes code from the npm registry. The `clawdhub` CLI then manages other skills by fetching them from `clawdhub.com`. While the skill itself does not exhibit explicit malicious intent, its core functionality involves broad remote code execution capabilities and creates a significant supply chain risk, as a compromise of the `clawdhub` npm package or the `clawdhub.com` registry could lead to the installation and execution of malicious code.

Capability Assessment

✓ Purpose & Capability

Name/description match the instructions: the SKILL.md documents installing and using an npm-installed 'clawdhub' CLI to search, install, update, list, and publish skills. Declared binaries and the suggested npm install are proportionate to that purpose.

⚠ Instruction Scope

Instructions include 'clawdhub install' (downloads and places remote skill code into a workdir) and 'clawdhub publish ./my-skill' (uploads local skill folders). Those operations can cause code execution (installing new skills) or data exfiltration (publishing local files). SKILL.md also notes defaults (cwd, ./skills) which could cause the agent to operate on the current workspace without explicit user confirmation. There is no guidance about verifying downloaded skill provenance or signing.

ℹ Install Mechanism

No install spec in the skill bundle (instruction-only), but SKILL.md recommends 'npm i -g clawdhub' (standard npm registry mechanism). Using npm is typical and traceable, but global npm installs affect the host environment and pull arbitrary package code from the registry.

✓ Credentials

The skill does not require extra environment variables or credentials in the manifest. SKILL.md mentions optional overrides (CLAWDHUB_REGISTRY, CLAWDHUB_WORKDIR) and uses interactive 'clawdhub login' for publishing; the requested privileges are consistent with a package manager CLI. No unrelated credentials are requested.

⚠ Persistence & Privilege

always is false, but autonomous invocation is allowed (default). Because the skill enables the agent to fetch and install arbitrary third-party skills at runtime, its use can expand the agent's capabilities and attack surface. Publishing also lets the agent send local folders to an external registry. Those powers increase blast radius if the agent is allowed to act without explicit human confirmation.

Version History

v1.0.0

- Initial release of the ClawdHub CLI skill. - Search, install, update, list, and publish agent skills from clawdhub.com directly via CLI commands. - Supports syncing installed skills to latest or specific versions. - Integrates publish workflow with authentication using clawdhub login. - Registry and working directory can be customized with environment variables or flags.

Metadata

Slug clawdhub-copy

Version 1.0.0

License —

All-time Installs 4

Active Installs 4

Total Versions 1

Frequently Asked Questions

What is Clawdhub Copy?

Use the ClawdHub CLI to search, install, update, and publish agent skills from clawdhub.com. Use when you need to fetch new skills on the fly, sync installed skills to latest or a specific version, or publish new/updated skill folders with the npm-installed clawdhub CLI. It is an AI Agent Skill for Claude Code / OpenClaw, with 1858 downloads so far.

How do I install Clawdhub Copy?

Run "/install clawdhub-copy" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Clawdhub Copy free?

Yes, Clawdhub Copy is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Clawdhub Copy support?

Clawdhub Copy is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Clawdhub Copy?

It is built and maintained by jk50505k (@jk50505k); the current version is v1.0.0.

More Skills

Clawdhub Copy