← Back to Skills Marketplace
705
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install hi
Description
Use the ClawdHub CLI to search, install, update, and publish agent skills from clawdhub.com. Use when you need to fetch new skills on the fly, sync installed...
README (SKILL.md)
ClawdHub CLI
Install
npm i -g clawdhub
Auth (publish)
clawdhub login
clawdhub whoami
Search
clawdhub search "postgres backups"
Install
clawdhub install my-skill
clawdhub install my-skill --version 1.2.3
Update (hash-based match + upgrade)
clawdhub update my-skill
clawdhub update my-skill --version 1.2.3
clawdhub update --all
clawdhub update my-skill --force
clawdhub update --all --no-input --force
List
clawdhub list
Publish
clawdhub publish ./my-skill --slug my-skill --name "My Skill" --version 1.2.0 --changelog "Fixes + docs"
Notes
- Default registry: https://clawdhub.com (override with CLAWDHUB_REGISTRY or --registry)
- Default workdir: cwd; install dir: ./skills (override with --workdir / --dir)
- Update command hashes local files, resolves matching version, and upgrades to latest unless --version is set
Usage Guidance
Do not install this skill yet. The published metadata and SKILL.md advertise the ClawdHub CLI (npm 'clawdhub'), but the package contains an unrelated Python project (FreeRide) that will read and modify ~/.openclaw/openclaw.json, store state under your home directory, and require an OpenRouter API key. Before proceeding, ask the publisher to explain: (1) why FreeRide files are bundled with a ClawdHub skill, (2) which files are actually installed/run when you 'npm i -g clawdhub', and (3) provide the source for the npm package and the exact install/run flow. If you must test, do so in an isolated environment (VM/container) and inspect activator/extract shell scripts, the watcher/daemon code, and any network endpoints (openrouter.ai). Verify the npm package on the official registry and prefer packages with a clear single-purpose source repo. If you want only the ClawdHub CLI, fetch and review the official 'clawdhub' npm package directly rather than installing this mixed bundle.
Capability Analysis
Type: OpenClaw Skill
Name: hi
Version: 1.0.0
The skill is designed for agent self-improvement and free AI model management, which are benign goals. However, the `scripts/extract-skill.sh` file, intended for creating new skill scaffolds, accepts an `--output-dir` argument without sufficient sanitization. If an AI agent were to be maliciously prompted (prompt injection) to execute this script with a sensitive or arbitrary path for `--output-dir`, it could lead to unauthorized file writes, potentially resulting in remote code execution or data corruption. This represents a significant vulnerability, classifying the skill as 'suspicious' rather than 'malicious' due to the lack of clear evidence of intentional harmful behavior within the script itself.
Capability Assessment
Purpose & Capability
Registry/SKILL.md describe a ClawdHub CLI (npm package 'clawdhub') and list only the 'clawdhub' binary, but the bundle includes a full Python project (FreeRide) with main.py, watcher.py, many assets, and skill.json for a 'freeride' skill. The declared install (npm clawdhub) does not explain the large Python codebase, duplicated files, or multiple _meta.json entries with different slugs. This is incoherent: either unrelated code was bundled, or the metadata is incorrect.
Instruction Scope
The SKILL.md provided is just usage for the ClawdHub CLI (no file reads). However, included runtime code (main.py, watcher.py) explicitly reads/writes the user's OpenClaw config at ~/.openclaw/openclaw.json, reads OPENROUTER_API_KEY (env or config), writes cache/state files under ~/.openclaw, and makes network calls to openrouter.ai. Those behaviors are outside what the ClawdHub CLI usage would suggest and are not described in the SKILL.md visible to the agent.
Install Mechanism
The declared install is an npm package 'clawdhub' which is a reasonable, traceable mechanism. However, the package contents include Python scripts and shell scripts (activator.sh, extract-skill.sh) and many duplicated files; it's unclear how/if those Python files are installed or executed by the npm package. The presence of shell extractor/activator scripts increases risk because they can run arbitrary commands or install additional components.
Credentials
The registry metadata lists no required env vars, yet the included project (skill.json and code) requires OPENROUTER_API_KEY and will look in env or ~/.openclaw/openclaw.json for credentials. The bundle will access and modify user config files under ~/.openclaw, meaning it needs credential/config access that is not declared in the top-level requirements — a mismatch and a potential privacy/security concern.
Persistence & Privilege
The Python code writes persistent state and config under the user's home (~/.openclaw/.freeride-cache.json, .freeride-watcher-state.json, and modifies openclaw.json). It also includes a watcher/daemon mode that can run continuously. While 'always' is false, the ability to persistently modify OpenClaw configuration and run a background watcher is significant and not represented by the ClawdHub-only description.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install hi - After installation, invoke the skill by name or use
/hi - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
hi
Metadata
Frequently Asked Questions
What is Tsz?
Use the ClawdHub CLI to search, install, update, and publish agent skills from clawdhub.com. Use when you need to fetch new skills on the fly, sync installed... It is an AI Agent Skill for Claude Code / OpenClaw, with 705 downloads so far.
How do I install Tsz?
Run "/install hi" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Tsz free?
Yes, Tsz is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Tsz support?
Tsz is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Tsz?
It is built and maintained by roman181 (@roman181); the current version is v1.0.0.
More Skills