← Back to Skills Marketplace
clawhub-skill-install
by
z448577223
· GitHub ↗
· v1.0.0
· MIT-0
376
Downloads
0
Stars
1
Active Installs
1
Versions
Install in OpenClaw
/install clawhub-skill-install
Description
Automatically install skills from ClawHub with retry logic. Handles rate limits (waits 10s and retries), auto-confirms prompts (--force), and stops after 30...
README (SKILL.md)
ClawHub Skill 安装工具
使用方式
当用户提供具体 skill 名称时，执行以下脚本：
bash /Users/jaredszhang/.openclaw/workspace/skills/clawhub-install/scripts/install_skill.sh \x3Cskill-name>
功能特性
- 自动重试: 遇到速率限制（Rate limit）时，等待 10 秒后自动重试
- 自动确认: 遇到确认提示（--force）时，自动输入 "yes"
- 持续重试: 持续尝试安装，直到成功
- 超时保护: 如果连续尝试 30 分钟仍不成功，停止并输出提示信息
脚本逻辑
- 使用
clawhub install \x3Cskill-name> --force进行安装 - 捕获输出中的错误信息判断类型：
- 包含 "Rate limit" → 等待 10 秒后重试
- 包含 "flagged as suspicious" → 使用 --force 参数重试
- 其他错误 → 停止并报告
- 记录尝试次数和耗时
- 30 分钟（1800 秒）后强制退出
Usage Guidance
This skill mostly does what it says (automatically retries a 'clawhub install'), but there are three issues to consider before installing:
- The metadata fails to declare that the 'clawhub' CLI is required; ensure you have and trust that binary before running the script.
- SKILL.md points to an absolute path in /Users/jaredszhang/... — update the instruction to use the bundled script path (relative) or verify the path on your machine. Running absolute, user-specific paths can cause unexpected execution of local files.
- The script forces installs (--force) and keeps retrying even when a skill is 'flagged as suspicious'. That behavior can bypass safety signals. If you plan to use this, run it manually first for a test skill, inspect the scripts and the 'clawhub' behavior, or disable autonomous execution so you can approve each install. If you do proceed, run inside a sandbox or test environment and prefer installing from trusted sources only.
Capability Analysis
Type: OpenClaw Skill
Name: clawhub-skill-install
Version: 1.0.0
The skill is designed to automate the installation of other skills while explicitly bypassing security warnings using the `--force` flag, even when an installation is 'flagged as suspicious' (scripts/install_skill.sh). This behavior encourages the automated deployment of potentially untrusted code without human oversight. Additionally, SKILL.md contains a hardcoded absolute path specific to a single user's environment (/Users/jaredszhang/...), which is a significant functional flaw.
Capability Assessment
Purpose & Capability
The skill claims to install ClawHub skills, which is consistent with the included script that runs 'clawhub install'. However the package metadata declares no required binaries while the runtime requires the 'clawhub' CLI. That mismatch is incoherent and will cause failure or surprise at runtime.
Instruction Scope
SKILL.md instructs the agent to execute a script at an absolute path (/Users/jaredszhang/.openclaw/...), which embeds a specific developer/user home path rather than a relative or bundled path; this is brittle and could cause the agent to execute a different local file or fail. The instructions themselves do not read unrelated files or exfiltrate secrets, but the absolute path is a portability and supply-chain risk.
Install Mechanism
There is no network download or package install step in the skill bundle itself — it's instruction-only with a small included shell script. That is low-risk compared to arbitrary downloads. The script is simple and self-contained (no obfuscated code).
Credentials
The skill requests no environment variables or credentials, which is reasonable, but it implicitly requires the 'clawhub' CLI and does not declare it. More importantly, the script auto-uses '--force' and explicitly continues to retry even when the installer output contains 'flagged as suspicious', which means it will attempt to override safeguards and repeatedly install items that the ecosystem flagged as suspicious. That behavior is disproportionate and risky.
Persistence & Privilege
The skill does not request permanent/always-on presence, does not modify other skills' configurations, and does not attempt to persist credentials or change global agent settings. Its runtime actions are limited to invoking the 'clawhub' CLI.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install clawhub-skill-install - After installation, invoke the skill by name or use
/clawhub-skill-install - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
# ClawHub Skill Install
Automatically install skills from ClawHub with retry logic.
## Features
- Handles rate limits (waits 10s and retries)
- Auto-confirms prompts (--force)
- 30-minute timeout protection
- Logs attempts and elapsed time
## Usage
When user provides a skill name, run:
bash /path/to/scripts/install_skill.sh <skill-name>
Metadata
Frequently Asked Questions
What is clawhub-skill-install?
Automatically install skills from ClawHub with retry logic. Handles rate limits (waits 10s and retries), auto-confirms prompts (--force), and stops after 30... It is an AI Agent Skill for Claude Code / OpenClaw, with 376 downloads so far.
How do I install clawhub-skill-install?
Run "/install clawhub-skill-install" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is clawhub-skill-install free?
Yes, clawhub-skill-install is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does clawhub-skill-install support?
clawhub-skill-install is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created clawhub-skill-install?
It is built and maintained by z448577223 (@z448577223); the current version is v1.0.0.
More Skills