← Back to Skills Marketplace
douglarek

clawhub

by douglarek · GitHub ↗ · v1.0.1 · MIT-0
cross-platform ⚠ suspicious
253
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install clawhub-wrapper
Description
Download and install skills from ClawHub (https://clawhub.ai). Use when user wants to browse, search, or download skills from the ClawHub skill registry.
README (SKILL.md)

ClawHub Skill

Download and install skills from ClawHub - a fast skill registry for AI agents.

Commands

Search Skills

Search for skills by keyword:

{baseDir}/clawhub-search.sh "\x3Ckeyword>"

This searches the ClawHub registry and displays matching skills with their slug, name, summary, and download count.

Download and Install Skill

Download and install a skill by slug or ClawHub URL:

# By slug
{baseDir}/clawhub-download.sh \x3Cslug>

# By ClawHub URL (e.g., https://clawhub.ai/steipete/github)
{baseDir}/clawhub-download.sh https://clawhub.ai/owner/slug

This will:

  1. Download the skill package from ClawHub
  2. Extract it to ~/.agents/skills/clawhub-skills/\x3Cslug>/
  3. Display the installed skill information

List Skills

Browse available skills (sorted by downloads):

{baseDir}/clawhub-search.sh

API Endpoints

ClawHub uses the following API endpoints:

  • List/Search Skills: https://wry-manatee-359.convex.site/api/v1/skills
  • Download Skill: https://wry-manatee-359.convex.site/api/v1/download?slug=\x3Cslug>

Examples

User says: "I want to download the github skill from clawhub" → Use clawhub-download.sh github

User says: "Search for weather related skills on clawhub" → Use clawhub-search.sh "weather"

User says: "Install https://clawhub.ai/steipete/summarize" → Use clawhub-download.sh https://clawhub.ai/steipete/summarize

User says: "What skills are popular on clawhub?" → Use clawhub-search.sh to list top skills by downloads

Usage Guidance
This skill implements a registry search/download tool, but it downloads skill ZIPs from an unexpected third-party host (wry-manatee-359.convex.site) rather than the public clawhub.ai domain and does not verify signatures or checksums. Installing will copy whatever is in those ZIPs into ~/.agents/skills so the agent may later execute them. Before installing: (1) confirm the API host is legitimate (ask the publisher or verify DNS/TLS ownership for clawhub.ai vs convex.site), (2) prefer installers that use verified release hosts or cryptographic signatures, (3) inspect downloaded packages manually before copying them into your skills directory, or run the downloader inside a sandbox/container, and (4) if you need stronger assurance, request that the skill be updated to verify checksums or signatures and to use the official ClawHub API/host. If you do not trust the remote host or cannot validate provenance, do not install.
Capability Analysis
Type: OpenClaw Skill Name: clawhub-wrapper Version: 1.0.1 The skill acts as a package manager that downloads and installs unverified third-party code from an external API (wry-manatee-359.convex.site) into the agent's environment. The 'clawhub-download.sh' script lacks any integrity verification (e.g., checksums or signatures) and contains a path traversal vulnerability when parsing slugs from URLs, which could allow writing files to unauthorized locations. While these behaviors align with the stated purpose of a skill registry wrapper, the lack of security controls and the capability to fetch arbitrary remote payloads present a significant security risk.
Capability Assessment
⚠ Purpose & Capability
Name/description match the included scripts: the two bash scripts implement searching and downloading skills and installing them to ~/.agents/skills/clawhub-skills/<slug>. However, the SKILL.md and scripts use an API host (https://wry-manatee-359.convex.site) rather than the public site name (clawhub.ai). Requesting to download and install arbitrary skill packages is functionally consistent with a 'registry downloader' but the unexpected API domain and lack of provenance/verification is disproportionate to the stated purpose and warrants caution.
⚠ Instruction Scope
Runtime instructions and the scripts perform network fetches, validate the ZIP format superficially, then extract and copy all files into the agent's skills directory (~/.agents/skills/...), thereby installing arbitrary code that the agent may later execute. The scripts do not verify signatures, checksums, or any publisher identity and do not restrict which files can be installed. They do not read unrelated system credentials, but they grant execution capability to remote-provided code.
⚠ Install Mechanism
There is no platform install spec, but the included downloader script performs a direct curl download from a third-party convex.site subdomain and extracts the archive locally. The download URL is not a well-known release host (e.g., GitHub releases) and the archive is extracted without cryptographic verification—this is a higher-risk install pattern (remote archive -> local extraction -> execution potential).
✓ Credentials
The skill does not request environment variables, credentials, or config paths beyond writing to ~/.agents/skills. It also checks for required local binaries (curl, unzip, jq) before running. No unrelated secrets are requested.
ℹ Persistence & Privilege
The skill is not always-enabled and does not modify other skills. It installs packages into the user's skill directory, which is normal for an installer but gives installed skills persistent presence and the same runtime privileges as other skills—those installed packages could be executed autonomously by the agent (default behavior).
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install clawhub-wrapper
  3. After installation, invoke the skill by name or use /clawhub-wrapper
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.1
- Improved documentation for searching, downloading, and installing skills from ClawHub. - Added example user prompts and corresponding commands. - Detailed the API endpoints used for skill search and download. - Clarified command usage for skill listing, searching, and installation by both slug and URL.
Metadata
Slug clawhub-wrapper
Version 1.0.1
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is clawhub?

Download and install skills from ClawHub (https://clawhub.ai). Use when user wants to browse, search, or download skills from the ClawHub skill registry. It is an AI Agent Skill for Claude Code / OpenClaw, with 253 downloads so far.

How do I install clawhub?

Run "/install clawhub-wrapper" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is clawhub free?

Yes, clawhub is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does clawhub support?

clawhub is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created clawhub?

It is built and maintained by douglarek (@douglarek); the current version is v1.0.1.

More Skills
self-improving agent
Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau...
⬇ 463283 · by pskoett
Skill Vetter
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
⬇ 259410 · by spclaudehome
Polymarket
Query Polymarket prediction markets. Check odds, find trending markets, search events, track price movements.
⬇ 232503 · by joelchance
Self-Improving + Proactive Agent
Self-reflection + Self-criticism + Self-learning + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when...
⬇ 200423 · by ivangdavila
Github
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
⬇ 191115 · by steipete
ontology
Typed knowledge graph for structured agent memory and composable skills. Use when creating/querying entities (Person, Project, Task, Event, Document), linkin...
⬇ 190156 · by oswalpalash

💬 Comments