功能描述

Use the ClawdHub CLI to search, install, update, and publish agent skills from clawdhub.com. Use when you need to fetch new skills on the fly, sync installed skills to latest or a specific version, or publish new/updated skill folders with the npm-installed clawdhub CLI.

使用说明 (SKILL.md)

ClawdHub CLI

Name: Clawdhub Copy
Author: jk50505k

Install

npm i -g clawdhub

Auth (publish)

clawdhub login
clawdhub whoami

Search

clawdhub search "postgres backups"

Install

clawdhub install my-skill
clawdhub install my-skill --version 1.2.3

Update (hash-based match + upgrade)

clawdhub update my-skill
clawdhub update my-skill --version 1.2.3
clawdhub update --all
clawdhub update my-skill --force
clawdhub update --all --no-input --force

List

clawdhub list

Publish

clawdhub publish ./my-skill --slug my-skill --name "My Skill" --version 1.2.0 --changelog "Fixes + docs"

Notes

Default registry: https://clawdhub.com (override with CLAWDHUB_REGISTRY or --registry)
Default workdir: cwd (falls back to Clawdbot workspace); install dir: ./skills (override with --workdir / --dir / CLAWDHUB_WORKDIR)
Update command hashes local files, resolves matching version, and upgrades to latest unless --version is set

安全使用建议

This instruction-only skill is internally consistent for managing a ClawdHub CLI, but it enables the agent to download and install third‑party skills and to upload local skill folders to an external registry. Before installing or giving the agent permission to use it: 1) Verify the ClawdHub CLI package and registry (is https://clawdhub.com legitimate and trusted?). 2) Avoid global installs as an elevated user; prefer sandboxed environments. 3) Require explicit user confirmation before any 'install', 'update', or 'publish' operation — these actions can execute code or exfiltrate files. 4) Review downloaded skill code before enabling it and restrict agent autonomy if you do not want it installing packages without human approval.

功能分析

Type: OpenClaw Skill Name: clawdhub-copy Version: 1.0.0 The skill's primary function is to install the `clawdhub` CLI via `npm i -g clawdhub` as instructed in `SKILL.md`'s metadata. This command downloads and executes code from the npm registry. The `clawdhub` CLI then manages other skills by fetching them from `clawdhub.com`. While the skill itself does not exhibit explicit malicious intent, its core functionality involves broad remote code execution capabilities and creates a significant supply chain risk, as a compromise of the `clawdhub` npm package or the `clawdhub.com` registry could lead to the installation and execution of malicious code.

能力评估

✓ Purpose & Capability

Name/description match the instructions: the SKILL.md documents installing and using an npm-installed 'clawdhub' CLI to search, install, update, list, and publish skills. Declared binaries and the suggested npm install are proportionate to that purpose.

⚠ Instruction Scope

Instructions include 'clawdhub install' (downloads and places remote skill code into a workdir) and 'clawdhub publish ./my-skill' (uploads local skill folders). Those operations can cause code execution (installing new skills) or data exfiltration (publishing local files). SKILL.md also notes defaults (cwd, ./skills) which could cause the agent to operate on the current workspace without explicit user confirmation. There is no guidance about verifying downloaded skill provenance or signing.

ℹ Install Mechanism

No install spec in the skill bundle (instruction-only), but SKILL.md recommends 'npm i -g clawdhub' (standard npm registry mechanism). Using npm is typical and traceable, but global npm installs affect the host environment and pull arbitrary package code from the registry.

✓ Credentials

The skill does not require extra environment variables or credentials in the manifest. SKILL.md mentions optional overrides (CLAWDHUB_REGISTRY, CLAWDHUB_WORKDIR) and uses interactive 'clawdhub login' for publishing; the requested privileges are consistent with a package manager CLI. No unrelated credentials are requested.

⚠ Persistence & Privilege

always is false, but autonomous invocation is allowed (default). Because the skill enables the agent to fetch and install arbitrary third-party skills at runtime, its use can expand the agent's capabilities and attack surface. Publishing also lets the agent send local folders to an external registry. Those powers increase blast radius if the agent is allowed to act without explicit human confirmation.

版本历史

v1.0.0

- Initial release of the ClawdHub CLI skill. - Search, install, update, list, and publish agent skills from clawdhub.com directly via CLI commands. - Supports syncing installed skills to latest or specific versions. - Integrates publish workflow with authentication using clawdhub login. - Registry and working directory can be customized with environment variables or flags.

元数据

Slug clawdhub-copy

版本 1.0.0

许可证 —

累计安装 4

当前安装数 4

历史版本数 1

常见问题

Clawdhub Copy 是什么？

Use the ClawdHub CLI to search, install, update, and publish agent skills from clawdhub.com. Use when you need to fetch new skills on the fly, sync installed skills to latest or a specific version, or publish new/updated skill folders with the npm-installed clawdhub CLI. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 1858 次。

如何安装 Clawdhub Copy？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install clawdhub-copy」即可一键安装，无需额外配置。

Clawdhub Copy 是免费的吗？

是的，Clawdhub Copy 完全免费（开源免费），可自由下载、安装和使用。

Clawdhub Copy 支持哪些平台？

Clawdhub Copy 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Clawdhub Copy？

由 jk50505k（@jk50505k）开发并维护，当前版本 v1.0.0。

Clawdhub Copy