← 返回 Skills 市场

clawhub-deployer — Skill Publishing Assistant

Name: clawhub-deployer — Skill Publishing Assistant
Author: futurizerush

作者 Futurize Rush · GitHub ↗ · v1.0.0 · MIT-0

cross-platform ✓ 安全检测通过

总下载

当前安装

版本数

在 OpenClaw 中安装

/install clawhub-deployer

功能描述

Publish a skill to ClawHub registry. Use when user asks to publish, release, or deploy a skill to ClawHub.

使用说明 (SKILL.md)

Publish Skill to ClawHub

Validate, prepare, and publish a skill to the ClawHub registry.

When to Trigger

User asks to publish / release / deploy a skill to ClawHub
User mentions clawhub publish or publish skill

Workflow

Step 1: Validate SKILL.md

Check that the target folder contains a valid SKILL.md:

ls TARGET_DIR/SKILL.md
head -20 TARGET_DIR/SKILL.md

Required frontmatter fields:

name — lowercase + hyphens, must match ^[a-z0-9][a-z0-9-]*$
description
version — semver format

Recommended fields for cross-platform compatibility:

allowed-tools — for Claude Code
metadata.openclaw.requires.env — required environment variables
metadata.openclaw.requires.bins — required binaries

Step 2: Check files

ClawHub only accepts text files: .md, .py, .txt, .json, .yaml, .toml, .js, .ts, .svg.

Must exclude:

Images: *.png, *.jpg, *.jpeg, *.gif, *.ico
Git: .git/, .gitignore
License: LICENSE (ClawHub enforces MIT-0 for all skills)
Environment: .env, .DS_Store

Step 3: Prepare publish folder

Create a folder with only text files:

mkdir -p TARGET_DIR/clawhub-publish
cp TARGET_DIR/SKILL.md TARGET_DIR/*.py TARGET_DIR/*.md TARGET_DIR/*.txt clawhub-publish/
cp -r TARGET_DIR/docs clawhub-publish/docs 2>/dev/null || true

Add clawhub-publish/ to .gitignore to keep the GitHub repo clean.

Step 4: Login

npx clawhub@latest whoami 2>&1 || npx clawhub@latest login

Step 5: Publish

npx clawhub@latest publish TARGET_DIR/clawhub-publish/ \
  --slug SLUG \
  --name "DISPLAY_NAME" \
  --version VERSION \
  --changelog "CHANGELOG" \
  --tags latest

SLUG: globally unique, lowercase + hyphens
DISPLAY_NAME: human-readable name, can include spaces
VERSION: semver (e.g. 1.0.0)
CHANGELOG: use Initial release. for first publish

Step 6: Verify

npx clawhub@latest inspect SLUG

Error Handling

Error	Fix
`Slug is required`	Add `--slug` parameter
`Taken`	Choose a different slug
`GitHub API rate limit`	Wait for reset (usually 10–60 seconds), then retry
`Remove non-text files`	Go back to Step 3, ensure only text files are included
`SKILL.md is required`	Confirm SKILL.md exists inside the publish folder

SKILL.md Template

---
name: my-skill
description: One-line description of what this skill does.
version: 1.0.0
allowed-tools: Bash, Write, Read
metadata:
  openclaw:
    requires:
      env: [MY_API_KEY]
      bins: [python3]
    primaryEnv: MY_API_KEY
    emoji: "🔧"
    homepage: https://github.com/USER/REPO
    os: [macos, linux, windows]
---

# Skill Title

What this skill does.

## When to Trigger
- Trigger condition 1
- Trigger condition 2

## Usage
(Instructions for the AI on how to invoke the skill)

## Environment
(How to obtain and configure required API keys)

## Errors
(Common errors and fixes)

安全使用建议

This skill is largely coherent for publishing to ClawHub, but check a few things before using it: ensure the agent environment has Node.js/npm available (the SKILL.md uses npx but the skill metadata doesn't declare that); prefer pinning a specific clawhub CLI version rather than `@latest` to reduce supply-chain risk; review the files that will be copied to confirm no secrets (API keys, .env contents, or private credentials) are included in the publish folder; be aware the workflow recommends removing LICENSE files because ClawHub enforces MIT-0 — make sure you understand and accept that license change before publishing. If you want higher assurance, run the npx commands manually or inspect the npm package source (https://www.npmjs.com/package/clawhub) before letting an agent invoke them.

功能分析

Type: OpenClaw Skill Name: clawhub-deployer Version: 1.0.0 The skill provides a legitimate workflow for publishing OpenClaw skills to the ClawHub registry. It includes security-positive steps in SKILL.md, such as explicitly excluding sensitive files like .env, .git, and .DS_Store from the publishing directory. The use of npx clawhub@latest is consistent with the tool's stated purpose, and no evidence of data exfiltration, malicious execution, or harmful prompt injection was found.

能力评估

ℹ Purpose & Capability

The name/description match the instructions (validate SKILL.md, prepare a text-only folder, run npx clawhub publish). However the SKILL.md invokes npx (Node.js/npm) and standard shell utilities (cp, mkdir, ls, head) but the skill metadata does not declare any required binaries — a small coherence gap.

✓ Instruction Scope

Runtime instructions are narrowly scoped to preparing a publish folder, logging in, and invoking the ClawHub CLI. They do not request reading unrelated system files or exfiltrating data. They explicitly exclude .env and other non-text files.

ℹ Install Mechanism

There is no install spec (instruction-only). The workflow uses `npx clawhub@latest`, which will fetch code from npm at runtime — a normal choice for a CLI but introduces standard supply-chain risk (using the `@latest` tag means the fetched package can change over time). No arbitrary URLs or archives are used.

✓ Credentials

The skill does not request environment variables, config paths, or credentials in its metadata. The login step uses the ClawHub CLI (interactive or token-based), which reasonably requires authentication but is not declared as an env variable here — acceptable but worth documenting.

✓ Persistence & Privilege

The skill is not always-enabled and requests no system-wide persistence or privileged access. It does not modify other skills' configs or require elevated privileges.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install clawhub-deployer
安装完成后，直接呼叫该 Skill 的名称或使用 /clawhub-deployer 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release.

元数据

Slug clawhub-deployer

版本 1.0.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 1

常见问题