← 返回 Skills 市场

ClawHub Publish Doctor

Name: ClawHub Publish Doctor
Author: bluebirdback

作者 BlueBirdBack ✨ · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

656

总下载

当前安装

版本数

在 OpenClaw 中安装

/install clawhub-publish-doctor

功能描述

Diagnose and mitigate ClawHub/ClawDHUB publish failures (auth, browser-login, missing dependencies, pending security-scan visibility errors, and wrong profil...

使用说明 (SKILL.md)

ClawHub Publish Doctor

Stabilize ClawHub publishing with preflight checks, safer publish commands, and post-publish verification that tolerates temporary registry states.

Quick workflow

Run preflight checks:
- scripts/clawhub_preflight.sh
If login/browser issues appear, follow references/error-map.md.
Publish with retry-aware verification:
- scripts/clawhub_publish_safe.sh \x3Cskill_path> \x3Cslug> \x3Cname> \x3Cversion> [changelog]
If inspect still fails, classify the error with references/error-map.md before escalating.

Standard commands

Preflight

bash scripts/clawhub_preflight.sh

Login (token-based, headless-safe)

clawhub login --token \x3Cclh_token>
clawhub whoami

Safe publish

bash scripts/clawhub_publish_safe.sh ./my-skill my-skill "My Skill" 1.0.0 "Initial release"

Manual inspect

clawhub inspect my-skill --json

Rules

Prefer token login in server/headless environments.
Treat inspect errors right after publish as potentially transient for a few minutes.
Verify with both CLI (clawhub inspect) and web URL (/skills/\x3Cslug>).
Use canonical URLs:
- Skill: https://clawhub.ai/skills/\x3Cslug>
- Owner/slug: https://clawhub.ai/\x3Chandle>/\x3Cslug>
- User profile (if available): https://clawhub.ai/users/\x3Chandle>

Resources

references/error-map.md: quick diagnosis for common failure signatures.
scripts/clawhub_preflight.sh: dependency + environment checks.
scripts/clawhub_publish_safe.sh: publish + retry verification wrapper.

安全使用建议

This package appears coherent and limited to helping with ClawHub publishes. Before running: (1) verify you have the official clawhub CLI installed (avoid unknown binaries), (2) keep your ClawHub token secret and use token login only in trusted environments, (3) review the small shell scripts yourself — they write temporary diagnostic files to /tmp and call clawhub commands but do not exfiltrate secrets, and (4) avoid running as an elevated user in shared systems. If you need higher assurance, test the scripts in an isolated environment first.

功能分析

Type: OpenClaw Skill Name: clawhub-publish-doctor Version: 1.0.0 The `scripts/clawhub_publish_safe.sh` file directly passes unsanitized user-controlled arguments (skill path, slug, name, version, changelog) to the `clawhub publish` command. This creates a potential command injection vulnerability if the `clawhub` CLI or the underlying environment is susceptible to shell injection via its arguments (e.g., if it internally uses `eval` or `system()` without proper escaping). While the script's stated purpose is benign (to publish skills), this lack of input sanitization represents a significant security risk, allowing for potential arbitrary command execution if exploited. There is no evidence of intentional malicious behavior such as data exfiltration or persistence.

能力评估

✓ Purpose & Capability

Name/description describe publish diagnostics; included scripts perform preflight checks (presence of clawhub/xdg-open/rg), instruct token-based login, run clawhub publish and clawhub inspect with retry — all coherent with the stated goal.

ℹ Instruction Scope

SKILL.md limits runtime actions to running the provided scripts and the clawhub CLI. The scripts write small diagnostic outputs to /tmp (whoami/publish outputs) and echo CLI results; this is within scope but worth noting if you run in a shared or highly-sensitive environment since temporary files are used.

✓ Install Mechanism

This is an instruction-only skill with two small shell scripts; there is no install spec, no downloads, and no archive extraction. No high-risk install behavior observed.

✓ Credentials

No required environment variables or credentials are declared. The workflow expects the user to supply a ClawHub token for `clawhub login --token <clh_token>` which is appropriate and proportional for publishing operations. Optional controls (MAX_RETRIES, SLEEP_SECONDS) are benign.

✓ Persistence & Privilege

The skill does not request permanent/forced inclusion (always:false), does not modify other skills or global agent settings, and has no autonomous persistence behavior beyond normal invocation.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install clawhub-publish-doctor
安装完成后，直接呼叫该 Skill 的名称或使用 /clawhub-publish-doctor 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial public release

元数据

Slug clawhub-publish-doctor

版本 1.0.0

许可证 —

累计安装 0

当前安装数 0

历史版本数 1

常见问题