← 返回 Skills 市场

ClawHub Publisher

Name: ClawHub Publisher
Author: bg1avd

作者 Rao Lin · GitHub ↗ · v1.0.0 · MIT-0

cross-platform ⚠ suspicious

265

总下载

当前安装

版本数

在 OpenClaw 中安装

/install clawhub-publisher-auto

功能描述

Automated skill publishing to ClawHub. Fix push error issue with acceptLicenseTerms support

使用说明 (SKILL.md)

ClawHub Publisher

Version: 1.0.0
Author: Midas Skills
License: MIT

Description

Automated skill publishing to ClawHub. Version management, changelog generation, asset bundling, one-command deploy.

Value Proposition

Automated skill publishing to ClawHub. Version management, changelog generation, asset bundling, instant deployment.

Skill Type

developer-tool

Pricing

Free: $0
Pro: $59.99

Key Features

✅ One-command skill publishing
✅ Automatic version bumping (major/minor/patch)
✅ Git-powered changelog generation
✅ Multi-file asset bundling
✅ Metadata validation
✅ README optimization
✅ Gumroad link injection
✅ Publishing history & rollback
✅ Skill analytics
✅ Team collaboration support
✅ CI/CD integration (GitHub Actions, etc.)

Use Cases

Automatic skill versioning & deployment
One-command publish workflow
Changelog auto-generation
Multi-file asset bundling
Gumroad integration & upsell linking
Skill stats & analytics dashboard
Rolling back bad deployments
Team publishing workflows

Installation

npm install clawhub-publisher
# or
pip install clawhub-publisher

Quick Start

const Publisher = require('clawhub-publisher');

const publisher = new Publisher({
  apiKey: process.env.CLAWHUB_API_KEY,
  author: 'Your Name',
  gumroadLink: 'https://gumroad.com/your-product'
});

const result = await publisher.publish({
  skillPath: './my-skill',
  version: '1.0.0',
  changelog: 'Initial release with core features'
});

console.log('Published to:', result.clawHubUrl);

Repository

https://github.com/midas-skills/clawhub-publisher

Support

📧 [email protected]
🔗 Docs: https://docs.midas-skills.com/clawhub-publisher

安全使用建议

This bundle looks like documentation for a publisher tool rather than a self-contained implementation. Before installing or running anything: (1) Do not supply your CLAWHUB_API_KEY (or other secrets) to an untrusted skill or agent; verify you trust the package/source. (2) Confirm the upstream package (https://github.com/midas-skills/clawhub-publisher and the package on npm/pypi) actually exists and review its code—package.json here references index.js and bin/cli.js but those files are not included in this bundle. (3) Be aware the tool will read skill directories and git history and will modify files (e.g., README injection), so run it in a controlled workspace or use dry-run mode first. (4) Prefer running publishing actions manually or in CI with scoped credentials/secrets and least privilege. If you plan to let an agent invoke this autonomously, ensure it cannot access unrelated files or secrets and that you trust the external package maintainer.

功能分析

Type: OpenClaw Skill Name: clawhub-publisher-auto Version: 1.0.0 The ClawHub Publisher skill is a developer tool designed to automate the versioning, bundling, and deployment of OpenClaw skills to the clawhub.ai registry. The bundle consists of documentation and metadata (SKILL.md, README.md, package.json) that describe legitimate functionality such as Git-powered changelog generation, CI/CD integration, and a 'Gumroad link injection' feature for monetization. No evidence of malicious intent, data exfiltration, or prompt injection was found; the tool's capabilities are consistent with its stated purpose as a publishing utility.

能力评估

⚠ Purpose & Capability

The skill claims to automate publishing to ClawHub (which reasonably requires an API key and network access). However, the skill metadata declares no required environment variables or credentials even though the README/SKILL.md examples repeatedly reference CLAWHUB_API_KEY and CLI login tokens. package.json declares a bin and main entry (index.js, bin/cli.js) but those code files are not present in the bundle. It's plausible this is an instruction-only wrapper around an external package, but the missing code and undeclared secrets are incoherent with the stated purpose.

⚠ Instruction Scope

SKILL.md instructs reading skill directories, package.json, git commit history (auto-changelog), modifying README (Gumroad link injection), bundling assets, and making network calls to ClawHub (publish, getStats, history). Those actions are within a publisher's scope, but the instructions also rely on environment variables (CLAWHUB_API_KEY) and on installing an external package. The instructions do not explicitly restrict which filesystem paths to read; they imply reading arbitrary skillPath directories and git history, which is expected for a publisher but means the agent would access local files and commit history. The documentation does not declare the needed env vars or warn about scope of file access.

⚠ Install Mechanism

There is no platform install spec (lowest risk), but the README and SKILL.md instruct users/agents to 'npm install clawhub-publisher' or 'pip install clawhub-publisher' and to run 'npx clawhub-publisher'. Installing an external package from npm/pypi is potentially risky because it executes third-party code. Additionally, package.json is present but the actual implementation files (index.js, bin/cli.js) are missing from the provided bundle—this mismatch is an incoherence that increases risk because the documentation pushes installation of an external package that is not included for review.

⚠ Credentials

The skill bundle declares no required env vars, yet examples and CLI/GitHub Actions snippets clearly rely on CLAWHUB_API_KEY (and GitHub secrets). Requesting an API key for the publishing service is expected, but the platform metadata should declare that as a required/protected credential. The absence of declared required credentials and the presence of examples using secrets is disproportionate and makes it unclear what the skill will request at runtime.

✓ Persistence & Privilege

The skill is not set to always:true, does not declare required config paths, and has default model/autonomous invocation settings. It does not request permanent platform presence or attempt to modify other skills' configurations in the provided files. The main privilege risk comes from the instruction to install/run an external package and access local project files, not from persistent platform privileges.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install clawhub-publisher-auto
安装完成后，直接呼叫该 Skill 的名称或使用 /clawhub-publisher-auto 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

- Initial release of ClawHub Publisher. - Automates skill publishing to ClawHub with version management, changelog generation, and asset bundling. - Supports one-command deployment, metadata validation, and CI/CD integration. - Includes features like publishing history, rollback, Gumroad integration, analytics, and team collaboration. - Free and Pro pricing tiers available.

元数据

Slug clawhub-publisher-auto

版本 1.0.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 1

常见问题