← 返回 Skills 市场

Clawhub Rate Limited Publisher Fixed

Name: Clawhub Rate Limited Publisher Fixed
Author: 52yuanchangxing

作者 vx：17605205782 · GitHub ↗ · v1.0.0 · MIT-0

darwinlinux ⚠ suspicious

263

总下载

当前安装

版本数

在 OpenClaw 中安装

/install clawhub-rate-limited-publisher-fixed

功能描述

Queue and publish local skills to ClawHub with a strict 5-per-hour cap using the local clawhub CLI and host scheduler.

使用说明 (SKILL.md)

ClawHub Rate Limited Publisher

Use this skill when the user wants to publish one or more local skills to ClawHub without exceeding the platform's publish cap.

What this skill does

This skill does not magically grant shell permissions. It provides a safe local queue + scheduler workflow around the user's own clawhub CLI.

Follow this procedure:

Verify the skill folder exists and contains SKILL.md.
Build or update a queue JSON file.
Ask the host to run the helper script from {baseDir}/scripts/clawhub_rate_limited_uploader.py.
Prefer a host scheduler such as cron or systemd timer so uploads happen automatically every 12 minutes.
Never exceed 5 publish attempts in any rolling 3600-second window.
Log stdout/stderr for each attempt and mark queue items as published or failed.

Required runtime conditions

clawhub must already be installed and authenticated on the host.
The host must allow command execution. In OpenClaw this usually means enabling runtime tools such as bash/exec, or running the Python script directly outside chat.
New sessions may be required after changing skill/config state because eligible skills are snapshotted per session.

Recommended invocation patterns

One-off manual run

Run:

python3 "{baseDir}/scripts/clawhub_rate_limited_uploader.py" --queue "/absolute/path/to/queue.json" --execute

Dry run

Run:

python3 "{baseDir}/scripts/clawhub_rate_limited_uploader.py" --queue "/absolute/path/to/queue.json" --dry-run

Cron schedule

Run every 12 minutes using the example in {baseDir}/resources/cron.example.

Queue file shape

See {baseDir}/examples/queue.sample.json.

Each item may contain:

path: absolute path to one skill directory
command: optional command template, default clawhub publish "{path}"

Safety rules

Use absolute paths.
Do not use curl|bash, base64 piping, or hidden remote installers.
Keep command limited to the local clawhub publish "{path}" pattern unless the user explicitly audits and accepts a custom command.
Count failures toward the hourly cap to avoid hammering ClawHub when auth or validation is broken.

安全使用建议

This package appears to do what it says: it provides a local Python script to enqueue and rate-limit clawhub publish attempts. Before running it: 1) verify clawhub is installed and authenticated on your host; 2) inspect and control the queue JSON file(s) — any custom item.command you include will be executed by the shell, so do not point the queue at untrusted files or commands; 3) run a dry-run first (--dry-run) to confirm the command printed is what you expect; 4) place the queue and state files in a directory you control and monitor the .publisher-state.json and logs; 5) schedule via cron/systemd as recommended if you want automation. If you cannot confidently guarantee the integrity of the queue file or the host environment, do not enable automated execution.

功能分析

Type: OpenClaw Skill Name: clawhub-rate-limited-publisher-fixed Version: 1.0.0 The skill provides a utility to manage and rate-limit the publishing of local skills to ClawHub. It is classified as suspicious because the core execution script, scripts/clawhub_rate_limited_uploader.py, uses subprocess.run(shell=True) with string formatting on inputs from a JSON queue file, creating a shell injection vulnerability. While the instructions in SKILL.md and README.md describe a legitimate workflow and include safety warnings, the technical implementation lacks input sanitization for shell commands, which could be exploited if a malicious queue file is processed.

能力评估

✓ Purpose & Capability

Name/description, required binaries (python3, clawhub), SKILL.md instructions, and the included Python script all align: a local tool to queue and rate-limit clawhub publish commands. There are no unrelated credentials, binaries, or config paths requested.

⚠ Instruction Scope

SKILL.md confines behavior to preparing a queue and asking the host to run the included script; the script enforces presence of SKILL.md in target directories and keeps state/logs. However, the script accepts a per-item 'command' template from the queue JSON and executes it with subprocess.run(..., shell=True). Although the default command is 'clawhub publish "{path}"' and the docs advise limiting commands, a compromised or malicious queue file could cause arbitrary shell execution. The script does not access environment variables beyond normal process env nor phone home to external endpoints.

✓ Install Mechanism

Instruction-only with an included script; there is no install step, no downloads or external installers. No elevated install risks are present.

✓ Credentials

The skill requests no environment variables or secrets. It requires the host have the clawhub CLI installed and authenticated, which is proportional to the purpose.

✓ Persistence & Privilege

always is false; the skill does not request permanent platform presence or modify other skills. It writes local state and logs next to the queue file (expected for this use).

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install clawhub-rate-limited-publisher-fixed
安装完成后，直接呼叫该 Skill 的名称或使用 /clawhub-rate-limited-publisher-fixed 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

- Initial release of clawhub-rate-limited-publisher. - Queue and publish local skills to ClawHub with a strict limit of 5 publishes per hour. - Integrates with the local clawhub CLI and host scheduler (e.g., cron or systemd). - Provides a safe queue/runner and logs all publish attempts, marking them as published or failed. - Enforces safety rules for command execution and counts failed attempts toward the hourly limit.

元数据

Slug clawhub-rate-limited-publisher-fixed

版本 1.0.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 1

常见问题