← 返回 Skills 市场

ClawHub Web Only Publish

Name: ClawHub Web Only Publish
Author: dalomeve

作者 Dalomeve · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

418

总下载

当前安装

版本数

在 OpenClaw 中安装

/install clawhub-web-only-publish

功能描述

Publish skills to ClawHub via web dashboard only. No CLI login, no device flow. Reuse existing browser session.

使用说明 (SKILL.md)

ClawHub Web-Only Publish

Publish to ClawHub via web dashboard. No CLI login.

Problem

CLI login causes:

Auth loop failures
Token expiration issues
Device flow complexity
Session management overhead

Workflow

1. Prerequisites

Browser already logged in to https://clawhub.ai
Skill folder contains SKILL.md
No secrets in skill files

2. Web Publish Steps

Navigate to https://clawhub.ai/upload
Verify logged in (username visible)
Fill form:
- Slug: skill-name
- Display name: Skill Name
- Version: 1.0.0
Click "Choose folder" -> Select skill directory
Wait for validation (SKILL.md recognized)
(Optional) Add changelog
Click "Publish skill"
Capture result URL

3. Fallback (No CLI Login)

If browser upload fails:

Use existing CLI token (if already authenticated)
Run: clawhub publish \x3Cpath> --version 1.0.0
Do NOT run clawhub login

Executable Completion Criteria

Criteria	Verification
Skill URL accessible	Navigate to URL, 200 OK
Name matches SKILL.md	Frontmatter name = listing name
Version correct	URL shows v1.0.0
No CLI login used	No `clawhub login` in history

Privacy/Safety

No credentials in skill files
Scan for apiKey/token/secret before publish
Use relative paths only

Self-Use Trigger

Use when:

Publishing any skill to ClawHub
CLI login fails or unavailable
Browser session already active

Web first. No login loops.

安全使用建议

This skill is coherent with its stated purpose (manual web upload to ClawHub). Before using it: 1) Ensure your browser session on https://clawhub.ai is legitimate and not a shared account. 2) Do not upload files containing API keys, tokens, or secrets — the SKILL.md advises scanning but you should confirm manually. 3) Be cautious about the fallback: if you use `clawhub publish` it will rely on an existing CLI token — verify where that token is stored (CLI config or environment) and avoid granting the agent blanket read access to config or shell history. 4) If you want the agent to perform the publish automatically, explicitly limit which local files it may read; otherwise perform the browser steps yourself. If you want greater assurance, ask the skill author to clarify how the CLI token is obtained and to remove or clarify the 'history' verification criterion.

功能分析

Type: OpenClaw Skill Name: clawhub-web-only-publish Version: 1.0.0 The skill is classified as suspicious due to the instruction in SKILL.md to 'Scan for apiKey/token/secret before publish'. While framed as a 'Privacy/Safety' measure, this instruction grants the AI agent the capability to read and parse the contents of skill files for sensitive patterns. This represents a significant privilege and a potential vulnerability surface, as it involves the agent inspecting potentially sensitive data without explicit malicious intent in the instruction itself. This falls under 'risky capabilities without clear malicious intent'.

能力评估

✓ Purpose & Capability

Name/description claim web-only publishing and the SKILL.md contains step-by-step browser upload instructions. No unexpected binaries, env vars, or permissions are requested; required actions align with the stated purpose.

ℹ Instruction Scope

Instructions are mostly limited to interacting with clawhub.ai via a browser and optionally running `clawhub publish` if an existing CLI token is present. One minor ambiguity: the execution criteria include 'No `clawhub login` in history' which could be interpreted as requiring a check of shell history (a privacy-sensitive action). The SKILL.md does not explicitly instruct reading system files, but the criteria are vague and could encourage agents to inspect local history or config files.

✓ Install Mechanism

Instruction-only skill; no install steps, downloads, or extracted archives. Lowest-risk installation profile.

ℹ Credentials

The skill declares no environment variables or credentials, which is appropriate for a web-dashboard workflow. However, the fallback relies on an existing CLI token (not declared or explained where it is stored), which is reasonable but under-specified — the SKILL.md does not state where the token lives or how to access it safely.

✓ Persistence & Privilege

No persistent installation, always:false, and no modifications to other skills or system-wide settings are requested.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install clawhub-web-only-publish
安装完成后，直接呼叫该 Skill 的名称或使用 /clawhub-web-only-publish 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release: Publish skills to ClawHub via web dashboard only—no CLI login or device flow required. - Publish directly from browser using active session; eliminates CLI login, device flow, and session issues. - Requires SKILL.md present in skill folder. - Step-by-step web workflow: upload, validate, and publish from https://clawhub.ai/upload. - CLI fallback allowed only if prior token exists—never use `clawhub login`. - Ensures no secrets included in published files for safety.

元数据

Slug clawhub-web-only-publish

版本 1.0.0

许可证 —

累计安装 0

当前安装数 0

历史版本数 1

常见问题