← 返回 Skills 市场
253
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install clawhub-wrapper
功能描述
Download and install skills from ClawHub (https://clawhub.ai). Use when user wants to browse, search, or download skills from the ClawHub skill registry.
使用说明 (SKILL.md)
ClawHub Skill
Download and install skills from ClawHub - a fast skill registry for AI agents.
Commands
Search Skills
Search for skills by keyword:
{baseDir}/clawhub-search.sh "\x3Ckeyword>"
This searches the ClawHub registry and displays matching skills with their slug, name, summary, and download count.
Download and Install Skill
Download and install a skill by slug or ClawHub URL:
# By slug
{baseDir}/clawhub-download.sh \x3Cslug>
# By ClawHub URL (e.g., https://clawhub.ai/steipete/github)
{baseDir}/clawhub-download.sh https://clawhub.ai/owner/slug
This will:
- Download the skill package from ClawHub
- Extract it to
~/.agents/skills/clawhub-skills/\x3Cslug>/ - Display the installed skill information
List Skills
Browse available skills (sorted by downloads):
{baseDir}/clawhub-search.sh
API Endpoints
ClawHub uses the following API endpoints:
- List/Search Skills:
https://wry-manatee-359.convex.site/api/v1/skills - Download Skill:
https://wry-manatee-359.convex.site/api/v1/download?slug=\x3Cslug>
Examples
User says: "I want to download the github skill from clawhub"
→ Use clawhub-download.sh github
User says: "Search for weather related skills on clawhub"
→ Use clawhub-search.sh "weather"
User says: "Install https://clawhub.ai/steipete/summarize"
→ Use clawhub-download.sh https://clawhub.ai/steipete/summarize
User says: "What skills are popular on clawhub?"
→ Use clawhub-search.sh to list top skills by downloads
安全使用建议
This skill implements a registry search/download tool, but it downloads skill ZIPs from an unexpected third-party host (wry-manatee-359.convex.site) rather than the public clawhub.ai domain and does not verify signatures or checksums. Installing will copy whatever is in those ZIPs into ~/.agents/skills so the agent may later execute them. Before installing: (1) confirm the API host is legitimate (ask the publisher or verify DNS/TLS ownership for clawhub.ai vs convex.site), (2) prefer installers that use verified release hosts or cryptographic signatures, (3) inspect downloaded packages manually before copying them into your skills directory, or run the downloader inside a sandbox/container, and (4) if you need stronger assurance, request that the skill be updated to verify checksums or signatures and to use the official ClawHub API/host. If you do not trust the remote host or cannot validate provenance, do not install.
功能分析
Type: OpenClaw Skill
Name: clawhub-wrapper
Version: 1.0.1
The skill acts as a package manager that downloads and installs unverified third-party code from an external API (wry-manatee-359.convex.site) into the agent's environment. The 'clawhub-download.sh' script lacks any integrity verification (e.g., checksums or signatures) and contains a path traversal vulnerability when parsing slugs from URLs, which could allow writing files to unauthorized locations. While these behaviors align with the stated purpose of a skill registry wrapper, the lack of security controls and the capability to fetch arbitrary remote payloads present a significant security risk.
能力评估
Purpose & Capability
Name/description match the included scripts: the two bash scripts implement searching and downloading skills and installing them to ~/.agents/skills/clawhub-skills/<slug>. However, the SKILL.md and scripts use an API host (https://wry-manatee-359.convex.site) rather than the public site name (clawhub.ai). Requesting to download and install arbitrary skill packages is functionally consistent with a 'registry downloader' but the unexpected API domain and lack of provenance/verification is disproportionate to the stated purpose and warrants caution.
Instruction Scope
Runtime instructions and the scripts perform network fetches, validate the ZIP format superficially, then extract and copy all files into the agent's skills directory (~/.agents/skills/...), thereby installing arbitrary code that the agent may later execute. The scripts do not verify signatures, checksums, or any publisher identity and do not restrict which files can be installed. They do not read unrelated system credentials, but they grant execution capability to remote-provided code.
Install Mechanism
There is no platform install spec, but the included downloader script performs a direct curl download from a third-party convex.site subdomain and extracts the archive locally. The download URL is not a well-known release host (e.g., GitHub releases) and the archive is extracted without cryptographic verification—this is a higher-risk install pattern (remote archive -> local extraction -> execution potential).
Credentials
The skill does not request environment variables, credentials, or config paths beyond writing to ~/.agents/skills. It also checks for required local binaries (curl, unzip, jq) before running. No unrelated secrets are requested.
Persistence & Privilege
The skill is not always-enabled and does not modify other skills. It installs packages into the user's skill directory, which is normal for an installer but gives installed skills persistent presence and the same runtime privileges as other skills—those installed packages could be executed autonomously by the agent (default behavior).
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install clawhub-wrapper - 安装完成后，直接呼叫该 Skill 的名称或使用
/clawhub-wrapper触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.1
- Improved documentation for searching, downloading, and installing skills from ClawHub.
- Added example user prompts and corresponding commands.
- Detailed the API endpoints used for skill search and download.
- Clarified command usage for skill listing, searching, and installation by both slug and URL.
元数据
常见问题
clawhub 是什么？
Download and install skills from ClawHub (https://clawhub.ai). Use when user wants to browse, search, or download skills from the ClawHub skill registry. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 253 次。
如何安装 clawhub？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install clawhub-wrapper」即可一键安装，无需额外配置。
clawhub 是免费的吗？
是的，clawhub 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
clawhub 支持哪些平台？
clawhub 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 clawhub？
由 douglarek（@douglarek）开发并维护，当前版本 v1.0.1。
推荐 Skills