Skill Auto Publisher

ClawHub 技能发布助手 — AI 全流程搞定：自动递增版本 → 智能生成 changelog → 元数据验证 → 用户确认 → 一键发布。触发词：发布技能、publish skill、ClawHub发布、发布到ClawHub、技能发布。

This package appears to implement a legitimate ClawHub publish helper, but contains several inconsistencies you should check before trusting it: (1) Confirm which CLI it expects — 'clawhub' or 'skillhub' — and that that CLI is installed and logged in; (2) Inspect/approve the scripts (they will run locally) and be aware publish.sh will call the CLI and update _meta.json in the target skill directory; (3) Note that publish_history.py writes to /root/.openclaw/workspace/skills/.publish_history.json — consider changing that path to a user-writable location or running as a non-root user to avoid privileged writes; (4) The scripts snapshot all files under the skill directory (hashing them) — ensure there are no sensitive files you don't want recorded; (5) There are small logic bugs (exit-code handling and mismatched example paths) that could cause unexpected behavior; test the scripts in a safe/non-production environment first and consider running them manually to confirm what they will do before letting an agent invoke them autonomously.

Type: OpenClaw Skill Name: skill-auto-publisher Version: 1.1.0 The skill bundle is a developer utility designed to automate the publication of OpenClaw skills to ClawHub. It includes scripts for metadata validation (validate_meta.py), name collision checking (check_slug.py), and version/history tracking (publish_history.py). While publish.sh contains minor shell-to-python injection vulnerabilities due to unquoted variable interpolation in 'python3 -c' commands, there is no evidence of intentional malice, data exfiltration, or unauthorized remote execution. The behavior is consistent with the stated purpose and includes mandatory user confirmation steps before execution.