name: clawdhub description: Use the ClawdHub CLI to search, install, update, and publish agent skills from clawdhub.com. Use when you need to fetch new skills on the fly, sync installed skills to latest or a specific version, or publish new/updated skill folders with the npm-installed clawdhub CLI. metadata: {"clawdbot":{"requires":{"bins":["clawdhub"]},"install":[{"id":"node","kind":"node","package":"clawdhub","bins":["clawdhub"],"label":"Install ClawdHub CLI (npm)"}]}}

ClawdHub CLI

Install

npm i -g clawdhub

Auth (publish)

clawdhub login
clawdhub whoami

clawdhub search "postgres backups"

Install

clawdhub install my-skill
clawdhub install my-skill --version 1.2.3

Update (hash-based match + upgrade)

clawdhub update my-skill
clawdhub update my-skill --version 1.2.3
clawdhub update --all
clawdhub update my-skill --force
clawdhub update --all --no-input --force

List

clawdhub list

Publish

clawdhub publish ./my-skill --slug my-skill --name "My Skill" --version 1.2.0 --changelog "Fixes + docs"

Notes

Default registry: https://clawdhub.com (override with CLAWDHUB_REGISTRY or --registry)
Default workdir: cwd; install dir: ./skills (override with --workdir / --dir)
Update command hashes local files, resolves matching version, and upgrades to latest unless --version is set

Security Scan

Status

suspicious

Open VirusTotal

OpenClaw

gpt-5.5

suspicious

OpenClaw analysis

This skill is for managing ClawHub skills, but it gives an agent examples for broad install/update/publish actions without clear safety checks.

Confidence: medium

VirusTotal

Type: OpenClaw Skill Name: clawdhub Version: 1.0.0 The skill instructs the OpenClaw agent to install a global npm package `clawdhub` via `npm i -g clawdhub` as part of its setup instructions in `SKILL.md`. This introduces a significant supply chain risk, as the `clawdhub` package itself, fetched from an external registry, could be compromised or malicious. The installed CLI tool is designed to interact with `clawdhub.com`, which is an external domain (IOC), and includes a `publish` command that could be used to upload local files if the agent is prompted to do so.

Clawdhub