Skill: ivangdavila/clawic (version 1.0.0)

--- name: Clawic CLI slug: clawic version: 1.0.0 homepage: https://clawic.com/skills/clawic description: Search, inspect, and install Clawic skills from GitHub with local lexical matching, registry overrides, and safe destination control. changelog: Initial release with command patterns, query design guidance, registry override rules, and install safety notes. metadata: {"clawdbot":{"emoji":"CLI","requires":{"bins":["node"],"anyBins":["clawic","npx"],"config":["~/clawic/"]},"install":[{"id":"npm-clawic","kind":"npm","package":"clawic","bins":["clawic"],"label":"Install clawic CLI (npm)"}],"os":["linux","darwin","win32"]}} --- # Clawic CLI Use the published `clawic` package to discover, inspect, and install Clawic skills from the GitHub-backed registry. Keep the workflow anchored on the real registry index, the manifest file for each slug, and deliberate install destinations. ## When to Use User wants the exact `clawic` CLI commands, flags, registry behavior, or install flow. Use this skill for `search`, `show`, `install`, `registry`, `CLAWIC_REGISTRY_BASE_URL`, and the safety checks around writing skill files into a workspace. Do not route generic `clawhub` or `openclaw` CLI requests here unless the user is explicitly working with the published `clawic` package. ## Architecture Memory lives in `~/clawic/`. If `~/clawic/` does not exist, run `setup.md`. See `memory-template.md` for structure. ```text ~/clawic/ ├── memory.md # Stable defaults: runtime choice, install roots, review posture ├── installs.md # Installed slugs, target dirs, and overwrite notes └── queries.md # Query phrases that surface the right skills reliably ``` ## Quick Reference | Topic | File | |-------|------| | Setup and activation defaults | `setup.md` | | Memory structure | `memory-template.md` | | Copy-ready commands | `command-patterns.md` | | Query design for local matching | `search-strategy.md` | | Registry and manifest model | `registry-and-manifests.md` | | Install destinations and overwrite rules | `install-safety.md` | | Errors and custom registry overrides | `errors-and-overrides.md` | Open only the smallest file needed for the current blocker. Most sessions only need `command-patterns.md` plus `install-safety.md`. ## Quick Start ```bash npx clawic registry npx clawic search pocketbase --limit 5 npx clawic show pocketbase npx clawic install pocketbase --dir ./skills ``` Global install is also valid: ```bash npm install -g clawic clawic search pocketbase --limit 5 ``` ## Requirements - Node.js 20 or newer - `npx clawic ...` for one-off use, or `npm install -g clawic` for a persistent local binary - A writable destination directory before running `install` - Optional `CLAWIC_REGISTRY_BASE_URL` only when the user intentionally points to a compatible alternate registry ## Security Note `npx clawic ...` may fetch the published npm package if it is not already cached locally. Use a global install or a pinned project workflow when the user wants a repeatable local binary instead of ad hoc package fetches. ## Core Rules ### 1. Start by proving the runtime path - Confirm whether the user wants `npx clawic ...` or a globally installed `clawic` binary. - Confirm Node.js 20+ before debugging registry or install errors. - If the toolchain is broken, fix that first instead of inventing registry problems. ### 2. Search by exact skill nouns, not vague intent - `clawic search` is local lexical matching over the downloaded index, not semantic ranking. - Queries should use likely slug, name, and description terms such as `pocketbase`, `skill installer`, or `github actions`. - If a broad request returns weak results, rewrite it into the product nouns the target skill would actually contain. ### 3. Use `show` before `install` when fit is unclear - `show` fetches the manifest and reports the skill identity, file count, repository path, source repo, and summary without writing files. - Review the slug and source first when trust, version fit, or write scope is unclear. - Treat `show` as the low-risk inspection step and `install` as the write step. ### 4. Treat the manifest as the install contract - `install` writes every path listed in the manifest's `files` array into `<destination>/<slug>/`. - Expect files such as `SKILL.md`, auxiliary docs, and metadata files like `_meta.json` if the manifest includes them. - Do not promise files that are not present in the manifest, and do not assume hidden post-install steps. ### 5. Control the destination directory deliberately - Default install root is `./skills`, which becomes `./skills/<slug>/`. - Use `--dir` whenever the user needs project-local placement, a vendor folder, or a scratch review path. - Use `--force` only after confirming that overwriting existing files is intentional. ### 6. Make the registry base explicit when overriding it - `clawic registry` prints the active registry base URL. - The default base is the raw GitHub registry for `clawic/skills`. - Only set `CLAWIC_REGISTRY_BASE_URL` when the user intentionally wants a compatible mirror or test registry. ### 7. Keep network facts precise - Search terms stay local after the registry index is downloaded; the query text itself is not sent to a remote search endpoint by `clawic`. - Remote traffic is just HTTP GETs for the registry index, the selected manifest, and the files referenced by that manifest. - If the user changes the registry base, the same fetch pattern applies to that alternate host instead. ## Common Traps - Confusing `clawic` with `clawhub` or `openclaw` -> the user gets the wrong command family and wrong registry model. - Treating `clawic search` like semantic discovery -> vague requests miss because matching is lexical and field-based. - Installing before reviewing the manifest -> the wrong slug lands in the workspace. - Forgetting that install root defaults to `./skills` -> files appear in an unexpected folder. - Re-running `install` into an existing target without `--force` -> file creation fails on the first existing path. - Using `--force` in a shared or dirty tree -> previously reviewed files get overwritten. - Overriding `CLAWIC_REGISTRY_BASE_URL` without checking compatibility -> index or manifest fetches return 404 or malformed JSON. - Assuming `registry` validates availability -> it only prints the active base URL. ## External Endpoints | Endpoint | Data Sent | Purpose | |----------|-----------|---------| | `https://raw.githubusercontent.com/clawic/skills/main/registry/index.json` | Standard GET request only | Fetch the registry index used for local matching | | `https://raw.githubusercontent.com/clawic/skills/main/registry/skills/<slug>.json` | Standard GET request only | Fetch the manifest used by `show` and `install` | | `https://raw.githubusercontent.com/clawic/skills/main/skills/<slug>/*` | Standard GET requests for each file path in the manifest | Download the files that `install` writes locally | If `CLAWIC_REGISTRY_BASE_URL` is set, the same request pattern goes to that alternate registry host instead. No other data is sent externally by the documented CLI flow. ## Security & Privacy **Data that leaves your machine:** - HTTP GET requests to the active registry base URL - File downloads for the manifest-selected skill files during `install` **Data that stays local:** - The user's query text after the registry index has been downloaded - Installed skill files in the chosen destination directory - Optional defaults and notes in `~/clawic/` **This skill does NOT:** - send search queries to a hosted semantic search API - auto-install skills without consent - overwrite files unless the user chooses `--force` - read or modify files outside the selected install destination plus `~/clawic/` for optional memory ## Scope This skill ONLY: - helps use the official `clawic` CLI surface - explains how the registry index, manifests, and file downloads fit together - stores explicit workflow defaults in `~/clawic/` when the user wants continuity This skill NEVER: - invent unsupported subcommands or hidden registry APIs - claim `registry` verifies health when it only prints the base URL - hide write-side effects of `install` or `--force` - modify its own `SKILL.md` ## Trust By using this skill, registry and file requests go to the raw GitHub registry for `clawic/skills`, or to a user-selected compatible registry override. Only install and use it if you trust that registry owner with the files you download. ## Related Skills Install with `clawhub install <slug>` if user confirms: - `skill-finder` - broader skill discovery when the user is not already committed to the `clawic` registry - `bash` - safer shell composition around repeated `clawic` commands and directory checks - `documentation` - cleaner command references and troubleshooting notes for CLI-heavy workflows - `workflow` - turn repeated review and install sequences into a standard operating routine - `javascript` - debug Node runtime and package issues around local CLI execution ## Feedback - If useful: `clawhub star clawic` - Stay updated: `clawhub sync`

path: command-patterns.md
content: # Command Patterns - Clawic CLI

## Install the CLI

```bash
npm install -g clawic
clawic --version
```

For one-off use without a global install:

```bash
npx clawic registry
```

## Search

```bash
clawic search pocketbase
clawic search "skill installer" --limit 5
```

Use exact nouns the target skill is likely to contain in its slug, name, or description.

## Show

```bash
clawic show pocketbase
```

Typical output includes:
- skill name and slug
- description
- version and homepage when present
- repository path
- file count
- source repository and branch
- optional summary

## Install

```bash
clawic install pocketbase
clawic install pocketbase --dir ./vendor-skills
clawic install pocketbase --dir ./vendor-skills --force
```

Behavior:
- default root: `./skills`
- final directory: `<root>/<slug>/`
- without `--force`, existing files cause a write failure

## Registry Base

```bash
clawic registry
CLAWIC_REGISTRY_BASE_URL=https://raw.githubusercontent.com/clawic/skills/main/registry clawic registry
```

`registry` prints the active base URL. It does not validate the host or manifest shape.


path: errors-and-overrides.md
content: # Errors and Overrides - Clawic CLI

## No results for an obviously real skill

Likely causes:
- the query is too abstract
- the target words are not in slug, name, description, or summary
- the active registry base is not the one you think it is

Better move:
- rewrite the query into exact nouns
- run `clawic registry`
- inspect a likely slug directly with `show`

## Request failed with 404

Likely causes:
- bad slug
- wrong `CLAWIC_REGISTRY_BASE_URL`
- registry layout is incompatible with the expected JSON paths

Check:

```bash
clawic registry
clawic show <slug>
```

## Install fails because files already exist

That is expected when the target path already contains the same filenames and `--force` was not set.

Safer options:
- choose a fresh `--dir`
- inspect the destination first
- use `--force` only when overwrite is intentional

## Custom Registry Override

Example:

```bash
export CLAWIC_REGISTRY_BASE_URL=https://example.com/registry
clawic registry
clawic show some-skill
```

The alternate registry must expose the same shape:
- `index.json`
- `skills/<slug>.json`
- `files[].downloadUrl` values that are reachable

## Node or package execution problems

If the CLI fails before any registry fetch:
- confirm Node.js 20+
- retry with `npx clawic registry`
- if a global install is stale, reinstall the package


path: install-safety.md
content: # Install Safety - Clawic CLI

## Destination Rules

- Default install root is `./skills`
- Final path is always `<root>/<slug>/`
- Use `--dir` whenever the workspace already has its own vendor or tool folder

## Before Running `install`

Check these first:
1. Is the slug confirmed?
2. Is the destination directory correct?
3. Is the target folder empty, disposable, or intentionally replaceable?
4. Does the user want inspection first via `show`?

## Overwrite Behavior

Without `--force`, the package writes with exclusive-create semantics.
That means the install stops on the first existing path instead of silently replacing files.

Use `--force` only when:
- the existing folder is disposable
- the user wants a refresh from the registry
- the destination is not a mixed folder with unrelated files

## Safer Review Patterns

For review-first work:

```bash
clawic show pocketbase
clawic install pocketbase --dir ./tmp-skill-review
```

For project-local vendor placement:

```bash
clawic install pocketbase --dir ./tools/skills
```

For explicit refresh:

```bash
clawic install pocketbase --dir ./tools/skills --force
```


path: memory-template.md
content: # Memory Template - Clawic CLI

Create `~/clawic/memory.md` with this structure:

```markdown
# Clawic Memory

## Status
status: ongoing
version: 1.0.0
last: YYYY-MM-DD
integration: pending | done | declined

## Context
<!-- Activation cues, preferred runtime path, default install root -->
<!-- Example: "Use this when I ask for a Clawic skill or mention the clawic CLI." -->

## Registry Defaults
<!-- Default registry base URL or mirror notes -->
<!-- Example: "Stay on the public GitHub-backed registry unless I say otherwise." -->

## Install Defaults
<!-- Review posture, destination folders, overwrite policy -->
<!-- Example: "Always run show before install and keep vendor installs under ./skills." -->

## Notes
<!-- Stable observations that improve future command choices -->

---
*Updated: YYYY-MM-DD*
```

## Status Values

| Value | Meaning | Behavior |
|-------|---------|----------|
| `ongoing` | Still learning defaults | Keep collecting explicit workflow choices |
| `complete` | Runtime and install habits are stable | Reuse saved defaults unless overridden |
| `paused` | User does not want continuity right now | Work only from the current request |
| `never_ask` | User does not want setup questions | Stop asking for persistent defaults |

## Key Principles

- Store reusable workflow defaults, not secrets.
- Keep notes in natural language, not config dumps.
- Save registry overrides only when the user intentionally uses one.
- Update `last` after meaningful `clawic` work.


path: registry-and-manifests.md
content: # Registry and Manifests - Clawic CLI

## Default Registry Base

The package defaults to:

```text
https://raw.githubusercontent.com/clawic/skills/main/registry
```

This can be replaced with `CLAWIC_REGISTRY_BASE_URL` when the user intentionally wants a compatible alternate registry.

## Fetch Flow

### `search`

1. Fetch `index.json`
2. Score results locally
3. Print matching skills

The query text is not sent to a hosted search backend by the CLI itself.

### `show`

1. Fetch `skills/<slug>.json`
2. Read the manifest fields
3. Print a human-readable summary

### `install`

1. Fetch `skills/<slug>.json`
2. Iterate over `manifest.files`
3. Download each `downloadUrl`
4. Write each file into `<root>/<slug>/<path>`

## Manifest Model

Useful fields exposed by the registry:
- `skill.slug`
- `skill.name`
- `skill.description`
- `skill.summary`
- `skill.version`
- `skill.homepage`
- `skill.repositoryPath`
- `repository.owner`
- `repository.repo`
- `repository.branch`
- `files[].path`
- `files[].downloadUrl`

Treat `files[]` as the install contract. If a path is absent there, `install` will not create it.


path: search-strategy.md
content: # Search Strategy - Clawic CLI

`clawic search` does local lexical scoring after downloading the registry index.
That means query wording matters more than with a semantic registry.

## Query Rules

### 1. Lead with likely product nouns

Good:
- `pocketbase`
- `github actions`
- `skill installer`
- `sentry`

Weak:
- `help with backend`
- `make deployments easier`
- `something for skills`

### 2. Rewrite intent into likely slug words

If the user says:
- "I need safer installs" -> try `skill installer`, `skill manager`, `install`
- "I need CI help" -> try `github actions`, `ci-cd`
- "I need product analytics" -> try `analytics`, `mixpanel`, `amplitude`

### 3. Split broad jobs into multiple probes

Instead of one vague query, probe the main job facets:
- creation
- inspection
- deployment
- analysis

### 4. Use `show` on near matches

If the result set is close but not obvious, inspect the top 1-3 matches before recommending an install.

## Why This Matters

The published package scores against:
- `slug`
- `name`
- `description`
- `summary`

Exact and prefix matches are rewarded heavily. Abstract paraphrases are not.


path: setup.md
content: # Setup - Clawic CLI

Read this when `~/clawic/` is missing or empty.

## Your Attitude

Be direct, low-friction, and tool-first. Help the user get to the right command quickly, but keep installation and overwrite choices explicit.

## Priority Order

### 1. First: Integration

Within the first few exchanges, learn how the user wants this skill to activate in the future:
- when they mention `clawic`
- when they ask to inspect or install a Clawic skill
- when they want to point the CLI at a custom registry

If they want continuity, keep that activation guidance in `~/clawic/memory.md`.

### 2. Then: Understand Their Working Style

Ask only for the defaults that actually improve future CLI help:
- `npx clawic` or a global `clawic` binary
- preferred install root
- whether they want `show` before every `install`
- whether they use the default registry or an override

### 3. Finally: Save Only Reusable Details

Save explicit statements that reduce future friction:
- preferred runtime path
- default destination directory
- custom registry base URL if they intentionally use one
- liked and avoided slugs

## First Working Session

Start with the smallest safe path:
1. Confirm runtime path (`npx` or global install)
2. Confirm the query or slug
3. Prefer `search` or `show` before `install`
4. Confirm the write destination before installing

## Boundaries

- Keep local continuity files inside `~/clawic/`
- Do not save tokens or credentials in memory
- Do not enable `--force` unless the user wants overwrite behavior
- Do not assume a custom registry unless the user explicitly asked for it


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)