Skill: openlang-cn/clawhub-cli (version 1.0.2)

--- name: clawhub-cli description: Use the ClawHub CLI to search, install, update, and publish agent skills from clawhub.ai. Use when you need to fetch new skills on the fly, sync installed skills to the latest or a specific version, or publish new or updated skill folders with the npm-installed ClawHub CLI. metadata: {"openclaw":{"emoji":"🦞","requires":{"bins":[]},"os":["linux","darwin","win32"]}} --- # ClawHub CLI Skill (Agent Playbook) You are an execution assistant for managing **agent skills** using the **ClawHub CLI** (search, install, list, update, publish, sync). Your goal is to produce **the smallest set of correct commands** that achieve the user's intent, while avoiding destructive actions and avoiding publishing secrets. ## Use This Skill When Use this skill if the user asks to: - discover skills on ClawHub (search by keywords) - install skills into a workspace - list what is installed (as recorded by the CLI; may be lockfile-backed depending on setup) - update skills (all or a single one, latest or a pinned version) - publish one local skill folder - sync many local skill folders in bulk ## Guardrails (Must Follow) - **Do not invent CLI flags or subcommands.** If you are unsure, instruct to run `clawhub --help` or `clawhub <command> --help` first, then adapt. - **Never publish secrets.** Before publish/sync, remind the user to exclude `.env`, tokens, credentials, private keys, and proprietary data. - **Prefer dry-run when available.** For bulk operations, suggest `--dry-run` if the CLI supports it for that command. - **Keep versions valid.** Use SemVer like `0.1.0`, `1.2.3`. If bumping, use the smallest bump that matches the change. ## Preconditions / Preflight 1) Ensure the CLI is installed (global): ```bash npm i -g clawhub ``` Alternative: ```bash pnpm add -g clawhub ``` 2) Ensure the user is logged in: ```bash clawhub login ``` or: ```bash clawhub login --token <api-token> ``` 3) If anything fails, ask for the **exact CLI error output** and rerun with a corrected command. ## Quick Decision Guide - If the user describes a capability but not a slug → **search** - If the user provides a slug and wants it locally → **install** - If the user wants to see what is installed → **list** - If the user wants "latest everything" → **update --all** - If the user wants to ship a local folder to ClawHub → **publish** (single skill) or **sync** (many skills) ## Common Workflows (Command Patterns) ### Search for skills Use when the user is exploring / unsure of the exact slug. ```bash clawhub search "your query" ``` Offer 2-5 candidate queries based on the user's words (domain + action + platform). ### Install a skill Install by slug into the current workspace (destination/path may vary by CLI version; check `clawhub install --help`). ```bash clawhub install <skill-slug> ``` Example: ```bash clawhub install postgres-backup-tools ``` If a specific version is required, add `--version <semver>`. ### List installed skills ```bash clawhub list ``` Use this to confirm the lockfile state after install/update. ### Update installed skills Update all: ```bash clawhub update --all ``` Update one: ```bash clawhub update <skill-slug> ``` If the user needs a specific version, add `--version <semver>`. ### Publish a single local skill folder Use when the user has exactly one folder to publish and it contains a `SKILL.md`. ```bash clawhub publish ./skills/my-skill \ --slug my-skill \ --name "My Skill" \ --version 0.1.0 \ --tags latest ``` Before providing the final publish command, make sure the user has: - **path**: the local folder path - **slug**: lowercase, hyphenated, unique - **name**: human-friendly display name - **version**: SemVer - **tags**: e.g. `latest`, `beta`, `internal` (use only what the user intends) ### Sync many skills at once Use when the user has a directory containing many skill subfolders. ```bash clawhub sync --all ``` Common options (only if supported by the CLI in this environment): - `--tags latest` - `--changelog "Update skills"` - `--bump patch|minor|major` - `--dry-run` ## Verification & Troubleshooting Playbook After install/update: - Run `clawhub list` and confirm the expected slug(s) and version(s). After publish/sync: - Verify locally with `clawhub list` (if it records published state) - Verify on the website by searching by slug or display name If any errors occur (examples: slug already exists, version conflict, not logged in): - explain the likely cause in one sentence - propose a corrected command (new slug, bump version, or re-login) ## Local References Use these documents when you need more detail: | Document | Use when | What you get | |---|---|---| | `reference/CLI-COMMANDS.md` | You need a command cheat sheet | Common commands + safe patterns | | `reference/PUBLISHING-CHECKLIST.md` | You’re about to publish/sync | Pre-publish checklist (no secrets, slug/version/tags) | | `reference/SECURITY.md` | You’re publishing or handling tokens | Safety rules + what must never be published | | `reference/TROUBLESHOOTING.md` | A command fails | Common errors + corrective actions | | `reference/SEMVER-GUIDE.md` | You need to pick the next version | Patch/minor/major guidance | | `reference/SKILL-STRUCTURE.md` | You’re packaging/refactoring a skill folder | Recommended folder layout + conventions | | `reference/WINDOWS-USAGE.md` | You’re on Windows and cannot use scripts | Direct `clawhub` command snippets + Git Bash/WSL notes |

path: scripts/README.md
content: # Scripts

This folder contains optional helpers for running common `clawhub` workflows.

## Design Principles

- **Safe by default**: scripts should not delete data or hide failures.
- **Portable**: prefer `bash` with `set -euo pipefail`.
- **Non-assumptive flags**: when using optional CLI flags, scripts should check `clawhub <command> --help` first.

## Linux

Shell helpers live in `scripts/linux/`:

- `install-skill.sh <slug> [semver]`
- `update-skills.sh --all` or `update-skills.sh --slug <slug> [--version <semver>]`
- `publish-skill.sh <folder> <slug> <display-name> <semver> [tags_csv]`
- `sync-all.sh [--tags <tag>]... [--changelog <text>] [--bump patch|minor|major] [--dry-run]`

Make executable:

```bash
chmod +x scripts/linux/*.sh
```

## macOS

See `scripts/macos/README.md` (the Linux scripts usually work on macOS).

## Windows

No `.ps1` scripts are shipped. See:

- `reference/WINDOWS-USAGE.md`
- `scripts/windows/README.md`



path: scripts/windows/README.md
content: # Windows (No Scripts)

This skill package does **not** include `.ps1` scripts.

Use `clawhub` directly from PowerShell / cmd, or run the `.sh` scripts via Git Bash or WSL.

See: `reference/WINDOWS-USAGE.md`



path: scripts/macos/README.md
content: # macOS Notes

The scripts in `scripts/linux/` are written as portable `bash` scripts and typically work on macOS as well.

If your environment defaults to `zsh`, you can still run them with:

```bash
bash scripts/linux/install-skill.sh <skill-slug>
```

If you hit permission issues, make them executable:

```bash
chmod +x scripts/linux/*.sh
```



path: scripts/linux/install-skill.sh
content: #!/usr/bin/env bash
set -euo pipefail

slug="${1:-}"
version="${2:-}"

if [[ -z "$slug" ]]; then
  echo "Usage: $0 <skill-slug> [semver]" >&2
  exit 2
fi

args=(install "$slug")
if [[ -n "$version" ]]; then
  args+=(--version "$version")
fi

echo ">> clawhub ${args[*]}"
clawhub "${args[@]}"

echo ">> clawhub list"
clawhub list



path: scripts/linux/publish-skill.sh
content: #!/usr/bin/env bash
set -euo pipefail

skill_folder="${1:-}"
slug="${2:-}"
name="${3:-}"
version="${4:-}"
tags_csv="${5:-latest}"

if [[ -z "$skill_folder" || -z "$slug" || -z "$name" || -z "$version" ]]; then
  echo "Usage: $0 <skill-folder> <slug> <display-name> <semver> [tags_csv]" >&2
  echo "Example: $0 ./skills/my-skill my-skill \"My Skill\" 0.1.0 latest,beta" >&2
  exit 2
fi

IFS=',' read -r -a tags <<<"$tags_csv"

supports_flag() {
  local cmd="$1"
  local flag="$2"
  if ! command -v grep >/dev/null 2>&1; then
    return 1
  fi
  clawhub "$cmd" --help 2>/dev/null | grep -q -- "$flag"
}

args=(publish "$skill_folder" --slug "$slug" --name "$name" --version "$version")
if supports_flag "publish" "--tags"; then
  for t in "${tags[@]}"; do
    if [[ -n "$t" ]]; then
      args+=(--tags "$t")
    fi
  done
else
  echo "!! Note: 'clawhub publish' does not appear to support '--tags' in this environment. Publishing without tags." >&2
fi

echo ">> clawhub ${args[*]}"
clawhub "${args[@]}"



path: scripts/linux/sync-all.sh
content: #!/usr/bin/env bash
set -euo pipefail

usage() {
  cat <<'EOF' >&2
Usage:
  sync-all.sh [--tags <tag>]... [--changelog <text>] [--bump patch|minor|major] [--dry-run]
EOF
}

tags=()
changelog=""
bump=""
dry_run=false

while [[ $# -gt 0 ]]; do
  case "$1" in
    --tags) tags+=("${2:-}"); shift 2 ;;
    --changelog) changelog="${2:-}"; shift 2 ;;
    --bump) bump="${2:-}"; shift 2 ;;
    --dry-run) dry_run=true; shift ;;
    -h|--help) usage; exit 0 ;;
    *) echo "Unknown arg: $1" >&2; usage; exit 2 ;;
  esac
done

args=(sync --all)

supports_flag() {
  local flag="$1"
  if ! command -v grep >/dev/null 2>&1; then
    return 1
  fi
  clawhub sync --help 2>/dev/null | grep -q -- "$flag"
}

if ((${#tags[@]} > 0)) && supports_flag "--tags"; then
  for t in "${tags[@]}"; do
    if [[ -n "$t" ]]; then
      args+=(--tags "$t")
    fi
  done
elif ((${#tags[@]} > 0)); then
  echo "!! Note: 'clawhub sync' does not appear to support '--tags' here. Ignoring tags." >&2
fi

if [[ -n "$changelog" ]] && supports_flag "--changelog"; then
  args+=(--changelog "$changelog")
elif [[ -n "$changelog" ]]; then
  echo "!! Note: 'clawhub sync' does not appear to support '--changelog' here. Ignoring changelog." >&2
fi

if [[ -n "$bump" ]] && supports_flag "--bump"; then
  args+=(--bump "$bump")
elif [[ -n "$bump" ]]; then
  echo "!! Note: 'clawhub sync' does not appear to support '--bump' here. Ignoring bump." >&2
fi

if $dry_run && supports_flag "--dry-run"; then
  args+=(--dry-run)
elif $dry_run; then
  echo "!! Note: 'clawhub sync' does not appear to support '--dry-run' here. Running without dry-run." >&2
fi

echo ">> clawhub ${args[*]}"
clawhub "${args[@]}"



path: scripts/linux/update-skills.sh
content: #!/usr/bin/env bash
set -euo pipefail

usage() {
  cat <<'EOF' >&2
Usage:
  update all:
    update-skills.sh --all

  update one:
    update-skills.sh --slug <skill-slug> [--version <semver>]
EOF
}

all=false
slug=""
version=""

while [[ $# -gt 0 ]]; do
  case "$1" in
    --all) all=true; shift ;;
    --slug) slug="${2:-}"; shift 2 ;;
    --version) version="${2:-}"; shift 2 ;;
    -h|--help) usage; exit 0 ;;
    *) echo "Unknown arg: $1" >&2; usage; exit 2 ;;
  esac
done

if $all; then
  echo ">> clawhub update --all"
  clawhub update --all
elif [[ -n "$slug" ]]; then
  args=(update "$slug")
  if [[ -n "$version" ]]; then
    args+=(--version "$version")
  fi
  echo ">> clawhub ${args[*]}"
  clawhub "${args[@]}"
else
  echo "Provide --all or --slug <skill-slug>." >&2
  usage
  exit 2
fi

echo ">> clawhub list"
clawhub list



path: reference/CLI-COMMANDS.md
content: # ClawHub CLI Commands (Reference)

This document is a **quick reference** for common ClawHub CLI workflows used by the `clawhub-cli` skill.

> If you are unsure about supported flags in the user's environment, run:
>
> - `clawhub --help`
> - `clawhub <command> --help`

## Authentication

- Login (interactive):

```bash
clawhub login
```

- Login with token:

```bash
clawhub login --token <api-token>
```

## Discovery

- Search skills by keyword query:

```bash
clawhub search "postgres backup"
```

Search tips:

- use **domain + verb + platform** (e.g. `"docker cleanup"`, `"git release"`, `"kubernetes logs"`)
- keep queries short; try 2-5 variations

## Install / List / Update

- Install latest:

```bash
clawhub install <skill-slug>
```

- Install pinned version:

```bash
clawhub install <skill-slug> --version <semver>
```

- List installed skills (as recorded by the CLI; may be lockfile-backed depending on your setup):

```bash
clawhub list
```

- Update all skills:

```bash
clawhub update --all
```

- Update one skill:

```bash
clawhub update <skill-slug>
```

- Update one skill to a pinned version:

```bash
clawhub update <skill-slug> --version <semver>
```

## Publish / Sync

- Publish one local skill folder:

```bash
clawhub publish ./skills/my-skill \
  --slug my-skill \
  --name "My Skill" \
  --version 0.1.0 \
  --tags latest
```

- Sync all skill folders under a root:

```bash
clawhub sync --all
```

If available, prefer safety options for bulk ops:

- `--dry-run`
- `--bump patch|minor|major`



path: reference/PUBLISHING-CHECKLIST.md
content: # Publishing Checklist (Local Skill → ClawHub)

Use this checklist before running `clawhub publish` or `clawhub sync`.

## 1) Confirm the Skill Folder Is Valid

- Folder contains a `SKILL.md` at the root of the skill directory.
- `SKILL.md` has frontmatter with at least:
  - `name`
  - `description`
- `SKILL.md` clearly tells the agent:
  - when to use it
  - what inputs it needs
  - what commands/actions to run
  - what safety rules to follow

## 2) Ensure No Secrets Will Be Published

Before publishing, scan for and exclude:

- `.env`, `*.env`
- API tokens, passwords, session cookies
- SSH keys and certificates
- cloud credentials files (AWS/GCP/Azure)
- internal URLs or proprietary data you are not allowed to share

If needed, add a `.gitignore`-like exclusion strategy (depending on what the ClawHub CLI supports) or remove the files from the folder before publishing.

## 3) Pick a Good Slug

Slug rules of thumb:

- lowercase
- hyphen-separated
- stable (avoid dates)
- unique and descriptive (e.g. `docker-compose-cli`, `git-cli`, `azure-devops-helper`)

## 4) Choose Version + Tags

- Version must be valid SemVer (`MAJOR.MINOR.PATCH`), e.g. `0.1.0`
- Tag should match intent:
  - `latest` for the default stable
  - `beta` for pre-release
  - `internal` if intended for private/limited use (only if supported/desired)

## 5) Publish Command Template

```bash
clawhub publish <skill-folder> \
  --slug <slug> \
  --name "<Display Name>" \
  --version <semver> \
  --tags latest
```

## 6) Post-Publish Verification

- Run `clawhub list` (if it reflects published state in the lockfile)
- Search on the website by slug or display name
- Install the published slug into a clean workspace and verify behavior



path: reference/SECURITY.md
content: # Security & Safety (Publishing Skills)

This skill package is designed to help publish content to a public registry. Treat publishing as **data exfiltration** risk unless confirmed otherwise.

## Never Publish

- `.env` and any file containing secrets
- API keys, passwords, tokens, session cookies
- private keys (`id_rsa`, `*.pem`, `*.pfx`)
- cloud credentials (AWS/GCP/Azure)
- internal-only URLs, hostnames, IPs, or infrastructure details
- customer data, logs, datasets, or any proprietary artifacts you are not authorized to share

## Recommended Hygiene

- Keep skill folders minimal: `SKILL.md`, `reference/`, small `scripts/`, small `assets/`
- Prefer **text assets** (Markdown, SVG) over large binaries
- Before publish/sync, manually review the folder tree for accidental inclusions

## Preflight Checklist

Before `clawhub publish` or `clawhub sync`:

- confirm login status (`clawhub login`)
- confirm slug + version + tags
- run a dry-run if supported (check `clawhub sync --help`)
- verify the folder contains no secrets



path: reference/SEMVER-GUIDE.md
content: # SemVer Guide (for Skill Publishing)

ClawHub skills should use **Semantic Versioning**: `MAJOR.MINOR.PATCH`

## What to Bump

- **PATCH** (`1.2.3` → `1.2.4`)
  - typo fixes
  - documentation-only updates
  - small behavior tweaks that do not change expected inputs/outputs

- **MINOR** (`1.2.3` → `1.3.0`)
  - new optional features
  - new commands/workflows added that do not break existing usage

- **MAJOR** (`1.2.3` → `2.0.0`)
  - breaking changes to how the skill is invoked
  - removing/renaming required inputs
  - changing default behavior in a way that can surprise existing users

## Pre-1.0.0 Convention

For early-stage skills (`0.y.z`):

- bump **PATCH** for most changes
- bump **MINOR** when you add notable features or reshape the playbook
- consider `1.0.0` when the skill is stable and widely usable



path: reference/SKILL-STRUCTURE.md
content: # Skill Package Structure (Recommended)

This is the recommended structure for a ClawHub skill folder.

```
my-skill/
  SKILL.md
  reference/
    ... deeper docs ...
  scripts/
    linux/
      ... runnable helpers (.sh) ...
    macos/
      ... OS notes / wrappers ...
    windows/
      ... README with command snippets (no .ps1) ...
  assets/
    ... icons/templates (svg/md/png*) ...
```

## `SKILL.md` (Required)

`SKILL.md` should be the **agent instruction sheet**, optimized for execution:

- when to use the skill (signals / user intent)
- guardrails (what not to do)
- preflight requirements
- common workflows with concrete commands
- troubleshooting playbook
- links to deeper docs in `reference/`

## `reference/` (Optional but Recommended)

Store longer docs that are too detailed for `SKILL.md`, such as:

- command cheat sheets
- publishing checklists
- best practices and conventions
- troubleshooting guides

## `scripts/` (Optional)

Put small automation helpers:

- shell scripts for Linux/macOS (prefer portable `bash`)
- Windows instructions as Markdown (avoid shipping `.ps1` in repos that forbid it)
- scripts should be safe by default and avoid destructive actions

## `assets/` (Optional)

Put non-code reusable assets:

- icons (prefer `svg` text-based)
- templates (markdown, json, yaml)
- screenshots (only if necessary; keep size small)

\* Avoid committing large binary files unless required.



path: reference/TROUBLESHOOTING.md
content: # Troubleshooting (ClawHub CLI)

This guide helps diagnose common failures when using `clawhub` commands from an agent session.

## First Step (Always)

Capture:

- the exact command that was run
- the full CLI output (including the error)
- the OS + shell (PowerShell, bash, etc.)

Then re-run with the smallest possible change.

## Login / Auth Issues

### Symptom: "not logged in" / "unauthorized"

Actions:

- run `clawhub login` (interactive), or
- run `clawhub login --token <api-token>`

If still failing:

- verify the token is valid and not expired
- verify the token has permission to publish/sync (if relevant)

## Publish Conflicts

### Symptom: slug already exists

Actions:

- pick a new slug (recommended), or
- publish under a different namespace if the CLI supports it (check `clawhub publish --help`)

### Symptom: version already exists / version conflict

Actions:

- bump patch/minor/major depending on change magnitude
- re-run publish with the new SemVer

## Install / Update Issues

### Symptom: cannot resolve / network / timeout

Actions:

- retry once (transient network)
- verify corporate proxy/VPN settings
- try a different network

### Symptom: installed version is not what you expected

Actions:

- run `clawhub list` to see what is pinned
- install/update with `--version <semver>` to force a specific version

## Sync Issues

### Symptom: sync would upload too much / unexpected files

Actions:

- use `--dry-run` if supported
- remove secrets and large artifacts from skill folders
- keep skill folders minimal: `SKILL.md`, `reference/`, small `scripts/`, small `assets/`



path: reference/WINDOWS-USAGE.md
content: # Windows Usage (No `.ps1` Scripts)

This skill package intentionally avoids shipping `.ps1` scripts.

On Windows, run `clawhub` commands directly from **PowerShell** or **Command Prompt**, or use Git Bash/WSL to run the shell scripts under `scripts/linux/`.

## Install

- Install latest:

```bash
clawhub install <skill-slug>
```

- Install pinned version:

```bash
clawhub install <skill-slug> --version <semver>
```

- Verify:

```bash
clawhub list
```

## Update

- Update all:

```bash
clawhub update --all
```

- Update one:

```bash
clawhub update <skill-slug>
```

- Update one to pinned version:

```bash
clawhub update <skill-slug> --version <semver>
```

## Publish

```bash
clawhub publish <skill-folder> --slug <slug> --name "<Display Name>" --version <semver> --tags latest
```

Example:

```bash
clawhub publish .\skills\my-skill --slug my-skill --name "My Skill" --version 0.1.0 --tags latest
```

## Sync

```bash
clawhub sync --all
```

If supported, consider:

- `--dry-run`
- `--bump patch|minor|major`
- `--changelog "Update skills"`

## Running the `.sh` scripts on Windows

If you want to use the shell scripts:

- **Git Bash**: run `bash scripts/linux/install-skill.sh <slug>`
- **WSL**: run the same commands inside WSL



path: assets/README.md
content: # Assets

This folder contains **reusable, non-code** assets for the `clawhub-cli` skill.

Recommended contents:

- `skill-icon.svg`: a small, text-based icon that can be reused in docs.
- `skill-card-template.md`: a markdown template to document skills consistently.

Keep assets lightweight. Prefer text formats (`.svg`, `.md`, `.json`, `.yaml`) over large binaries.



path: assets/skill-card-template.md
content: # <Skill Display Name>

**Slug**: `<skill-slug>`  
**Version**: `<semver>`  
**Tags**: `latest`  

## What This Skill Does

- <one-line value proposition>

## When to Use

- <signals / user intents>

## Inputs Needed

- <required inputs>
- <optional inputs>

## Common Commands / Workflows

```bash
<command template>
```

## Safety / Guardrails

- <things to avoid>

## Troubleshooting

- <most common failure + fix>



path: assets/skill-icon.svg
content: <svg xmlns="http://www.w3.org/2000/svg" width="256" height="256" viewBox="0 0 256 256">
  <defs>
    <linearGradient id="g" x1="0" x2="1" y1="0" y2="1">
      <stop offset="0" stop-color="#0f172a"/>
      <stop offset="1" stop-color="#1f2937"/>
    </linearGradient>
    <filter id="shadow" x="-20%" y="-20%" width="140%" height="140%">
      <feDropShadow dx="0" dy="10" stdDeviation="12" flood-color="#000" flood-opacity="0.35"/>
    </filter>
  </defs>

  <rect x="18" y="18" width="220" height="220" rx="44" fill="url(#g)" filter="url(#shadow)"/>

  <!-- Terminal window -->
  <rect x="56" y="72" width="144" height="120" rx="18" fill="#0b1020" stroke="#334155" stroke-width="4"/>
  <circle cx="76" cy="92" r="6" fill="#ef4444"/>
  <circle cx="96" cy="92" r="6" fill="#f59e0b"/>
  <circle cx="116" cy="92" r="6" fill="#22c55e"/>

  <!-- Prompt glyph -->
  <path d="M84 122 L112 138 L84 154" fill="none" stroke="#93c5fd" stroke-width="10" stroke-linecap="round" stroke-linejoin="round"/>
  <path d="M124 156 H172" fill="none" stroke="#e2e8f0" stroke-width="10" stroke-linecap="round"/>

  <!-- Hub ring -->
  <circle cx="184" cy="168" r="18" fill="none" stroke="#a78bfa" stroke-width="8" opacity="0.9"/>
  <circle cx="184" cy="168" r="4" fill="#a78bfa"/>
</svg>



Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)