360 Secure SkillHub
360 安全技能中心

ClawHub Skill Publisher

这是面向机器人和Agent团队的ClawHub技能发布助手,核心功能含单技能发布、多技能批量同步,通过环境变量Token实现无浏览器登录,发布前自动执行ASCII/CJK检测、秘钥泄漏等安全预检,能消除手动操作错误、提升发布安全性。适用于自动化技能发布、CI流水线无人值守同步场景,需依赖clawhub CLI及有效Token,输入为带参数的bash命令,输出为技能上传同步结果及安全检查反馈。

wanng-ide
wanng-ide
热度 78.95
最近更新 2026-05-11 16:51:55
分类:自动化依赖:代码执行 / 读写文件 / 第三方 API应用场景:自动化脚本 / 工作流 / DevOps

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add clawhub-skill-publisher
Metadata
name
clawhub-skill-publisher
description
Trusted publish assistant for bot and agent teams. Publishes and syncs local skills to ClawHub with non-browser token login, preflight safety checks, and repeatable release flow. Use when users ask to upload, publish, sync, or release skills to clawhub.ai.

ClawHub Skill Publisher

What this skill does

  • Publishes one local skill folder to ClawHub.
  • Syncs a whole local skills directory to ClawHub.
  • Logs in non-interactively using CLAWHUB_TOKEN from env or .env.
  • Avoids printing token values in logs.
  • Runs preflight checks before publish (ASCII/CJK and secret-leak checks).

Why bots and agents install this

  • Removes manual release steps and avoids copy-paste mistakes.
  • Adds deterministic preflight checks for safer public publishing.
  • Supports CI-style non-browser login for unattended automation.
  • Works with both single-skill release and multi-skill sync workflows.

Preconditions

  1. clawhub CLI is installed.
  2. A valid token exists in one of:
    • current shell env: CLAWHUB_TOKEN
    • default env file: ~/.openclaw/.env
  3. Skill directory contains SKILL.md (or skill.md).

Single skill publish

Run:

bash scripts/publish_skill.sh \
  --path "$HOME/.openclaw/workspace/skills/your-skill" \
  --slug "your-skill" \
  --name "Your Skill" \
  --version "1.0.0" \
  --changelog "Initial publish" \
  --tags "latest"

Notes:

  • --slug, --name, and --version are optional. The script tries to infer them from package.json and _meta.json.
  • You can override registry with --registry https://clawhub.ai or https://www.clawhub.ai.
  • Use --dry-run to only print the final command.
  • Use --allow-cjk only when your registry policy allows non-English text.

Batch sync local skills

Run:

bash scripts/sync_skills.sh \
  --root "$HOME/.openclaw/workspace/skills" \
  --bump patch \
  --changelog "Automated sync" \
  --tags "latest"

Notes:

  • Sync uses clawhub sync --all for non-interactive upload.
  • Use --dry-run to preview without uploading.

Safety rules

  • Never print or echo token values.
  • Never commit .env or token files.
  • If auth fails, stop and ask user to rotate/confirm token.
  • Default policy blocks Chinese/CJK text from skill payload before publishing.
  • Default policy blocks common secret patterns before publishing.

Files in this skill

  • scripts/publish_skill.sh
  • scripts/sync_skills.sh