ClawHub Guide

ClawHub runs VirusTotal scanning on every upload and auto-hides skills that receive 3+ community reports. Publishers need a GitHub account at least one week old to publish. That baseline covers the obvious stuff.For anything handling sensitive credentials, do your own check. Three questions: Does the source code match what the description says? Are credentials read from env vars — not hardcoded? Does it only call the APIs it claims to call? That's it.Sort by install count when browsing. High install count + active GitHub + recent updates = a skill that real operators are using and that's being maintained. That's usually a better signal than the automated safety checks.For production workflows, prefer bundled skills (maintained by the OpenClaw core team) where they exist. Think of ClawHub the same way you'd think of npm — most packages are fine, but a quick review before you hand something your API keys is always worth it.

Built something useful? Publishing to ClawHub is built into the CLI. You need a GitHub account (at least one week old), a working SKILL.md manifest, and your skill packaged and tested.The publish command: `clawhub publish . --slug your-skill-name --name "Your Skill Name" --version 1.0.0 --tags latest`. The slug becomes the install identifier — `clawhub install your-skill-name`. Pick something descriptive and lowercase with hyphens.Your skill package can be up to 50MB and must include a SKILL.md file with valid YAML frontmatter. Optional support files (scripts, configs, assets) can accompany it. ClawHub runs automated security scanning on upload before the skill becomes visible.Free skills build your reputation in the community. If you want to charge for a skill, you'll need a publisher account for payment processing — ClawHub handles distribution and takes a small cut. You keep the rest.