Skill Hub
@PhenixStar
npx machina-cli add skill @PhenixStar/skill-hub --openclawSkill Hub
Unified skill discovery, security vetting, and installation for OpenClaw.
Commands
Search Skills
Find skills by keyword, category, or credibility score.
python3 scripts/skill-hub-search.py --query "spreadsheet"
python3 scripts/skill-hub-search.py --category "DevOps" --min-score 60
python3 scripts/skill-hub-search.py --query "auth" --live # include live ClawHub results
python3 scripts/skill-hub-search.py --installed # show only installed
python3 scripts/skill-hub-search.py --not-installed --limit 20 # discovery mode
Install Skills
After finding a skill, install via ClawHub:
npx clawhub@latest install <skill-slug>
Vet Skills (Security Scan)
Scan a skill for malicious patterns, prompt injection, and logic weaknesses.
python3 scripts/skill-hub-vet.py --slug google-sheets # vet single skill
python3 scripts/skill-hub-vet.py --all-installed # vet all installed
python3 scripts/skill-hub-vet.py --category "DevOps" # vet category
python3 scripts/skill-hub-vet.py --top 10 # vet top N unvetted
Status Dashboard
See installed vs catalog coverage, unvetted warnings, recommendations.
python3 scripts/skill-hub-status.py
Quick Check (GitHub API)
Fast check if new skills were added since last sync. Uses gh CLI — no full download needed.
python3 scripts/skill-hub-quick-check.py # check for updates
python3 scripts/skill-hub-quick-check.py --sync # auto-sync if updates found
python3 scripts/skill-hub-quick-check.py --query "ai" # check + search new skills
Browse Full Catalog
Export catalog as formatted table (terminal or markdown), grouped by category.
python3 scripts/skill-hub-table-export.py # terminal table
python3 scripts/skill-hub-table-export.py --format markdown # markdown table
python3 scripts/skill-hub-table-export.py --category "AI" # filter category
Sync Catalog
Full re-fetch from GitHub awesome-list. Computes credibility, preserves vet results, shows diff.
python3 scripts/skill-hub-sync.py
Credibility Scores (0-100)
| Tier | Score | Meaning |
|---|---|---|
| Trusted | 85-100 | Curated + vetted + mature |
| Good | 60-84 | Curated or vetted, some signals |
| Unvetted | 30-59 | Exists in registry, not scanned |
| Caution | 0-29 | Missing signals or security warnings |
Security Checks
Code-level: eval/exec, shell injection, obfuscation, network access, env harvesting, destructive ops.
NLP/Prompt-level: hidden instructions, role hijacking, invisible unicode, exfiltration prompts, authority escalation, social engineering.
When to Use
- User asks "find a skill for X" or "is there a skill that can..."
- User wants to extend capabilities with new tools
- User wants to check if installed skills are safe
- Before installing unknown skills from registry
Overview
Skill Hub unifies OpenClaw skill discovery, security vetting, and installation. It searches 3000+ curated skills from the ClawHub registry and the awesome-openclaw-skills catalog, scores credibility, and detects prompt injection and other malicious patterns, while managing installations. It also performs quick GitHub checks to surface new skills.
How This Skill Works
The hub aggregates curated skill lists, computes credibility scores, and runs both code-level and NLP prompt-level security checks. It then facilitates installation via CLI commands and provides a status dashboard plus quick-checks to keep the catalog in sync with new skills.
When to Use It
- When a user asks for a skill for a specific task or capability and wants vetted options.
- Before installing unknown or new skills from the registry to minimize risk.
- To check installed skills for security issues or prompt-injection patterns.
- To discover and compare skills across the ClawHub registry and related catalogs.
- When you want a quick update on new skills added since the last sync.
Quick Start
- Step 1: Search or browse skills with skill-hub-search.py or browse commands.
- Step 2: Vet or install a selected skill; use: npx clawhub@latest install <skill-slug> and/or skill-hub-vet.py --slug <slug>.
- Step 3: Optionally run quick-check or view status to verify updates.
Best Practices
- Always vet new candidates with Skill Hub’s security checks before installation.
- Filter searches using credibility scores to prioritize trusted skills.
- Regularly run the quick-check and status dashboard to stay up-to-date.
- Preserve vet results when syncing or updating the catalog for auditing.
- Verify installation success and monitor for any post-install issues.
Example Use Cases
- A developer searches for a DevOps skill with a high credibility score and installs it after vetting.
- An team runs the quick-check to surface newly added AI skills since the last sync.
- A project manager exports the catalog to a markdown table to share with stakeholders.
- Security engineers vet all installed skills and re-run audits after updates.
- A user filters by category 'AI' and min-score to compare top options before installation.
