ClawHub Skills: Install and Review Safely

ClawHub is the public OpenClaw Skills registry. Treat it as a discovery and distribution layer, not as a blanket approval of every instruction.

Verify the exact publisher and Skill

Use the owner-qualified reference:

openclaw skills verify @owner/skill-name
openclaw skills verify @owner/skill-name --card

ClawHub exposes registry verification and scanner signals. A failed verification should stop the install; a passing scan is still not proof that the workflow matches your risk tolerance.

Read the source

Review SKILL.md plus every referenced script. Pay special attention to:

• remote downloads and package installation;
• shell commands built from user input;
• access to environment variables or credential files;
• broad recursive file operations;
• instructions that upload local data.

Install at the narrowest scope

openclaw skills install @owner/skill-name

Workspace scope is easier to reason about than a shared global install. Promote a Skill to global scope only after it has been reviewed and used successfully in a controlled workspace.

Keep origin and updates visible

Use OpenClaw’s update flow for tracked ClawHub installs, and review material version changes before applying them to privileged agents.

Expected result

The installed Skill retains a known owner and version, its source and scanner signals have been reviewed, and a controlled test shows only the intended behavior and tool scope.