ClawHub CLI: Complete Command Reference for Skill Management

The ClawHub registry grew from 5,700 skills in early February 2026 to over 44,000 by April, a roughly 670% expansion in three months. That growth happened because the barrier to publishing is low: a SKILL.md file, a GitHub account, and one CLI command. But the same openness that drove adoption also drove a security incident where 341 malicious skills were distributed through typosquatted names in a campaign tracked as ClawHavoc.

The ClawHub CLI is the command-line tool for OpenClaw's skill and plugin registry, letting you discover, install, publish, and manage agent skills from the terminal. It handles the authenticated side of the registry: publishing, deletion, ownership transfer, security scanning, and batch sync. OpenClaw's own CLI includes a basic skill installation command, but ClawHub's CLI is what you need for anything beyond consumption.

The distinction matters. If you only install and update skills, OpenClaw's built-in commands work fine. If you publish skills, manage versions, verify package integrity, or run CI pipelines that batch-publish skill folders, you need the ClawHub CLI. For teams storing skill artifacts and agent output in a shared workspace, Fastio's Business Trial pairs well with ClawHub's publish-and-sync workflow.

Install instructions are in the ClawHub repository README. After installation, verify with clawhub --version. Every command supports --json for machine-readable output and --no-input to disable interactive prompts in CI environments.

The ClawHub CLI documentation covers the full command surface. This guide organizes those commands by workflow so you can find the right one without scrolling through a flat reference.

ClawHub authentication flows map to three environments: local development, headless CI, and remote servers without a browser.

Browser login (default):

clawhub login

This opens your browser to clawhub.ai/cli/auth with a loopback callback. Approve the request and the CLI stores your token locally.

Token-based login for CI:

clawhub login --token clh_abc123...

Generate tokens from your ClawHub account settings. Store them in CLAWHUB_TOKEN or pass them directly. This is the standard approach for GitHub Actions, GitLab CI, and similar automation.

Device-code flow for remote/headless machines:

clawhub login --device

Prints a code and URL. Open the URL on any device, enter the code, and the CLI picks up the token.

After login, verify your session:

clawhub whoami

For scripts that need the raw token (piping to another tool, setting environment variables), use clawhub token to print it to stdout.

Three commands cover skill discovery, each at a different level of detail.

Search by keyword:

clawhub search file storage agent

Search queries hit /api/v1/search and prioritize exact slug/name matches before falling back to popularity ranking. Natural language queries work here: "file storage for agents" returns relevant results, not just exact string matches.

Browse the registry:

clawhub explore --sort trending --limit 10

Explore lists skills from the registry feed. Sort options include newest, updated, downloads, rating, installs, installsAllTime, and trending. Set --limit from 1 to 200 (default: 25). Add --json for structured output.

Inspect before installing:

clawhub inspect fast-io

Inspect fetches full metadata without downloading the skill. Add --versions to see the version history with --limit to control how many versions appear. Use --files to list the skill's file tree, or --file SKILL.md to read a specific file's contents directly. Specify --version 2.1.0 or --tag latest to inspect a particular release.

Give your OpenClaw agent persistent file storage

Fastio's Business Trial includes 50GB storage, included credits, and an MCP server your agent can call directly. No credit card, no trial expiration.

Start 14-Day Trial

Skill installation downloads a versioned zip from the registry and extracts it into your skills directory (default: ./skills/).

Install a skill:

clawhub install fast-io

This resolves the latest version and writes a lockfile entry. The CLI refuses to overwrite pinned skills, which prevents accidental version changes in production setups.

List installed skills:

clawhub list

Reads the lockfile and displays installed skills with their version and pin status.

Pin a skill to its current version:

clawhub pin fast-io --reason "stable for production workflow"

Pinned skills are skipped by clawhub update --all, so pinning is the mechanism for freezing a known-good version while letting everything else update. Remove the pin with clawhub unpin <slug>.

Update skills:

clawhub update fast-io
clawhub update --all

Update computes a fingerprint and only downloads if the remote version differs. Use --force to overwrite even when fingerprints mismatch (for example, after a local edit). Pinned skills are always skipped by --all unless you explicitly name them.

Uninstall:

clawhub uninstall fast-io

Removes the skill directory and lockfile entry. In non-interactive environments (CI), add --yes to skip the confirmation prompt.

clawhub install fast-io --dir ./my-agent/skills

Publishing is where the ClawHub CLI separates from OpenClaw's built-in commands. You need a GitHub account (at least one week old) and a local folder containing a SKILL.md file.

Publish a skill:

clawhub skill publish ./my-skill --version 1.0.0

The CLI uploads the folder contents via multipart upload. The --version flag is required and must follow semver. Add --owner <handle> to publish under an organization instead of your personal account. Use --migrate-owner when transferring a skill from a personal to an organization publisher.

Rename a skill:

clawhub skill rename old-slug new-slug

Renaming creates a redirect alias so existing installs still resolve. Anyone following the old slug gets routed to the new one.

Merge two skills:

clawhub skill merge deprecated-skill active-skill

Merges the source into the target. The source slug becomes a permanent alias. Both skills must share the same owner.

Transfer ownership:

clawhub transfer request my-skill target-user --message "Maintained by your team now"

The transfer system is handshake-based. The recipient runs clawhub transfer accept my-skill or clawhub transfer reject my-skill. List pending transfers with clawhub transfer list (incoming) or clawhub transfer list --outgoing. Cancel a pending request with clawhub transfer cancel my-skill.

Delete and restore:

clawhub delete my-skill --reason "Replaced by v2 skill"
clawhub undelete my-skill

Delete is a soft-delete (also available as clawhub hide). Restore with undelete or unhide. Both accept --reason for audit trails.

Star a skill:

clawhub star fast-io

Stars are public highlights, similar to GitHub stars. Remove with clawhub unstar <slug>.

ClawHub supports both skills (text-based SKILL.md bundles) and packages (code plugins that run inside OpenClaw). Package commands live under the clawhub package namespace and have their own discovery, verification, and publishing workflows.

Browse packages:

clawhub package explore --family code-plugin --official

The explore command supports granular filters: --family (skill, code-plugin, bundle-plugin), --os, --arch, --requires-browser, --executes-code, and --external-service <name>. These filters matter because code plugins run with system access, and you want to know what you are granting before installation.

Verify artifact integrity:

clawhub package verify ./downloaded-plugin.tgz

clawhub package verify computes and checks SHA-256 checksums against the registry record. You can also supply --npm-integrity for SRI hashes or --npm-shasum for SHA-1. This is the command to run after downloading a package outside the normal install flow, such as in air-gapped environments or manual audits.

Validate a plugin offline:

clawhub package validate ./my-plugin --runtime --allow-execute

Validate runs the Plugin Inspector against a local folder or tarball without uploading anything. Use --runtime to test actual execution and --allow-execute to permit code execution during validation. The --openclaw <path> flag points to a specific OpenClaw binary for compatibility testing.

Security scanning:

clawhub scan --slug suspicious-skill

Scan runs ClawScan asynchronously against a published skill. Add --version to scan a specific release. Download scan reports as ZIPs with clawhub scan download <name> --version 1.0.0. Given that the ClawHavoc campaign distributed 341 malicious skills through typosquatted names, scanning skills before installing them in production is worth the extra step.

Batch sync for CI:

clawhub sync --root ./skills --dry-run --json

clawhub sync scans skill folders and publishes anything new or changed. It is designed for CI pipelines: point --root at one or more directories, set --concurrency for parallel uploads, and use --dry-run to preview what would publish. Add --bump patch to auto-increment versions, --changelog "Fixed edge case" for release notes, and --tags agent,storage for categorization. The --source-repo, --source-commit, and --source-ref flags embed provenance metadata from your CI environment.

For organizations managing multiple publishers, clawhub publisher create <handle> sets up an organization account, and --owner <handle> on publish/sync commands routes content to the right publisher.