# ClawHub CLI: Complete Command Reference for Skill Management The ClawHub registry grew from 5,700 skills in February 2026 to over 44,000 by April, but the CLI that manages all of it remains poorly documented outside its own repo. This guide covers every ClawHub CLI command grouped by workflow: authentication, discovery, installation, publishing, package verification, and batch sync for CI pipelines. Source: https://fast.io/resources/clawhub-cli-guide/ Last reviewed: 2026-06-09 ## What the ClawHub CLI Actually Does The ClawHub registry grew from 5,700 skills in early February 2026 to over 44,000 by April, a roughly 670% expansion in three months. That growth happened because the barrier to publishing is low: a SKILL.md file, a GitHub account, and one CLI command. But the same openness that drove adoption also drove a security incident where 341 malicious skills were distributed through typosquatted names in a campaign tracked as ClawHavoc. The ClawHub CLI is the command-line tool for OpenClaw's skill and plugin registry, letting you discover, install, publish, and manage agent skills from the terminal. It handles the authenticated side of the registry: publishing, deletion, ownership transfer, security scanning, and batch sync. OpenClaw's own CLI includes a basic skill installation command, but ClawHub's CLI is what you need for anything beyond consumption. The distinction matters. If you only install and update skills, OpenClaw's built-in commands work fine. If you publish skills, manage versions, verify package integrity, or run CI pipelines that batch-publish skill folders, you need the ClawHub CLI. For teams storing skill artifacts and agent output in a shared workspace, [Fastio's Business Trial](/storage-for-agents/) pairs well with ClawHub's publish-and-sync workflow. Install instructions are in the [ClawHub repository README](https://github.com/openclaw/clawhub). After installation, verify with `clawhub --version`. Every command supports `--json` for machine-readable output and `--no-input` to disable interactive prompts in CI environments. The [ClawHub CLI documentation](https://github.com/openclaw/clawhub/blob/main/docs/cli.md) covers the full command surface. This guide organizes those commands by workflow so you can find the right one without scrolling through a flat reference. ## How to Authenticate Across Local, CI, and Headless Environments ClawHub authentication flows map to three environments: local development, headless CI, and remote servers without a browser. **Browser login (default):** ```bash clawhub login ``` This opens your browser to `clawhub.ai/cli/auth` with a loopback callback. Approve the request and the CLI stores your token locally. **Token-based login for CI:** ```bash clawhub login --token clh_abc123... ``` Generate tokens from your ClawHub account settings. Store them in `CLAWHUB_TOKEN` or pass them directly. This is the standard approach for GitHub Actions, GitLab CI, and similar automation. **Device-code flow for remote/headless machines:** ```bash clawhub login --device ``` Prints a code and URL. Open the URL on any device, enter the code, and the CLI picks up the token. After login, verify your session: ```bash clawhub whoami ``` For scripts that need the raw token (piping to another tool, setting environment variables), use `clawhub token` to print it to stdout. ### Environment Variables ClawHub respects several environment variables for configuration without flags: - `CLAWHUB_SITE` overrides the browser login base URL (default: `https://clawhub.ai`) - `CLAWHUB_REGISTRY` overrides the API base URL for self-hosted registries - `CLAWHUB_WORKDIR` sets the working directory without `--workdir` - `CLAWHUB_CONFIG_PATH` points to a custom config file - `CLAWHUB_DISABLE_TELEMETRY` turns off usage telemetry - Standard proxy variables (`HTTPS_PROXY`, `HTTP_PROXY`, `NO_PROXY`) work for corporate networks ## Discovery: Search, Explore, and Inspect Three commands cover skill discovery, each at a different level of detail. **Search by keyword:** ```bash clawhub search file storage agent ``` Search queries hit `/api/v1/search` and prioritize exact slug/name matches before falling back to popularity ranking. Natural language queries work here: "file storage for agents" returns relevant results, not just exact string matches. **Browse the registry:** ```bash clawhub explore --sort trending --limit 10 ``` Explore lists skills from the registry feed. Sort options include `newest`, `updated`, `downloads`, `rating`, `installs`, `installsAllTime`, and `trending`. Set `--limit` from 1 to 200 (default: 25). Add `--json` for structured output. **Inspect before installing:** ```bash clawhub inspect web-search ``` Inspect fetches full metadata without downloading the skill. Add `--versions` to see the version history with `--limit` to control how many versions appear. Use `--files` to list the skill's file tree, or `--file SKILL.md` to read a specific file's contents directly. Specify `--version 2.1.0` or `--tag latest` to inspect a particular release. ## Installation, Pinning, and Updates Skill installation downloads a versioned zip from the registry and extracts it into your skills directory (default: `./skills/`). **Install a skill:** ```bash clawhub install web-search ``` This resolves the latest version and writes a lockfile entry. The CLI refuses to overwrite pinned skills, which prevents accidental version changes in production setups. **List installed skills:** ```bash clawhub list ``` Reads the lockfile and displays installed skills with their version and pin status. **Pin a skill to its current version:** ```bash clawhub pin web-search --reason "stable for production workflow" ``` Pinned skills are skipped by `clawhub update --all`, so pinning is the mechanism for freezing a known-good version while letting everything else update. Remove the pin with `clawhub unpin `. **Update skills:** ```bash clawhub update web-search clawhub update --all ``` Update computes a fingerprint and only downloads if the remote version differs. Use `--force` to overwrite even when fingerprints mismatch (for example, after a local edit). Pinned skills are always skipped by `--all` unless you explicitly name them. **Uninstall:** ```bash clawhub uninstall web-search ``` Removes the skill directory and lockfile entry. In non-interactive environments (CI), add `--yes` to skip the confirmation prompt. ### Where Installed Skills Live By default, skills install into a `skills/` directory relative to your working directory. Override this with the `--dir` flag: ```bash clawhub install web-search --dir ./my-agent/skills ``` The `--workdir` flag changes the base directory for all operations. Set `CLAWHUB_WORKDIR` in your shell profile to avoid repeating it. ## How to Publish, Version, and Transfer Skill Ownership Publishing is where the ClawHub CLI separates from OpenClaw's built-in commands. You need a GitHub account (at least one week old) and a local folder containing a SKILL.md file. **Publish a skill:** ```bash clawhub skill publish ./my-skill --version 1.0.0 ``` The CLI uploads the folder contents via multipart upload. The `--version` flag is required and must follow semver. Add `--owner ` to publish under an organization instead of your personal account. Use `--migrate-owner` when transferring a skill from a personal to an organization publisher. **Rename a skill:** ```bash clawhub skill rename old-slug new-slug ``` Renaming creates a redirect alias so existing installs still resolve. Anyone following the old slug gets routed to the new one. **Merge two skills:** ```bash clawhub skill merge deprecated-skill active-skill ``` Merges the source into the target. The source slug becomes a permanent alias. Both skills must share the same owner. **Transfer ownership:** ```bash clawhub transfer request my-skill target-user --message "Maintained by your team now" ``` The transfer system is handshake-based. The recipient runs `clawhub transfer accept my-skill` or `clawhub transfer reject my-skill`. List pending transfers with `clawhub transfer list` (incoming) or `clawhub transfer list --outgoing`. Cancel a pending request with `clawhub transfer cancel my-skill`. **Delete and restore:** ```bash clawhub delete my-skill --reason "Replaced by v2 skill" clawhub undelete my-skill ``` Delete is a soft-delete (also available as `clawhub hide`). Restore with `undelete` or `unhide`. Both accept `--reason` for audit trails. **Star a skill:** ```bash clawhub star web-search ``` Stars are public highlights, similar to GitHub stars. Remove with `clawhub unstar `. ## Packages, Security Scanning, and CI Sync ClawHub supports both skills (text-based SKILL.md bundles) and packages (code plugins that run inside OpenClaw). Package commands live under the `clawhub package` namespace and have their own discovery, verification, and publishing workflows. **Browse packages:** ```bash clawhub package explore --family code-plugin --official ``` The explore command supports granular filters: `--family` (skill, code-plugin, bundle-plugin), `--os`, `--arch`, `--requires-browser`, `--executes-code`, and `--external-service `. These filters matter because code plugins run with system access, and you want to know what you are granting before installation. **Verify artifact integrity:** ```bash clawhub package verify ./downloaded-plugin.tgz ``` `clawhub package verify` computes and checks SHA-256 checksums against the registry record. You can also supply `--npm-integrity` for SRI hashes or `--npm-shasum` for SHA-1. This is the command to run after downloading a package outside the normal install flow, such as in air-gapped environments or manual audits. **Validate a plugin offline:** ```bash clawhub package validate ./my-plugin --runtime --allow-execute ``` Validate runs the Plugin Inspector against a local folder or tarball without uploading anything. Use `--runtime` to test actual execution and `--allow-execute` to permit code execution during validation. The `--openclaw ` flag points to a specific OpenClaw binary for compatibility testing. **Security scanning:** ```bash clawhub scan --slug suspicious-skill ``` Scan runs ClawScan asynchronously against a published skill. Add `--version` to scan a specific release. Download scan reports as ZIPs with `clawhub scan download --version 1.0.0`. Given that the ClawHavoc campaign distributed 341 malicious skills through typosquatted names, scanning skills before installing them in production is worth the extra step. **Batch sync for CI:** ```bash clawhub sync --root ./skills --dry-run --json ``` `clawhub sync` scans skill folders and publishes anything new or changed. It is designed for CI pipelines: point `--root` at one or more directories, set `--concurrency` for parallel uploads, and use `--dry-run` to preview what would publish. Add `--bump patch` to auto-increment versions, `--changelog "Fixed edge case"` for release notes, and `--tags agent,storage` for categorization. The `--source-repo`, `--source-commit`, and `--source-ref` flags embed provenance metadata from your CI environment. For organizations managing multiple publishers, `clawhub publisher create ` sets up an organization account, and `--owner ` on publish/sync commands routes content to the right publisher. ## Frequently asked questions ### How do I install a ClawHub skill? Run `clawhub install ` to download and install the latest version of a skill. The CLI resolves the version, downloads the skill zip, and extracts it into your skills directory (default: `./skills/`). OpenClaw's own CLI also includes a basic install command if you only need to add skills without ClawHub's publishing and management features. ### What is the difference between ClawHub CLI and OpenClaw CLI? OpenClaw's built-in CLI handles basic skill consumption: installing and updating skills in your active workspace. The ClawHub CLI covers authenticated registry operations: publishing, versioning, deletion, ownership transfer, security scanning, package verification, and batch sync for CI pipelines. Use OpenClaw's CLI for day-to-day skill use, ClawHub CLI for skill authorship and pipeline automation. ### How do I publish a skill to ClawHub? Create a folder containing a SKILL.md file, then run `clawhub skill publish ./your-folder --version 1.0.0`. You need a GitHub account that is at least one week old. Add `--owner ` to publish under an organization. Use `--dry-run` to preview the publish plan without uploading. ### How do I update all installed ClawHub skills? Run `clawhub update --all` to check every installed skill for newer versions. Pinned skills are automatically skipped. To update a single skill, use `clawhub update `. Add `--force` to overwrite even when the local fingerprint does not match the remote version. ### How do I verify a ClawHub package is safe to install? Use `clawhub package verify ` to check SHA-256 checksums against the registry record after downloading. For pre-install scanning of published skills, run `clawhub scan --slug ` to trigger an asynchronous ClawScan security analysis. You can also run `clawhub inspect --files` to review a skill's file tree before installing. ### What does clawhub sync do? The sync command scans local skill folders and batch-publishes any skills that are new or have changed since the last sync. It is designed for CI pipelines: set `--root` to point at your skill directories, `--concurrency` for parallel uploads, and `--dry-run` to preview changes. Source provenance flags (`--source-repo`, `--source-commit`) embed CI metadata into the published skill. ## About Fast.io Fast.io provides shared workspaces where people and AI agents work on the same files, with built-in semantic search and citation-backed chat over what they hold. Agents reach it through a remote MCP server at https://mcp.fast.io/mcp, a REST API at https://api.fast.io/current/, and a command line client published on npm as @vividengine/fastio-cli.