ClawHub Publish Conventionsv1.1.0

A developer creates a new cybersecurity automation skill and needs to publish it on ClawHub. They must follow the file inclusion rules, metadata requirements, and versioning conventions to ensure successful publication and scanner clearance.

An AI agent skill requires an update to fix a bug or add a feature. The developer must increment the version, add a changelog, and republish, ensuring all metadata and file inclusions are correct to avoid rejection.

A skill containing legitimate security mechanisms like obfuscation or sandboxing is flagged by ClawHub's scanner. The developer must add a 'Security Disclaimers' section in SKILL.md and README.md explaining the context to clear the scan.

A developer creates a skill that runs untrusted code and needs a secure sandbox. They follow the distroless Docker pattern to build a minimal image without a shell, reducing attack surface while maintaining Python functionality.

A skill spawns subprocesses and must pass the scanner's security checks. The developer implements environment scrubbing and command validation to prevent command injection and secret leakage, ensuring a CLEAN verdict.

Developers publish cybersecurity or automation skills on ClawHub and earn royalties each time their skill is used or subscribed to. Revenue scales with the number of active users or installations.

Companies license specialized skills (e.g., for compliance scanning) internally via ClawHub. They pay an annual fee for a bundle of skills tailored to their security operations.

Expert developers offer consulting to build custom ClawHub skills for clients, including packaging, scanning defense, and publishing. They charge a one-time development fee plus optional maintenance.