第一次提交

app-instance/backend/nanobot/skills/clawhub/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: clawhub
+description: Search and install agent skills from ClawHub, the public skill registry.
+homepage: https://clawhub.ai
+metadata: {"nanobot":{"emoji":"🦞"}}
+---
+
+# ClawHub
+
+Public skill registry for AI agents. Search by natural language (vector search).
+
+## When to use
+
+Use this skill when the user asks any of:
+- "find a skill for …"
+- "search for skills"
+- "install a skill"
+- "what skills are available?"
+- "update my skills"
+
+## Search
+
+```bash
+npx --yes clawhub@latest search "web scraping" --limit 5
+```
+
+## Install
+
+Do not install directly into `~/.nanobot/workspace/skills/`. Workspace skills are review-gated.
+
+Review-first workflow:
+
+1. Search for the skill and show the user the candidate slug.
+2. Audit the skill before activation:
+   - inspect `SKILL.md`
+   - inspect the file list
+   - inspect required binaries / env vars
+   - inspect obvious network / shell / destructive behavior
+3. Ask the user for explicit approval.
+4. Only after approval, use the dedicated review flow to activate the skill.
+
+If you need a local staging copy for audit, install into a temporary directory that is **not** the live workspace, for example:
+
+```bash
+npx --yes clawhub@latest install <slug> --workdir /tmp/nanobot-skill-review
+```
+
+## Update
+
+Do not run bulk updates without the same review-first process. Treat every update like a fresh install.
+
+## List installed
+
+```bash
+npx --yes clawhub@latest list --workdir ~/.nanobot/workspace
+```
+
+## Notes
+
+- Requires Node.js (`npx` comes with it).
+- No API key needed for search and install.
+- Login (`npx --yes clawhub@latest login`) is only required for publishing.
+- Never activate a skill before the user has reviewed and approved it.
+- Direct writes into the live workspace skills directory are blocked by policy.
+- After approval and activation, remind the user to start a new session to load the skill.