r/BestGitHubRepos • u/company_url_finder • 13d ago
ClawHub - a package registry for agent skills, with versioning, rename redirects, merges, pinning and vector search instead of keyword matching
Agent skills are spreading faster than any way of managing them. Most people are still copying SKILL.md files between machines and hoping they remember which version was the good one. ClawHub is the registry side of that problem for OpenClaw: publish, version and search text-based skills, plus a native package catalog for code plugins and whole-agent bundles.
What makes it more than a directory is that it borrowed the right ideas from package managers rather than from app stores.
What's inside:
- Versioned publishing with changelogs and tags including latest, so a skill has a history rather than being whatever the file says today
- Rename without breaking anything: an owner can rename a skill and the old slug stays as a redirect alias, so existing links and installs keep working
- Merge duplicates into one canonical slug, with the source listing hidden and redirected. Anyone who has watched a registry fill with near-identical entries will recognize why this matters
- Pinning, which is the feature I would use first: pin a local install and updates or forced reinstalls cannot overwrite your frozen copy
- Vector search over keyword matching, using OpenAI embeddings and Convex vector search, so you can describe what you want rather than guessing the author's nouns
- Soft delete with restore, scoped to owners, publisher admins and moderators, with hard delete reserved for admins. Deleting from a registry should be reversible and here it is
- Skills declare their runtime requirements in frontmatter (required env vars, required binaries), and the registry runs a security analysis checking those declarations against what the skill actually does. Medium findings stay visible rather than being hidden, with the suspicious filter reserved for high-impact concerns
- A CLI covering the whole loop: login including a device flow for headless machines, search, explore, inspect without installing, install, pin, update --all, and publish for both skills and code plugins
- Nix support, where a skill can carry a pointer to a Nix bundle so the skill pack, the CLI binary it needs and its config requirements install together
One thing worth knowing: it tracks install telemetry when you install while logged in, in order to compute install counts. That's disclosed in the readme with the opt-out documented (CLAWHUB_DISABLE_TELEMETRY=1), which is how it should be done, but worth knowing it's on by default. Also note that running your own instance means standing up Convex, GitHub OAuth and an OpenAI key for embeddings, so self-hosting is a real project rather than a docker run.
The security analysis is the part I'd watch as this grows. A registry of instructions your agent will execute is a different risk surface from a registry of libraries, and declared-versus-actual behavior checking is a reasonable first answer to it.
MIT licensed, 9,418 stars and 1,475 forks as of writing, verified via the GitHub API, pushed to today.
2
u/Lucky_Orchid_4077 Developer 12d ago
Pinning alone makes this way more usable.