admin/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-08-14 08:52:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: add clawhub scan command (#2479)

Browse Source 
* docs: design clawhub scan command

* docs: plan clawhub scan command

* feat: add clawhub scan command

* fix: prune ephemeral scan uploads

* fix: avoid scan route slug collision
This commit is contained in:
Patrick Erichsen
2026-06-03 16:05:11 -07:00
committed by GitHub
parent 162528abe4
commit e8cfbddf17
30 changed files with 2538 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/cli.md
+18
View File
@@ -189,6 +189,24 @@ Stores your API token + cached registry URL.
clawhub skill publish ./my-skill --version 1.0.0
```
### `scan [path]`
- Requires `clawhub login`.
- Runs ClawHub ClawScan through `POST /api/v1/skills/-/scan`, then polls until the scan is terminal.
- Local path scans are always ephemeral. They upload the local skill bundle for scanning, print the security report, and never create or update a published skill/version.
- Published scans require ownership or publisher management access. Moderators/admins can use the same backend through `clawhub-mod`.
- `--update` is valid only with `--slug`; it writes successful published scan results back to the selected version.
- `--output <file.zip>` downloads the full report archive with `manifest.json`, `clawscan.json`, `skillspector.json`, `static-analysis.json`, `virustotal.json`, and `README.md`.
- `--json` prints the full poll response for automation.
```bash
clawhub scan ./my-skill
clawhub scan ./my-skill --output report.zip
clawhub scan --slug gifgrep
clawhub scan --slug gifgrep --version 1.2.3
clawhub scan --slug gifgrep --update --output report.zip
```
#### GitHub Actions
ClawHub ships an official reusable workflow at