$ ~/registry/skill/openclaw-agents-skills-clawhub-moderation

SKILL

clawhub-moderation

Name: clawhub-moderation
Author: openclaw

Perform ClawHub moderation actions like bans, role changes, and status checks.

Stars

★ 9,034

Source

GitHub

Updated

2026-06-25

// securityCaution

Prompt only, no code
Open source

Summary

The material indicates an open-source, prompt-oriented moderation skill with no standalone secrets or fixed external endpoints declared, so overall risk appears low. However, it is designed for high-privilege moderation actions and relies on a local repo tool that uses existing CLI/API auth, so code execution, data access, and credential context still warrant caution.

CredentialsCaution

The material declares no standalone environment variables, but the README explicitly says it reuses existing ClawHub CLI auth/config and API-token context. This means the skill does not introduce new secrets by itself, yet it operates within potentially high-privilege token context for bans and role changes, so misuse impact should be considered and least privilege verified.

Network egressCaution

No fixed remote host is listed, but the README states that the tool wraps existing HTTP API surfaces and verifies via CLI/API after writes. It is therefore reasonable to expect moderation data to be sent to ClawHub-related APIs. This is normal network behavior for such a tool, and the material shows no red flag of exfiltration to unrelated or unknown endpoints.

Code executionCaution

The README repeatedly instructs running `bun run mod -- ...` from the ClawHub repo root, indicating local execution of the repo-local `clawhub-mod` command and Bun scripts. This is standard local process execution, but because it can trigger high-impact writes such as bans, unbans, role changes, and report triage, the actual repository code and command arguments should be reviewed before use.

Data accessCaution

The material does not declare extra filesystem permissions, but the skill depends on a checked-out local repository and reads existing CLI auth/config. Its targets also include sensitive business data such as user accounts, skill state, reports, and moderation status. No overbroad access beyond the stated purpose is described, but it should be assumed to access at least repository contents and related local configuration.

Supply chainCaution

Positive signals include GitHub availability and the system classification as open-source/prompt-only, which improves auditability. However, the repository has no declared license, zero stars, unknown maintenance status, and the skill depends on a repo-local tool whose implementation details matter, so source trust is not strong enough to rate as safe. No obvious malicious or prompt-injection red flags are visible, but the repository contents and recent commits should be verified first.

Recommendations

Use it only from a verified ClawHub official/internal repository checkout, and inspect the scripts and dependencies behind `bun run mod` first.
Use a least-privilege account or dedicated moderation token instead of running directly under a long-lived personal high-privilege token.
Keep the README safeguards of explicit targets, reasons, and confirmation before writes to reduce accidental bans or role changes.
Confirm the actual CLI/API domains and environment before execution to avoid operating on the wrong environment.

Audited by: gpt-5.4 · 2026-06-17

// install

Copy the install command and let the AI configure it · recommended for beginners

Please install the "clawhub-moderation" skill from askskill:
1. Download https://raw.githubusercontent.com/openclaw/clawhub/main/.agents/skills/clawhub-moderation/SKILL.md
2. Save it as ~/.claude/skills/clawhub-moderation/SKILL.md
3. Reload skills and tell me it's ready

// download

Download SKILL.mdInstall manifest ↗

// examples

Ban a violating user

Prompt

Use clawhub-mod to ban user user_123 for repeatedly posting spam skills, then return the current ban status.

Expected

Returns the ban result, recorded reason, and the user's current ban status.

Unhide a hidden skill

Prompt

Use clawhub-mod to unhide skill skill_456 and confirm that the skill is now visible to users.

Expected

Returns the unhide result and states whether the skill is visible again.

Change a user role and verify

Prompt

Use clawhub-mod to change user user_789's role to moderator, then check and report the current role and moderation state.

Expected

Returns the role change result and reports the user's updated role and related moderation state.

// docs

ClawHub Moderation

Use the repo-local clawhub-mod tool from a checked-out ClawHub repo. It wraps the existing ClawHub CLI auth/config and HTTP API surfaces. Do not call Convex internal mutations directly for staff actions.

Safety Rules

Require an explicit target from the user: skill slug, user handle, or user id.
Require a reason for skills unhide, users ban, and users unban.
Before any write, show the exact command and ask for confirmation unless the user already said to proceed or supplied --yes.
Prefer handles for humans. Use --id only when the user provides a user id.
Never bypass API-token auth, server role checks, or audit logging.
After the write, verify state with the CLI/API and report the result.

Commands

Run from the ClawHub repo root:

bun run mod -- --help

Authenticate or validate the current token:

bun run mod -- login
bun run mod -- whoami

Unhide a skill after moderator review:

bun run mod -- skills unhide <slug> --reason "<reason>" --yes

List and triage skill reports:

bun run mod -- skills reports --status open
bun run mod -- skills triage-report <report-id> --status confirmed --action hide --note "<note>" --yes

Ban a user:

bun run mod -- users ban <handleOrId> --reason "<reason>" --yes

Unban a user:

bun run mod -- users unban <handleOrId> --reason "<reason>" --yes

Change a user role:

bun run mod -- users set-role <handleOrId> <user|moderator|admin> --yes

Use --id when <handleOrId> is a user id. Use --fuzzy only when the user has asked for fuzzy handle resolution or the exact handle is ambiguous.

The old top-level aliases still exist for user commands:

bun run mod -- ban-user <handleOrId> --reason "<reason>" --yes
bun run mod -- unban-user <handleOrId> --reason "<reason>" --yes

Verification

For skills, inspect the page/API status after skills unhide.
For users, prefer bun run mod -- whoami for the current token and user search/admin surfaces for target accounts where available.
If verification is blocked by auth or missing admin access, report the command result and the verification blocker plainly.

Impact Notes

skills unhide is a moderator manual restore. It clears skill hidden state, applies a clean manual override to top-level moderation fields, preserves version-level scanner records, updates public stats, and writes audit logs.
There is no standalone skills hide command in clawhub-mod; use report triage with --action hide when resolving a report that should hide a skill.
ban-user is disruptive: it revokes API tokens, marks the user deleted, hides owned skills, soft-deletes comments, and writes audit logs.
unban-user is admin-only. It clears ban state and restores skills that were hidden by the matching ban flow; revoked API tokens stay revoked.