External Skills (ClawHub and More)

Overview

AgentPowers aggregates skills from external registries alongside its own native catalog. When you search, you see two sections: AgentPowers skills first, then skills from each external source (starting with ClawHub). External skills are free, open-source skills hosted on their original registry. AgentPowers proxies the search, handles installation, and runs its full security pipeline before any external skill reaches your machine.

How It Works

Searching

When you search for a skill, AgentPowers queries its own database and all registered external sources in parallel. Results come back in clearly labeled, sectioned format:

ap search "postgres backup"

The API returns a sectioned response:

{
  "agentpowers": {
    "items": [...],
    "total": 1,
    "limit": 20,
    "offset": 0
  },
  "clawhub": {
    "items": [
      {
        "slug": "postgres-backup",
        "title": "Postgres Backup",
        "source": "clawhub",
        "source_url": "https://clawhub.ai/owner/postgres-backup",
        "source_installs": 234,
        "source_downloads": 234,
        "source_stars": 47,
        "source_comments": 3,
        "ap_security_status": "pass",
        "version": "1.2.0"
      }
    ],
    "total": 1
  }
}

The CLI renders this as a unified table with Source, Type, Price, and Security columns. Install counts and star ratings are shown inline in the title.

pass/warn — AgentPowers has scanned this skill version before
unscanned — No one has installed this version through AgentPowers yet; it will be scanned on first install

Installing

External skills go through a sandboxed install + security scan flow:

The CLI downloads the skill into a temporary sandbox directory
AgentPowers checks if this exact version has been scanned before
Cache hit — the cached security result is returned instantly
Cache miss — the full security pipeline runs (static validation, malware detection, AI review, agent checks), then caches the result
Pass or warn — files move to ~/.claude/skills/ and a version pin is recorded
Block — findings are displayed and the skill is not installed

Version Pinning

Every installed skill is pinned by its content. This protects against supply chain attacks:

If an author re-uploads a skill (files change), the pin detects the mismatch
On update, AgentPowers re-scans before applying the new version
Run ap verify to check all installed skills against their recorded pins

Updating

External skills support the same update flow as native skills:

ap update ontology           # Update a single external skill
ap update                    # Check all installed skills (native + external)

When a newer version is available, the update command:

Fetches the latest version from the external source
Compares the installed version against the latest
Re-runs the full sandboxed install flow (download, scan, install)
Updates the pin with the new version

Edit detection works the same way. If you’ve modified the installed files, ap update detects the change and prompts before overwriting. Use --force to bypass the prompt. Missing version info. Some external skills are pinned without version information (e.g., when the original install didn’t report a version). In this case, ap update treats the skill as up-to-date if it hasn’t been locally edited, avoiding unnecessary re-downloads.

Security

External skills receive the same security treatment as native AgentPowers skills:

Check	Description
Static validation	File type checks, dangerous pattern scanning
Malware detection	ClamAV signatures and VirusTotal multi-engine scan
Dependency scan	Snyk CVE detection for known vulnerabilities
Supply chain analysis	GuardDog (Python) and Socket.dev (npm)
AI security review	Semantic analysis for injection, auth flaws, data exposure
Agent-specific checks	Tool audit, instruction analysis, trust scoring

The only difference: native skills are scanned at publish time. External skills are scanned at install time (and cached for subsequent users).

Supported Sources

Source	Status	Skills
ClawHub	Active	Community skills for Claude Code
More coming	Planned	Additional registries in the future

For Developers

API

Search Results

GET /v1/search?q=postgres&type=skill

Returns a sectioned response with agentpowers and clawhub keys. External items include:

source — “clawhub”, etc.
source_url — Link to the original registry entry
source_installs — Download count from the original source
source_downloads — Same as source_installs (full detail)
source_stars — Star/rating count
source_comments — Comment count
ap_security_status — AgentPowers scan result (“pass”, “warn”, or null if unscanned)

Unified Detail Get full details for any skill regardless of source:

GET /v1/detail/{slug}?source=clawhub

Returns author info, version, stats, description, and AgentPowers security status. Security Results View the security scan results for any skill:

GET /v1/security/results/{slug}

Returns the scan outcome (pass/warn/block) with findings.

CLI

The ap install command automatically detects external skills by their source field and routes through the sandbox + scan flow. Use --source to specify explicitly:

ap install ontology --source clawhub

Preview before installing — Use ap detail --scan to run the full security pipeline without installing:

ap detail ontology --scan --source clawhub

This downloads to a temporary sandbox, scans, displays per-finding result cards, and cleans up. Nothing is installed. Verify integrity — The ap verify command checks all installed skills against their recorded pins:

ap verify

Need Help?

Email Support

Reach us at support@agentpowers.ai for account issues, billing questions, or technical help.

Discord Community

Join the AgentPowers Discord to get help from the team and other creators in real time.

Getting Started

Guides

Reference

External Skills (ClawHub and More)

Overview

How It Works

Searching

Installing

Version Pinning

Updating

Security

Supported Sources

For Developers

API

CLI

Need Help?

Email Support

Discord Community

​Overview

​How It Works

​Searching

​Installing

​Version Pinning

​Updating

​Security

​Supported Sources

​For Developers

​API

​CLI

​Need Help?

Email Support

Discord Community

Overview

How It Works

Searching

Installing

Version Pinning

Updating

Security

Supported Sources

For Developers

API

CLI

Need Help?