ClawHub Batch Analysis

Use this skill when a maintainer working on @openclaw/plugin-inspector wants to answer:

• "If we deprecate this API, how many ClawHub plugins are affected?"
• "Which plugins would receive this new warning/error?"
• "What are the most common Plugin Inspector findings across exported ClawHub plugins?"

Workflow

1. Confirm the ClawHub export route

   • In the ClawHub repo, verify the current /api/v1/plugins/export contract before using it.
   • Prefer a local or staging ClawHub target unless the user explicitly asks for production.
   • Check auth requirements and pagination headers such as X-Next-Cursor in the current ClawHub code.

2. Export the plugin corpus

   • Request ZIP exports from /api/v1/plugins/export.
   • Include both plugin families unless the user requests a narrower slice:
     • family=code-plugin
     • family=bundle-plugin
   • If the endpoint is paginated, follow X-Next-Cursor until exhausted.
   • Store raw export ZIPs and an export manifest in a temp or ignored working directory.

3. Unpack safely

   • Unpack into a fresh directory.
   • Do not execute plugin code during unpacking.
   • Keep any ClawHub export metadata near the unpacked corpus so plugin names/owners can be traced.

4. Run Plugin Inspector batch

   • From the plugin-inspector repo:

plugin-inspector batch /path/to/unpacked-clawhub-export \
  --no-openclaw \
  --out reports/clawhub-batch-analysis \
  --concurrency 8 \
  --json

• Use --openclaw <path> instead of --no-openclaw when validating against a local OpenClaw checkout or a branch with new compatibility metadata.
• Add --keep-plugin-reports only when per-plugin artifacts are needed; large exports can produce many files.

5. Summarize impact
   • Lead with:
     • total plugins scanned
     • plugins with errors
     • plugins with warnings
     • top finding codes by affected plugin count
   • Include affected plugin/version rows for the specific finding under investigation.
   • Link or point to:
     • plugin-inspector-batch-report.json
     • plugin-inspector-batch-report.md

Safety Notes

• Treat exported plugins as untrusted source. Do not pass --runtime, --mock-sdk, or --allow-execute unless the user explicitly requests runtime capture in an isolated workspace.
• Keep production exports and reports out of git unless the user explicitly asks to publish a sanitized artifact.
• If export counts or endpoint behavior matter, verify against live ClawHub instead of relying on memory.