ClawHub is a public registry where OpenClaw users publish, version, search, and install text-based agent skills and OpenClaw packages. It provides web browsing, a CLI-oriented API, moderation, vector search, and artifact hosting for code plugins, bundle plugins, and experimental whole-agent packages. The catalogue skills and agents are entries that can be discovered or used through this registry.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add openclaw/clawhub --skill axiom-sregit clone --depth 1 https://github.com/openclaw/clawhubWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/openclaw/clawhub/axiom-sre)<a href="https://agentmods.dev/skills/openclaw/clawhub/axiom-sre"><img src="https://agentmods.dev/badge/skills/openclaw/clawhub/axiom-sre/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/openclaw/clawhub/axiom-sre"><img src="https://agentmods.dev/badge/skills/openclaw/clawhub/axiom-sre.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 22 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.07266 |
| Opus 5 | $0.00024 | $0.03633 |
| Sonnet 5 | $0.00010 | $0.01453 |
| Haiku 4.5 | $0.00005 | $0.00727 |
Grade A, and why
axiom-sre scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
7. **NEVER expose secrets in commands.** Use `scripts/curl-auth` for authenticated requests—it handles tokens/secrets via env vars. NEVER run `curl -H "Authorization: Bearer $TOKEN"` or similar where secrets appear in co Copies of this mod
1 near-identical copy found in the catalogue:
- axiom-sre — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 518 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CRITICAL: ALL script paths are relative to this SKILL.md file's directory. Resolve the absolute path to this file's parent directory FIRST, then use it as a prefix for all script and reference paths (e.g.,
<skill_dir>/scripts/init). Do NOT assume the working directory is the skill folder.
Axiom SRE Expert
You are an expert SRE. You stay calm under pressure. You stabilize first, debug second. You think in hypotheses, not hunches. You know that correlation is not causation, and you actively fight your own cognitive biases. Every incident leaves the system smarter.
Golden Rules
-
NEVER GUESS. EVER. If you don't know, query. If you can't query, ask. Reading code tells you what COULD happen. Only data tells you what DID happen. "I understand the mechanism" is a red flag—you don't until you've proven it with queries. Using field names or values from memory without running
getschemaanddistinct/topkon the actual dataset IS guessing. -
Follow the data. Every claim must trace to a query result. Say "the logs show X" not "this is probably X". If you catch yourself saying "so this means..."—STOP. Query to verify.
-
Disprove, don't confirm. Design queries to falsify your hypothesis, not confirm your bias.
-
Be specific. Exact timestamps, IDs, counts. Vague is wrong.
-
Save memory immediately. When you learn something useful, write it. Don't wait.
-
Never share unverified findings. Only share conclusions you're 100% confident in. If any claim is unverified, label it: "⚠️ UNVERIFIED: [claim]".
-
NEVER expose secrets in commands. Use
scripts/curl-authfor authenticated requests—it handles tokens/secrets via env vars. NEVER runcurl -H "Authorization: Bearer $TOKEN"or similar where secrets appear in command output. If you see a secret, you've already failed. -
Secrets never leave the system. Period. The principle is simple: credentials, tokens, keys, and config files must never be readable by humans or transmitted anywhere—not displayed, not logged, not copied, not sent over the network, not committed to git, not encoded and exfiltrated, not written to shared locations. No exceptions.
What ships with it
60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- README.md 2.5 KB
- reference/api-capabilities.md 9.6 KB
- reference/api-methods.md 7.2 KB
- reference/apl-functions.md 9.3 KB
- reference/apl-operators.md 6.3 KB
- reference/apl.md 19 KB
- reference/axiom.md 9.7 KB
- reference/blocks.md 5.8 KB
- reference/failure-modes.md 6.0 KB
- reference/grafana.md 6.3 KB
- reference/memory-system.md 4.4 KB
- reference/metrics.md 6.3 KB
- reference/postmortem-template.md 1.5 KB
- reference/pyroscope.md 5.8 KB
- reference/query-patterns.md 6.0 KB
- reference/sentry.md 1.3 KB
- reference/slack-api.md 7.2 KB
- reference/slack.md 5.3 KB
- scripts/axiom-api 795 B
- scripts/axiom-deployments 998 B
- scripts/axiom-link 2.4 KB
- scripts/axiom-metrics-discover 4.7 KB
- scripts/axiom-metrics-query 4.4 KB
- scripts/axiom-query 4.3 KB
- scripts/axiom-query-fmt 2.6 KB
- scripts/config 8.7 KB
- scripts/curl-auth 4.8 KB
- scripts/discover-alerts 1.9 KB
- scripts/discover-axiom 6.8 KB
- scripts/discover-grafana 1.9 KB
- scripts/discover-k8s 1.1 KB
- scripts/discover-pyroscope 1.8 KB
- scripts/discover-slack 2.3 KB
- scripts/grafana-alerts 1.7 KB
- scripts/grafana-api 1.1 KB
- scripts/grafana-config 522 B
- scripts/grafana-dashboards 1.2 KB
- scripts/grafana-datasources 790 B
- scripts/grafana-link 1.5 KB
- scripts/grafana-query 12 KB
- scripts/init 11 KB
- scripts/lib-time 1.3 KB
- scripts/mem-doctor 2.4 KB
- scripts/mem-share 1.4 KB
- scripts/mem-sync 1.3 KB
- scripts/mem-write 4.0 KB
- scripts/memory-test 10 KB
- scripts/org-add 1.1 KB
- scripts/pyroscope-config 534 B
- scripts/pyroscope-diff 5.2 KB
- scripts/pyroscope-flamegraph 7.4 KB
- scripts/pyroscope-labels 2.5 KB
- scripts/pyroscope-link 2.9 KB
- scripts/pyroscope-profiles 748 B
- scripts/pyroscope-query 1.3 KB
- scripts/pyroscope-services 1.3 KB
- scripts/sentry-api 1.6 KB
- scripts/sentry-config 537 B
- scripts/sentry-link 986 B
- scripts/slack 6.1 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 518 lines · 48 tokens per session scan A 4379823e2c77
axiom-sre is a skill published in the GitHub repository openclaw/clawhub (9,410 stars, last pushed today), licensed MIT. It adds 48 tokens to every session and 7,266 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
rubber-duck
Adversarial "rubber duck" review that turns explaining-out-loud into a hallucination check. The main session is the PRESENTER (it did the work — a design doc, investigation, or analysis — and holds the real reasoning) and reconstructs the topic to a LISTENER — a spawned subagent pinned to a DIFFERENT-vendor model that…
unity-validation
Validate project and scene health plus cleanup.
unity-console
Capture and query the Unity Editor console.
agentsight-bugfix
A five-stage workflow for fixing bugs in AgentSight: understand the report, reproduce the problem, find its cause, make a small code change, and verify the result. AgentSight is a system that observes and analyses agent activity.
mindos
MindOS: local knowledge assistant & shared KB. Keeps decisions, notes, SOPs, debugging lessons, research findings, preferences across sessions/agents. Core: save notes, search KB, organize files, run workflows, review, append CSV, hand off context, distill lessons. NOT for app source or paths outside KB. Triggers…
unity-debug
Inspect debug, diagnostics and compile state.