Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Peiiii/nextclaw --skill nextclaw-app-publishergit clone --depth 1 https://github.com/Peiiii/nextclawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/peiiii/nextclaw/nextclaw-app-publisher)<a href="https://agentmods.dev/skills/peiiii/nextclaw/nextclaw-app-publisher"><img src="https://agentmods.dev/badge/skills/peiiii/nextclaw/nextclaw-app-publisher/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/peiiii/nextclaw/nextclaw-app-publisher"><img src="https://agentmods.dev/badge/skills/peiiii/nextclaw/nextclaw-app-publisher.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00081 | $0.01874 |
| Opus 5 | $0.00041 | $0.00937 |
| Sonnet 5 | $0.00016 | $0.00375 |
| Haiku 4.5 | $0.00008 | $0.00187 |
Grade A, and why
nextclaw-app-publisher scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 144 lines — stays where its author put it; the contents beside it link to each section on GitHub.
发布 NextClaw Mini App
把已经完成开发和验证的 schema v2 Mini App 提交到 NextClaw Marketplace。对外只使用 nextclaw app ...；不要要求用户安装或调用 napp，也不要暴露 registry URL、token 或内部 bundle mode。
边界
- 本 skill 只拥有组包、发布前校验、账户就绪和提交流程。
- 创建或修改 Panel/Service 时读取
nextclaw-app-creator及其路由的专项 skill。 - 只有用户明确要求“发布、提交、上架”时才执行
nextclaw app publish；检查或准备发布停在validate-publish。 - 只处理 root
manifest.json为schemaVersion: 2的 Mini App 包；legacy schema v1 NApp 不进入本流程。 - 不在
~/.nextclaw/apps中创建开发源码；该目录属于已安装包和实例数据 owner。
先确认组件组成，再确认 Service runtime 与 distribution
先独立判断包的组件组成：
- Panel-only：只有 Panel components；
- Service-only：只有 Service components；
- Panel + Service：两类 components 同时存在。
只有后两种组成需要继续判断 Service runtime。Panel-only 与 Portable WASI、native-process 不是同一层的三个选项：前者描述组件组成，后两者只描述 Service 如何运行。
| Service runtime | 根 runtime profile | distribution | 发布边界 |
|---|---|---|---|
| 不适用（Panel-only） | panel-only |
通常 universal |
普通审核 |
| Portable Rust/WASI | wasi |
纯可移植资源使用 universal |
按声明能力审核 |
| native-process | native-process |
自包含时可通用；含平台原生资源时使用 targeted |
高权限人工审核 |
不要按“包里存在 Service”就推断为 native-process。判断以 service-app.json 为准：
protocol: "wasi-component"+component.entry对应 Portable WASI；protocol: "mcp"+command/args对应 native-process。
不能只改 runtime.profile 来改变真实安全边界。WASI 包必须有合法 Component、匹配 WIT/manifest action 合同和宿主能力声明；native-process 包必须如实保留宿主进程、权限与外部依赖。
Rust 与最终用户
- 应用作者在发布前构建 Rust/WASI Guest 时需要 Rust 工具链，并运行
nextclaw app build/test。 - 最终用户安装、启用和运行已构建的 Portable
.napp不需要 Rust、Cargo、Wasmtime 或系统 Node；NextClaw 提供 runner。 - 发布结果不能把开发工具链写成终端安装前置条件。
发布资格门
有效包至少包含：
manifest.json：schema v2、稳定 app id/version、真实 runtime、distribution、permissions 与 component 引用；marketplace.json：slug、summary、summaryI18n、author、非空 tags 和真实展示信息；- 根 manifest 引用的所有 Panel/Service 目录、图标和 Marketplace 图片；
- Portable Service 的已构建
.wasm、版本匹配 WIT 和 service smoke fixture； - targeted App 声明的精确 target 集与对应自包含 artifacts。
如果用户只有散落的 loose Panel/native Service，先按 nextclaw-app-creator 的 package-root 合同组装到 workspace app-packages/<username>.<app-name>/。复制组件时保留原开发目录，根 manifest 成为发布包组件归属的事实源。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago Changed · +51 lines · +1 tokens per session c4689fda9ecb
- 12d ago First seen · 93 lines · 80 tokens per session scan A b573380d2371
nextclaw-app-publisher is a skill published in the GitHub repository Peiiii/nextclaw (256 stars, last pushed today), licensed MIT. It adds 81 tokens to every session and 1,874 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
openclaw-github-dedupe
Investigate a cluster of GitHub issues and PRs, determine canonical candidates, post duplicate/related status, preserve contributor credit, and execute cleanup actions. Supports autonomous mode for provided-link-only closeout, merge/fix follow-through, changelog, and post-merge issue/PR cleanup.
openclaw-pr-batch-sweep
Select, review, repair, validate, and land batches of up to 20 low-risk OpenClaw contributor pull requests using Vincent's maintainer preferences and bounded sub-agent lanes. Use for "next 20", broad contributor PR sweeps, merge-candidate mining, or continued PR-batch work where drafts, maintainer work, trivial…
tmux-lane-orchestrator
Manage one tmux agent lane from its matching ops pane, inspect live pane state and Codex logs on cold start, and produce concise manager summaries for OpenClaw and adjacent project work.
ghcrawl-cluster-operator
Use when inspecting a ghcrawl SQLite store, pulling GitHub issue/PR data, refreshing summaries, embeddings, and clusters, or extracting one cluster and its evidence through the ghcrawl CLI.
opik-optimizer
Optimize LLM prompts, tools, and agents in Opik using standardized optimizer workflows (prompt optimization, tool optimization, and parameter tuning), dataset/metric wiring, and result interpretation.
org-branch-cleanup
Audit and safely prune stale branches across a GitHub organization with immutable snapshots, conservative merged-PR classification, live SHA/protection/open-PR revalidation, resumable deletion ledgers, and post-delete verification. Use when a maintainer asks to clean up old, dead, merged, bot-created, or abandoned…