feat(clawhub): add full LLM tool integration + CLI (RMN-300)

[klampatech]

Linear: RMN-300

Summary

• Base branch target: main
• Problem:
  • Telegram channel caused MiniMax 500 errors due to [IMAGE: markers in system prompt being incorrectly parsed as image references
  • ClawHub install tool was incomplete (only showed preview, didn't actually install)
  • No uninstall tool available for LLM use
  • CLI search didn't show install commands
• Why it matters: ClawHub skill management was broken for LLM agents and Telegram
• What changed:
  • Full clawhub_install tool implementation with download, audit, install
  • New clawhub_uninstall tool for LLM use
  • Fixed Telegram channel media marker format to avoid parsing conflicts
  • Updated CLI search to display install commands
  • Fixed observability config (stdout → none)
• What did not change: Core ClawHub API client, search tool behavior

Label Snapshot

• Risk label (risk: low|medium|high): medium
• Size label (size: XS|S|M|L|XL): M
• Scope labels: skills, channel:telegram, tool
• Module labels: tool:clawhub, channel:telegram

Change Metadata

• Change type (bug|feature|refactor|docs|security|chore): feature
• Primary scope (runtime|provider|channel|memory|security|ci|docs|multi): tool

Validation Evidence

cargo fmt --all -- --check  # Pass
cargo clippy --all-targets -- -D warnings  # Pre-existing warnings (not from changes)
cargo test --lib  # Pass (2829 tests)

• Evidence: All tests pass, manual testing verified:
  • CLI clawhub search shows install commands
  • CLI clawhub install works
  • CLI clawhub uninstall works
  • LLM can search, install, and uninstall skills via tools
  • Telegram works without 500 errors

Security Impact

• New permissions/capabilities? No
• New external network calls? No (uses existing ClawHub API)
• Secrets/tokens handling changed? No
• File system access scope changed? No (writes to workspace/skills, same as before)

Compatibility / Migration

• Backward compatible? Yes
• Config/env changes? Only user config (changed stdout to none)
• Migration needed? No

Human Verification

• Verified scenarios: CLI search/install/uninstall, LLM tool calls, Telegram messaging
• Edge cases: Already-installed skills, non-existent skills
• What was not verified: ClawHub auth (login/whoami)

Side Effects / Blast Radius

• Affected subsystems: Skills, Telegram channel, CLI
• Potential unintended effects: None
• Guardrails: Security audit runs before any install

Rollback Plan

• Fast rollback command: git revert HEAD
• Feature flags or config toggles: None
• Observable failure symptoms: Missing tools, Telegram errors

Risks and Mitigations

• Risk: LLM might install malicious skills
  • Mitigation: Security audit runs on all skills before install

Summary by CodeRabbit

Release Notes

• New Features

  • ClawHub skill marketplace integration with search, install, and uninstall capabilities
  • New CLI commands for managing and discovering skills
  • Enhanced skill configuration and registry system

• Bug Fixes

  • Fixed Telegram markdown code-block rendering
  • Corrected Telegram notification logging behavior

[github-actions]

Thanks for contributing to ZeroClaw.

For faster review, please ensure:

• PR template sections are fully completed
• cargo fmt --all -- --check, cargo clippy --all-targets -- -D warnings, and cargo test are included
• If automation/agents were used heavily, add brief workflow notes
• Scope is focused (prefer one concern per PR)

See CONTRIBUTING.md and docs/pr-workflow.md for full collaboration rules.

[klampatech]

Updated PR Details

Validation Evidence

cargo fmt --all -- --check       # Pass
cargo clippy --all-targets -- -D warnings  # Pass (pre-existing warnings only)
cargo test --lib                 # Pass (2829 tests)

Manual Testing Evidence:

• CLI clawhub search - Shows install commands ✅
• CLI clawhub install <slug> - Successfully installs skills ✅
• CLI clawhub uninstall <slug> - Successfully uninstalls ✅
• LLM clawhub_search tool - Returns skills with slug ✅
• LLM clawhub_install tool - Downloads, audits, installs ✅
• LLM clawhub_uninstall tool - Removes skills ✅
• Telegram - No 500 errors (verified with MiniMax) ✅

Security Impact

• New permissions/capabilities? No
• New external network calls? No (uses existing ClawHub API)
• Secrets/tokens handling changed? No
• File system access scope changed? No (writes to workspace/skills)

Privacy Status

• Data-hygiene status: pass
• No personal data, sensitive info, or identity-like wording

Rollback Plan

• Fast rollback: git revert HEAD
• No feature flags
• Failure symptoms: Missing tools, Telegram errors

Note on Target Branch

This PR targets main because the changes include bug fixes (Telegram 500 error) that are needed in production. The dev branch has diverged significantly and would require conflict resolution. If preferred, I can rebase onto dev.

[theonlyhennygod]

Closing — the core ClawHub integration is already on master. ScoutSource::ClawHub is recognized in the skillforge subsystem (src/skillforge/scout.rs) and listed as a default source. If there are additional CLI commands or tool routing features beyond what's implemented, please open a focused follow-up PR. Thank you for the foundational work!