---
name: capabilityhub-registry
description: Install and use the NeoCapabilityHub Registry client from an external coding agent, authenticate through browser Device Flow with the canonical AnyClaw company identity, and safely search, publish, inspect, or download versioned skills.
---

# NeoCapabilityHub Registry

Use this workflow when Codex or another external Agent is not connected to the AnyClaw Connector but the operator belongs to an AnyClaw tenant.

The Registry client never reads or exchanges a local `lark-cli` token. Authentication happens in the browser through the company identity provider; CapabilityHub then maps that login to the canonical User Center user and tenant.

## Install

Require Node.js 20 or newer. The official `neocapabilityhub` CLI has no npm dependencies.

Choose the skill root used by the current Agent. For Codex:

```bash
export CAPABILITYHUB_SKILLS_DIR="${CODEX_HOME:-$HOME/.codex}/skills"
mkdir -p "$CAPABILITYHUB_SKILLS_DIR/capabilityhub-registry"
curl --fail --show-error --location \
  https://capabilityhub.neoway.com/registry/skill.md \
  --output "$CAPABILITYHUB_SKILLS_DIR/capabilityhub-registry/SKILL.md"
npx --yes neocapabilityhub help
```

For another Agent, replace `CAPABILITYHUB_SKILLS_DIR` with that Agent's documented skill directory. The CLI can also be installed persistently with `npm install --global neocapabilityhub`.

If Node runs behind an HTTP proxy, set the standard `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` variables. Node 22 may additionally require:

```bash
export NODE_USE_ENV_PROXY=1
```

## Login with the AnyClaw identity

```bash
npx --yes neocapabilityhub login start
```

Open the returned `verificationUrl`, sign in with Feishu in the browser, verify the displayed code, and approve the device. Then redeem the code and verify the canonical identity:

```bash
npx --yes neocapabilityhub login finish
npx --yes neocapabilityhub whoami
npx --yes neocapabilityhub namespaces
```

The scoped token is stored at `~/.config/capabilityhub/credentials.json` with mode `0600`. Never print, upload, or paste this file. Use `--config PATH` for an isolated Agent profile.

An existing `lark-cli` login is optional and is not reused. Never copy its Feishu access token into CapabilityHub.

## Publish and wait for governance

Publish only to a namespace selected or clearly implied by the user:

```bash
npx --yes neocapabilityhub publish \
  --file ./skill-package.zip \
  --namespace team-name \
  --wait
```

`UPLOADED` or `SCANNING` is not a final publish result. With `--wait`, the client waits for the security audit and returns `SCAN_SAFE`, `SCAN_SUSPICIOUS`, `SCAN_DANGEROUS`, or `SCAN_BLOCKED` with findings. Do not use `--confirm-warnings` unless the user has reviewed and explicitly accepted the reported findings.

Check an existing upload separately:

```bash
npx --yes neocapabilityhub status \
  --skill-id SKILL_ID --version-id VERSION_ID --wait
```

## Explain a Medium-risk finding

When governance returns a Medium finding, the verified publisher may ask the
security appeal Agent to review concrete execution boundaries and user intent:

```bash
npx --yes neocapabilityhub appeal create \
  --skill-id SKILL_ID --version-id VERSION_ID \
  --fingerprints FINDING_FINGERPRINT_1,FINDING_FINGERPRINT_2 \
  --message "Explain why the capability is required and how paths, inputs, and outputs are constrained."
npx --yes neocapabilityhub appeal get --appeal-id APPEAL_ID
npx --yes neocapabilityhub appeal reply --appeal-id APPEAL_ID \
  --message "Provide the additional evidence requested by the reviewer."
```

Never invent an explanation or appeal without the publisher's informed approval.
High and Critical findings always require a human administrator. An accepted
appeal creates a waiver only for the exact version and finding fingerprints; it
does not delete the original finding or weaken later versions.

## Search and download

```bash
npx --yes neocapabilityhub search --query "wiki download"
npx --yes neocapabilityhub install team-name--skill-slug
npx --yes neocapabilityhub download \
  --slug team-name--skill-slug --version latest --output ./skill.zip
```

Public Global search and install/download work anonymously. When the user has logged in, the CLI also sends the stored CapabilityHub identity for tenant-private access. Install defaults to the Codex Skill root and accepts `--skills-dir PATH` for other Agents. It rejects unsafe ZIP paths, symbolic links, and existing destinations. Downloads refuse to overwrite a file, validate the ZIP signature, and report SHA-256 and byte count.

Download coordinates use `skill-slug` for Global skills and `namespace--skill-slug` for team namespaces. Copy the coordinate returned by search when possible. `latest` means the latest published version, never a draft, scanning, blocked, or pending-review version.

## Public identity privacy

Anonymous users can read the privacy-protected Global leaderboard. After Device Flow login, the CLI can also read the current tenant leaderboard; the server derives the tenant from the token and does not accept a tenant key from the caller:

```bash
npx --yes neocapabilityhub leaderboard --scope global --period monthly
npx --yes neocapabilityhub leaderboard --scope tenant
```

The website privacy settings and CLI expose the same identity preference for the Global leaderboard and public Global Skill author profiles:

```bash
npx --yes neocapabilityhub privacy get
npx --yes neocapabilityhub privacy set --mode anonymous
npx --yes neocapabilityhub privacy set --mode alias --alias "Builder"
npx --yes neocapabilityhub privacy set --mode real-name
```

Anonymous and alias modes omit the verified name, canonical user ID, and organization fields from public cross-tenant responses. The website visually obscures the real avatar with a strong frosted-glass treatment unless the user uploads a privacy avatar. Tenant members, administrators, and audit records still use the verified identity so every publication remains accountable.

## Legacy ClawHub compatibility (optional)

Existing integrations that already use ClawHub may continue to access anonymous Global public skills:

```bash
export CLAWHUB_REGISTRY=https://capabilityhub.neoway.com
npx clawhub search "email"
npx clawhub install skill-slug
```

Do not install ClawHub for a new NeoCapabilityHub integration. The compatibility route does not provide the official CLI's Device Flow, tenant-private access, publish status, or governance findings.

Logout removes the local credential:

```bash
npx --yes neocapabilityhub logout
```