
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Command-line interface for building, testing, and deploying Hauba AI agents and skills.
cd tools/cli
pnpm install
pnpm build
# Install globally (optional)
npm link
# Check CLI is working
hauba --help
# Login to Hauba platform
hauba login
# Generate a skill using AI (Phase 5 - NEW!)
hauba skill generate -d "A skill that summarizes long articles"
# Or create skill from template
hauba skill init my-awesome-skill
# Deploy an agent
hauba deploy
# Login with email/password
hauba login
hauba login -e user@example.com
# Login with API token (CI/CD)
hauba login -t hauba_abc123...
# Check current user
hauba whoami
hauba whoami --json
# Logout
hauba logout
Generate skills using natural language!
# Quick generation
hauba skill generate -d "Monitor HackerNews for AI posts"
# Interactive mode with examples
hauba skill generate -i
# Specify category
hauba skill generate -d "Translate messages" -c communication
# Save to local directory (for editing)
hauba skill generate -d "Weather checker" --save
# Custom API URL
hauba skill generate -d "Task manager" --api-url https://api.hauba.tech
Examples:
# Productivity skill
hauba skill gen -d "Extract action items from meeting notes and create tasks"
# Analytics skill
hauba skill gen -d "Track GitHub stars for my repositories daily"
# Automation skill
hauba skill gen -d "Auto-reply to emails mentioning 'urgent' with priority flag"
What happens:
For developers who want full control:
# Create skill from template
hauba skill init weather-checker
hauba skill init my-skill -c productivity
# Development server
cd weather-checker
pnpm install
hauba skill dev
hauba skill dev -p 3002
# Build for production
hauba skill build
# Run tests
hauba skill test
hauba skill test --watch
# Validate skill structure
hauba skill validate
# Publish to marketplace
hauba skill publish
hauba skill publish --unlisted
hauba skill publish --dry-run
# Create new Hauba project
hauba init my-agent
hauba init my-project -t skill
hauba init full-project -t full -y
# Templates:
# - agent: Full AI agent project
# - skill: Installable skill package
# - full: Complete project with all features
# Deploy to development
hauba deploy
# Deploy to production
hauba deploy --prod
hauba deploy -e production -r us-east-1
# Dry run (simulate)
hauba deploy --dry-run
# Skip confirmations
hauba deploy --prod -y
hauba skill generate (AI):✅ Quick prototyping
✅ Learning Hauba SDK
✅ Non-developers building skills
✅ Common use cases (summarize, extract, notify)
✅ Rapid MVP development
hauba skill init (Template):✅ Complex custom logic
✅ External API integrations
✅ Performance-critical code
✅ Team collaboration (version control)
✅ Advanced TypeScript features
# Generate
hauba skill generate -d "Summarize long Slack threads"
# Test in dashboard
# (Opens https://app.hauba.tech)
# Use immediately!
# Create from template
hauba skill init slack-summarizer
# Develop locally
cd slack-summarizer
pnpm install
hauba skill dev
# Write code in src/index.ts
# Write tests in tests/
# Build & validate
hauba skill build
hauba skill test
hauba skill validate
# Publish
hauba skill publish
Create .env in your project or set globally:
# Hauba API URL
HAUBA_API_URL=http://localhost:3001 # Development
HAUBA_API_URL=https://api.hauba.tech # Production
# AI Provider (optional - uses platform keys by default)
DEFAULT_AI_MODEL=gemini-2.0-flash # Free for development!
ANTHROPIC_API_KEY=sk-ant-...
OPENAI_API_KEY=sk-proj-...
GOOGLE_AI_API_KEY=AIzaSy...
# 1. Start Hauba API server
cd ../../hauba
pnpm --filter @hauba/api dev
# 2. Login to CLI
hauba login -e test@hauba.dev
# 3. Generate skill
hauba skill generate -d "Count words in messages"
# 4. Check dashboard
# Skill appears in http://localhost:5173
AI-generated skills are validated before execution:
Blocked patterns:
eval() - Dynamic code executionFunction() - Constructor executionrequire() - Arbitrary module loadingprocess.env - Environment accesschild_process - Shell commandsfs - File system accessvm - Virtual machine__proto__ - Prototype pollutionStatus:
private (only you can use)approved (reviewed & public)tools/cli/
├── bin/
│ └── hauba.js # CLI entry point
├── src/
│ ├── index.ts # Main CLI setup
│ └── commands/
│ ├── generate.ts # AI skill generation (Phase 5)
│ ├── skill.ts # Skill management
│ ├── init.ts # Project initialization
│ ├── login.ts # Authentication
│ └── deploy.ts # Deployment
├── package.json
└── tsconfig.json
hauba login
# Check API server is running
cd hauba
pnpm --filter @hauba/api dev
# Verify URL
echo $HAUBA_API_URL # Should be http://localhost:3001
# Check AI provider keys in API server
cd hauba
cat apps/api/.env | grep API_KEY
# Try with --api-url flag
hauba skill generate -d "test" --api-url http://localhost:3001
# Rebuild CLI
cd tools/cli
pnpm build
# Re-link globally
npm link
hauba skill generate -d "Summarize inbox emails and highlight action items"
hauba skill generate -i
# Interactive prompts:
# What should this skill do?
# > Review pull requests and suggest improvements
# Add examples?
# > Yes
# Example 1 - Input:
# > Pull request with 50 lines of Python code
# Example 1 - Output:
# > List of code quality suggestions and security checks
# Generate
hauba skill gen -d "Daily standup reminder at 9am"
# Test
# (Tests in dashboard)
# Publish
hauba skill publish <skill-id>
# Deploy to agent
hauba agent add-skill <agent-id> <skill-id>
MIT
✨ AI Skill Generation
Try it now:
hauba skill generate -d "Your idea here!"
FAQs
Hauba AI Agent Platform - The first Nepalese AI employee that actually works
We found that hauba demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.