diff --git a/README.md b/README.md
index 8395b3a..67f0814 100644
--- a/README.md
+++ b/README.md
@@ -164,6 +164,33 @@ git pull
 docker compose up -d --build
 ```
 
+**Agent workspace data storage:**
+Agent workspace files (soul.md, memory, skills, workspace files) are stored in `./backend/agent_data/` on the host filesystem. Each agent has its own directory named by its UUID (e.g., `backend/agent_data/<agent-id>/`). This directory is mounted into the backend container at `/data/agents/`, making agent data directly accessible from your local filesystem.
+
+**Running as admin user:**
+The backend container runs as the `clawith` user by default. To run commands as the `admin` user (with sudo privileges), use:
+```bash
+# Get an interactive shell as admin (recommended for multiple commands)
+docker compose exec --user admin backend bash
+
+# Run a single command as admin
+docker compose exec --user admin backend <command>
+
+# Run a command as root via sudo
+docker compose exec --user admin backend sudo <command>
+```
+
+**Example: Installing packages as admin:**
+```bash
+# Get admin shell
+docker compose exec --user admin backend bash
+
+# Inside the shell, you can use sudo without password
+sudo apt-get update
+sudo apt-get install -y <package>
+sudo npm install -g <package>
+```
+
 > **🇨🇳 Docker Registry Mirror (China users):** If `docker compose up -d` fails with a timeout, configure a Docker registry mirror first:
 > ```bash
 > sudo tee /etc/docker/daemon.json > /dev/null <<EOF
diff --git a/backend/Dockerfile b/backend/Dockerfile
index 024696e..55b4cae 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -23,7 +23,10 @@ FROM python:3.12-slim AS production
 
 WORKDIR /app
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends libpq5 curl shadowsocks-libev && \
+    apt-get install -y --no-install-recommends libpq5 curl shadowsocks-libev sudo && \
+    curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
+    apt-get install -y --no-install-recommends nodejs && \
+    npm install -g @clawhub/cli && \
     rm -rf /var/lib/apt/lists/*
 
 # Copy installed packages from deps stage
@@ -33,10 +36,16 @@ COPY --from=deps /usr/local/bin/ /usr/local/bin/
 # Copy application code
 COPY . .
 
-# Non-root user
-RUN useradd --create-home clawith && \
+# Create both users: admin (with sudo/root access) and clawith (default user)
+RUN useradd --create-home --shell /bin/bash admin && \
+    useradd --create-home --shell /bin/bash clawith && \
+    echo "admin ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers && \
     mkdir -p /data/agents && \
-    chown -R clawith:clawith /app /data
+    chown -R clawith:clawith /app /data/agents
+
+# Run as clawith by default (container runs as clawith user)
+# - admin user can use sudo to run commands as root
+# - To run as admin: docker compose exec backend su - admin
 USER clawith
 
 # Health check
diff --git a/backend/app/services/skill_seeder.py b/backend/app/services/skill_seeder.py
index d0d591c..b9265ed 100644
--- a/backend/app/services/skill_seeder.py
+++ b/backend/app/services/skill_seeder.py
@@ -558,6 +558,98 @@
         "is_default": True,
         "files": [],  # populated at runtime from agent_template/skills/MCP_INSTALLER.md
     },
+    # ─── ClawHub CLI (mandatory default) ──────────────
+    {
+        "name": "ClawHub",
+        "description": "Use the ClawHub CLI to search, install, update, and publish agent skills from clawhub.com. Use when you need to fetch new skills on the fly, sync installed skills to latest or a specific version, or publish new/updated skill folders with the npm-installed clawhub CLI.",
+        "category": "development",
+        "icon": "📦",
+        "folder_name": "clawhub",
+        "is_default": True,
+        "files": [
+            {
+                "path": "SKILL.md",
+                "content": """---
+name: clawhub
+description: Use the ClawHub CLI to search, install, update, and publish agent skills from clawhub.com. Use when you need to fetch new skills on the fly, sync installed skills to latest or a specific version, or publish new/updated skill folders with the npm-installed clawhub CLI.
+metadata:
+  {
+    "openclaw":
+      {
+        "requires": { "bins": ["clawhub"] },
+        "install":
+          [
+            {
+              "id": "node",
+              "kind": "node",
+              "package": "clawhub",
+              "bins": ["clawhub"],
+              "label": "Install ClawHub CLI (npm)",
+            },
+          ],
+      },
+  }
+---
+
+# ClawHub CLI
+
+Install
+
+```bash
+npm i -g clawhub
+```
+
+Auth (publish)
+
+```bash
+clawhub login
+clawhub whoami
+```
+
+Search
+
+```bash
+clawhub search "postgres backups"
+```
+
+Install
+
+```bash
+clawhub install my-skill
+clawhub install my-skill --version 1.2.3
+```
+
+Update (hash-based match + upgrade)
+
+```bash
+clawhub update my-skill
+clawhub update my-skill --version 1.2.3
+clawhub update --all
+clawhub update my-skill --force
+clawhub update --all --no-input --force
+```
+
+List
+
+```bash
+clawhub list
+```
+
+Publish
+
+```bash
+clawhub publish ./my-skill --slug my-skill --name "My Skill" --version 1.2.0 --changelog "Fixes + docs"
+```
+
+Notes
+
+- Default registry: https://clawhub.com (override with CLAWHUB_REGISTRY or --registry)
+- Default workdir: cwd (falls back to OpenClaw workspace); install dir: ./skills (override with --workdir / --dir / CLAWHUB_WORKDIR)
+- Update command hashes local files, resolves matching version, and upgrades to latest unless --version is set
+""",
+            },
+        ],
+    },
 ]
 
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 6a33c6d..0aa6849 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -50,7 +50,7 @@ services:
       - "8000:8000"
     volumes:
       - ./backend:/app
-      - agent_data:/data/agents
+      - ./backend/agent_data:/data/agents
       - /var/run/docker.sock:/var/run/docker.sock
       - ./ss-nodes.json:/data/ss-nodes.json:ro
     depends_on:
@@ -79,7 +79,6 @@ services:
 volumes:
   pgdata:
   redisdata:
-  agent_data:
 
 
 networks: