OpenClaw/clawhub-security-signals huggingface dataset:
Skill: neo1307/neo1307-flutter-release-pipeline (version 1.0.0)

--- name: flutter-release-pipeline description: Build and package Flutter Android release artifacts (APK/AAB), collect outputs into a single folder, and produce a short release checklist. Use when the user asks to build APK/AAB, prepare a Play Store release, bump version, gather mapping/symbols, or generate a deterministic release folder for sharing. --- # Flutter Android Release Pipeline ## Workflow 1) **Preflight** - Confirm `flutter --version` works. - Confirm project path contains `pubspec.yaml`. 2) **Build** (choose one) - AAB: `flutter build appbundle --release` - APK: `flutter build apk --release` (optionally `--split-per-abi`) 3) **Collect artifacts** Create `out/flutter_release_<timestamp>/` and copy: - `build/app/outputs/flutter-apk/*.apk` (if APK build) - `build/app/outputs/bundle/release/*.aab` (if AAB build) - `build/app/outputs/mapping/release/mapping.txt` (if present) - `pubspec.yaml` (snapshot) 4) **Report** - Print paths + sizes + SHA256 for each artifact. - Print a short checklist (versionCode/versionName sanity, signing, Play Console notes). ## Script Run (PowerShell): - `powershell -ExecutionPolicy Bypass -File scripts/flutter_release.ps1 -Project "<path>" -Mode aab|apk -SplitPerAbi:$false` ## Notes - Avoid changing app code unless explicitly requested. - If build fails, return the exact error + suggested fix.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: matthewxmurphy/openclaw-agent-orchestrator (version 0.6.0)

--- name: openclaw-agent-orchestrator description: Create and repair durable OpenClaw agents, bindings, and runtime state. Use when the user wants real subagents, durable agent entries, or proof that orchestration actions actually changed live state. Prefer verified `openclaw agents add` flows over optimistic `sessions_spawn` narration. metadata: {"openclaw":{"emoji":"🎛️"}} --- # OpenClaw Agent Orchestrator Use this skill when the user wants real subagents or when the runtime claims it started agents but `openclaw agents list` and `openclaw agents bindings` do not show them. ## Durable Agent Rule For durable subagents in this deployment, use `openclaw agents add` and verify the result. Do not use `sessions_spawn` with `mode="session"` for durable agent creation here. This runtime has already returned errors such as: - `mode="session" requires thread=true` - `thread=true is unavailable because no channel plugin registered subagent_spawning hooks` Treat `sessions_spawn` as ephemeral-only unless the current runtime explicitly proves thread-bound session support. ## Workflow 1. Run `scripts/verify-runtime.sh` to see the current truth. 2. If the requested durable agent does not exist, run `scripts/create-agent.sh <agent-id> <name> <emoji> [theme]`. 3. If the user asked for routing, add bindings with `openclaw agents bind`. 4. Re-run `scripts/verify-runtime.sh`. 5. Report only what is present in verified runtime output. ## Guardrails - Never say an agent was created until `openclaw agents list --json` shows it. - Never claim bindings exist until `openclaw agents bindings --json` shows them. - Do not use `crontab` in this environment. Use `openclaw cron ...` only if a schedule is actually needed. - Do not say `GO`, `starting now`, or `spawned successfully` before a verified state change. ## Commands Verify: ```bash ./scripts/verify-runtime.sh ``` Create one durable agent: ```bash ./scripts/create-agent.sh oracle "Oracle" "🔮" "qa" ``` Create one durable agent from a copied workspace and verify: ```bash ./scripts/create-agent.sh trinity "Trinity" "🥷" "ops" ./scripts/verify-runtime.sh ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: terrycarter1985/camsnap-snap (version 1.0.0)

--- name: camsnap description: Take webcam snapshots with path validation, safe resource handling, and flexible output options. metadata: openclaw: requires: commands: [python3] pypi: [opencv-python] --- # Camsnap Camera snapshot utility for AI agents. ## Features - Safe webcam capture with guaranteed resource release - Path traversal protection and extension validation - Configurable camera index and output directory - Structured logging (no print statements) - Type-annotated API ## Usage ```bash python3 camsnap.py python3 camsnap.py --output-dir ./photos python3 camsnap.py snapshot.png --camera 1 ``` ### As a module ```python from camsnap import take_snapshot path = take_snapshot(output_dir="snapshots", camera_index=0) ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ckchzh/seedbed (version 1.0.0)

--- name: "seedbed" version: "1.0.0" description: "Seedbed preparation reference — tillage methods, soil structure, moisture management, planting surface quality. Use when preparing fields for sowing, evaluating seedbed conditions, or selecting tillage equipment." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [seedbed, tillage, soil, planting, agriculture, cultivation, sowing] category: "agriculture" --- # Seedbed — Seedbed Preparation Reference Quick-reference skill for seedbed preparation, tillage methods, and planting surface management. ## When to Use - Preparing field seedbeds for crop planting - Selecting tillage equipment and sequence - Evaluating soil moisture for optimal seedbed work - Troubleshooting emergence problems related to seedbed quality - Balancing seedbed quality with soil conservation ## Commands ### `intro` ```bash scripts/script.sh intro ``` Overview of seedbed preparation — goals, soil physics, tilth requirements. ### `tillage` ```bash scripts/script.sh tillage ``` Tillage systems — conventional, minimum-till, strip-till, no-till comparison. ### `equipment` ```bash scripts/script.sh equipment ``` Tillage equipment — moldboard plow, chisel, disk, field cultivator, harrow. ### `moisture` ```bash scripts/script.sh moisture ``` Soil moisture management — timing, ribbon test, compaction avoidance. ### `structure` ```bash scripts/script.sh structure ``` Soil structure for seedbeds — aggregate size, bulk density, porosity targets. ### `crops` ```bash scripts/script.sh crops ``` Seedbed requirements by crop — fine vs coarse, depth, firmness. ### `problems` ```bash scripts/script.sh problems ``` Troubleshooting — crusting, cloddy seedbeds, compaction, poor emergence. ### `checklist` ```bash scripts/script.sh checklist ``` Seedbed preparation quality checklist. ### `help` ```bash scripts/script.sh help ``` ### `version` ```bash scripts/script.sh version ``` ## Configuration | Variable | Description | |----------|-------------| | `SEEDBED_DIR` | Data directory (default: ~/.seedbed/) | --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bullkis1/howtoletmyagent-installer (version 0.1.0)

--- name: howtoletmyagent_installer description: "Install companion OpenClaw skills from howtoletmyagent.xyz article URLs or skill manifests." --- # Howtoletmyagent Installer Use this skill when the user wants to install or learn a companion skill from a Howtoletmyagent article. Accepted inputs: - An article URL like https://howtoletmyagent.xyz/articles/<slug> - A manifest URL like https://howtoletmyagent.xyz/api/skills/<slug> - A plain request such as "learn the skill from this page" when the article URL is present in context Required workflow: 1. Verify that the source URL belongs to https://howtoletmyagent.xyz or another explicitly approved preview host. 2. Resolve the manifest URL: - article URL -> /api/skills/<slug> - manifest URL -> use it directly 3. Fetch the manifest JSON. 4. Explain what will be installed and ask for approval before writing files or running install commands. 5. If the manifest says the source is `clawhub`, prefer the provided install command. 6. If a ClawHub install is unavailable or fails, create a local workspace skill folder and write the manifest files exactly as provided. 7. After install, tell the user to start a new session with `/new` or restart the gateway so OpenClaw reloads the skill. Safety rules: - Only trust manifests from https://howtoletmyagent.xyz unless the user explicitly approves another domain. - Never execute arbitrary code from the manifest. This manifest is for skill files, not shell scripts. - Show the target install path before writing files. - If a manifest looks malformed or unsafe, stop and explain the issue instead of guessing. Implementation notes: - Prefer using browser or web-fetch tools to read the manifest. - If a CLI install is approved, use the exact command supplied by the manifest. - If you must install from files, write each file under `skills/<skill-name>/` using the manifest `files` array. Success condition: - The requested companion skill is installed. - The user gets the exact prompt they can use next to trigger it.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: nasusuna/gdrive (version 1.0.0)

--- name: gdrive description: Access Google Drive in a privacy-safe way by only working inside an allow-listed set of approved folders. Use when the user wants to browse, read, search, or upload files in Google Drive but strictly within pre-approved folders. --- # GDrive – Approved-Folder Google Drive Access ## What this skill does This skill lets the agent interact with Google Drive **only inside explicitly approved folders**. It assumes there is some existing Google Drive access layer (CLI, API, or MCP server) and adds a strict, configurable **allow‑list** in front of it. Core capabilities: - List the approved folders and their permissions - Browse the contents of an approved folder - Read/download file contents - Search for files within approved folders - Upload files to approved folders (if allowed) - Add or remove approved folders (admin‑only) Everything outside the allow‑listed folders is treated as **off‑limits**. --- ## Configuration model The skill uses an “approved folders” configuration that can be represented as JSON or any other config source with the same fields:


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal:  | SkillSpector: clean (LOW)
Skill: 52yuanchangxing/run-command-safety-check (version 1.0.0)

--- name: run-command-safety-check version: 1.0.0 description: "在执行 shell 方案前检查危险模式，如 pipe-to-shell、覆盖式删除、危险重定向或混淆执行。；use for shell, security, command-review workflows；do not use for 提供攻击性命令, 帮用户绕过限制." author: OpenClaw Skill Bundle homepage: https://example.invalid/skills/run-command-safety-check tags: [shell, security, command-review, safety] user-invocable: true metadata: {"openclaw":{"emoji":"🛑","requires":{"bins":["python3"]},"os":["darwin","linux","win32"]}} --- # 命令执行安全检查官 ## 你是什么 你是“命令执行安全检查官”这个独立 Skill，负责：在执行 shell 方案前检查危险模式，如 pipe-to-shell、覆盖式删除、危险重定向或混淆执行。 ## Routing ### 适合使用的情况 - 检查这段 shell 命令安不安全 - 识别 pipe-to-shell 和 rm 风险 - 输入通常包含：命令文本、脚本文件或目录 - 优先产出：危险模式、中风险模式、最终建议 ### 不适合使用的情况 - 不要提供攻击性命令 - 不要帮用户绕过限制 - 如果用户想直接执行外部系统写入、发送、删除、发布、变更配置，先明确边界，再只给审阅版内容或 dry-run 方案。 ## 工作规则 1. 先把用户提供的信息重组成任务书，再输出结构化结果。 2. 缺信息时，优先显式列出“待确认项”，而不是直接编造。 3. 默认先给“可审阅草案”，再给“可执行清单”。 4. 遇到高风险、隐私、权限或合规问题，必须加上边界说明。 5. 如运行环境允许 shell / exec，可使用： - `python3 "{baseDir}/scripts/run.py" --input <输入文件> --output <输出文件>` 6. 如当前环境不能执行脚本，仍要基于 `{baseDir}/resources/template.md` 与 `{baseDir}/resources/spec.json` 的结构直接产出文本。 ## 标准输出结构 请尽量按以下结构组织结果： - 危险模式 - 中风险模式 - 背景说明 - 替代写法 - 人工确认项 - 最终建议 ## 本地资源 - 规范文件：`{baseDir}/resources/spec.json` - 输出模板：`{baseDir}/resources/template.md` - 示例输入输出：`{baseDir}/examples/` - 冒烟测试：`{baseDir}/tests/smoke-test.md` ## 安全边界 - 优先输出替代与审查意见，不执行命令。 - 默认只读、可审计、可回滚。 - 不执行高风险命令，不隐藏依赖，不伪造事实或结果。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: zzz123hash/cc-remote (version 1.0.0)

--- name: cc-remote description: Claude Code 远程执行 Skill — 通过三通道（FastAPI/Redis/Screen）向远程机器上的 Claude Code 派发指令，支持重试机制。触发：博士让我"派发给 Claude Code"、"远程执行"、"让XX机器执行Claude Code"、remote cc。 --- # cc-remote 通过三通道向远程机器上的 Claude Code 派发指令，支持重试机制。 ## 部署架构 ``` 我 (NAS/OpenClaw) │ ├─→ FastAPI:18900 ──→ Worker 监听 Redis ──→ Claude Code 执行 │ ↑ │ HTTP POST │ └─→ Redis LPUSH ──→ Worker BLPOP ──→ Claude Code 执行 ↑ 直接写队列 ``` 远程机器需要运行： - **FastAPI 服务**（端口 18900） - **Redis Worker**（监听 Redis 队列） - **Redis**（可连的队列服务） ## 首次部署（远程机器） 在远程机器上运行： ```bash # 安装依赖 pip3 install redis uvicorn fastapi # 启动 Worker（后台常驻） nohup python3 cc_worker.py > worker.log 2>&1 & # 启动 API nohup python3 cc_api.py > api.log 2>&1 & ``` ## 三通道（按优先级） | 通道 | 原理 | 稳定性 | |------|------|--------| | **fastapi** | HTTP POST 到远程 API，Worker 执行 | ⭐⭐⭐ 最稳定 | | **redis** | 直接 LPUSH 到 Redis 队列 | ⭐⭐ | | **screen** | SSH Screen 后台执行 | ⭐ fallback | ## 重试机制 - 每个通道最多 **3 次重试** - 失败后等待 **5~7 秒随机** - 三通道全失败 → 返回错误 ## 配置修改 首次使用前，编辑 `scripts/exec.py` 顶部配置： ```python M1_HOST = "远程机器IP" # 如 "192.168.0.128" M1_API_PORT = 18900 # FastAPI 端口 REDIS_HOST = "Redis服务器IP" # 如 "192.168.0.107" REDIS_PORT = 11980 # Redis 端口 ``` ## 使用方式 ```bash python3 scripts/exec.py "你的指令" ``` ### 参数 | 参数 | 说明 | |------|------| | `prompt` | 要执行的指令（必须） | | `--task-id` | 指定任务ID | | `--timeout` | 超时秒数（默认300） | | `--channel` | 强制指定通道（fastapi/redis/screen） | ### 示例 ```bash # 基本用法（自动选择通道） python3 scripts/exec.py "say hello" # 强制用 fastapi python3 scripts/exec.py "say hello" --channel fastapi # 指定任务ID，方便查结果 python3 scripts/exec.py "修改 index.html" --task-id fix001 ``` ## 远程机器进程管理 ```bash # 查看进程 ssh 远程机器 "ps aux | grep cc_" # 重启 Worker ssh 远程机器 "pkill -f cc_worker; nohup python3 ~/cc_worker.py > ~/worker.log 2>&1 &" # 重启 API ssh 远程机器 "pkill -f cc_api; nohup python3 ~/cc_api.py > ~/api.log 2>&1 &" ``` ## 故障排查 **任务提交成功但没结果**： 1. 查远程机器 Worker 日志：`ssh 远程机器 "tail worker.log"` 2. 查 API 状态：`curl http://远程机器IP:18900/health` 3. 查 Redis 队列：`redis-cli -h Redis服务器 -p 端口 LLEN claude_tasks` **FastAPI 连不上**： - 检查远程机器 API 是否在跑 - 重启 API **Worker 不处理队列**： - 检查 worker 是否在跑 - 重启 worker ## 指令构造技巧 发给 Claude Code 的指令要清晰： - 说明要改哪个文件 - 说明改什么 - 说明期望效果 - 复杂任务加"逐步思考" **好例子**： ``` 修改 /path/to/project/web/index.html： 1. 找到 body 样式部分 2. 添加背景色：background: #f5f5f5 3. 确保在移动端也生效（响应式） 注意：先备份原文件。 ``` ## 文件说明 | 文件 | 功能 | |------|------| | `exec.py` | 三通道执行器（核心） | | `deploy_m1.py` | 远程机器一键部署脚本 | | `deploy_ssh.py` | SSH 强化配置（连接池复用） |


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: claudiodrusus/qr-gen (version 1.1.0)

--- name: qr-gen description: Generate QR codes from text, URLs, WiFi credentials, vCards, or any data. Use when the user wants to create a QR code, share a link as a scannable code, generate WiFi login QR codes, create contact/vCard QR codes, or produce any scannable barcode image. Outputs PNG, SVG, or ASCII art. --- # QR Code Generator Generate QR codes via the bundled Python script. ## Quick Start ```bash python3 scripts/generate_qr.py "https://example.com" -o qr.png ``` ## Common Patterns ### URL or text ```bash python3 scripts/generate_qr.py "https://example.com" -o link.png ``` ### WiFi network (scannable by phones) ```bash python3 scripts/generate_qr.py "wifi" --wifi-ssid "MyNetwork" --wifi-pass "secret123" -o wifi.png ``` ### vCard contact Generate the vCard string and pipe it: ```bash python3 scripts/generate_qr.py "BEGIN:VCARD VERSION:3.0 FN:Jane Smith TEL:+1234567890 EMAIL:[REDACTED_SECRET] END:VCARD" -o contact.png ``` ### ASCII art (terminal preview) ```bash python3 scripts/generate_qr.py "hello" --format ascii ``` ### SVG (scalable, web-friendly) ```bash python3 scripts/generate_qr.py "data" -o code.svg ``` ## Options - `-o FILE` — output path (default: qr.png) - `-s N` — box size in pixels (default: 10) - `--border N` — border width (default: 4) - `--format png|svg|ascii` — force format (auto-detected from extension) - `--error-correction L|M|Q|H` — error correction level (default: M; use H for logos/damage tolerance) ## Dependencies The script auto-installs `qrcode[pil]` via pip if missing. No manual setup needed.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: 0xsolace/clawdnet (version 1.0.0)

--- name: clawdnet description: Register and manage AI agents on ClawdNet, the decentralized agent registry. Use when you need to register an agent, send heartbeats, update agent status, invoke other agents, or discover agents on the network. --- # ClawdNet Agent Skill ClawdNet is the agent registry and discovery network. This skill enables AI agents to register themselves, maintain status, and interact with other agents. ## Quick Start ### Register Your Agent ```bash curl -X POST https://clawdnet.xyz/api/v1/agents/register \ -H "Content-Type: application/json" \ -d '{ "name": "Your Agent Name", "handle": "your-agent-handle", "description": "What your agent does", "endpoint": "https://your-domain.com/api/agent", "capabilities": ["text-generation", "code-generation"] }' ``` Response: ```json { "agent": { "id": "uuid", "handle": "your-agent-handle", "api_key": "clawdnet_abc123...", "claim_url": "https://clawdnet.xyz/claim/xyz789" } } ``` **Important:** Save the `api_key` and send `claim_url` to your human for verification. ### Send Heartbeats Keep your agent status updated (recommended every 60s): ```bash curl -X POST https://clawdnet.xyz/api/v1/agents/heartbeat \ -H "Authorization: Bearer $CLAWDNET_API_KEY" \ -H "Content-Type: application/json" \ -d '{"status": "online"}' ``` ### Get Your Agent Info ```bash curl https://clawdnet.xyz/api/v1/agents/me \ -H "Authorization: Bearer $CLAWDNET_API_KEY" ``` ## API Reference See [references/api.md](references/api.md) for complete API documentation. ## Invoking Other Agents ```bash curl -X POST https://clawdnet.xyz/api/agents/{handle}/invoke \ -H "Content-Type: application/json" \ -H "X-Caller-Handle: your-handle" \ -d '{ "skill": "text-generation", "input": {"prompt": "Hello!"} }' ``` ## Discovery - List agents: `GET /api/agents` - Search agents: `GET /api/agents?search=keyword` - Filter by skill: `GET /api/agents?skill=code-generation` - Agent profile: `GET /api/agents/{handle}` - Agent capabilities: `GET /api/agents/{handle}/registration.json` ## Standard Capabilities Use these IDs when registering: - `text-generation` - Generate text - `code-generation` - Write code - `image-generation` - Create images - `translation` - Translate text - `web-search` - Search the web - `research` - Deep research - `analysis` - Data analysis - `summarization` - Summarize content ## Environment Variables Store your API key securely: ```bash export CLAWDNET_API_KEY="clawdnet_..." ``` ## Integration Pattern 1. Register agent on startup (if not already registered) 2. Start heartbeat loop (every 60s) 3. Handle incoming invocations at your endpoint 4. Use API to discover and invoke other agents


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: axelhu/openclaw-magika (version 1.0.0)

--- name: openclaw-magika description: "AI-powered file type detection. Detects file content types (200+ types, ~99% accuracy) using Google Magika deep learning model. Triggered when: (1) user asks to identify/check/detect file type, (2) analyzing uploaded files, (3) batch classifying files by content. Requires: magika CLI (pip install/pipx install/brew). Reads: no config files. No data sent to third parties; local inference only." metadata: {"openclaw":{"emoji":"🔍","requires":{"anyBins":["magika"]}}}} --- # openclaw-magika > AI-powered file content type detection using Google Magika. ## Quick Use ```bash # Single file — label output magika -l /path/to/file # MIME type output magika -i /path/to/file # Recursive directory scan magika -r ./workspace/ # JSON output (for programmatic use) magika --json /path/to/file # Batch multiple files magika -r --json ./uploads/ ``` ## Common Tasks | Task | Command | |------|---------| | Identify single file | `magika -l <file>` | | Get MIME type | `magika -i <file>` | | Recursive scan | `magika -r <dir>` | | Batch JSON | `magika --jsonl <files...>` | | With confidence score | `magika -s -l <file>` | ## Output Labels Magika identifies 200+ content types including: `markdown`, `json`, `python`, `javascript`, `pdf`, `zip`, `png`, `jpeg`, `html`, `xml`, `sql`, `csv`, `png`, `gif`, `mp3`, `mp4`, `exe`, `elf`, `wasm`, and many more. High-confidence predictions are marked with `[HIGH]`. Low-confidence returns generic labels like `text` or `unknown binary data`. ## Install ```bash # pipx (recommended) pipx install magika # pip pip install magika # brew brew install magika # curl script curl -LsSf https://securityresearch.google/magika/install.sh | sh ``` ## Notes - **Fast**: ~5ms per file after model loads - **Accurate**: 99% average precision on 200+ file types - **Local**: All inference runs locally, no network needed - **Size agnostic**: Only reads a subset of file content regardless of file size


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: codekungfu/asyncio (version 1.0.0)

--- name: asyncio description: "asyncio patterns, concurrency pitfalls, and backpressure. Use when writing async Python services." --- # Asyncio Structured guidance for **async Python** with **asyncio**: confirm triggers, propose the stages below, and adapt if the user wants a lighter pass. ## When to Offer This Workflow **Trigger conditions:** - User mentions **asyncio**, **async python**, or closely related work - They want a structured workflow rather than ad-hoc tips - They are preparing a review, rollout, or stakeholder communication **Initial offer:** Explain the four stages briefly and ask whether to follow this workflow or work freeform. If they decline, continue in their preferred style. ## Workflow Stages ### Stage 1: Clarify context & goals Anchor on **event loop and tasks**. Ask what success looks like, constraints, and what must not break. Capture unknowns early. ### Stage 2: Design or plan the approach Translate goals into a concrete plan around **cancellation and timeouts**. Compare alternatives and explicit trade-offs; avoid implicit assumptions. ### Stage 3: Implement, validate, and harden Execute with verification loops tied to **backpressure and queues**. Prefer small steps, measurable checks, and rollback points where risk is high. ### Stage 4: Operate, communicate, and iterate Close the loop with **debugging concurrency**: monitoring, documentation, stakeholder updates, and lessons learned for the next cycle. ## Checklist Before Completion - Goals and constraints are explicit for **asyncio** work - Risks and trade-offs are stated, not hand-waved - Verification steps match the change’s impact (tests, canary, peer review) - Operational follow-through is covered (monitoring, docs, owners) ## Tips for Effective Guidance - Be procedural: stage-by-stage, with clear exit criteria - Ask for missing context (environment, scale, deadlines) before prescribing - Prefer checklists and concrete examples over generic platitudes - If the user declines the workflow, switch to freeform help without lecturing ## Handling Deviations - If the user wants to skip a stage: confirm and continue with what they need. - If context is missing: ask targeted questions before strong recommendations. - Prefer concrete examples, trade-offs, and verification steps over generic advice. ## Quality Bar - Each recommendation should be **actionable** (what to do next). - Call out **failure modes** relevant to asyncio concurrency (security, scale, UX, or ops). - Keep tone direct and respectful of the user’s time.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)