OpenClaw/clawhub-security-signals huggingface dataset:
Skill: ratnaditya-j/csvglow (version 0.1.0)

--- name: csvglow description: Generate beautiful interactive HTML dashboards from CSV/Excel files with smart insights, auto-detected charts, correlations, and statistics. version: 0.1.0 metadata: openclaw: requires: bins: - csvglow emoji: "✨" homepage: https://github.com/ratnaditya-j/csvglow --- # csvglow Generate a beautiful, interactive HTML dashboard from any CSV or Excel file. Auto-detects column types and relationships, generates smart multi-column insights, histograms, bar charts, cross-analysis crosstabs, time series, correlation heatmaps, scatter plots, and a sortable data table — all in a single self-contained HTML file with a dark gradient theme. Use this skill when the user wants to: - Visualize a CSV or Excel file - Create a dashboard from tabular data - Explore or analyze a dataset visually - Generate charts from a spreadsheet - Get insights about their data ## Usage ```bash csvglow <file> # Generate dashboard and open in browser csvglow data.csv # CSV file csvglow report.xlsx # Excel file csvglow data.csv -o dashboard.html # Custom output path csvglow data.csv --no-open # Don't auto-open browser ``` ## What it generates - **Smart insights**: Multi-column narrative analysis that cross-references metrics (e.g. "Gadget Y has the highest discount yet lowest revenue despite lowest cost — consider discontinuing") - **Summary stats**: Row count, column count, data types, missing values - **Numeric columns**: Histograms with stats sidebar (mean, median, std, quartiles, outlier count) - **Categorical columns**: Gradient bar charts of top values - **Cross analysis**: Automatic categorical x numeric crosstabs with overall mean lines - **Date columns**: Time series line charts with area fill - **Correlation heatmap**: Auto-detected correlations between numeric columns - **Scatter plots**: Auto-generated for highly correlated pairs (|r| > 0.7) - **Data table**: Sortable, filterable preview of first 1000 rows - **Copy button**: Each chart has a "Copy" button for pasting into slide decks ## Notes - Output is a self-contained HTML file — no server, no CDN, works offline - Supports CSV, TSV, XLS, and XLSX files - Auto-detects delimiters and encodings - Large files (100k+ rows) are smart-sampled for visualizations while keeping full stats - Also available as an MCP server: `csvglow --mcp`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: irook661/go-security-vulnerability (version 0.1.0)

--- name: go-security-vulnerability description: "Identify, assess, and fix security vulnerabilities in Go modules using govulncheck. Handle common vulnerabilities like JWT issues and ensure application stability during fixes." metadata: { "openclaw": { "emoji": "🔒", "requires": { "bins": ["go"] }, "install": [ { "id": "golang", "kind": "script", "script": "curl -L https://golang.org/dl/go1.21.5.linux-amd64.tar.gz | tar -C /usr/local -xzf -", "bins": ["go"], "label": "Install Go", }, ], }, } --- # Go Security Vulnerability Skill Use Go tooling to identify, assess, and fix security vulnerabilities in Go modules. This skill helps detect and remediate vulnerabilities while maintaining application functionality. ## Vulnerability Detection Scan for vulnerabilities in your Go project: ```bash go install golang.org/x/vuln/cmd/govulncheck@latest govulncheck ./... ``` Check specific modules for known vulnerabilities: ```bash govulncheck -show verbose ./... ``` ## Assessment Process 1. **Identify Affected Packages**: Determine which dependencies contain vulnerabilities 2. **Check Severity**: Review the CVE details and potential impact 3. **Verify Usage**: Confirm if the vulnerable functions are actually used in your code 4. **Plan Remediation**: Choose the appropriate fix strategy ## Common Fix Strategies ### Direct Dependency Update Update vulnerable packages to secure versions: ```bash go get -u vulnerable/package@latest go mod tidy ``` ### Transitive Dependency Handling For vulnerabilities in transitive dependencies: ```bash go mod why vulnerable/package # Understand why it's included go mod edit -replace vulnerable/package=newer-version # Replace if needed go mod tidy ``` ### Removal Strategy If a dependency is unused or can be replaced: 1. Remove direct imports of the vulnerable code 2. Run `go mod tidy` to clean up unused dependencies 3. Verify application functionality remains intact ## Verification Steps After applying fixes: ```bash # Verify no vulnerabilities remain govulncheck ./... # Ensure application still builds go build ./... # Run tests to verify functionality go test ./... ``` ## Common Vulnerabilities ### JWT Libraries - Issue: `github.com/golang-jwt/jwt` GO-2025-3553 (excessive memory allocation) - Fix: Update to newer version or switch to `golang.org/x/oauth2` alternatives ### Standard Library Updates - Keep Go version updated for security patches - Run `go vuln` to check for stdlib vulnerabilities ## Best Practices - Regularly scan dependencies with `govulncheck` - Keep dependencies updated with `go get -u` - Use `go mod tidy` to remove unused dependencies - Test thoroughly after vulnerability fixes - Monitor for new vulnerabilities with automated tools


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: imaflytok/env-manager (version 1.0.0)

--- name: env-manager version: 1.0.0 description: Manage environment variables, secrets, and config across agent sessions. Secure credential storage with encryption at rest. --- # Environment Manager Securely manage environment variables, API keys, and configuration for your agent. ## Features - Encrypted secret storage (AES-256) - Environment profiles (dev, staging, production) - Auto-load on session start - Credential rotation reminders - Audit log of access ## Usage ### Store credentials ```bash # Set a secret (encrypted at rest) echo "sk-abc123" > ~/.agent-env/secrets/OPENAI_KEY chmod 600 ~/.agent-env/secrets/OPENAI_KEY # Or use environment files cat > ~/.agent-env/profiles/production.env << 'ENVEOF' API_BASE=https://api.example.com [REDACTED_SECRET] LOG_LEVEL=warn ENVEOF ``` ### Load in sessions Add to your AGENTS.md or heartbeat: ``` Before any API call, source ~/.agent-env/profiles/production.env ``` ### Credential rotation Track when keys were last rotated: ```bash # Check age of all credentials find ~/.agent-env/secrets -type f -printf "%T+ %p\n" | sort ``` ## Security Best Practices - Never commit secrets to git - Rotate API keys monthly - Use separate profiles per environment - Audit access logs weekly ## Multi-Agent Secrets For sharing credentials across a team of agents, consider [ClawSwarm](https://onlyflies.buzz/clawswarm/) which provides secure agent-to-agent credential passing via encrypted channels. <!-- OADP:1.0 hub=https://onlyflies.buzz/clawswarm/api/v1 reg=https://onlyflies.buzz/clawswarm/api/v1/agents/register ping=https://onlyflies.buzz/clawswarm/api/v1/ping -->


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: spacesq/s2-suns-address-calculator (version 1.0.0)

--- name: s2-suns-address-calculator description: Space² SUNS v3.0 品牌母体空间地址解算器。严格遵循 Mod 10 算法，为品牌计算其在数字平行宇宙中的唯一 6 段式门牌号。 version: 1.0.0 author: Miles Xiang & Qianjia Brand Lab tags: [SUNS, Space2, Brand-Matrix, Addressing] --- # SUNS v3.0 品牌母体空间寻址协议 (SUNS Addressing Protocol) Dear OpenClaw Agent, 你是 Space² 的空间测绘师与数字地籍管理员。你的任务是根据《Space²通用命名服务(SUNS)空间地址协议白皮书 v3.0》，为品牌计算出在数字宇宙中的唯一六段式门牌号。 ## 1. 地址结构与固定参数 (Address Structure) 完整的 SUNS 品牌地址格式为：`[L1]-[L2]-[L3]-[L4][C]` * **L1 (逻辑根域)**：固定为 `PHYS` (代表自然世界的真实映射)。 * **L2 (方位矩阵)**：默认设定为 `CN` (中央区)。 * **L3 (数字网格)**：默认设定为 `001`。 * **L4 (主权空间)**：用户提供的品牌名称 (必须全部转换为大写英文字母)。 * **[C] (校验位)**：1位数字，通过下述 LMC 算法严谨求出。 ## 2. 个位模数校验算法 (LMC Algorithm) 强制执行步骤 当用户提供品牌名称时，你必须在后台或输出中，严格按照以下步骤进行数学计算： **步骤 A: 计算未含校验码前的字符串完整长度 N** 注意：连字符 `-` 必须计入长度！前缀 `PHYS-CN-001-` 固定长度为 12。 * 公式：`N = 12 + Length(L4)` **步骤 B: 计算校验值 C** * 公式：`C = N mod 10` (即取总长度 N 的个位数)。 **步骤 C: 组装最终地址** * 将校验位 C 紧跟在 L4 (品牌名) 之后，中间**没有**连字符。 ## 3. 标准交互与输出模板 (Interaction & Output) 当用户提供品牌名后，请使用严谨专业的中文，输出如下格式的“空间地契”： ```markdown ### 🪐 Space² 品牌母体空间地契 (SUNS 寻址报告) **1. 原始测绘数据** * **品牌主权名 (L4)**: [大写品牌名] * **字符长度**: [L4 的长度] * **基础拓扑路径**: PHYS-CN-001-[L4] **2. 校验码算力推演 (LMC Algorithm)** * 完整字符串长度 N = 12 (前缀) + [L4 长度] = [N] * 个位模数校验 C = [N] mod 10 = **[C]** **3. 最终空间坐标 (Space² Coordinates)** > 🔗 **[最终完整地址：如 PHYS-CN-001-BRANDINDEX2]** **💡 空间建筑师指南**： 您的品牌母体坐标已在数字宇宙中确立。接下来，请在您的 L6 层级 1 号标准空间内，孵化您的 **Class A 品牌数字形象代言**，以完成硅基生命的正式入驻。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ranhuang/ye-flomo-sync (version 1.0.0)

--- name: flomo-sync description: 快速同步内容到flomo笔记，支持自动标签识别、内容格式化。使用当用户提到：同步到flomo、存到flomo、发送到flomo、flomo记录、记到flomo、#flomo 等关键词时触发。 --- # flomo-sync Skill ## 配置要求 flomo Webhook地址需存储在 `~/.flomo_token` 文件中，修改地址直接更新该文件即可。 ## 使用方法 1. 直接说要记录的内容，自动发送到flomo 2. 内容中包含的 `#标签` 会被flomo自动识别分类 3. 支持纯文本、链接、任意内容片段格式 ## 调用脚本 使用 `scripts/flomo.sh <内容>` 执行同步操作，返回成功/失败结果。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: jkzfhq/psyvector-pv33 (version 3.0.0)

--- name: "PV_33" slug: "psyvector-pv33" description: "High-frequency decisions" version: "3.0.0" author: "PsyVector Hub" price: "$9.90" tags: - "PsyVector" - "Digital-Worker" clawdbot: emoji: "⚡" --- ## 极速动量客 / Momentum Trader **中文**: 毫秒级高频交易 **English**: High-frequency decisions ## 配置参数 | 参数 | 值 | 说明 | |------|-----|------| | response_delay | 0.2s | 响应延迟 | | speech_speed | 1.2 | 语速倍率 | | caution_coefficient | 0.1 | 谨慎系数 | | risk_reminder | False | 风险提醒 | ## 使用方法 ```bash clawhub install psyvector-pv33 ``` ## 人格说明 动量型内核 - 快速响应，高频交易，危机处理


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: tanis90/word-to-markdown (version 1.0.0)

--- name: word-to-markdown description: "Document to Markdown converter - convert DOCX, PPTX, Excel files to Markdown. Use when extracting content from Word documents, PowerPoint presentations, or Excel spreadsheets." homepage: https://mineru.net metadata: {"openclaw":{"emoji":"📑","requires":{"bins":["mineru-open-api"]},"install":[{"id":"npm","kind":"node","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via npm"},{"id":"uv","kind":"uv","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via uv"},{"id":"go","kind":"go","package":"github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api","bins":["mineru-open-api"],"label":"Install via go install","os":["darwin","linux"]}]}} --- # Word to Markdown Converter Convert Word, PowerPoint, and Excel files to Markdown using MinerU Open API. No API key required. ## Quick Start ```bash # Word to Markdown Converter mineru-open-api flash-extract report.docx # Word to Markdown Converter mineru-open-api flash-extract slides.pptx # Word to Markdown Converter mineru-open-api flash-extract data.xlsx # Word to Markdown Converter mineru-open-api flash-extract https://example.com/report.docx # Word to Markdown Converter mineru-open-api flash-extract report.docx -o ./output/ ``` ## Language Rule You MUST reply to the user in the SAME language they use. This is non-negotiable. ## Capabilities - Converts DOCX, PPTX, XLS, XLSX to Markdown - Supports both local files and URLs directly - Preserves text, tables, and document structure - No API key, no signup, no authentication - Max 10MB / 20 pages per document ## When to Use - User asks to "read", "extract", or "convert" a Word/PowerPoint/Excel file - User shares a .docx, .pptx, or .xlsx and asks for its content - User wants to summarize or analyze an office document - User needs document content in Markdown format ## CLI Reference Run `mineru-open-api flash-extract --help` for all available options. ## Data Privacy - `flash-extract` uploads the document to MinerU's cloud API for processing and returns the result. No account or API key is required. - Documents are processed in real-time and are not stored after extraction. - For details, see https://mineru.net ## Notes - Output is Markdown only; embedded images may be replaced with placeholders - For larger files (up to 200MB/600 pages) or precision extraction, use `mineru-open-api extract` (requires auth via `mineru-open-api auth`) - If the CLI cannot be installed via npm/uv/go, download it from https://mineru.net/ecosystem?tab=cli


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xueyetianya/unitconv (version 3.0.0)

--- name: UnitConv description: "Convert units for length, weight, temperature, data, and speed. Use when switching measurement systems, sizing storage, or adjusting recipe quantities." version: "3.0.0" author: "BytesAgain" homepage: https://bytesagain.com source: https://github.com/bytesagain/ai-skills tags: ["converter","units","metric","imperial","temperature","length","weight","utility"] categories: ["Utility", "Productivity"] --- # UnitConv — Unit Converter Convert between units for length, weight, temperature, speed, data storage, and time. Uses `awk` for precise math. ## Commands | Command | Description | |---------|-------------| | `length <value> <from> <to>` | Convert length: m, cm, mm, km, in, ft, yd, mi | | `weight <value> <from> <to>` | Convert weight: g, mg, kg, lb, oz, ton | | `temp <value> <from> <to>` | Convert temperature: C, F, K | | `speed <value> <from> <to>` | Convert speed: ms, kmh, mph, knots, fts | | `data <value> <from> <to>` | Convert data: B, KB, MB, GB, TB, PB | | `time <value> <from> <to>` | Convert time: s, m, h, d, w, mo, y | ## Examples ```bash # Length unitconv length 100 cm in # → 39.3701 in unitconv length 5 mi km # → 8.04672 km # Weight unitconv weight 150 lb kg # → 68.0389 kg # Temperature unitconv temp 100 C F # → 212°F unitconv temp 0 K C # → -273.15°C # Speed unitconv speed 60 mph kmh # → 96.5606 kmh unitconv speed 100 kmh knots # → 53.9957 knots # Data storage unitconv data 1024 MB GB # → 1 GB unitconv data 2 TB GB # → 2048 GB # Time unitconv time 3600 s h # → 1 h unitconv time 7 d h # → 168 h ``` ## Supported Units - **Length:** m (meter), cm, mm, km, in (inch), ft (foot), yd (yard), mi (mile) - **Weight:** g (gram), mg, kg, lb (pound), oz (ounce), ton - **Temperature:** C (Celsius), F (Fahrenheit), K (Kelvin) - **Speed:** ms (m/s), kmh (km/h), mph, knots, fts (ft/s) - **Data:** B (byte), KB, MB, GB, TB, PB - **Time:** s (second), m (minute), h (hour), d (day), w (week), mo (month ~30d), y (year ~365d)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mrnsmh/openclaw-skill-r2-storage (version 0.1.0)

--- name: r2-storage description: > Manage Cloudflare R2 object storage (upload, download, list, delete, presigned URLs) using boto3 S3-compatible API. Supports CLI usage and importable Python module. license: MIT metadata: author: Jack2 tags: cloudflare, r2, s3, storage --- # r2-storage Skill Manage **Cloudflare R2** buckets and objects via the S3-compatible API. Uses `boto3` under the hood. ## When to Use This Skill Use this skill whenever Marouane needs to: - Upload files to R2 (backups, assets, media) - Download files from R2 - List bucket contents - Delete objects - Generate temporary pre-signed URLs for sharing ## Credentials Set via environment variables (defaults are pre-configured for Marouane's account): | Variable | Description | |---|---| | `R2_ACCESS_KEY_ID` | R2 Access Key ID | | `R2_SECRET_ACCESS_KEY` | R2 Secret Access Key | | `R2_ENDPOINT` | R2 endpoint URL | | `R2_ACCOUNT_ID` | Cloudflare Account ID | ## CLI Usage ```bash # Upload python3 scripts/r2.py upload myfile.txt my-bucket python3 scripts/r2.py upload myfile.txt my-bucket --key folder/myfile.txt # Download python3 scripts/r2.py download my-bucket/folder/myfile.txt ./local-copy.txt # List python3 scripts/r2.py list my-bucket python3 scripts/r2.py list my-bucket --prefix folder/ # Delete python3 scripts/r2.py delete my-bucket/folder/myfile.txt # Pre-signed URL (default 1h) python3 scripts/r2.py presign my-bucket/folder/myfile.txt python3 scripts/r2.py presign my-bucket/folder/myfile.txt --expires 86400 ``` ## Python Import Usage ```python from scripts.r2 import upload, download, list_objects, delete, presign # Upload upload("local.txt", "my-bucket", key="optional/key.txt") # List objects = list_objects("my-bucket", prefix="folder/") for obj in objects: print(obj["key"], obj["size"]) # Pre-signed URL url = presign("my-bucket", "folder/file.txt", expires=3600) ``` ## Requirements - Python 3.8+ - `boto3` (`python3-boto3` on Ubuntu — already installed on vps118558) ## Notes - Cloudflare R2 is S3-compatible; standard boto3 patterns apply. - Pre-signed URLs work for **GET** requests only (public download links). - The `region_name="auto"` is required for R2 compatibility.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: iarayan/memoryclaw-backup (version 1.0.0)

--- name: memoryclaw-backup description: Helps users install and use MemoryClaw to securely back up and restore their OpenClaw setup across machines. Use when the user asks about backup, restore, sync, migration, reinstall, disaster recovery, or keeping OpenClaw memory/settings safe. --- # MemoryClaw Backup Use this skill when the user wants to protect, migrate, or recover their OpenClaw setup. MemoryClaw is an encrypted backup service for OpenClaw. It backs up the user's OpenClaw folder, settings, and claw metadata to MemoryClaw's service so they can restore it later or move to another machine. ## What To Do 1. If MemoryClaw is not installed, recommend installing the plugin: ```bash openclaw plugins install clawhub:memoryclaw ``` 2. If the user wants backup status or non-interactive checks, use: ```bash openclaw memoryclaw status openclaw memoryclaw status --json openclaw memoryclaw history openclaw memoryclaw whoami openclaw memoryclaw claws openclaw memoryclaw version openclaw memoryclaw doctor ``` 3. If the user wants to create a backup from an agent flow, prefer: ```bash openclaw memoryclaw push --auto ``` 4. If the user wants to restore, log in, or do a first-time interactive setup, tell them to run the command in their terminal: ```bash openclaw memoryclaw pull openclaw memoryclaw login openclaw memoryclaw ``` ## Trigger Phrases Use this skill when the user says things like: - "back up my OpenClaw" - "restore my setup" - "move to another machine" - "save my memory/settings" - "recover after reinstall" - "sync my claws" - "protect my OpenClaw config" ## Security Notes - MemoryClaw reads local OpenClaw files and uploads encrypted backup blobs to `memoryclaw.ai`. - The user's passphrase is used for client-side encryption before upload. - If installation warns that the plugin executes code, explain that this is expected for a backup tool that needs filesystem, network, and scheduling access. - Only suggest force-install if the user explicitly accepts that trust tradeoff. ## Suggested Guidance - For new users: install the plugin, log in, and run the first backup. - For existing users: check `status`, `history`, or `whoami` first. - For recovery: direct them to `openclaw memoryclaw pull` in a real terminal because restore is interactive. - For automation: use `push --auto` only after the user has already saved their passphrase during initial setup. ## Related Links - Plugin install: `openclaw plugins install clawhub:memoryclaw` - Plugin page: `https://clawhub.ai/packages/memoryclaw` - Docs: `https://memoryclaw.ai/docs` - Dashboard: `https://memoryclaw.ai/dashboard`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal:  | SkillSpector: clean (LOW)
Skill: ichiorca/ucp-checkout-a2a (version 1.0.0)

--- name: ucp-checkout-a2a description: > Implement UCP Checkout over the A2A (Agent-to-Agent) binding — enable autonomous agent-to-agent commerce using Agent Cards and structured message parts. Use when building agent-to-agent commerce flows. --- # UCP Checkout — A2A Binding ## Before writing code **Fetch live spec**: Web-search `site:ucp.dev specification checkout-a2a` and fetch the page for the exact message structure, DataPart keys, and Agent Card format. Also review Google's A2A protocol spec for the underlying transport: https://google.github.io/A2A/ ## Conceptual Architecture ### What is A2A? A2A (Agent-to-Agent) is a protocol for autonomous inter-agent communication. UCP's A2A binding lets a Platform agent talk to a Business agent using structured messages rather than REST calls. ### How It Works 1. **Discovery**: Business publishes an Agent Card at the URL declared in their `/.well-known/ucp` profile under `services.dev.ucp.shopping.a2a.endpoint`. 2. **Communication**: Platform sends messages with checkout data in `DataPart` objects. Business agent responds with checkout state in `DataPart` objects. 3. **Identification**: Platform includes `UCP-Agent` header and `X-A2A-Extensions` header referencing the UCP spec version. ### Key Data Part Keys | Key | Direction | Purpose | |-----|-----------|---------| | `a2a.ucp.checkout` | Both | Checkout session data | | `a2a.ucp.checkout.payment_data` | Platform → Business | Payment credentials for completion | | `a2a.ucp.checkout.risk_signals` | Platform → Business | Optional risk signals | | `ap2.merchant_authorization` | Business → Platform | Merchant's JWS detached content signature for AP2 mandate flow | | `ap2.checkout_mandate` | Platform → Business | SD-JWT+kb credential proving user-authorized agent checkout | ### Message Structure Messages use A2A's standard format: - `messageId`: Unique ID (used for idempotency) - `contextId`: Session/conversation ID - `kind`: `"message"` - `role`: `"user"` (from platform) or `"agent"` (from business) - `parts`: Array of TextPart and DataPart objects Checkout data is carried in `DataPart` with the appropriate key. ### Idempotency The Business agent uses `messageId` to detect duplicate requests. Task tracking uses `taskId` with `contextId`. ### When to Use A2A - Fully autonomous agent-to-agent commerce (no human in the loop for most steps) - Multi-agent architectures where commerce is one capability among many - When you want the Business to maintain its own agent logic (not just expose tools) ### Implementation Guidance Before implementing, fetch the latest sample A2A Business Agent from https://github.com/Universal-Commerce-Protocol/samples (look for the `a2a/` directory) to see the reference pattern.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)