OpenClaw/clawhub-security-signals huggingface dataset:
Skill: zhangqixin9527/web-scraping (version 1.0.0)

--- name: web-scraping description: Extract structured information from websites using web_fetch for simple pages and browser automation for dynamic sites, login-gated flows, pagination, infinite scroll, or pages that require clicking/searching/filtering. Use when the user asks to scrape a site, collect listings, gather fields from many pages, monitor website changes, or turn webpage content into structured summaries/JSON/CSV. --- # Web Scraping Extract data with the lightest reliable method first. ## Choose the approach 1. Use `web_fetch` for simple public pages when the needed content is already in HTML. 2. Use `browser` when the site is dynamic, needs clicking, infinite scroll, filters, tabs, or login/session state. 3. Use `web_search` only to discover candidate pages when the target URL is unknown. ## Default workflow 1. Identify the target site and exact fields to collect. 2. Test one page first. 3. Decide the extraction method: - `web_fetch` for readable article/listing text - `browser snapshot` for dynamic DOM inspection 4. Normalize the output into a stable schema. 5. If scraping multiple pages, avoid tight loops and serialize requests. 6. Deduplicate by URL or stable item id. 7. Save results in the workspace when the task is larger than a quick one-off. ## Browser scraping pattern 1. Open the page. 2. Take a snapshot. 3. Interact only as needed: search, click filters, pagination, expand sections. 4. Re-snapshot after each meaningful state change. 5. Extract only the fields the user asked for. 6. Close tabs when finished. ## Output guidance Prefer one of these formats: - concise bullet summary - JSON array of objects - CSV/TSV when the user wants exportable rows Use explicit keys, for example: ```json [ { "title": "...", "url": "...", "source": "...", "date": "...", "summary": "..." } ] ``` ## Reliability rules - Do not invent missing fields. - If a site blocks access, say so and switch sources when appropriate. - For news/results pages, capture source + title + link at minimum. - For large jobs, checkpoint partial results to a workspace file. - Prefer fewer larger writes over many tiny writes. ## Cleanup - Close browser tabs opened for scraping. - If you create state/output files, store them under the workspace and name them clearly.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: laolaoqi/crypto-price-watcher (version 1.0.0)

--- name: Crypto Price Watcher description: > Real-time cryptocurrency price checker for BTC, ETH, and top altcoins. Fetches live prices, 24h change, market cap, and volume from free APIs. No API key required. Supports price alerts and portfolio tracking. --- # Crypto Price Watcher Real-time crypto price data with zero setup. Uses CoinGecko free API — no key needed. ## Actions ### `price` — 查询实时价格 ```json { "action": "price", "symbols": ["bitcoin", "ethereum", "solana"] } ``` ### `alerts` — 设置价格提醒 ```json { "action": "alert", "symbol": "bitcoin", "target_price": 65000, "direction": "above" } ``` ### `watch` — 监控持仓价值 ```json { "action": "watch", "portfolio": [{"symbol": "bitcoin", "amount": 0.5}, {"symbol": "ethereum", "amount": 5}] } ``` ## Pricing $2.99 — One-time purchase


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector:  ()
Skill: mickshu/stock-invest-master (version 3.9.1)

--- name: stock-invest-master version: 3.9.1 license: MIT description: | 股票投资分析技能。道法+大师+AI的三位分析框架，支持A股、港股、美股。适用场景：个股分析、公司估值、财报解读、行业研究、投资决策、基本面分析、技术面分析、风险评估、资金流向、13F机构持仓、南北向资金、买入卖出建议、投资大师视角（格雷厄姆/巴菲特/芒格/段永平/林奇/费雪/索罗斯/马克斯/达利欧/西蒙斯）、价值投资、成长股分析、价值股筛选、PE/PB/ROE估值、DCF估值、PEG估值、护城河分析、安全边际、财务健康检查、盈利质量分析、现金流分析等、分析师评级。触发关键词：股票、分析、估值、投资。 --- # Stock Invest Master ## 1. 核心分析框架：志·道·势·法·术·器 * **志 (信仰)**：验证价值投资信仰与心性成熟度。**不通过则停止分析。** * **道 (逻辑)**：商业本质、能力圈、护城河、定价权。 * **势 (时机)**：马克斯周期、索罗斯反身性、达利欧债务周期。 * **法 (方法)**：林奇PEG、费雪15点、格雷厄姆定量筛选、财务质量(ROE/ROIC/FCF)。 * **术 (执行)**：金字塔建仓、仓位管理、大师卖出标准。 * **器 (量化)**：西蒙斯量化验证、PE/PB历史分位、技术指标辅助。 ## 2. 快速筛选 (25问红旗) * **核心：** Q18(管理层诚信)=否，直接淘汰。任何主题>3个“否”或总计>8个“否”则放弃。 * **分类：** 志(Q1-4)、道(Q5-9)、势(Q10-13)、法(Q14-18)、术(Q19-21)、器(Q22-25)。 ## 3. 数据检索与质量协议 1. **市场识别**：A股(.SZ/.SH)、港股(.HK)、美股(纯英文代码)。 2. **数据源**： * A/港股：`neodata-financial-search` (实时/估值), `finance-data-retrieval` (历史/财务)。 * 美股：`financial-datasets` (SEC/财务), `WebSearch` (13F/评级)。 3. **必查项**：重大公告(近12月)、内部人交易、机构持仓(13F/南北向资金)、融资融券、分析师评级。 4. **校验**：PE ≈ PB/ROE；市值 ≈ 股价 × 股本。 ## 4. 十大师视角映射 | 大师 | 核心逻辑 | 对应层级 | | :--- | :--- | :--- | | **格雷厄姆** | 安全边际、内在价值 | 志/道/法 | | **巴菲特** | 护城河、能力圈 | 志/道 | | **芒格** | 逆向思维、心智模型 | 道 | | **林奇** | 六类分类、PEG | 法 | | **费雪** | 15点、管理层质量 | 法 | | **马克斯** | 周期定位、第二层次思维 | 势 | | **段永平** | 本分、Stop Doing | 志/道 | | **达利欧** | 债务周期、全天候 | 势 | | **索罗斯** | 反身性、试错加仓 | 势/术 | | **西蒙斯** | 量化模型、统计验证 | 器 | ## 5. 报告输出规范 * **保存路径**：`~/.stock-invest-master/yyyymmdd_公司名.md`。 * **报告速览卡片**：使用 `claude-design` 或 HTML 截图生成包含：评级、星级(赛道/公司/价格)、安全边际、关键数据、大师共识。 * **深度风险分析**：必须量化财务(债务/现金流)、行业(份额/技术)、估值(泡沫)风险。 ## 6. 自动化工作流指令 1. **识别**：确认市场与代码。 2. **检索**：调用工具获取财务、公告、资金流向数据。 3. **筛选**：执行25问快速评估，记录红旗。 4. **建模**：DCF、PEG、格雷厄姆公式交叉估值。 5. **注入**：按六层架构逐层注入对应大师视角。 6. **诊断**：违背“志道法”专项检查。 7. **存档**：生成报告、保存图片、启动Web服务。 ## 7. 违背诊断与红旗 (Stop Doing List) * **自动否决**：财务造假、管理层失信、持续价值毁灭(ROIC<WACC)、反身性泡沫末期。 * **风险等级**：对每项红旗标注：[无/轻微/严重/致命]。 --- **提示**：分析前必须先读取 `references/` 下对应的框架文件，禁止仅依赖内置知识。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: chris6970barbarian-hue/glitch-dashboard (version 2026.2.18)

# Dashboard Unified web terminal for task management, queue processing, and system monitoring. ## Overview Single-page dashboard combining: - **Task Queue** - View and manage pending tasks - **System Monitor** - CPU, Memory, Load, Uptime - **ZeroTier Status** - Network connection info - **Output Stream** - Recent log entries ## Quick Start ```bash # Start dashboard dashboard start 3853 ``` Then open: http://localhost:3853 ## Features ### Real-time Monitoring - CPU usage with progress bar - Memory usage with progress bar - Load average - System uptime ### Task Queue Management - View pending/processing tasks - Complete current task - Clear queue - Auto-refresh every 3 seconds ### ZeroTier Integration - Connection status - ZeroTier IP address - Network info ### Output Stream - Recent log entries - Source filtering ## CLI Commands | Command | Description | |---------|-------------| | `start [port]` | Start web server | | `status` | Quick CLI status | ## API Endpoints | Endpoint | Method | Description | |----------|--------|-------------| | `/` | GET | Main dashboard | | `/raw` | GET | JSON status | | `/api/complete` | POST | Complete task | | `/api/clear` | POST | Clear queue | ## Integration Combines data from: - `task-queue` skill - `system-monitor` skill - `output-streamer` skill - `zerotier-deploy` skill ## Use Cases 1. **Operations Dashboard** - Monitor all systems in one view 2. **Task Management** - See and complete queued tasks 3. **Quick Status** - CLI `dashboard status` for quick check 4. **ZeroTier Access** - Quick access to ZT IP ## Author Glitch (OpenClaw agent)


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: lniosy/coolapk (version 1.0.0)

--- name: coolapk description: 酷安社区搜索工具 — 搜索帖子、用户、应用、话题信息（CLI 直调，比 MCP Server 更省 token） --- # 酷安社区搜索工具 通过 CLI 命令搜索酷安社区内容，获取帖子和用户信息。所有命令输出精简 JSON，自动排除空值字段。 ## 前置安装 首次使用前运行： ```bash pip install coolapk-mcp ``` ## 使用方式 ### 搜索 ```bash # 搜索帖子（默认） coolapk search "关键词" # 搜索用户 coolapk search "用户名" --type user # 搜索话题 coolapk search "话题" --type feedTopic # 搜索应用 coolapk search "应用名" --type app # 翻页 coolapk search "关键词" --page 2 ``` ### 帖子详情 ```bash # 查看帖子详情 + 回复 coolapk feed <帖子ID> # 只要详情不要回复 coolapk feed <帖子ID> --no-replies # 指定回复页码 coolapk feed <帖子ID> --reply-page 2 ``` ### 用户 ```bash # 用户资料 coolapk user <UID> # 用户帖子列表 coolapk user <UID> --feeds coolapk user <UID> --feeds --page 2 ``` ### 首页 ```bash # 推荐动态（默认） coolapk home # 热门 coolapk home --tab hot # 最新 coolapk home --tab latest ``` ### 话题 ```bash # 话题详情 coolapk topic "话题名" # 话题下的帖子 coolapk topic "话题名" --feeds ``` ### 交互（需先登录） ```bash # 登录（传入 Cookie） coolapk login --cookie "uid=xxx;username=xxx;token=xxx" # 查看登录状态 coolapk login --status # 点赞/取消赞 coolapk like <帖子ID> coolapk unlike <帖子ID> # 回复 coolapk reply <帖子ID> -m "回复内容" coolapk reply <回复ID> -m "回复内容" --type reply # 关注/取消关注 coolapk follow <UID> coolapk unfollow <UID> ``` ### 通知 ```bash # 未读计数 coolapk notify # 具体类型 coolapk notify atMeMeFeed coolapk notify comment coolapk notify feedLike coolapk notify contactsFollow coolapk notify message ``` ## 注意事项 - 首次运行会自动生成设备码并保存到 ~/.coolapk-mcp/config.json - 搜索和浏览不需要登录 - 点赞、回复、关注等交互操作需要先登录 - 所有输出为精简 JSON，自动排除空值字段节省 token


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: mattjefferson/todoist-td (version 0.1.1)

--- name: todoist description: Use the td (Todoist CLI) to read and manage Todoist todos/to-dos/tasks from the terminal. Trigger when the user asks about their todos/tasks/agenda/checklist (today/upcoming/overdue), wants to list inbox/tasks/projects/labels, add a task/todo with natural language, or update/complete/delete/move tasks (e.g., add a phone number to a task description, change due dates, priorities, labels). --- # Todoist via `td` CLI ## Install / verify Repo: https://github.com/Doist/todoist-cli If `td` is not installed (e.g., `command not found: td`), install from the repo: ```bash git clone https://github.com/Doist/todoist-cli cd todoist-cli npm install npm run build npm link ``` Then verify: ```bash td --help ``` Use `td` for all Todoist operations. Prefer parseable output: - Use `--json` (or `--ndjson`) for listing/reading tasks. - Use `td task update ...` for edits (content, due, description, priority, labels, etc.). ## Quick agenda - Today + overdue: - `td today --json` - Next N days: - `td upcoming 7 --json` - Inbox: - `td inbox --json` When summarizing an agenda for the user: - Separate **Overdue** vs **Due today** (and optionally **Upcoming**). - Include priority (p1–p4) if present and any labels. ## Find the right task to edit Preferred approaches: 1) If you already have the task id, use it directly: - Reference format: `id:<taskId>` (e.g., `id:6WcqCcR4wF7XW5m6`) 2) If you only have a title/snippet, search/list then match: - `td task list --json` (optionally filter via other list commands like `today`, `upcoming`, `inbox`) - Then pick the correct item by `content` + due date + project. To view a single task: - `td task view <ref> --json` ## Common edits Update description (notes): - `td task update <ref> --description "..."` Update title/content: - `td task update <ref> --content "New task title"` Change due date/time (natural language often works): - `td task update <ref> --due "tomorrow 3pm"` Priority: - `td task update <ref> --priority p1` (or p2/p3/p4) Labels (replaces existing labels): - `td task update <ref> --labels "Chores,Calls"` Complete / reopen: - `td task complete <ref>` - `td task uncomplete id:<taskId>` Delete: - `td task delete <ref> --yes` (only if the user explicitly wants deletion) ## Add tasks Fast natural-language add: - `td add "Call dentist tomorrow 10am p2 #Personal"` Or explicit add (when you need structured fields): - `td task add --content "..." --due "..." --priority p2 --labels "..."` ## Safety / UX - Confirm before destructive actions (delete). - If multiple tasks match the user’s description, ask a clarifying question (or show candidates) before updating. - When the user asks to add info (e.g., a phone number), put it in the **description** unless they explicitly want it in the title.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: spideystreet/remind-myself (version 1.0.6)

--- name: remind-myself description: "Set a one-shot reminder delivered via Telegram at a specific time or after a duration. Use when the user asks to be reminded of something, set an alarm, or schedule a future notification. Always use this skill instead of the cron tool directly — it handles chat ID resolution and delivery." metadata: {"openclaw":{"requires":{"bins":["openclaw"]}}} --- # Reminder Creates a one-shot cron job that delivers a reminder to Telegram at the specified time. ## Workflow ### 1. Parse the user's message Extract: | Field | Notes | |-------|-------| | `text` | What to remember (verbatim or paraphrased, concise) | | `when` | When to deliver — relative or absolute | If `when` is ambiguous, ask for clarification before proceeding. ### 2. Compute the `when` value **Relative durations** → pass directly as `<n><unit>`: - "in 20 minutes" → `20m` - "in 2 hours" → `2h` - "in 1 day" → `1d` **Absolute times** → convert to ISO 8601 in **Europe/Paris** timezone: ```bash TZ=Europe/Paris date -d "tomorrow 09:00" --iso-8601=seconds # → 2026-03-03T09:00:00+01:00 ``` ### 3. Confirm with the user before scheduling Show a summary and ask for confirmation: ``` Set this reminder? - What: <text> - When: <human-readable time> ``` Only proceed after the user confirms. ### 4. Run the reminder script **This is the only way to create a reminder. Do not use any other method.** ```json { "tool": "exec", "command": "bash {baseDir}/scripts/remind.sh \"<when>\" \"<text>\"" } ``` The script handles everything: chat ID resolution, cron job creation, and verification. ### 5. Check the script output The script prints the result. Look for: - `OK: reminder-xxx is scheduled` → success - `ERROR: ...` → report the exact error to the user **Do not confirm success unless the script output says "OK".** ### 6. Confirm to the user Only after seeing "OK" in the script output: ``` ⏰ Reminder set! 📝 <text> 🕐 <human-readable time> ``` ### 7. Error handling - **Never assume failure without running the script.** Always execute it and report the actual output. - **Never invent a diagnosis.** If something fails, show the raw error. - **Never use sessions_spawn, sleep, or any other method.** Only use the script above. - If the time is in the past → warn the user and ask for a new time - If the reminder text is empty → ask what to remind them of ## Examples | User says | `when` | `text` | |-----------|--------|--------| | "in 20 minutes, remind me to take out the laundry" | `20m` | `Take out the laundry` | | "remind me to call Alice tomorrow at 14h" | `2026-03-03T14:00:00+01:00` | `Call Alice` | | "in 2 hours: check the oven" | `2h` | `Check the oven` | | "friday at 9am: team standup" | `2026-03-06T09:00:00+01:00` | `Team standup` |


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: utromaya-code/gif-search-cli (version 1.0.2)

--- name: gifgrep description: Search GIF providers with CLI/TUI, download results, and extract stills/sheets. homepage: https://gifgrep.com metadata: { "openclaw": { "emoji": "🧲", "requires": { "bins": ["gifgrep"] }, "install": [ { "id": "brew", "kind": "brew", "formula": "steipete/tap/gifgrep", "bins": ["gifgrep"], "label": "Install gifgrep (brew)", }, { "id": "go", "kind": "go", "module": "github.com/steipete/gifgrep/cmd/gifgrep@latest", "bins": ["gifgrep"], "label": "Install gifgrep (go)", }, ], }, } --- # gifgrep Use `gifgrep` to search GIF providers (Tenor/Giphy), browse in a TUI, download results, and extract stills or sheets. GIF-Grab (gifgrep workflow) - Search → preview → download → extract (still/sheet) for fast review and sharing. Quick start - `gifgrep cats --max 5` - `gifgrep cats --format url | head -n 5` - `gifgrep search --json cats | jq '.[0].url'` - `gifgrep tui "office handshake"` - `gifgrep cats --download --max 1 --format url` TUI + previews - TUI: `gifgrep tui "query"` - CLI still previews: `--thumbs` (Kitty/Ghostty only; still frame) Download + reveal - `--download` saves to `~/Downloads` - `--reveal` shows the last download in Finder Stills + sheets - `gifgrep still ./clip.gif --at 1.5s -o still.png` - `gifgrep sheet ./clip.gif --frames 9 --cols 3 -o sheet.png` - Sheets = single PNG grid of sampled frames (great for quick review, docs, PRs, chat). - Tune: `--frames` (count), `--cols` (grid width), `--padding` (spacing). Providers - `--source auto|tenor|giphy` - `GIPHY_API_KEY` required for `--source giphy` - `TENOR_API_KEY` optional (Tenor demo key used if unset) Output - `--json` prints an array of results (`id`, `title`, `url`, `preview_url`, `tags`, `width`, `height`) - `--format` for pipe-friendly fields (e.g., `url`) Environment tweaks - `GIFGREP_SOFTWARE_ANIM=1` to force software animation - `GIFGREP_CELL_ASPECT=0.5` to tweak preview geometry


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dinghaibin/nl-tool (version 1.0.0)

--- name: nl-tool description: Number lines of text files, showing line numbers alongside content. Use for reference, indexing, and code line numbering. --- # NL - Line Numbering Utility Add line numbers to text files. Supports configurable number formats, starting values, and numbering schemes. Useful for code review, document reference, and log analysis. ## Usage ```bash nl-tool [options] <file> ``` ## Options - `-ba`: Number all lines (including blank) - `-bt`: Number non-empty lines only (default) - `-v N`: Start numbering from N - `-i N`: Increment by N for each line ## Examples ```bash # Number all lines including blanks nl-tool -ba script.sh # Start from 100 nl-tool -v 100 data.txt ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: cinience/volcengine-ai-video-generation (version 1.0.0)

--- name: volcengine-ai-video-generation description: AI video generation workflow on Volcengine. Use when users need text-to-video, image-to-video, generation parameter tuning, or async task troubleshooting for video jobs. --- # volcengine-ai-video-generation Run video generation jobs with deterministic task submission and status polling. ## Execution Checklist 1. Confirm input mode (text-to-video or image-to-video). 2. Set duration, resolution, fps, and style constraints. 3. Submit task and poll status until completion. 4. Return final video URL/path and task metadata. ## Reliability Rules - Always log task ID for retries. - Use bounded polling intervals. - Surface failure reason and rerun suggestions. ## References - `references/sources.md`

path: agents/openai.yaml
content: interface:
  display_name: "Volcengine Video Generation"
  short_description: "Run text or image to video workflows"
  default_prompt: "Use $volcengine-ai-video-generation to create a video from this input."


path: references/sources.md
content: # Sources

- Volcengine video generation API documentation
- Volcengine async task status and retry documentation


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: sabyaghosh/openclaw-kilo-agent (version 1.0.0)

--- name: openclaw-kilo-agent description: "High-performance coding agent and browser automation orchestrator using the Kilo CLI. Use when you need to: (1) Offload heavy-duty coding tasks (refactoring, multi-file edits, complex implementations), (2) Execute browser automation workflows (scraping, form-filling, navigating websites), (3) Manage sessions and context across different Kilo runs, (4) Use MCP servers for extended capabilities (Puppeteer, GitHub, FileSystem). This skill is the 'hands' for OpenClaw's 'brain'." --- # OpenClaw-Kilo-Agent This skill coordinates the Kilo CLI to perform complex execution tasks, from deep codebase refactoring to automated browser interactions. ## Core Capabilities - **Heavy-Lifting Coding**: Offload file-intensive tasks to the specialized Kilo agent. - **Browser Automation**: Control web browsers via Puppeteer MCP integration. - **Session Continuity**: Resume or fork existing Kilo sessions to maintain context. - **Autonomous Execution**: Run Kilo with `--auto` for hands-free automation in OpenClaw. ## Setting Up Kilo If Kilo is not yet configured, follow the instructions in [setup-guide.md](references/setup-guide.md). **Key Config Location:** `~/.config/kilo/kilo.json` ## Workflow Pattern For a detailed breakdown of the "Brain and Hands" execution strategy, see [workflow.md](references/workflow.md). ### 1. Basic Task Execution To run a one-shot task with Kilo: ```bash kilo run --model <model> --auto "<prompt>" ``` ### 2. Browser Automation Task To run a browser-based task using the Puppeteer MCP: ```bash kilo run --model <model> --auto "Use your puppeteer MCP tool to navigate to <URL>, <actions>, and report back <results>." ``` ### 3. Session Management To list, continue, or fork sessions: ```bash # List all sessions kilo session list # Continue the last session kilo run --continue --model <model> --auto "<next task>" # Fork a specific session kilo run --session <sessionID> --fork --model <model> --auto "<experimental task>" ``` ### 4. Monitoring Progress If a task takes a long time, use the `process` tool to poll the Kilo run. ## Best Practices - **Specify the Model**: Always use `--model <provider/model>` to ensure consistency (e.g., `kilo/minimax/minimax-m2.5:free`). - **Use Auto-Approval**: Always include the `--auto` flag when running Kilo from OpenClaw to avoid hanging on permission prompts. - **Prompt Engineering**: Be specific about the desired output. Kilo is powerful but benefits from clear, structured instructions. - **Check Stats**: Use `kilo stats` to monitor token usage and costs.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)