OpenClaw/clawhub-security-signals huggingface dataset:
Skill: castlewang/hk-insurance-news (version 1.0.0)

# 技能名称：香港保险市场周报生成器 ## 描述 我是一个专业的香港保险市场分析师。我的任务是在每周一早上10点，自动搜索、整理过去一周香港保险行业的重要动态，并生成一篇图文并茂的微信公众号推文。 ## 指令 1. **信息收集**：请为我检索以下来源过去一周（上周一至上周日）的资讯： * 香港保险业监管局官网新闻及统计公报。 * 主要香港本地媒体（如信报、经济日报）的保险版块新闻。 * 主要保险公司（如友邦、保诚、安盛、宏利）香港官网的“新闻中心”或“产品资讯”更新。 * （可选）专业保险新闻网站或论坛的讨论热点。 2. **内容筛选与整理**： * 将收集到的信息分为三个板块：**行业动态**（监管政策、市场数据、公司战略）、**产品更新**（新产品发布、老产品迭代、费率调整）、**公司要闻**（高层变动、业绩发布、市场活动）。 * 为每个板块筛选出2-3条最重要的资讯。 * 每条资讯需包含：**核心摘要（一句话总结）、详细内容（50-100字）、来源链接、相关图片（如有）**。 3. **文章撰写与排版**： * 生成一个吸引人的公众号标题，例如“【每周保险】XX月XX日-XX日香港保险市场要闻精选”。 * 使用清晰、专业的语言将筛选后的信息整合成一篇完整的文章。 * 按照微信公众号的排版习惯，使用Markdown语法进行排版，包括使用`# ##`分级标题、`**`加粗重点、`>`引用、`-`列表等。 * 在文末添加“数据来源：[香港保监局](链接) | [媒体名称](链接)”等信息。 4. **图片处理**：将收集到的资讯配图或相关数据图表，以本地路径或网络图片的形式包含在Markdown文档中。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bytesagain3/move (version 1.0.0)

--- name: "move" version: "1.0.0" description: "Move reference tool. Use when working with move in blockchain contexts." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [move, blockchain, finance, reference, cli] category: "blockchain" --- # Move Move reference tool. Use when working with move in blockchain contexts. ## When to Use - Working with move and need quick reference - Looking up blockchain standards or best practices for move - Troubleshooting move issues - Need a checklist or guide for move tasks ## Commands ### `intro` ```bash scripts/script.sh intro ``` Overview and fundamentals ### `formulas` ```bash scripts/script.sh formulas ``` Key formulas and calculations ### `regulations` ```bash scripts/script.sh regulations ``` Regulatory framework and compliance ### `risks` ```bash scripts/script.sh risks ``` Risk factors and mitigation ### `instruments` ```bash scripts/script.sh instruments ``` Instruments and tools overview ### `strategies` ```bash scripts/script.sh strategies ``` Common strategies and approaches ### `glossary` ```bash scripts/script.sh glossary ``` Key terms and definitions ### `checklist` ```bash scripts/script.sh checklist ``` Due diligence checklist ### `help` ```bash scripts/script.sh help ``` ### `version` ```bash scripts/script.sh version ``` --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: wumaoqianq/express-hunter (version 1.0.2)

--- name: express-hunter description: 智能快递追踪管家。输入任意单号自动识别快递公司并查询完整物流轨迹+地图追踪链接，支持转发快递短信自动提取单号加入追踪，支持收藏夹管理和每日定时推送快递日报。覆盖顺丰、极兔、圆通、中通、韵达、京东、百世、EMS、德邦等1000+快递公司。零配置开箱即用，持续跟踪与上报。 --- # 快递猎手 · 智能追踪 ## 核心功能 1. **单号查询** - 输入快递单号，自动识别快递公司并返回完整物流轨迹 + 地图追踪链接 2. **短信解析** - 转发快递通知短信，自动提取单号和快递公司并加入追踪列表 3. **追踪管理** - 添加/删除/查看/刷新所有在途快递 4. **定时报告** - 每天 8:00 / 12:00 / 18:00 自动推送全量快递状态（含地图链接） 5. **地图追踪** - 每个快递附快递100地图追踪链接，点击查看包裹路线图 ## 数据引擎 - **主力**: 聚合数据（juhe.cn），稳定可靠 - **备用**: 快递100公开接口 - **识别**: 自动识别 + 热线号匹配 + 轨迹关键词反推 + 前缀匹配 ## 数据存储 - 快递数据: `G:\PC先生\express_data\packages.json` - 聚合Key: `桌面\999.txt`（方便更新） ## 使用脚本 | 命令 | 说明 | |------|------| | `python scripts/track.py <单号>` | 查快递（含地图链接） | | `python scripts/sms_parse.py "<短信>"` | 解析快递短信 | | `python scripts/manage.py list` | 列出所有快递 | | `python scripts/manage.py add <单号>` | 添加追踪 | | `python scripts/manage.py refresh` | 刷新全部状态 | | `python scripts/report.py` | 生成日报 | | `python scripts/map.py` | 查看地图追踪链接 |


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: 1054570699/invoice-recognize (version 1.0.0)

--- name: invoice-ocr description: 发票 OCR 识别技能。扫描文件夹中的发票文件（PDF/图片），调用阿里云 OCR API 识别发票信息并导出到 Excel 表格。支持 17+ 种发票类型（增值税发票、火车票、出租车票、机票行程单、定额发票、机动车销售发票、过路过桥费发票等）。使用场景：(1) 用户提到"发票识别"、"发票统计"、"发票整理"、"发票汇总" (2) 用户需要批量处理发票 (3) 用户提到阿里云 OCR 识别发票。**重要：首次使用必须先配置阿里云凭证，主动向用户索要 AccessKey ID 和 AccessKey Secret，或引导用户运行 --config 命令自行配置。** --- # 发票 OCR 识别技能 批量识别发票并汇总到 Excel 表格。 ## ⚠️ 首次使用必须配置凭证 **此技能需要阿里云 OCR 服务，使用前必须先配置凭证！** ### 方式一：向用户提供凭证（推荐） 主动询问用户： > "使用此技能需要阿里云 AccessKey ID 和 AccessKey Secret，请提供这两个凭证。\ > 获取方式：阿里云控制台 → 开通票据凭证识别 → 创建 AccessKey" 然后运行： ```bash python scripts/recognize_invoices.py --config ``` ### 方式二：引导用户自行配置 告诉用户： > "请先运行以下命令配置阿里云凭证：" > ```bash > python ~/.openclaw/skills/invoice-ocr/scripts/recognize_invoices.py --config > ``` ## 特点 - ✅ **17+ 发票类型** - 自动识别发票类型 - ✅ **Excel 输出** - 生成标准 xlsx 文件 - ✅ **支持 PDF/OFD** - 电子发票友好 ## 依赖安装 ```bash pip install openpyxl ``` ## 支持的发票类型 | 类型 | 说明 | |------|------| | 增值税发票 | 专用发票、普通发票、电子发票 | | 火车票 | 火车票识别 | | 出租车发票 | 机打发票 | | 定额发票 | 手撕发票 | | 机票行程单 | 航空运输电子客票 | | 机动车销售发票 | 购车发票 | | 网约车行程单 | 滴滴等平台发票 | | 过路过桥费 | 高速公路发票 | | 客运车船票 | 汽车票、船票 | | 税收完税证明 | 完税凭证 | | 银行承兑汇票 | 票据识别 | ## 支持的文件格式 | 格式 | 扩展名 | |------|--------| | PDF | .pdf | | OFD | .ofd | | 图片 | .jpg, .jpeg, .png, .bmp, .gif, .tiff, .webp | ## 输出字段 按以下顺序输出到 Excel： | 字段 | 说明 | |------|------| | 发票号码 | 发票代码 + 发票号码 | | 开票日期 | 开票日期 | | 购买方信息 | 购买方名称 | | 销售方信息 | 销售方名称 | | 项目名称 | 商品/服务名称 | | 规格型号 | 商品规格 | | 单位 | 计量单位 | | 数量 | 商品数量 | | 单价 | 商品单价 | | 金额 | 不含税金额 | | 税率 | 税率百分比 | | 税额 | 税金金额 | | 价税合计 | 含税总额 | **注意：** 如果发票上某字段不存在，默认填空值。 ## 使用方法 ### 识别发票 ```bash # 识别文件夹中的所有发票 python scripts/recognize_invoices.py /path/to/invoices # 指定输出文件 python scripts/recognize_invoices.py /path/to/invoices --output 发票汇总.xlsx ``` ### 配置管理 ```bash # 设置阿里云凭证 python scripts/recognize_invoices.py --config # 查看当前配置 python scripts/recognize_invoices.py --list-config ``` ## 获取阿里云 AccessKey 1. 登录 [阿里云控制台](https://www.aliyun.com/) 2. 开通 [票据凭证识别](https://common-buy.aliyun.com/?commodityCode=ocr_invoice_public_cn) 服务 3. 创建 AccessKey（建议使用 RAM 子账号） 4. 授予 `AliyunOCRFullAccess` 权限 详细 API 说明见 [阿里云 OCR API 参考](references/aliyun-ocr-api.md) ## 工作流程 ``` 发票文件 → OCR识别 → Excel表格 ↓ ↓ ↓ PDF/图片 混贴识别 xlsx文件 ``` ## 注意事项 1. 图片需清晰，建议长宽 > 500px 2. 单个文件不超过 10MB 3. 阿里云 OCR 按次计费，注意费用控制 4. 配置文件保存在技能目录下的 config.json

path: config.json

Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: tobeyrebecca/generate-healthcare-ad-creative-brief (version 1.0.0)

--- name: Generate Healthcare Ad Creative Brief description: "Plan campaign visuals and hooks for healthcare promotions. Use when working on paid campaign planning for healthcare operators, clinic teams, patient..." allowed-tools: Bash, Read metadata: openclaw: emoji: "📝" homepage: "https://www.skillboss.co/skills/generate-healthcare-ad-creative-brief" --- # Generate Healthcare Ad Creative Brief Plan campaign visuals and hooks for healthcare promotions. Use when working on paid campaign planning for healthcare operators, clinic teams, patient... ## Use When Use this skill for paid campaign planning work for healthcare operators, clinic teams, patient educators. ## Workflow 1. Clarify the audience, business goal, constraints, and deliverable. 2. Produce the strongest first draft for the target use case. 3. Use the relevant SkillBoss capabilities to enrich assets or supporting data. 4. Refine the output for accuracy, readability, and actionability before delivery. ## SEO / GEO - Primary keywords: ad creative brief AI, healthcare ad planning, healthcare marketing AI, clinic workflow automation - Search intent: paid campaign planning - Canonical slug: `generate-healthcare-ad-creative-brief` - Install query: Install Generate Healthcare Ad Creative Brief with SkillBoss ## APIs Used - `chat` - `image_generation` ## Suggested Prompt [Generate Healthcare Ad Creative Brief] for my team ## Notes - Plan campaign visuals and hooks for healthcare promotions - Use human review before sending patient-facing content or relying on regulated medical claims. ## SEO Keywords - ad creative brief AI - healthcare ad planning - healthcare marketing AI - clinic workflow automation


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dophinl/birdx (version 1.0.0)

--- name: birdx description: X/Twitter CLI that reads Chrome cookies directly from disk — no browser session required after first auth. Supports reading tweets with viewCount/bookmarkCount, full thread replies, search with engagement metrics, and followers/following lists. Use when you need to fetch Twitter/X data, search tweets, read threads, or get user follower lists without a browser. No Twitter API key needed. --- # birdx CLI for X/Twitter via direct API calls. Reads Chrome cookies from disk (no browser needed after `birdx auth`). ## Install ```bash bash <skill-dir>/scripts/install.sh ``` Or manually: ```bash npm install --prefix ~/clawd ws jsdom x-client-transaction-id ln -sf <skill-dir>/scripts/birdx.js /opt/homebrew/bin/birdx birdx auth ``` ## Auth ```bash birdx auth # Read Chrome cookies from disk (no browser needed) birdx auth --cdp # Use openclaw browser CDP fallback ``` Cookie cache: `~/.config/bird/birdx-cookies.json` (TTL ~5h, re-run auth to refresh) ## Commands ```bash # Read single tweet (includes viewCount, bookmarkCount) birdx read <tweet-url|id> # Read thread + all replies (--sort relevance puts author thread first) birdx replies <tweet-url|id> --sort relevance birdx replies <tweet-url|id> --sort latest --total 40 # Search tweets (full metrics: views, likes, bookmarks, reposts) birdx search "query" --sort top --total 20 birdx search "from:elonmusk" --sort latest # Followers / following birdx followers @username --total 50 birdx following @username --total 20 # JSON output birdx read <url> --json birdx search "query" --json ``` ## Output Fields - `viewCount` — total impressions - `likeCount`, `repostCount`, `replyCount`, `bookmarkCount` - `author.userName`, `author.fullName`, `author.isVerified` ## Environment - `BIRDX_MODULES` — override node_modules path (default: `$HOME/clawd/node_modules`) - Deps required: `ws`, `jsdom`, `x-client-transaction-id` - Node 20+ required (uses `node:sqlite`) ## Notes - Query ID cache auto-refreshes from X on first use. If stale: check `~/.config/bird/query-ids-cache.json` - `birdx read` may fail behind certain VPNs; `birdx search` is more reliable - Bookmark count is only available via birdx (not bird CLI)


Security scan verdicts — ClawScan: suspicious | static analysis:  | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: constx1337/finance-cron (version 1.0.1)

# Finance Calendar Trading-day calendar utilities for financial markets (US, CN, HK). ## Overview This skill provides trading-day-aware scheduling helpers. It helps you: - Check if a date is a trading day - Show upcoming trading days - Sync latest holiday calendar data - Plan when to schedule tasks (trading-day-aware) **Important**: This skill identifies trading days and calculates optimal run times, but does NOT execute scheduled tasks. Use with `/loop` for actual task scheduling. ## Commands ### Check Trading Day ``` /finance-cron check <market> [date] ``` Check if a date is a trading day for a market. Example: ``` /finance-cron check US # Check today /finance-cron check CN 2024-12-25 # Check specific date ``` ### Show Next Trading Days ``` /finance-cron next <market> [n] ``` Show next N trading days for a market. Example: ``` /finance-cron next US 5 # Show next 5 US trading days ``` ### Sync Calendar ``` /finance-cron sync [market] ``` Sync latest trading calendar from data sources. Example: ``` /finance-cron sync # Sync all markets /finance-cron sync US # Sync US market only ``` ### Plan Task Schedule ``` /finance-cron add <market> <time> <command> ``` Plan a trading-day-aware task and get the next execution time. **Note**: This command calculates and displays when the task should run, but does NOT execute it. To actually run tasks on schedule, combine with `/loop`: Example workflow: ``` # First, plan the task /finance-cron add US 09:30 echo "US market opening" # Output: Next Run: 2024-01-15 (Mon) 09:30 # Then, use /loop for actual scheduling /loop 0 9 * * 1-5 /finance-cron check US && echo "US market opening" ``` ### List Planned Tasks ``` /finance-cron list ``` List all planned tasks with their next scheduled times. ## Markets | Code | Name | Exchanges | Timezone | Hours | |------|------|-----------|----------|-------| | US | US Stock Market | NYSE, NASDAQ | America/New_York | 09:30-16:00 | | CN | China A-Share | SSE, SZSE | Asia/Shanghai | 09:30-15:00 | | HK | Hong Kong | HKEX | Asia/Hong_Kong | 09:30-16:00 | ## Integration with /loop For actual scheduled execution, use `/loop` with trading day checks: ```bash # Run command only on US trading days at 9:30 AM /loop 30 9 * * 1-5 /finance-cron check US --quiet && your_command # The --quiet flag (if implemented) would suppress output for clean scheduling ``` ## API for Other Skills This skill also exports programmatic APIs: ```typescript import { isTradingDay, getNextTradingDay, getDueTasks } from 'finance-cron'; // Check if today is a US trading day const canTrade = isTradingDay('US'); // Get next US trading day const nextDay = getNextTradingDay('US'); // Get tasks due for execution (for external schedulers) const dueTasks = getDueTasks(); ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: cinience/aliyun-ice-manage (version 1.0.0)

--- name: aliyun-ice-manage description: Use when managing Alibaba Cloud Intelligent Cloud Editing (ICE) media workflows via OpenAPI/SDK, including media processing jobs, template/workflow orchestration, editing and production pipelines, and job status troubleshooting. version: 1.0.0 --- Category: service # Intelligent Cloud Editing (ICE) ## Validation ```bash mkdir -p output/aliyun-ice-manage python -m py_compile skills/media/ice/aliyun-ice-manage/scripts/list_openapi_meta_apis.py echo "py_compile_ok" > output/aliyun-ice-manage/validate.txt ``` Pass criteria: command exits 0 and `output/aliyun-ice-manage/validate.txt` is generated. ## Output And Evidence - Save API inventory and operation evidence under `output/aliyun-ice-manage/`. - Keep region, workflow IDs, job IDs, and request parameters in evidence files. Use Alibaba Cloud OpenAPI (RPC) with official SDKs or OpenAPI Explorer to manage ICE resources. Prefer metadata-first API discovery before mutate operations. ## Prerequisites - Prepare least-privilege RAM AccessKey/STS credentials. - Confirm target region, input/output OSS locations, and workflow scope before changes. - Query current state with read-only APIs before invoking processing jobs. ## Workflow 1) Confirm target workflow/template and media input/output locations. 2) Discover API names and required parameters via metadata and API Explorer. 3) Validate prerequisite resources using read-only APIs. 4) Submit and monitor processing jobs. 5) Save outputs and evidence under `output/aliyun-ice-manage/`. ## AccessKey Priority 1) Environment variables: `ALICLOUD_ACCESS_KEY_ID` / `ALICLOUD_ACCESS_KEY_SECRET` / `ALICLOUD_REGION_ID`. 2) Shared config file: `~/.alibabacloud/credentials`. If region is ambiguous, ask before write operations. ## API Discovery - Product code: `ice` - Default API version: `2020-11-09` - Metadata source: `https://api.aliyun.com/meta/v1/products/ice/versions/2020-11-09/api-docs.json` ## Minimal Executable Quickstart ```bash python skills/media/ice/aliyun-ice-manage/scripts/list_openapi_meta_apis.py ``` Optional overrides: ```bash python skills/media/ice/aliyun-ice-manage/scripts/list_openapi_meta_apis.py \ --product-code ice \ --version 2020-11-09 \ --output-dir output/aliyun-ice-manage ``` ## Common Operation Mapping - Media info and metadata: `GetMediaInfo`, `SearchMedia`, `UpdateMediaMeta` - Workflow/template: `CreateMediaWorkflow`, `UpdateMediaWorkflow`, `ListMediaWorkflowExecutions` - Job submission: `SubmitMediaProducingJob`, `SubmitBatchMediaProducingJob`, `GetMediaProducingJob` - Editing/material: `CreateSourceLocation`, `AddMedia`, `GetDefaultMaterial` - Task status/troubleshooting: `GetTaskInfo`, `ListJobs`, `GetBatchMediaProducingJob` ## Output Policy Write all generated files and execution evidence under: `output/aliyun-ice-manage/` ## References - Source list: `references/sources.md` - Task templates: `references/templates.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: c0ldsmi1e/social-media-strategy (version 1.0.0)

--- description: "Advises on building-in-public, social listening, and platform selection for startup social media marketing. Use when someone wants help with their social media strategy." user_invocable: true command: social-media-strategy --- You are a social media marketing advisor for startup founders. Help them build a practical, time-efficient social media strategy. **Start by asking these discovery questions (ask all at once, then wait for answers):** 1. What is your product and who is your target audience? 2. Which social media platforms are you currently active on (personally or for your product)? 3. How much time per week can you realistically dedicate to social media? 4. Are you comfortable sharing behind-the-scenes content and building in public? 5. What's your primary goal? (brand awareness, lead generation, community building, customer acquisition) **After receiving answers, provide a tailored strategy with these sections:** ### Platform Recommendations Based on their audience and capacity, recommend which 1-2 platforms to focus on and why. Consider X/Twitter, LinkedIn, TikTok, Instagram, Pinterest, and niche communities. ### Building in Public Strategy If appropriate, outline a build-in-public content plan: - Types of content to share (milestones, revenue updates, lessons learned, behind-the-scenes, user stories) - Posting frequency and best times - Engagement tactics (commenting on others, joining conversations) - Content formats that work for their platform ### Social Listening Setup Help them set up social listening to find and join relevant conversations: - Keywords and topics to monitor - Tools to use (F5 bot for free Reddit/HN monitoring) - How to identify high-intent mentions (BOFU keywords) - Response templates for different mention types ### Content Calendar Starter Provide a sample week of content ideas tailored to their product. ### Action Plan Numbered checklist of immediate next steps. ### Further Reading - How to Build in Public as a Founder: https://www.failory.com/blog/building-in-public - The Ultimate Founder-Led LinkedIn Guide: https://www.mrrunlocked.com/p/founder-led-linkedin-guide - LinkedIn CEO/Founder playbook: https://www.markepear.dev/blog/linkedin-ceo-founder-playbook - Social Listening guide: https://www.mrrunlocked.com/p/social-listening-guide - F5 bot (free Reddit/HN monitoring): https://f5bot.com/ - How to market to developers on Twitter: https://www.markepear.dev/blog/developer-marketing-twitter - Organic Growth Guide for TikTok and Instagram: https://www.post-bridge.com/growth-guide/start-here - Pinterest Growth Guide: https://www.blogtopin.com/growth-guide/start-here


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: hu-xiao-tian/clean-code-styleguide (version 1.0.0)

--- name: karpathy-guidelines description: Behavioral guidelines to reduce common LLM coding mistakes. Use when writing, reviewing, or refactoring code to avoid overcomplication, make surgical changes, surface assumptions, and define verifiable success criteria. license: MIT --- # Karpathy Guidelines Behavioral guidelines to reduce common LLM coding mistakes, derived from [Andrej Karpathy's observations](https://x.com/karpathy/status/2015883857489522876) on LLM coding pitfalls. **Tradeoff:** These guidelines bias toward caution over speed. For trivial tasks, use judgment. ## 1. Think Before Coding **Don't assume. Don't hide confusion. Surface tradeoffs.** Before implementing: - State your assumptions explicitly. If uncertain, ask. - If multiple interpretations exist, present them - don't pick silently. - If a simpler approach exists, say so. Push back when warranted. - If something is unclear, stop. Name what's confusing. Ask. ## 2. Simplicity First **Minimum code that solves the problem. Nothing speculative.** - No features beyond what was asked. - No abstractions for single-use code. - No "flexibility" or "configurability" that wasn't requested. - No error handling for impossible scenarios. - If you write 200 lines and it could be 50, rewrite it. Ask yourself: "Would a senior engineer say this is overcomplicated?" If yes, simplify. ## 3. Surgical Changes **Touch only what you must. Clean up only your own mess.** When editing existing code: - Don't "improve" adjacent code, comments, or formatting. - Don't refactor things that aren't broken. - Match existing style, even if you'd do it differently. - If you notice unrelated dead code, mention it - don't delete it. When your changes create orphans: - Remove imports/variables/functions that YOUR changes made unused. - Don't remove pre-existing dead code unless asked. The test: Every changed line should trace directly to the user's request. ## 4. Goal-Driven Execution **Define success criteria. Loop until verified.** Transform tasks into verifiable goals: - "Add validation" → "Write tests for invalid inputs, then make them pass" - "Fix the bug" → "Write a test that reproduces it, then make it pass" - "Refactor X" → "Ensure tests pass before and after" For multi-step tasks, state a brief plan: ``` 1. [Step] → verify: [check] 2. [Step] → verify: [check] 3. [Step] → verify: [check] ``` Strong success criteria let you loop independently. Weak criteria ("make it work") require constant clarification.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)