OpenClaw/clawhub-security-signals huggingface dataset:
Skill: victorzhou123/postgres-mcp-skills (version 1.0.2)

--- name: postgres description: | PostgreSQL 数据库管理和优化助手。提供完整的数据库操作能力：健康检查、索引优化、查询计划分析、模式查询、SQL 执行。 当用户提到 PostgreSQL、Postgres、数据库优化、索引调优、查询性能、数据库健康检查等任何与 PostgreSQL 相关的操作时使用此 skill。 --- 你是 PostgreSQL 数据库管理助手，通过 postgres-mcp 的 MCP 工具帮助用户管理和优化 PostgreSQL 数据库。 ## 前置检查（每次执行必做） 所有 PostgreSQL 操作依赖 postgres-mcp 提供的 MCP 工具（如 `get_database_health`、`analyze_query_plan` 等）。执行任何操作前，先确认这些工具是否可用： **判断方法**：检查当前可用的 MCP 工具列表中是否存在 postgres-mcp 相关工具。 - **工具存在** → 正常执行后续流程 - **工具不存在** → 说明 postgres-mcp 服务未配置。直接告知用户：「PostgreSQL MCP 服务尚未连接，请先运行 `/setup-postgres-mcp` 完成部署和配置。」 ## 意图识别与路由 根据用户输入判断意图，然后直接按对应参考文档的指令执行。如果意图不明确，先询问用户想做什么。 | 用户意图 | 参考文档 | 典型说法 | |---|---|---| | 安装部署 | `reference/setup-postgres-mcp/setup-postgres-mcp.md` | 安装、部署、配置、第一次用、连不上 | | 健康检查 | `reference/pg-health/pg-health.md` | 健康检查、数据库状态、性能监控、连接数 | | 索引优化 | `reference/pg-index-tuning/pg-index-tuning.md` | 索引优化、慢查询、性能调优、建索引 | | 查询计划 | `reference/pg-query-plan/pg-query-plan.md` | 执行计划、EXPLAIN、查询分析、为什么慢 | | 模式查询 | `reference/pg-schema/pg-schema.md` | 表结构、字段、关系、生成 SQL | | 执行 SQL | `reference/pg-execute/pg-execute.md` | 执行、查询、更新、插入、删除 | ## 全局约束 1. **MCP 连接优先**：必须通过前置检查确认 MCP 工具可用后才能执行任何操作——不可用时只提示用户运行 `/setup-postgres-mcp` 2. **安全第一**：执行写操作（UPDATE、DELETE、DROP 等）前必须向用户确认，展示将要执行的 SQL 3. **只读模式**：如果 postgres-mcp 配置为只读模式，只能执行 SELECT 查询 4. **性能保护**：长时间运行的查询会被自动限制，避免影响数据库性能


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: adarshvmore/marketing-orchestrator (version 1.0.0)

# Marketing Orchestrator Skill ## Purpose Orchestrates the marketing audit pipeline by sequentially running the following collector agents: - Instagram Collector - Meta Ads Collector - SEO / Keyword Collector - Competitor Finder - Website Audit Collector Aggregates the individual results and invokes the Report Generator skill to produce the final comprehensive marketing audit report. ## Input Schema ```typescript interface MarketingInput { instagramHandle?: string; websiteDomain?: string; } ``` ## Output Schema ```typescript interface MarketingAuditReport { reportMarkdown: string; rawData: any; error?: string; } ``` ## Implementation Pattern - Validate input: either `instagramHandle` or `websiteDomain` is required - Sequentially call each collector skill, passing relevant input - Collect results in a composite data object - Call report-generator skill with the aggregated data - Return the final report markdown and raw data ## Example Usage ```typescript const input = { instagramHandle: 'gymshark', websiteDomain: 'gymshark.com' }; const report = await marketingOrchestrator(input); console.log(report.reportMarkdown); ``` ## Orchestration Logic (Pseudocode) ```typescript async function marketingOrchestrator(input: MarketingInput): Promise<MarketingAuditReport> { if (!input.instagramHandle && !input.websiteDomain) { throw new Error("Either instagramHandle or websiteDomain is required"); } const auditData: any = { input, collectedAt: new Date().toISOString(), }; if (input.instagramHandle) { auditData.instagram = await runSkill('instagram-collector', { handle: input.instagramHandle }); } if (input.websiteDomain) { auditData.metaAds = await runSkill('meta-ads-collector', { brandName: input.websiteDomain, domain: input.websiteDomain }); auditData.keywords = await runSkill('seo-collector', { domain: input.websiteDomain }); auditData.competitors = await runSkill('competitor-finder', { brandName: input.websiteDomain, domain: input.websiteDomain }); auditData.websiteAudit = await runSkill('website-audit', { domain: input.websiteDomain }); } const report = await runSkill('report-generator', auditData); return { reportMarkdown: report.reportMarkdown, rawData: auditData, }; } ``` ## Notes - Each runSkill call corresponds to invoking another skill as a sub-agent or subprocess. - The calling framework should handle API keys, env vars for external services. - Errors in individual collectors should not block the overall orchestration. - Extend as needed for additional collectors or data sources.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: moooai/obtain-takeout-coupon (version 1.0.3)

--- name: obtain-takeout-coupon description: 获取外卖优惠券（隐藏券、大额券）的技能，支持平台： 美团（Meituan），淘宝闪购（饿了么，taobao）。A skill for obtaining takeout coupons (hidden coupons, large-value coupons), supported platforms: Meituan, Taobao Flash Sale (Ele.me, Taobao).. metadata: { "openclaw": { "emoji": "🎁", "requires": { "bins": ["uv"] }, "install": [ {"id": "uv-brew", "kind": "brew", "formula": "uv", "bins": ["uv"], "label": "Install uv (brew)"}, {"id": "uv-pip", "kind": "pip", "formula": "uv", "bins": ["uv"], "label": "Install uv (pip)"}, {"id": "pip-aiohttp", "kind": "pip", "formula": "aiohttp", "label": "Install aiohttp (pip)"}, {"id": "pip-argparse", "kind": "pip", "formula": "argparse", "label": "Install argparse (pip)"}, {"id": "pip-PyYAML", "kind": "pip", "formula": "PyYAML", "label": "Install PyYAML (pip)"}, ], }, } --- # 获取最新的外卖优惠券 Obtain Takeout Coupons 获取中国在线购物平台的外卖优惠券（大额券，隐藏券），统一使用 `/coupon/takeout` 接口获取。 ```yaml # 参数解释 source: 1: 美团优惠券 2: 淘宝闪购优惠券 3: 饿了么优惠券 ``` ## 获取优惠券口令(字符串格式，不要更改接口返回的内容，否则会失效) ```shell uv run scripts/route.py search --source={source} ``` **注意**: 所有平台现在都使用统一的 API 接口 `/coupon/takeout`，不再区分平台端点。 ## 隐私提示 Privacy Tips 本技能提供的脚本不会读写本地文件，可放心使用 The scripts provided by this skill do not read or write local files, so you can use them with confidence.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: fionn1989/gog2 (version 1.0.0)

--- name: gog description: Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs. homepage: https://gogcli.sh metadata: {"clawdbot":{"emoji":"🎮","requires":{"bins":["gog"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/gogcli","bins":["gog"],"label":"Install gog (brew)"}]}} --- # gog Use `gog` for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup. Setup (once) - `gog auth credentials /path/to/client_secret.json` - `gog auth add [REDACTED_SECRET] --services gmail,calendar,drive,contacts,sheets,docs` - `gog auth list` Common commands - Gmail search: `gog gmail search 'newer_than:7d' --max 10` - Gmail send: `gog gmail send --to [REDACTED_SECRET] --subject "Hi" --body "Hello"` - Calendar: `gog calendar events <calendarId> --from <iso> --to <iso>` - Drive search: `gog drive search "query" --max 10` - Contacts: `gog contacts list --max 20` - Sheets get: `gog sheets get <sheetId> "Tab!A1:D10" --json` - Sheets update: `gog sheets update <sheetId> "Tab!A1:B2" --values-json '[["A","B"],["1","2"]]' --input USER_ENTERED` - Sheets append: `gog sheets append <sheetId> "Tab!A:C" --values-json '[["x","y","z"]]' --insert INSERT_ROWS` - Sheets clear: `gog sheets clear <sheetId> "Tab!A2:Z"` - Sheets metadata: `gog sheets metadata <sheetId> --json` - Docs export: `gog docs export <docId> --format txt --out /tmp/doc.txt` - Docs cat: `gog docs cat <docId>` Notes - Set `GOG_ACCOUNT=[REDACTED_SECRET]` to avoid repeating `--account`. - For scripting, prefer `--json` plus `--no-input`. - Sheets values can be passed via `--values-json` (recommended) or as inline rows. - Docs supports export/cat/copy. In-place edits require a Docs API client (not in gog). - Confirm before sending mail or creating events.

path: _meta.json
content: ownerId: kn70pywhg0fyz996kpa8xj89s57yhv26
slug: gog
version: 1.0.0
publishedAt: 1767545346060

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zacjiang/docx-toolkit (version 1.0.0)

--- name: docx-toolkit description: Extract text, tables, and images from .docx and legacy .doc files. Handles large documents, CJK text, and complex table structures. Includes deduplication and filtering for extracted images. author: zacjiang version: 1.0.0 tags: docx, doc, word, extract, text, tables, images, document, office, CJK, chinese --- # DOCX Toolkit A complete toolkit for processing Microsoft Word documents (.docx and legacy .doc formats). ## Capabilities ### 1. Text + Table Extraction (.docx) ```bash python3 {baseDir}/scripts/extract_text.py input.docx output.txt ``` Extracts all paragraphs and tables with structure preserved. Tables are formatted as pipe-delimited rows for easy parsing. ### 2. Text Extraction (Legacy .doc) ```bash python3 {baseDir}/scripts/extract_doc_text.py input.doc output.txt ``` Handles legacy OLE2 .doc format using olefile. Extracts Unicode text from the WordDocument stream. ### 3. Image Extraction (.docx) ```bash python3 {baseDir}/scripts/extract_images.py input.docx output_dir/ ``` Extracts all embedded images with: - Automatic deduplication (MD5 hash comparison) - Size filtering (skips tiny icons <5KB by default) - Sequential renaming (img_001.png, img_002.jpg, etc.) ### 4. Image Compression ```bash python3 {baseDir}/scripts/resize_images.py input_dir/ output_dir/ [--max-width 1024] ``` Batch resize/compress images for API processing (saves 50-70% on vision API costs). ## Dependencies - Python 3.6+ - `python-docx` — for .docx processing - `olefile` — for legacy .doc processing - `Pillow` — for image resizing (optional, only needed for resize script) Install: ```bash pip3 install python-docx olefile Pillow ``` ## Use Cases - **Document analysis**: Extract text for AI review/summarization - **Migration**: Pull content from Word docs into other formats - **Image audit**: Extract and review all embedded images - **Cost optimization**: Compress images before sending to vision APIs - **Batch processing**: Process multiple documents in a pipeline ## Notes - Large .doc files (>200MB) may require significant RAM for olefile processing - Image extraction preserves original format (png/jpg/gif/etc.) - Deduplication catches exact duplicates; near-duplicates still pass through - CJK (Chinese/Japanese/Korean) text is fully supported in both extractors


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: m-lwatcher/familiar-app (version 1.0.0)

--- name: familiar-app description: Deploy, manage, and extend Familiar App — a multi-user AI social presence platform that lets AI familiars run autonomously on X/Twitter. Use when setting up a new familiar instance, deploying to a VPS, managing users/queues, or building on top of the platform. Source: https://github.com/m-lwatcher/familiar-app --- # Familiar App Multi-user AI social presence platform. Runs on Node.js (no npm dependencies). ## Quick Deploy ```bash git clone https://github.com/m-lwatcher/familiar-app.git cd familiar-app/core node api-server.js # Dashboard at http://localhost:18790 login: admin / familiar ``` ## VPS Deploy (systemd) ```bash git clone https://github.com/m-lwatcher/familiar-app.git /home/ubuntu/familiar-app sudo tee /etc/systemd/system/familiar.service > /dev/null << 'SERVICE' [Unit] Description=Familiar App After=network.target [Service] Type=simple User=ubuntu WorkingDirectory=/home/ubuntu/familiar-app/core ExecStart=/usr/bin/node api-server.js Restart=always RestartSec=5 [Install] WantedBy=multi-user.target SERVICE sudo systemctl enable --now familiar sudo ufw allow 18790/tcp ``` ## Structure ``` core/api-server.js — REST API + dashboard (port 18790) core/user-manager.js — User CRUD, queue management core/posting-engine.js — Tweet/meme posting logic core/user-daemon.js — Per-user background loop core/soul-builder.js — Generates persona/soul from config web/index.html — Dashboard UI users/<id>/ — Per-user data, queues, logs, soul.md tools/ — Agent tools (auto_reply, check_x_stats) ``` ## API Endpoints | Method | Path | Notes | |--------|------|-------| | GET | `/` | Dashboard (requires auth) | | POST | `/api/login` | `{password}` → session cookie | | GET | `/api/users` | List all users | | POST | `/api/users` | Create user `{name, username, bio}` | | GET | `/api/users/:id` | User detail + stats | | POST | `/api/users/:id/tweet` | Queue a tweet `{text}` | | POST | `/api/users/:id/meme` | Queue a meme `{prompt}` | | GET | `/api/users/:id/queue` | View pending queue | ## Auth Default: `admin` / `familiar` — set `FAMILIAR_PASSWORD` env to change. ## Notes - No npm install needed — all Node.js core modules - User data stored in `users/<hash>/` directories - Each user has a `soul.md` defining their persona - Posting engine respects daily limits and gap timers


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: freedompixels/cn-sort-lines (version 1.0.0)

# cn-sort-lines 文本行排序工具。支持升序、降序、按长度排序。 ## 使用方法 ```bash python3 scripts/sort_lines.py --text "行C\n行A\n行B" python3 scripts/sort_lines.py --text "行C\n行A\n行B" --desc python3 scripts/sort_lines.py --text "行C\n行A\n行B" --by-length ``` 纯Python标准库。

path: scripts/sort_lines.py
content: #!/usr/bin/env python3
"""文本行排序工具"""
import argparse

def sort_lines(text, descending=False, by_length=False):
    """排序文本行"""
    lines = text.split('\n')
    if by_length:
        lines.sort(key=len, reverse=descending)
    else:
        lines.sort(reverse=descending)
    return '\n'.join(lines)

def main():
    parser = argparse.ArgumentParser(description="文本行排序工具")
    parser.add_argument("--text", required=True, help="要排序的文本")
    parser.add_argument("--desc", action="store_true", help="降序排列")
    parser.add_argument("--by-length", action="store_true", help="按长度排序")
    args = parser.parse_args()
    print(sort_lines(args.text, args.desc, args.by_length))

if __name__ == "__main__":
    main()


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: maverick/maverick-mailchimp-mcp (version 1.0.2)

--- name: maverick-mailchimp-mcp description: Search and read Mailchimp Marketing API audiences, members, campaigns, content, and reports through a local MCP wrapper. Use when the user asks about Mailchimp marketing data. metadata: openclaw: emoji: "📣" requires: bins: - mcporter - uv env: - MAVERICK_MAILCHIMP_MCP_ACCESS_TOKEN - MAVERICK_MAILCHIMP_MCP_API_BASE primaryEnv: MAVERICK_MAILCHIMP_MCP_ACCESS_TOKEN install: - id: node kind: node package: mcporter bins: - mcporter label: Install mcporter (node) - id: brew-uv kind: brew formula: uv bins: - uv label: Install uv (brew) --- # Mailchimp ## Quick start This skill is a thin pass-through to a local stdio MCP server for the Mailchimp Marketing API. mcporter spawns the skill's Python server on each call. The live MCP schema is the source of truth for what tools exist, what they're called, and what arguments they take. ```sh mcporter --config {baseDir}/mcporter.json list maverick-mailchimp --schema ``` For structured output: ```sh mcporter --config {baseDir}/mcporter.json call --output json maverick-mailchimp.<tool> key=value ``` ## Safety This first implementation exposes read-only tools. Use them freely to inspect audiences, members, campaigns, campaign content, and reports. If write tools are added later, confirm clear user intent for the exact audience, member, campaign, tag, or schedule before invoking them. ## Authentication Maverick provisions these env vars from the connected Mailchimp OAuth grant: - `MAVERICK_MAILCHIMP_MCP_ACCESS_TOKEN` - `MAVERICK_MAILCHIMP_MCP_API_BASE` Mailchimp Marketing access tokens do not use refresh tokens in this skill. If calls return auth errors, reconnect the Mailchimp integration so Maverick can provision a fresh access token and API base. ## Data flow Tool calls run locally: mcporter spawns this skill's Python MCP server as a subprocess, and that server forwards Mailchimp Marketing API requests with the OAuth bearer token. Mailchimp sees the audience, member, campaign, content, and report data referenced by each call. Use this skill for Mailchimp-related work only; do not pass unrelated sensitive content through these tools. ## Dependencies - **`mcporter`** ([github.com/steipete/mcporter](https://github.com/steipete/mcporter)) - MCP CLI used to invoke the local MCP server. Auto-installed via `npm install -g --ignore-scripts mcporter` if missing on PATH (see `install` spec in frontmatter). The install spec uses unpinned `mcporter` (npm `latest`); operators with strict supply-chain controls should override the install to pin a specific version. - **`uv`** ([docs.astral.sh/uv](https://docs.astral.sh/uv/)) - runs the Python wrapper and local MCP server from their inline dependency metadata.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal:  | SkillSpector: clean (LOW)
Skill: afine907/linux-ops (version 1.0.0)

--- name: linux-ops description: Linux 运维速查。当需要：(1) 进程管理 (2) 日志分析 (3) 网络诊断 (4) 性能监控 (5) 用户管理时使用。 --- # Linux Operations Linux 运维命令速查手册。 ## 快速参考 ### 进程管理 ```bash ps aux | grep nginx # 查找进程 kill -9 PID # 终止进程 systemctl status nginx # 服务状态 journalctl -u nginx -f # 服务日志 ``` ### 系统资源 ```bash top / htop # CPU/内存 free -h # 内存 df -h # 磁盘 du -sh /var/log # 目录大小 ``` ### 网络 ```bash ip addr # 网络接口 netstat -tuln # 监听端口 ss -tun # 连接状态 ping -c 5 host # 测试连通 curl -v https://example.com # HTTP 测试 ``` ### 日志 ```bash tail -f /var/log/syslog # 实时查看 grep "error" /var/log/syslog # 搜索日志 journalctl -u nginx --since "1 hour ago" ``` ### 文件查找 ```bash find /path -name "*.py" # 按名称查找 find / -size +100M # 按大小查找 grep -r "pattern" /path # 递归搜索 ``` ## 详细参考 - **进程管理**: [references/process.md](references/process.md) - 进程查看、管理、服务 - **系统资源**: [references/system.md](references/system.md) - CPU、内存、磁盘 - **网络诊断**: [references/network.md](references/network.md) - 连接、端口、抓包 - **日志分析**: [references/logs.md](references/logs.md) - 系统日志、nginx 日志 - **用户权限**: [references/users.md](references/users.md) - 用户、组、权限 ## 常用命令 ### 查找大文件 ```bash find / -type f -size +100M 2>/dev/null du -ah / | sort -rh | head -20 ``` ### 统计访问 ```bash awk '{print $1}' access.log | sort | uniq -c | sort -rn | head awk '{print $9}' access.log | sort | uniq -c | sort -rn ``` ### 排查端口占用 ```bash lsof -i :80 netstat -tlnp | grep 80 ``` ## 文档 - TLDR: `tldr command` - Linux 命令速查: https://cheatography.com/davechild/cheat-sheets/linux-command-line/


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: yang1002378395-cmyk/openclaw-feishu-setup (version 1.0.0)

# OpenClaw 飞书 Setup 15 分钟配置飞书机器人作为 OpenClaw 消息渠道。 ## 为什么选飞书？ - **企业首选**：字节跳动出品，国内企业广泛使用 - **功能强大**：消息、文档、日历、会议一体化 - **开放平台**：丰富的 API 和机器人能力 - **免费版够用**：小团队免费使用 ## 快速配置 ### Step 1: 创建飞书应用 1. 访问 https://open.feishu.cn/app 2. 点击 "创建企业自建应用" 3. 设置名称（如 "AI 助手"） 4. 保存 **App ID** 和 **App Secret** ### Step 2: 配置权限 在应用管理 > 权限管理中，开启： - `im:message` - 获取与发送单聊、群组消息 - `im:message:send_as_bot` - 以应用身份发消息 ### Step 3: 配置事件订阅 1. 在 "事件订阅" 页面启用 2. 配置 OpenClaw Gateway 的公网地址（需要内网穿透或云服务器） 3. 订阅事件： - `im.message.receive_v1` - 接收消息 ### Step 4: 配置 OpenClaw 编辑 `~/.openclaw/config.yaml`: ```yaml plugins: entries: - plugin: openclaw-feishu config: appId: "cli_xxxxxxxxxx" appSecret: "xxxxxxxxxxxxxx" encryptKey: "xxxx" # 可选，用于消息加密 verificationToken: "xxxx" # 可选，用于验证 ``` ### Step 5: 发布应用 1. 在飞书开放平台提交审核 2. 审核通过后，添加到企业可用范围 3. 在飞书中搜索你的应用，开始对话 ### Step 6: 启动 Gateway ```bash openclaw gateway start ``` ## 内网穿透方案 如果没有公网 IP，可以用： ### 方案 1：ngrok（推荐） ```bash ngrok http 3000 # 将生成的 https://xxx.ngrok.io 配置到事件订阅 ``` ### 方案 2：cloudflared ```bash cloudflared tunnel --url http://localhost:3000 ``` ### 方案 3：Tailscale Funnel ```bash tailscale funnel 3000 ``` ## 高级功能 ### 群聊支持 ```yaml plugins: entries: - plugin: openclaw-feishu config: appId: "xxx" appSecret: "xxx" enableGroupChat: true groupTriggerPrefix: "@AI助手" # 群聊触发前缀 ``` ### 富文本消息 OpenClaw 自动将 Markdown 转换为飞书富文本卡片。 ### 多租户支持 ```yaml tenants: - appId: "cli_xxx1" appSecret: "xxx1" - appId: "cli_xxx2" appSecret: "xxx2" ``` ## 常见问题 ### Q: 提示 "app not found" A: 检查 App ID 是否正确，应用是否已发布 ### Q: 收不到消息 A: 检查事件订阅是否配置正确，Gateway 是否运行 ### Q: 提示 "permission denied" A: 确保已开启 `im:message` 相关权限 ### Q: 如何在群聊中使用？ A: 配置 `enableGroupChat: true`，并设置触发前缀 ## 成本 - 飞书开放平台：**完全免费** - OpenClaw Gateway：本地运行，无费用 - AI 模型：按使用量计费 ## 安全建议 1. **不要**公开 App Secret 2. 启用消息加密（encryptKey） 3. 定期轮换密钥 4. 限制应用可用范围 ## 需要帮助？ - 微信：yanghu_ai - Telegram: @yanghu_openclaw - 飞书配置服务：¥99（远程协助） --- Version: 1.0.0 Created: 2026-03-21

path: package.json
content: {
  "name": "openclaw-feishu-setup",
  "version": "1.0.0",
  "description": "15-minute Feishu Bot setup for OpenClaw (Chinese)",
  "keywords": ["feishu", "openclaw", "bot", "chinese", "messaging"],
  "author": "OpenClaw CN Team"
}


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: homeofe/openclaw-todo (version 0.3.0)

--- name: openclaw-todo description: OpenClaw plugin providing TODO commands for a markdown TODO.md file. --- # openclaw-todo Adds commands to manage a local markdown TODO list (default: `~/.openclaw/workspace/TODO.md`). ## Commands - `/todo-list` - list open TODO items (overdue items shown first) - `/todo-add <text>` - add a new TODO item (supports `@due(YYYY-MM-DD)`, `#tag`, `!priority`) - `/todo-done <index>` - mark an open TODO item done (index from `/todo-list`) - `/todo-edit <index> <new text>` - edit an existing TODO item's text - `/todo-remove <index>` - remove a TODO item entirely - `/todo-search <query>` - search TODOs by text, `#tag`, `!priority`, `@due`, `@overdue`, or `@today` ## Inline Markers - **Tags:** `#tag-name` - categorize items (e.g., `#dev`, `#ops`) - **Priority:** `!high`, `!medium`, `!low` - set urgency level - **Due date:** `@due(YYYY-MM-DD)` - set a deadline; overdue items appear first in listings ## Install ```bash clawhub install openclaw-todo ``` ## Notes - This plugin is safe for public repos (no secrets required). - Customize file paths via plugin config in your local `openclaw.json`.


Security scan verdicts — ClawScan: clean | static analysis:  | VirusTotal: clean | SkillSpector: suspicious (HIGH)