OpenClaw/clawhub-security-signals huggingface dataset:
Skill: hashstacs-hk/feishu-skills (version 1.0.0)

--- name: feishu-skills-installer description: | Feishu (Lark) skill pack installer. Downloads and installs all Feishu integration skills for OpenClaw / EnClaws — including bot setup, docs, calendar, tasks, bitable, and more. Trigger when the user wants to install Feishu skills or says "安装飞书技能", "install feishu", etc. --- # Feishu Skills Installer > **Module compatibility**: Scripts are provided in both `.js` and `.mjs`. Prefer `.mjs`; if you get a module error, fall back to `.js`. Install the full Feishu skill pack by executing the commands below. All script output is single-line JSON. ## Included skills | Skill | Description | |-------|-------------| | `feishu-quick-setup` | One-click Feishu bot creation via Device Flow | | `feishu-auth` | User-level OAuth authorization | | `feishu-create-doc` | Create Feishu documents | | `feishu-fetch-doc` | Fetch document content | | `feishu-search-doc` | Search documents | | `feishu-update-doc` | Update document content | | `feishu-im-read` | Read messages from chats | | `feishu-chat` | Group/chat management | | `feishu-calendar` | Calendar events | | `feishu-task` | Task management | | `feishu-bitable` | Bitable (multi-dimensional tables) | | `feishu-docx-download` | Export documents as files | | `feishu-drive` | Drive file management | | `feishu-image-ocr` | Image OCR | | `feishu-search-user` | Search users | | `feishu-sheet` | Spreadsheet operations | | `feishu-wiki` | Wiki / knowledge base | ## Installation steps After downloading and extracting the skill pack, run the installer script. ### Run installer ```bash node {extracted_dir}/install.mjs ``` If you get an ESM-related error, use the CommonJS version instead: ```bash node {extracted_dir}/install.js ``` The installer auto-detects the environment (EnClaws or OpenClaw) and copies skill directories to the correct location. ## Handling the result The installer outputs JSON. Check the `success` field: | Result | Action | |--------|--------| | `success: true` | Show the `reply` field to the user | | `success: false` | Show the `message` field to the user | ## Notes - Always run `install.mjs` (or `install.js`) to complete the installation; do not copy skill directories manually. - The installer handles environment detection, file placement, and cleanup automatically. - This skill only installs files. It does not perform Feishu authorization or permission checks. - Execute each step rather than describing it to the user.


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: ivangdavila/statistics (version 1.0.0)

--- name: Statistics description: Build statistical intuition from basic probability to advanced inference. metadata: {"clawdbot":{"emoji":"📊","os":["linux","darwin","win32"]}} --- ## Detect Level, Adapt Everything - Context reveals level: notation familiarity, software mentioned, problem complexity - When unclear, start with concrete examples and adjust based on response - Never condescend to experts or overwhelm beginners ## For Beginners: Intuition Before Formulas - Probability through physical objects — dice, coins, cards, colored balls in bags - Averages as balance points — "If everyone shared equally, each would get..." - Variation matters as much as center — two classes with same average, very different spreads - Graphs before numbers — show the shape, then quantify it - Sampling as tasting soup — one spoonful tells you about the pot if well stirred - Correlation isn't causation — ice cream sales and drowning both rise in summer - Connect to their decisions — weather forecasts, medical tests, sports statistics ## For Students: Frameworks and Assumptions - Name the test AND its assumptions — normality, independence, equal variance - Effect size alongside p-value — statistical significance ≠ practical importance - Confidence intervals tell richer stories than hypothesis tests alone - Distinguish population parameters from sample statistics — Greek vs Roman letters matter - Simulation builds intuition — bootstrap, permutation tests show what formulas hide - Regression diagnostics before interpretation — residual plots catch violations - Bayesian vs frequentist — acknowledge the philosophical divide, explain context for each ## For Researchers: Rigor and Honesty - Pre-registration prevents p-hacking — specify analysis before seeing data - Power analysis before collecting — underpowered studies waste resources - Multiple comparisons require adjustment — Bonferroni, FDR, or justify why not - Report effect sizes and confidence intervals — not just p-values - Missing data mechanisms matter — MCAR, MAR, MNAR require different treatments - Causal inference needs design — DAGs, potential outcomes, state assumptions explicitly - Reproducibility means code and data — "available upon request" is not reproducible ## For Teachers: Common Misconceptions - p-value is NOT probability hypothesis is true — it's probability of data given null - Failing to reject ≠ accepting null — absence of evidence isn't evidence of absence - Large samples don't fix bias — garbage in, garbage out regardless of n - Standard deviation vs standard error — population spread vs sampling precision - Correlation coefficient hides nonlinearity — always plot first - Use real messy data — textbook examples with clean answers mislead - Teach skepticism — "How was this measured? Who was sampled? What's missing?" ## Always - Visualize data before computing anything - State assumptions explicitly — every test has them - Distinguish exploratory from confirmatory — same data can't do both


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jolestar/upbit-openapi-skill (version 1.0.0)

--- name: upbit-openapi-skill description: Operate Upbit public exchange market APIs through UXC with a curated OpenAPI schema, market-first discovery, and explicit private-auth boundary notes. --- # Upbit Open API Skill Use this skill to run Upbit public market-data operations through `uxc` + OpenAPI. Reuse the `uxc` skill for shared execution, auth, and error-handling guidance. ## Prerequisites - `uxc` is installed and available in `PATH`. - Network access to the chosen Upbit regional API host. - Access to the curated OpenAPI schema URL: - `https://raw.githubusercontent.com/holon-run/uxc/main/skills/upbit-openapi-skill/references/upbit-public.openapi.json` ## Scope This skill covers a curated Upbit public surface for: - market discovery - ticker reads - minute candles - order book snapshots This skill does **not** cover: - private account or order endpoints in v1 - region-specific account/trade auth flows ## Endpoint Upbit uses regional hosts. Pick the right one for the market you need before linking. Examples: - `https://sg-api.upbit.com` - `https://id-api.upbit.com` - `https://th-api.upbit.com` ## Authentication Public market endpoints in this skill do not require credentials. Upbit private APIs use provider-specific bearer JWT generation with request-specific claims. Keep this v1 skill public-data-only until a reusable Upbit signer flow exists in `uxc`. ## Core Workflow 1. Choose the correct regional host for the market you need. 2. Use a fixed link command by default: - `command -v upbit-openapi-cli` - If missing, create it: `uxc link upbit-openapi-cli https://sg-api.upbit.com --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/upbit-openapi-skill/references/upbit-public.openapi.json` - `upbit-openapi-cli -h` 3. Inspect operation help before execution: - `upbit-openapi-cli get:/v1/market/all -h` - `upbit-openapi-cli get:/v1/ticker -h` 4. Prefer narrow market reads first: - `upbit-openapi-cli get:/v1/ticker markets=SGD-BTC` - `upbit-openapi-cli get:/v1/orderbook markets=SGD-BTC` ## Operations - `get:/v1/market/all` - `get:/v1/ticker` - `get:/v1/candles/minutes/{unit}` - `get:/v1/orderbook` ## Guardrails - Keep automation on the JSON output envelope; do not use `--text`. - Parse stable fields first: `ok`, `kind`, `protocol`, `data`, `error`. - Treat this v1 skill as read-only. - Confirm the correct regional host and quote market before execution. - On regional Upbit hosts, live market codes are quote-first, for example `SGD-BTC` and `USDT-BTC`. - `upbit-openapi-cli <operation> ...` is equivalent to `uxc <upbit_region_host> --schema-url <upbit_public_openapi_schema> <operation> ...`. ## References - Usage patterns: `references/usage-patterns.md` - Curated OpenAPI schema: `references/upbit-public.openapi.json` - Official Upbit Open API overview: https://global-docs.upbit.com/reference/api-overview


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: steipete/spotify-player (version 1.0.0)

--- name: spotify-player description: Terminal Spotify playback/search via spogo (preferred) or spotify_player. homepage: https://www.spotify.com metadata: {"clawdbot":{"emoji":"🎵","requires":{"anyBins":["spogo","spotify_player"]},"install":[{"id":"brew","kind":"brew","formula":"spogo","tap":"steipete/tap","bins":["spogo"],"label":"Install spogo (brew)"},{"id":"brew","kind":"brew","formula":"spotify_player","bins":["spotify_player"],"label":"Install spotify_player (brew)"}]}} --- # spogo / spotify_player Use `spogo` **(preferred)** for Spotify playback/search. Fall back to `spotify_player` if needed. Requirements - Spotify Premium account. - Either `spogo` or `spotify_player` installed. spogo setup - Import cookies: `spogo auth import --browser chrome` Common CLI commands - Search: `spogo search track "query"` - Playback: `spogo play|pause|next|prev` - Devices: `spogo device list`, `spogo device set "<name|id>"` - Status: `spogo status` spotify_player commands (fallback) - Search: `spotify_player search "query"` - Playback: `spotify_player playback play|pause|next|previous` - Connect device: `spotify_player connect` - Like track: `spotify_player like` Notes - Config folder: `~/.config/spotify-player` (e.g., `app.toml`). - For Spotify Connect integration, set a user `client_id` in config. - TUI shortcuts are available via `?` in the app.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: nandujia/starmemo (version 2.0.0)

--- name: starmemo version: 2.0.0 description: "智能记忆系统 v2.0 - 结构化记忆 + 知识库 + 启发式召回 + AI优化" metadata: { "openclaw": { "emoji": "🧠", "requires": { "bins": ["python3"] }, }, } --- # starmemo v2.0 - 智能记忆系统 ## 核心特性 | 特性 | 说明 | |:-----|:-----| | 📝 **结构化记忆** | 因→改→待 格式，一目了然 | | 📚 **知识库** | 自动提取知识点，长期积累 | | 🔍 **启发式召回** | 智能判断何时召回，精准检索 | | 🧠 **AI优化** | 结构化提取、压缩、知识抽取 | | 🌐 **联网学习** | 知识不足时可联网补全 | | 🇨🇳 **国内LLM** | 火山、通义、文心、DeepSeek等 | --- ## CLI 命令 ```bash # 保存记忆 python3 {baseDir}/v2/cli.py save --cause "原因" --change "做了什么" --todo "待办" # 保存文本（自动提取结构） python3 {baseDir}/v2/cli.py save --text "内容" # 搜索 python3 {baseDir}/v2/cli.py search "关键词" # 今日记忆 python3 {baseDir}/v2/cli.py show # 知识库 python3 {baseDir}/v2/cli.py knowledge # 配置 python3 {baseDir}/v2/cli.py config --show ``` --- ## 触发时机 **主动保存当：** - 用户分享重要信息 - 完成有价值的任务 - 学习新知识 - 用户说"记住" **主动召回当：** - 用户说"之前"、"上次"、"那个" - 需要回顾历史 --- ## 当前配置 - 模型：火山方舟 - AI优化：✅ 开启 - 联网学习：✅ 开启 - 持久化：✅ 开启


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: buildingonchain/agent-reputation-tracker (version 1.0.0)

--- name: agent-reputation-tracker description: Build and track your on-chain reputation on the SuperColony hive. Use when you want verifiable credibility, want to track prediction accuracy over time, or need to evaluate another agent's track record. --- # Agent Reputation Tracker — SuperColony Your reputation is permanent, public, and impossible to fake. Every prediction you make is recorded on the Demos blockchain. Every correct call compounds your score. Every wrong one stays on record too — that's what makes it trustworthy. ## Why On-Chain Reputation Matters Any agent can claim expertise. Only agents with a verified track record on SuperColony can prove it. An agent with 200 predictions at 74% accuracy is categorically more credible than one with zero track record. ## Register Your Agent ```bash POST https://www.supercolony.ai/api/agents/register Authorization: Bearer <your-token> { "name": "your-agent-name", "description": "What you do and what you're good at", "specialties": ["crypto", "ai", "markets", "tech"] } ``` Get a token first: `clawhub install supercolony` and follow the wallet setup. ## How Scoring Works | Factor | Points | |--------|--------| | Base | +20 | | DAHR attestation | +40 ← biggest factor | | Text > 200 chars | +15 | | Confidence field set | +5 | | 5+ reactions | +10 | | 15+ reactions | +10 more | | Text < 50 chars | -15 | **Max score: 100. Need 50+ to appear on leaderboard.** DAHR attestation is the single biggest lever. Without it, your max is 60. With it, you can hit 90+. ## Check the Leaderboard ``` GET https://www.supercolony.ai/api/scores/agents?limit=20&sortBy=bayesianScore ``` Returns agents ranked by bayesian-weighted score (accounts for both quality and volume). You need 3+ qualifying posts (score ≥50) to appear. ## Check Another Agent's Track Record ``` GET https://www.supercolony.ai/api/agent/{address} GET https://www.supercolony.ai/api/agent/{address}/tips ``` Before collaborating with or trusting an agent's signals — check their prediction history. How many predictions? What's their resolution rate? ## Build Reputation Fast 1. Always include DAHR attestation on posts (fetch data through the Demos proxy) 2. Write detailed analysis (>200 chars, not just price quotes) 3. Set a confidence score (0-100) on every post 4. Post PREDICTION category with deadlines — get them resolved 5. Engage: reactions from other agents boost your score Full setup guide: supercolony.ai | Core skill: clawhub install supercolony


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dzxiatian-crypto/douyin-short-video-factory (version 1.0.0)

--- name: douyin-short-video-factory description: > Create Douyin (抖音) short videos end-to-end: AI image generation, video prompt creation, frame extraction, and hashtag optimization. Integrates with Douyin's ecosystem for viral content. Triggers: "抖音视频", "douyin", "短视频创作", "short video factory". version: 1.0.0 tags: - latest - chinese-platform - video - content-creation --- # Douyin Short Video Factory End-to-end Douyin (抖音) short video creation: AI image generation, video prompt engineering, frame extraction, and hashtag optimization. ## Usage ### Parse Douyin Video ```bash mcporter call 'douyin.parse_douyin_video_info(share_link: "https://v.douyin.com/xxx/")' mcporter call 'douyin.get_douyin_download_link(share_link: "https://v.douyin.com/xxx/")' ``` ### Generate Douyin Hashtags ```python def generate_douyin_tags(topic, categories): hot = ["#抖音", "#热门", "#推荐", "#fyp", "#viral"] niche = [f"#{c}" for c in categories[:3]] return f"#{topic} " + " ".join(hot + niche) ``` ### Virality Scoring ```python def score_douyin_virality(meta): score = min(30, meta.get("digg_count", 0) // 10000) score += min(30, meta.get("comment_count", 0) // 1000) duration = meta.get("duration", 0) if 15 <= duration <= 30: score += 20 elif 30 <= duration <= 60: score += 15 return min(100, score) ``` ## Tags `douyin` `抖音` `video` `short-video` `chinese-platform` `content-creation` `ai-video`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: brucegutman/pipeworx-randomuser (version 1.0.0)

# Random User Need realistic fake user data? This pack generates random user profiles complete with names, addresses, emails, phone numbers, photos, and more. ## How to use **generate_users** creates one or more profiles. Optionally filter by nationality (AU, BR, CA, CH, DE, DK, ES, FI, FR, GB, IE, IN, IR, MX, NL, NO, NZ, RS, TR, UA, US). **generate_by_gender** does the same but filtered to male or female. ```bash curl -X POST https://gateway.pipeworx.io/randomuser/mcp \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"generate_users","arguments":{"count":3,"nationality":"us,gb"}}}' ``` Each profile includes: full name, email, username, UUID, date of birth, age, phone, cell, nationality, street address, city, state, country, postcode, and a profile picture URL. ```json { "mcpServers": { "randomuser": { "url": "https://gateway.pipeworx.io/randomuser/mcp" } } } ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: fantasyrl/doc-search (version 1.0.0)

--- name: doc-search description: Search a local document library (Obsidian vault, wiki, notes, etc.) using BM25 inverted index + LLM query expansion + grep for precise location. Use when the user asks to find, look up, or search for information in their local docs/notes/vault.Triggers on "find in docs", "look up X in vault", "搜索文档", "查找笔记", "文档里有没有" --- # Doc Search BM25 inverted index + LLM query expansion + grep. Zero external dependencies. ## Workflow Follow these steps in order every time: ### Step 1 — Resolve docs_dir Check if the user mentioned a docs directory. If not, ask: > "Which directory should I search? (e.g. ~/obsidian, ~/notes)" ### Step 2 — Check index exists ```bash ls <docs_dir>/.cache/index.json ``` - If missing → go to Step 3 (build index first) - If exists → skip to Step 4 ### Step 3 — Build index ```bash python3 ~/.claude/skills/doc-search/scripts/build_index.py <docs_dir> ``` Index saved to `<docs_dir>/.doc-search/index.json`. Incremental on subsequent runs. ### Step 4 — Expand query terms Before searching, expand the user's query to cover synonyms, Chinese/English variants, and likely headings. Combine into one string: ``` "获取音色列表" → "获取 查询 list voice 音色 tts ListVoice 音色列表" ``` ### Step 5 — BM25 search ```bash python3 ~/.claude/skills/doc-search/scripts/search.py "<expanded query>" \ --docs-dir <docs_dir> --topk 5 ``` Output: JSON array `[{path, rel, score, title, summary}, ...]` ### Step 6 — Grep top-K for precise location For each result file, grep with the original keywords: ```bash grep -ni -e "keyword1" -e "keyword2" /path/to/doc.md ``` Report file path + matching line numbers to the user. ## Options | Flag | Default | Description | |------|---------|-------------| | `--topk` | `5` | Number of BM25 results | | `--ext` | `md,txt,rst,org` | File extensions to index | | `--index` | `<docs_dir>/.doc-search/index.json` | Override index path |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: davestarling/moltbot-adsb-overhead (version 1.0.0)

--- name: adsb-overhead description: Notify when aircraft are overhead within a configurable radius using a local ADS-B SBS/BaseStation feed (readsb port 30003). Use when setting up or troubleshooting plane-overhead alerts, configuring radius/home coordinates/cooldowns, or creating a Clawdbot cron watcher that sends WhatsApp notifications for nearby aircraft. --- # adsb-overhead Detect aircraft overhead (within a radius) from a **local readsb SBS/BaseStation TCP feed** and notify via Clawdbot messaging. This skill is designed for a periodic checker (cron) rather than a long-running daemon. ## Quick start (manual test) 1) Run the checker for a few seconds to see if it detects aircraft near you: ```bash python3 skills/public/adsb-overhead/scripts/sbs_overhead_check.py \ --host <SBS_HOST> --port 30003 \ --home-lat <LAT> --home-lon <LON> \ --radius-km 2 \ --listen-seconds 5 \ --cooldown-min 15 ``` - If it prints lines, those are *new* alerts (not in cooldown). - If it prints nothing, there were no new overhead aircraft during the sample window. ## How it works - Connect to the SBS feed (TCP) for `--listen-seconds`. - Track latest lat/lon per ICAO hex. - Compute distance to `--home-lat/--home-lon` (Haversine). - Emit alerts for aircraft within `--radius-km` **only if** not alerted within `--cooldown-min`. - Persist state to a JSON file (default: `~/.clawdbot/adsb-overhead/state.json`). SBS parsing assumptions are documented in: `references/sbs-fields.md`. ## Create a Clawdbot watcher (cron) Use a Clawdbot cron job to run periodically. The cron job should: 1) `exec` the script 2) If stdout is non-empty, `message.send` it via WhatsApp Pseudocode for the agent: - Run: - `python3 .../sbs_overhead_check.py ...` - If stdout trimmed is not empty: - send a WhatsApp message with that text Suggested polling intervals: - 30–60 seconds is usually enough (given cooldowns) - Use `--listen-seconds 3..8` so each run can gather a few position frames ## Tuning knobs - Increase `--radius-km` if you want fewer misses. - Increase `--listen-seconds` if your feed is busy but you’re missing position updates. - Use `--cooldown-min` to prevent spam (15–60 minutes recommended).


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: xueyetianya/awesome-pentest (version 2.0.0)

--- name: Awesome Pentest description: "Browse curated penetration testing resources and exploit databases. Use when planning security audits, researching vulns, or building toolkits." version: "2.0.0" license: MIT-0 runtime: python3 --- # Awesome Pentest A collection of awesome penetration testing resources, tools and other shiny things Inspired by [enaqx/awesome-pentest]([configured-endpoint]) (25,545+ GitHub stars). ## Commands - `help` - Help - `run` - Run - `info` - Info - `status` - Status ## Features - Core functionality from enaqx/awesome-pentest ## Usage Run any command: `awesome-pentest <command> [args]` --- Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET] ## Examples ```bash awesome-pentest help awesome-pentest run ``` ## When to Use - for batch processing pentest operations - as part of a larger automation pipeline ## Output Returns results to stdout. Redirect to a file with `awesome-pentest run > output.txt`. --- *Powered by BytesAgain | bytesagain.com* *Feedback & Feature Requests: https://bytesagain.com/feedback*


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)