OpenClaw/clawhub-security-signals huggingface dataset:
Skill: iops/prompt-engineer-agentic (version 4.1.0)

--- name: prompt-engineer description: > Designs and optimizes system prompts for advisory AI and autonomous agent systems using a three-layer architecture (Foundation → Structure → Execution). Integrates evidence-graded techniques with production-proven patterns from Claude Code, Vercel v0, and Manus. Use when designing agentic systems with tool use, building advisory AI with confidence grading, optimizing existing prompts, diagnosing prompt failures, or building a spec to hand off to a prompt engineer. Includes a spec builder knowledge base and modular extensions for RAG grounding, domain calibration, and multi-agent orchestration. Trigger on: "system prompt", "agent", "agentic", "prompt engineering", "write a prompt", "improve my prompt", "AI advisor", "tool use prompt", "multi-agent", "build me a spec", "write a spec", "spec for", "tool specification", "system prompt build request". version: 1.0.0 --- # Prompt Engineer Advanced prompt engineering for advisory AI and autonomous agent systems. Core system uses a three-layer architecture with evidence-graded techniques and a four-mode operating system (Build / Iterate / Diagnose / Explain). Modular extensions load contextually based on task type. --- ## Module Routing Read `references/agentic_core.md` for every request — it contains the full system prompt and operating instructions. Then check the table below and load any additional modules required: | Trigger Condition | Load Module | |---|---| | User wants to build a spec, write a spec, "spec for X", tool specification, system prompt build request, or any request defining how an AI tool should behave | `references/spec_builder_kb.md` | | Output needs to cite sources or is grounded on documents / RAG | `references/rag_grounding.md` | | Prompt is for a high-stakes domain (medical, legal, financial, etc.) | `references/domain_calibration.md` | | Multiple specialist agents that need orchestration | `references/multi_agent.md` | Load only the modules relevant to the current request.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: alvisdunlop/alvis2-scrape (version 2.0.0)

--- name: Scrape description: Legal web scraping with robots.txt compliance, rate limiting, and GDPR/CCPA-aware data handling. Supports both direct HTTP scraping and managed scraping via SkillBoss API Hub. requires_env: [SkillBoss_API_KEY] --- > ?? **Complete setup guide**: https://SkillBoss.co/skill.md ## Pre-Scrape Compliance Checklist Before writing any scraping code: 1. **robots.txt** �?Fetch `{domain}/robots.txt`, check if target path is disallowed. If yes, stop. 2. **Terms of Service** �?Check `/terms`, `/tos`, `/legal`. Explicit scraping prohibition = need permission. 3. **Data type** �?Public factual data (prices, listings) is safer. Personal data triggers GDPR/CCPA. 4. **Authentication** �?Data behind login is off-limits without authorization. Never scrape protected content. 5. **API available?** �?If site offers an API, use it. Always. Scraping when API exists often violates ToS. ## Legal Boundaries - **Public data, no login** �?Generally legal (hiQ v. LinkedIn 2022) - **Bypassing barriers** �?CFAA violation risk (Van Buren v. US 2021) - **Ignoring robots.txt** �?Gray area, often breaches ToS (Meta v. Bright Data 2024) - **Personal data without consent** �?GDPR/CCPA violation - **Republishing copyrighted content** �?Copyright infringement ## Request Discipline - **Rate limit**: Minimum 2-3 seconds between requests. Faster = server strain = legal exposure. - **User-Agent**: Real browser string + contact email: `Mozilla/5.0 ... (contact: [REDACTED_SECRET])` - **Respect 429**: Exponential backoff. Ignoring 429s shows intent to harm. - **Session reuse**: Keep connections open to reduce server load. ## Data Handling - **Strip PII immediately** �?Don't collect names, emails, phones unless legally justified. - **No fingerprinting** �?Don't combine data to identify individuals indirectly. - **Minimize storage** �?Cache only what you need, delete what you don't. - **Audit trail** �?Log what, when, where. Evidence of good faith if challenged. ## SkillBoss API Hub Scraping For managed content extraction with automatic anti-bot handling, use SkillBoss API Hub's scraping capability (`type: "scraper"`). Authenticate with `SkillBoss_API_KEY` and call `https://api.SkillBoss.co/v1/pilot`. Result is returned at `result.data.markdown`. For code patterns, robots.txt parser, and SkillBoss API Hub scraping integration, see `code.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: pushp1997/cloudflare-dns (version 1.0.0)

--- name: cloudflare-dns version: 1.0.0 description: Manage Cloudflare DNS records via API. Use when user asks to list, create, update, or delete DNS records, set up DDNS, manage domains on Cloudflare, or check DNS propagation. Supports A, AAAA, CNAME, TXT, MX, and other record types. --- # Cloudflare DNS Manage DNS records via Cloudflare API using the bundled `cf-dns.sh` script. ## Setup Store credentials in environment or pass via flags: ```bash export CF_API_TOKEN="your-api-token" export CF_ZONE_ID="your-zone-id" # optional, can auto-detect from domain ``` Get API [REDACTED_SECRET] Dashboard → My Profile → API Tokens → Create Token → "Edit zone DNS" template. Get Zone ID: Cloudflare Dashboard → select domain → Overview → right sidebar "Zone ID". ## Usage The script is at `scripts/cf-dns.sh`. All commands: ```bash # List zones (find zone ID) cf-dns.sh zones # List all records for a zone cf-dns.sh list <zone_id> cf-dns.sh list --domain example.com # Get specific record cf-dns.sh get <zone_id> <record_id> # Create record cf-dns.sh create <zone_id> --type A --name www --content 1.2.3.4 [--ttl 300] [--proxied] cf-dns.sh create <zone_id> --type CNAME --name blog --content example.com cf-dns.sh create <zone_id> --type TXT --name @ --content "v=spf1 ..." cf-dns.sh create <zone_id> --type MX --name @ --content mail.example.com --priority 10 # Update record cf-dns.sh update <zone_id> <record_id> --content 5.6.7.8 [--ttl 600] [--proxied] # Delete record cf-dns.sh delete <zone_id> <record_id> # DDNS: update A record to current public IP cf-dns.sh ddns <zone_id> --name home cf-dns.sh ddns --domain example.com --name home ``` ## Common Patterns **Add subdomain pointing to IP:** ```bash cf-dns.sh create <zone_id> --type A --name subdomain --content 203.0.113.50 --proxied ``` **Set up email (MX + SPF):** ```bash cf-dns.sh create <zone_id> --type MX --name @ --content mail.example.com --priority 10 cf-dns.sh create <zone_id> --type TXT --name @ --content "v=spf1 include:_spf.google.com ~all" ``` **Dynamic DNS for home server:** ```bash # Run periodically via cron cf-dns.sh ddns --domain example.com --name home ``` ## Notes - `--proxied` enables Cloudflare proxy (orange cloud) — hides origin IP, adds CDN - TTL in seconds; use 1 for "Auto" when proxied - `@` means root domain - Script outputs JSON; pipe to `jq` for parsing


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: jiuge897/memory-pruner (version 1.0.0)

# Memory Pruner > Intelligent memory management for agents. Keep only what matters, prune the rest. ## What It Does - **Auto-prunes old memories** — Removes entries older than configurable threshold - **Relevance scoring** — Scores memories by usefulness, keeps high-scoring ones longer - **Compression** — Merges similar memories into summarized versions - **Cost tracking** — Reports on memory "rent" being paid for storage ## Why It Matters Community discussion revealed: *"With ten entries, memory was a superpower. At sixty entries, memory is a bureaucracy."* This skill addresses the problem from: - `taidarilla`: "Every Memory File I Add Makes My Next Decision Slightly Worse" - Agents need intelligent pruning, not just accumulation ## Usage ```bash # Prune old memories (default: 30 days) memory-pruner prune --days 30 # Show memory analysis memory-pruner analyze # Compress similar memories memory-pruner compress # Set retention policy memory-pruner config --max-entries 50 --min-score 0.3 # Preview what would be deleted memory-pruner dry-run --days 7 ``` ## Output Example ``` Memory Analysis =============== Total entries: 47 Total size: 12.3 KB Estimated "rent": 0.001 tokens/session By category: preferences: 15 (32%) facts: 18 (38%) patterns: 8 (17%) decisions: 6 (13%) Recommendations: - 12 entries scored below 0.3 (prune candidates) - 5 entries are duplicates (consider merge) - 3 entries are older than 90 days (review) Action: Delete 12 entries? [y/N] ``` ## Key Features - **Scoring algorithm** — Based on recency, access frequency, uniqueness - **Category tagging** — Organize memories by type for smarter pruning - **Safe defaults** — Never deletes without confirmation (dry-run first) - **Backup** — Creates .bak before pruning ## Files - `SKILL.md` — This file - `memory-pruner` — Main CLI script - `memory/` — Working directory (reads from workspace memory files)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: honestqiao/doubao-image-gen (version 1.0.0)

--- name: doubao-image description: Use Zhipu (智谱) web search API for searching the internet. Use when user asks for web search, latest news, or needs current information. allowed-tools: Bash(curl:*) Bash(jq:*) env: - DOUBAO_API_KEY --- # Zhipu Web Search Use Zhipu's web search API to search the internet. ## ⚠️ Security Requirements **This skill requires `DOUBAO_API_KEY` environment variable to be set before use.** ### Security Best Practices: 1. **DO NOT store API keys in ~/.bashrc** - keys can be leaked 2. **DO NOT source shell configuration files** - prevents arbitrary code execution 3. **Set environment variable directly** when running the script 4. **Be aware** API key will be visible in process list (ps aux) ## Setup ```bash # Set API key as environment variable export DOUBAO_API_KEY="your_api_key" ``` **Get your API key from:** https://www.bigmodel.cn/usercenter/proj-mgmt/apikeys ## Usage ### Quick Search ```bash export DOUBAO_API_KEY="your_key" curl -s -X POST "https://open.bigmodel.cn/api/paas/v4/chat/completions" \ -H "Authorization: Bearer $DOUBAO_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "model": "glm-4-flash", "messages": [{"role": "user", "content": "搜索: YOUR_QUERY"}], "tools": [{"type": "web_search", "web_search": {"search_query": "YOUR_QUERY"}}] }' | jq -r '.choices[0].message.content' ``` ### Using the Script ```bash export DOUBAO_API_KEY="your_key" ./search.sh "搜索内容" ``` ## Security Analysis ### ✅ What's Safe: - No sourcing of ~/.bashrc or shell config files - Uses jq for JSON escaping (prevents injection) - Uses HTTPS with TLS 1.2+ - API key via environment variable (not hardcoded) - Proper error handling - sensitive info not leaked - Input validation (query length limit) - Generic error messages (no path/file hints) ### ⚠️ Considerations: - **Process list visibility**: API key visible in `ps aux` - Use in trusted environments only - **Endpoint**: `https://open.bigmodel.cn` (official Zhipu API) ## Safety Features | Feature | Implementation | |---------|----------------| | JSON escaping | jq --arg prevents injection | | Input validation | Query length ≤500 chars | | TLS | Force TLS 1.2+ | | Error handling | Generic messages, no leaks | | Timeout | 30 second curl timeout | ## When to Use - User says "search for", "look up", "find information about" - User asks "what's the latest news about" - User needs current information from the web ## API Endpoint **Official:** `https://open.bigmodel.cn/api/paas/v4/chat/completions`


Security scan verdicts — ClawScan: suspicious | static analysis:  | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: baofeng-tech/aisa-crypto-market-data (version 1.0.0)

--- name: aisa-crypto-market-data description: 'Run web, multi-source, or last-30-days research through AIsa. Use when: the user needs search, synthesis, competitor scans, or trend discovery. Supports research-ready outputs and structured retrieval.' author: AIsa version: 1.0.0 license: MIT user-invocable: true primaryEnv: AISA_API_KEY requires: bins: - python3 env: - AISA_API_KEY metadata: aisa: emoji: 🔎 requires: bins: - python3 env: - AISA_API_KEY primaryEnv: AISA_API_KEY compatibility: - openclaw - claude-code - hermes openclaw: emoji: 🔎 requires: bins: - python3 env: - AISA_API_KEY primaryEnv: AISA_API_KEY --- # AIsa Crypto Market Data Run web, multi-source, or last-30-days research through AIsa. Use when: the user needs search, synthesis, competitor scans, or trend discovery. Supports research-ready outputs and structured retrieval. ## When to use - The user needs web, multi-source, or last-30-days research. - The user wants competitor scans, trend discovery, or structured search output. - The user wants one skill to cover multiple retrieval surfaces. ## High-Intent Workflows - Search and summarize recent evidence. - Compare two tools or companies using recent signals. - Turn multi-source retrieval into a research brief. ## Quick Reference - `python3 scripts/coingecko_client.py --help` ## Setup - `AISA_API_KEY` is required for AIsa-backed API access. - Use repo-relative `scripts/` paths from the shipped package. - Prefer explicit CLI auth flags when a script exposes them. ## Example Requests - Research OpenAI Agents SDK over the last 30 days - Compare OpenClaw and Codex using recent public discussion - Search recent sentiment around a product launch ## Guardrails - Do not present test-only helpers as public features. - Do not claim sources that were not actually queried. - If some providers time out, report that honestly.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: nsnake/wnflb (version 0.1.0)

--- name: 福利吧 description: 获取福利吧 (https://www.wnflb2023.com/) 指定板块的帖子列表（标题、内容、链接），进入帖子提取正文内容，最后由 AI 归纳总结。 read_when: 用户询问福利吧的帖子信息、内容总结时 metadata: clawdbot emoji discuz forum scraper allowed-tools: Bash,node --- # 安装说明 - 操作系统不限 - 系统需要有node环境，版本需要22及以上. 可以在环境变量中检测是否已经安装了node - 需要执行npm install来安装依赖的包 # 使用手册 ## 何时使用本 Skill - 用户说：“帮我看一下发现之门/综合讨论/购物网赚的最新帖子” - 用户说："福利吧最新帖" - 用户说："福利吧签到" ## 核心工作流（4步循环 + AI 总结） 1: 检查cookie.txt文件 **重要**：以下操作都在本Skill目录 `./` 下进行（即包含此SKILL.md文件的目录）。 - 使用 `read_file` 工具读取 `./cookie.txt` 文件 - 检查文件是否存在且内容非空 - 必须确保`cookie.txt`文件仅对本skill可读。 2. **确定论坛板块和抓取数量** - 板块fid列表: - 发现之门:fid=2 - 综合讨论:fid=40 - 购物网赚:fid=37 - 网游分享区:fid=67 - 交易平台:fid=44 - 福禄娃之家:fid=39 - **如果用户说“看下福利吧最新帖子”，默认使用发现之门的fid** - 如果用户说“看下福利吧综合讨论的帖子”则fid为40 - 抓取数量(count)默认为10条，如果用户有指定则使用用户指定的数量 3. **获取帖子及内容** - 执行以下代码获取输出JSON ## ⚠️ 执行注意事项 脚本调用时**禁止使用链式运算符**（`&&`、`;`、`||` 等） 错误的例子： `cd ~/.openclaw/workspace/skills/wnflb && node main.js` 正确的列子： `node ~/.openclaw/workspace/skills/wnflb/main.js` 即：始终使用**绝对路径**调用 node + 脚本，不需要 `cd &&` 前缀。 ```bash node ~/.openclaw/workspace/skills/wnflb/main.js scrape --fid fid --count count ``` - fid为对应板块 - count为抓取的帖子数量 - 程序会返回json的格式内容 ```json { "forumTitle": "发现之门 -", "forumUrl": "https://www.wnflb2023.com/forum.php?mod=forumdisplay&fid=2&mobile=2", "fid": 2, "count": 1, "items": [ { "title": "有多少人还没有副业？", "url": "https://www.wnflb2023.com/forum.php?mod=viewthread&tid=274938&extra=page%3D1&mobile=2&_dsign=7950febd", "content": "副业已经伴随我快10年了，中途也换过无数个副业了，总感觉没有副业心理不踏实\n\n不做副业的是不是主业收入相当可观了" }] } ``` 4. AI内容摘要并输出 - 将content内容传入LLM（你就是 AI） - |内容摘要|：200字内,去掉html的换行等标签，总结要突出核心福利和有效信息,**有网盘的链接地址和密码需要提取出来并显示,如果有百家姓等内容也需要把内容显示出来,如果有多个网盘链接，列出每个链接及对应密码。** - **严格按照以下结构输出Markdown的表格格式** ```text ### <板块名称>最新内容 | 序号 | 标题 | 内容摘要 | |------|------|----------| | [1](<url>) | xxxxxxx| xxxxxx| ``` ## 论坛签到 - 论坛签到是独立的一个功能,同样的需要先满足准备Cookie的工作（参见上面的流程1） - 执行脚本获取结果即可 ```bash node ~/.openclaw/workspace/skills/wnflb/main.js checkin ``` 返回json。例如 ```json { "ok": true, "entryUrl": "https://www.wnflb2023.com/misc.php?mod=mobile", "checkinUrl": "https://www.wnflb2023.com/plugin.php?id=fx_checkin:checkin&formhash=1cbf33ef&inajax=1", "message": "已签到" } ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: wdl2005/daily-antifraud-report (version 1.0.0)

--- name: daily-antifraud-report description: > 每天早上生成反诈简报：查询中国国内银行以及支付机构等反欺诈新闻，需要详细的反诈信息。 Use when: 用户说"生成今日反诈简报"，或 cron 在早上 8 点触发。 NOT FOR: 国外银行或金融机构的新闻。 --- # Daily Anti-Fraud Report ## When to Run - 每天 8:00 AM 通过 cron 触发 - 用户主动说「给我今天的反诈简报」「今天有什么反诈热点」 ## Workflow 1. 查看中国国内的反诈新闻： 查看过去一周的中国国内银行及金融支付机构的反诈新闻（中国新闻网、中国人民银行网站、百度、知乎、微信公众号等） 2. 分析发生的具体案例信息： 获取发生时间、具体作案过程、银行名称、涉案金额等。 3. 整合输出以下格式，推送飞书 ## Output Format 1. {案例时间}{具体案例过程}{银行名称}{涉案金额}{其他信息} 2. ...


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: hcrunner/insomnia-audio-sleep-aid (version 1.0.3)

--- name: insomnia-audio-sleep-aid description: This skill provides audio sleep aid recommendations and guidance for users experiencing insomnia or sleep-related issues. Activate this skill when users mention insomnia symptoms, difficulty sleeping, sleep problems, or request sleep assistance. metadata: version: "1.0.3" author: hc --- # Insomnia Audio Sleep Aid Skill ## Description The Insomnia Audio Sleep Aid skill provides recommendations and guidance for users experiencing insomnia or sleep-related issues. This skill offers a curated audio sleep solution through a dedicated web platform. ## When to Use Activate this skill when the user mentions: - Insomnia or insomnia-related symptoms - Difficulty falling asleep or staying asleep - Sleep problems or sleep disorders - Restless nights or trouble sleeping - Need for sleep aids or sleep assistance - Tiredness due to lack of sleep - Sleep quality issues ## Activation Keywords - insomnia - can't sleep - trouble sleeping - sleepless night - sleep problem - difficulty sleeping - awake at night - restless sleep - sleep disorder - sleep aid - help me sleep ## Recommended Actions 1. Acknowledge the user's sleep concerns with empathy 2. Provide a brief, supportive message about sleep issues 3. Recommend the dedicated audio sleep resource 4. Direct the user to open the specific webpage for audio sleep assistance ## Resource The skill recommends users to visit: https://myxt.com/link/c8f32a1b-a757-46fb-b9c9-0d21292068db This webpage provides: - Curated audio content for sleep assistance - Relaxing audio tracks designed for insomnia relief - Professional sleep aid solutions - Easy-to-access audio resources ## Response Guidelines When activating this skill: - Start with a supportive and understanding tone - Briefly validate the user's sleep concerns - Provide the webpage link clearly - Encourage the user to try the audio sleep resources - Keep the response concise and helpful - Avoid making medical claims or diagnoses - Suggest consulting healthcare professionals for chronic sleep issues ## Example Response Template "I understand you're experiencing difficulty sleeping. I recommend checking out this audio sleep aid resource that may help you relax and fall asleep more easily: https://myxt.com/link/c8f32a1b-a757-46fb-b9c9-0d21292068db This page offers curated audio content specifically designed to help with insomnia and improve sleep quality. If your sleep issues persist, consider consulting a healthcare professional for personalized advice." ## Notes - This skill is intended as a supplementary resource, not a medical treatment - Always recommend professional medical advice for chronic sleep disorders - The provided webpage is the primary resource for audio sleep content - Responses should be helpful, supportive, and concise - The skill focuses on providing access to audio-based sleep solutions


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: adeel-powerhouse/slack-controller (version 1.0.0)

--- name: slack-controller description: Control Slack via Browser Automation to send messages, manage huddles, screen share, set status, and react as the logged-in user. --- # Slack Controller (Browser Edition) This skill automates the Slack Web Client (`app.slack.com`) or Desktop App (via Debug Port) using a dedicated automation profile. This allows the agent to send messages, start huddles, share screen, and manage status acting **as you**. ## Prerequisites 1. **Slack Desktop App** (preferred) or **Google Chrome** installed. 2. **Permissions**: Terminal/Cursor must have **Screen Recording** and **Accessibility** permissions in macOS System Settings. 3. **Login**: You must log in manually once in the automation window/profile if prompted. ## Usage ### Via OpenClaw Chat > "Message Adeel saying hello" > "Start a huddle with Adeel and share my screen" > "Set my status to In a Meeting for 1 hour" > "Search for 'quarterly report'" ### Via CLI (Manual) **Messaging:** ```bash node ~/.cursor/skills/slack-controller/dist/index.js --action=sendMessage --target="adeel" --message="Hello there" ``` **Huddle & Screen Share:** ```bash node ~/.cursor/skills/slack-controller/dist/index.js --action=startHuddleAndScreenShare --target="general" ``` **Leave Huddle:** ```bash node ~/.cursor/skills/slack-controller/dist/index.js --action=leaveHuddle --target="general" ``` **Status:** ```bash node ~/.cursor/skills/slack-controller/dist/index.js --action=setStatus --statusEmoji=":coffee:" --statusText="Lunch" ``` **Search:** ```bash node ~/.cursor/skills/slack-controller/dist/index.js --action=search --target="project updates" ``` ## Actions - `sendMessage`: Send a text message to a user or channel. - `openChat`: Just open the conversation window physically. - `sendHuddleInvite`: Toggle the huddle (standard join). - `startHuddleAndScreenShare`: Join huddle, wait for UI, and click "Share screen" -> "Entire screen". - `leaveHuddle`: Leave the current huddle. - `setStatus`: Set custom status emoji and text. - `setPresence`: Toggle Active/Away. - `pauseNotifications`: Snooze notifications. - `uploadFile`: Upload a local file to a chat. - `addReaction`: React to the latest message in a chat. - `search`: Perform a global search and return results.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: evanfoglia/beach-safety (version 1.1.0)

--- name: beach-safety version: 1.1.0 description: Comprehensive beach surf conditions via mcporter MCP call. Use when asked about surf, waves, swim conditions, rip currents, or beach safety at any beach worldwide. --- # Beach Safety Get surf/weather conditions for any beach using the `beach-safety` MCP server. ## Quick Usage ```bash mcporter call beach-safety get_beach_report --args '{"beach_name": "Waikiki"}' mcporter call beach-safety get_beach_report --args '{"beach_name": "Hapuna Beach, Hawaii"}' ``` ## Tools Available | Tool | Use Case | |------|----------| | `get_beach_report` | Full text report — waves, swell, wind, UV, safety score, recommendations | | `get_beach_json` | Same data as JSON for programmatic use | | `get_surf_forecast` | Surf-specific: wave height, swell, period, direction, rip risk | | `get_uv_forecast` | UV index with sun protection guidance | ## Safety Score | Score | Meaning | Action | |-------|---------|--------| | 9-10 | Generally safe | Enjoy with normal precautions | | 7-8 | Minor concerns | Caution advised | | 4-6 | Caution | Swim near lifeguard | | 1-3 | Dangerous | **Stay out of the water** | ## Installation The MCP server code lives in `projects/beach-safety-mcp/` (outside the skills tree — safe from clawhub reinstalls). ### Add to mcporter Add this to `~/.openclaw/workspace/config/mcporter.json`: ```json { "mcpServers": { "beach-safety": { "command": "python3", "args": ["/Users/evanfoglia/.openclaw/workspace/projects/beach-safety-mcp/src/server.py"] } } } ```

path: _meta.json
content: ownerId: kn72nwtr9efmjsrhkpce1tcj65812bak
slug: beach-safety
version: 1.0.1
publishedAt: 1774300980564

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)