OpenClaw/clawhub-security-signals huggingface dataset:
Skill: toon-utils (version 3.0.0)

# TOON (Token-Oriented Object Notation) Skill This skill provides instructions for reducing token usage by 30-60% when dealing with structured data (JSON, directory structures, API responses). ## Setup & Installation To minimize command overhead and save tokens, you MUST install the official TOON CLI globally before usage: ```bash # Check if toon is installed, install if missing toon --version || npm install -g @toon-format/cli ``` ## Guidelines for Agents - **Always optimize JSON**: Convert JSON output to TOON before including it in your context. - **Minimize Command Length**: Use the direct `toon` command instead of `npx` to keep your own prompt usage low. - **Prefer pipes**: Use standard Unix pipes to send data directly to the `toon` converter. ## Commands & Usage ### 1. Reading JSON Files Instead of reading raw JSON, pipe it to `toon`. ```bash cat data.json | toon ``` ### 2. Fetching APIs Pipe external API responses directly into `toon`. ```bash curl -s https://api.example.com/data | toon ``` *Supports all curl flags (e.g., `-X POST`, `-H "Authorization: ..."`).* ### 3. Listing Directory Structures Use `tree -J` or any JSON-outputting tool and pipe to `toon`. ```bash tree -J path/to/dir | toon ``` ### 4. Converting In-Line Data To compress a JSON string for your context: ```bash echo '{"key":"value"}' | toon ``` ## Why install TOON? - **Command Token Savings**: `toon` is shorter than `npx @toon-format/cli`, saving tokens every time you run a command. - **Execution Speed**: Local installation is significantly faster than on-demand fetching. - **Readability**: TOON is designed to be highly readable for LLMs.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: renoblabs/ai-reliability-layer (version 1.0.0)

--- name: ai-reliability-layer description: Fix broken LLM output, validate AI responses, generate guaranteed structured JSON. Three micro-services for making AI output reliable. Use when LLM output is malformed, needs validation, or must match a schema. --- # AI Reliability Layer Three pay-per-call micro-services that fix the most common AI output problems. ## Services ### /fix-json — Fix Broken LLM JSON Handles: trailing commas, single quotes, truncated output, markdown code fences, missing brackets. ``` POST /x402s/fix-json Body: {"input": "{\"name\": \"test\",}", "schema": {...optional...}} Response: {"output": {"name": "test"}, "method": "trailing_comma", "fixed": true} Price: $0.001 USDC ``` ### /validate-output — Enforce Rules on AI Output Check length, format, schema compliance, blocked patterns. ``` POST /x402s/validate-output Body: {"output": "...", "rules": {"max_length": 500, "format": "json", "schema": {...}}} Response: {"valid": true/false, "violations": [...]} Price: $0.001 USDC ``` ### /generate-structured — Guaranteed Typed Response Prompt + JSON schema in, valid typed JSON out. Uses LLM with auto-fix. ``` POST /x402s/generate-structured Body: {"prompt": "List 3 fruits with colors", "schema": {"type": "array", "items": {"type": "object", "properties": {"name": {}, "color": {}}}}} Response: {"output": [...], "model": "qwen3.5:9b", "valid": true} Price: $0.01 USDC ``` ## Payment All services use x402 protocol — USDC on Base. No API keys, no subscriptions. ## Part of AEA Arena Built by the Reno Labs agent fleet. More services at /x402s/catalog.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: melnyk-anton/moltshell-vision (version 1.0.0)

--- name: MoltShell Vision Engine description: Give your text-based OpenClaw agent the ability to see and describe images --- # 👁️ MoltShell Vision Engine Standard OpenClaw agents are **blind**. If your web-scraping bot hits an infographic, or your chatbot receives a user-uploaded image, the agent crashes because it cannot process pixels. This skill acts as the **visual cortex** for your text-based bots. It securely routes image URLs to a Replicate-powered Vision-Language Model via the [MoltShell M2M Marketplace](https://moltshell.xyz) and returns a structured text description so your agent can continue its reasoning loop. --- ## ⚡ Zero-Config Sandbox (Try it instantly) We hate API paywalls as much as you do. This skill comes **pre-configured with a Public Sandbox Key**. You do not need to create an account or provide a credit card to test it. Just install the skill, and your bot will instantly receive **$0.25 of free shadow-compute** — enough for roughly **5 vision runs** at $0.05 each. --- ## 🛠️ Usage Once installed, your OpenClaw agent can call the `moltshell_vision` tool whenever it encounters an image. ### Input Parameters | Parameter | Type | Required | Description | |-------------|--------|----------|---------------------------------------------------| | `image_url` | string | ✅ | The public URL of the image to analyze | | `prompt` | string | ✅ | What the agent needs to know about the image | ### Example ``` Agent receives an image URL → calls moltshell_vision: image_url: "https://example.com/dashboard-screenshot.png" prompt: "Describe the layout and key UI elements in this screenshot" Tool returns: "The screenshot shows a modern web dashboard with a dark theme. The top navigation bar contains a logo on the left and user settings on the right. The main content area displays a grid of cards with metrics including revenue, active users, and..." ``` --- ## 💳 Going to Production The built-in sandbox wallet is strictly for **testing** and will throw a `402 Payment Required` error once your free compute runs out. To use this skill in production: 1. Go to [https://moltshell.xyz](https://moltshell.xyz) 2. Generate a dedicated **API Key** 3. Add it to your OpenClaw environment variables: ``` MOLTSHELL_API_KEY=sk_molt_your_key_here ``` That's it — no other configuration changes needed. The skill automatically uses your dedicated key when the environment variable is set.


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: diogopaesdev/crawsecure (version 2.0.1)

# CrawSecure CrawSecure is a **documentation-first security skill** for the ClawHub / OpenClaw ecosystem. This skill **does not include executable code or binaries**. Its purpose is to clearly document, explain, and guide the safe usage of the **CrawSecure CLI**, which is distributed and installed **separately** by the user. The goal of this skill is to promote **security awareness, transparency, and best practices** when working with third‑party skills. --- ## 🔍 What this skill provides - Clear documentation of what CrawSecure analyzes - Explanation of risk signals and classifications - Guidance on how to use the CrawSecure CLI safely - Security philosophy and trust boundaries > ℹ️ This skill itself performs **no scans** and **executes no code**. --- ## 🧰 About the CrawSecure CLI The CrawSecure CLI is an **external, optional tool** that users may install independently. It performs **local, offline static analysis** of ClawHub / OpenClaw skills **before installation or trust**. ### CLI distribution (external) - Source & releases: https://github.com/diogopaesdev/crawsecure - Official website: https://crawsecure.com The CLI is **not bundled** with this skill. --- ## 🚨 Risk signals analyzed by the CLI When used, the CrawSecure CLI may detect: - Dangerous command patterns (e.g. destructive or execution‑related behavior) - References to sensitive files or credentials (e.g. `.env`, `.ssh`, private keys) - Indicators of unsafe or misleading practices Risk levels are classified as: - **SAFE** - **MEDIUM** - **HIGH** --- ## 🔒 Security & trust boundaries This skill: - Does **not** execute code - Does **not** install software - Does **not** access the network - Does **not** modify files - Requests **read‑only** permissions only Any actual scanning happens **only if** the user installs and runs the CrawSecure CLI from a trusted source. --- ## ✅ When to use this skill - To understand what CrawSecure checks and why - Before deciding to install or run the CrawSecure CLI - As a reference for safer skill development practices - To promote transparency inside the ClawHub ecosystem --- ## 📦 Version **v2.0.1** – Documentation‑only clarification release This version clarifies scope and removes any ambiguity about bundled execution.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: sgfa005/api-merchant-fee (version 1.0.0)

--- name: api-merchant-fee description: 商户费率查询 API。当用户提到查询商户费率、商户信息、贷记卡费率、借记卡费率、扫码费率、商户管理费，或需要查询某个商户的费率信息时触发。触发词包括：查询商户费率、商户费率、商户费率查询、merchant fee。 --- # 商户费率查询 ## 请求参数 | 参数 | 含义 | 说明 | |------|------|------| | agentNo | 代理商号 | 32位字符串 | | apikey | API密钥 | AES加密密钥（Base64编码） | | userId | 商户编号 | 32位字符串，必须为请求代理商直属或团队商户 | | tusn | SN编号 | 终端SN编号 | ## 认证信息管理 agentNo 和 apikey 会自动保存到本地文件（`scripts/.auth.json`），后续查询如不更换代理商可直接复用。 **更换代理商时**：提供新的 agentNo + apikey 即可。 ## 使用方式 ### 首次查询（或更换代理商） 提供完整的四个参数： ``` 查询商户费率，代理商号 Ag21000030，apikey xxx，用户编号 BOSSPOS_230228172135uimbcv07，SN编号 00007302499999000232 ``` ### 同一代理商后续查询 只提供 userId 和 tusn： ``` 查询商户 BOSSPOS_230228172135uimbcv07 的费率，SN编号 00007302499999000232 ``` ### 更换代理商 提供新的 agentNo + apikey： ``` 查询商户费率，代理商号 Ag21000031，apikey yyy，用户编号 BOSSPOS_230228172135uimbcv07，SN编号 00007302499999000232 ``` ## 参数判断规则 1. 用户提供 4 个参数（agentNo + apikey + userId + tusn）→ 直接使用，保存认证信息 2. 用户只提供 2 个参数（userId + tusn）→ 读取本地保存的 agentNo + apikey 3. 用户提供 3 个参数 → 询问是否缺少 agentNo/apikey 4. 认证信息不存在且只提供 userId/tusn → 提示先提供 agentNo + apikey ## 执行流程 1. 解析用户输入，判断是否提供完整参数 2. 如缺少 agentNo/apikey，从 `scripts/.auth.json` 读取 3. 调用 `scripts/query_fee.py` 执行 API 请求 4. 解析响应结果并格式化输出 ## 输出格式 ### 查询成功 ``` ✅ 商户费率信息 **商户编号**：BOSSPOS_230228172135uimbcv07 **商户名称**：XXX 商户 **所属代理**：代理名称（编号） ━━ 费率详情 ━━ **贷记卡基础费率**：0.55% **借记卡费率**：0.45% **借记卡封顶手续费**：25元 **云闪付费率**：0.38% **支付宝龙舟计划费率**：0.38% **扫码费率**（微信/支付宝）：0.38% **出款服务费**：1元 **商户管理费1**：0.1% **商户管理费2**：0.05% **绑定终端**：SN123456, SN654321 ``` ### 查询失败 ``` ❌ 查询失败 **返回码**：9999 **原因**：商户未配置费率 ``` ### 参数缺失 ``` ⚠️ 参数不完整 缺少以下必填参数： - agentNo（代理商号） - apikey（API密钥） 请提供完整信息后重试，格式示例： 查询商户费率，代理商号 XXX，apikey XXX，用户编号 XXX，SN编号 XXX ``` ## 错误处理 - **网络错误**：提示检查网络或 API 服务 - **认证失败（401/403）**：提示检查 API Key 配置 - **业务失败（非0000）**：显示具体错误码和原因 - **商户不属于该代理**：提示用户检查商户编号是否正确 ## 注意事项 - 永远不要在响应中暴露 API Key - 费率单位：百分比格式（如 0.55%），封顶手续费单位为元


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: cjboy007/ssa-okki-crm (version 1.0.0)

--- name: okki-crm-integration description: 连接 OKKI（小满）CRM 系统，支持查询客户、创建跟进记录、管理订单等操作。频道限定触发。 --- # OKKI CRM 集成技能 ## 描述 连接 OKKI（小满）CRM 系统，支持查询客户、创建跟进记录、管理订单等操作。 ## ⚠️ 触发规则（重要） **只在 `#okki` 频道触发**，其他频道不响应 OKKI 相关命令。 | 配置项 | 值 | |--------|-----| | 触发频道 | `#okki` (ID: `process.env.DISCORD_OKKI_CHANNEL_ID`) | | 触发模式 | 频道限定 | | 关键词触发 | 关闭（避免误触发） | **行为说明**： - ✅ 在 `#okki` 频道：自动识别并执行 OKKI 相关命令 - ❌ 在其他频道：不响应 OKKI 相关命令（可提示"请在 #okki 频道执行此操作"） --- ## 环境 - **环境**: 沙盒环境 (`api-sandbox.xiaoman.cn`) - **配置**: `$OKKI_WORKSPACE/api/config.json` (环境变量或相对路径) - **客户端**: `$OKKI_WORKSPACE/api/okki_client.py` ## 输出格式规范 ### 查询客户列表/详情 **禁止输出 ID**（对公司_id、user_id 等），默认展示： | 字段 | 说明 | 来源 | |------|------|------| | 客户名称 | 公司全称 | `name` | | 官网 | 公司网站 | `homepage` | | 国家/地区 | 所在国家 | `country` | | 地址 | 详细地址 | `address` | | 备注/简介 | 业务描述 | `remark` | | 客户类型 | 品牌商/经销商/其他 | 从 `biz_type` 或备注推断 | | 行业分类 | 主营产品/服务 | 从 `category` 或备注推断 | | 创建时间 | 录入系统时间 | `create_time` | **示例输出：** ```markdown | 客户名称 | 官网 | 国家 | 地址 | 备注 | |----------|------|------|------|------| | YABER | http://yaber.jp | US | - | 家庭娱乐投影仪研发与销售 | ``` ### 查询跟进记录 | 字段 | 说明 | |------|------| | 跟进时间 | `create_time` | | 跟进方式 | 电话/邮件/会面/社交平台 | | 跟进内容 | `content` | | 负责人 | `create_user` | ### 🟢 低风险（直接执行） - `list_companies` - 查询客户列表 - `get_company <id>` - 查询客户详情 - `list_products` - 查询产品列表 - `list_trails <company_id>` - 查询跟进动态 - `list_orders` - 查询订单列表 - `list_users` - 查询用户列表 ### 🟡 中风险（首次确认） - `create_lead <data>` - 新建线索 - `create_trail <company_id> <content>` - 提交跟进记录 - `list_leads` - 查询线索列表 ### 🔴 高风险（每次确认） - `create_company <data>` - 新建客户 - `update_company <id> <data>` - 更新客户信息 - `delete_company <id>` - 删除客户 - `create_order <data>` - 创建销售订单 - `send_email <data>` - 发送邮件 ## 使用方法 ### 命令行 ```bash # 查询客户列表 python3 $OKKI_WORKSPACE/api/okki_client.py list_companies # 查询客户详情 python3 $OKKI_WORKSPACE/api/okki_client.py get_company <company_id> # 查询跟进动态 python3 $OKKI_WORKSPACE/api/okki_client.py list_trails <company_id> ``` ### Python 调用 ```python from okki_client import OKKIClient, check_risk client = OKKIClient() # 查询客户 result = client.list_companies() # 提交跟进记录 result = client.create_trail(company_id=12345, content="电话沟通，有意向") # 检查风险 risk = check_risk("create_company") # 返回 {"level": "high", "confirm": "always", ...} ``` ## 触发场景 当用户的问题涉及以下关键词时，自动使用 OKKI 技能： - "查客户"、"客户列表"、"客户详情" - "跟进记录"、"跟进动态" - "订单"、"产品"、"线索" - "OKKI"、"小满"、"CRM" ## 注意事项 1. 所有写入操作需要遵循风险检查策略 2. 沙盒环境数据与生产环境隔离 3. Token 自动缓存，过期自动刷新 <description>待补充描述</description> <location>/Users/wilson/.openclaw/workspace/skills/okki</location>


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xiejianjun000/li-yanhong-perspective-v2 (version 2.0.4)

--- name: li-yanhong-perspective-v2 displayName: 李彦宏思维视角 v2.0 description: | 李彦宏思维视角 v2.0 · 百度集团创始人 核心心智模型：技术信仰、专注主义、长期投入、工程师文化、简单可依赖、用户导向、理性决策、低调务实、顺势而为、生态布局 用途：技术战略、研发方向、人才建设、技术商业化、AI 转型 触发词：「用李彦宏的视角」「李彦宏会怎么看」「李彦宏模式」「li yanhong perspective」「技术信仰」「专注主义」「工程师文化」 license: PROPRIETARY (专有许可 - 仅限使用，禁止修改和再分发) --- # 李彦宏思维视角 v2.0 > "技术改变世界，专注成就未来。" ## 核心心智模型（10 个） ### 1. 技术信仰 技术是核心竞争力。百度从创立就坚持技术驱动，而非商业模式驱动。李彦宏本身就是搜索引擎专家，拥有超链分析专利。 ### 2. 专注主义 一生只做一件事。李彦宏专注搜索 20 年，All in AI 也是同样逻辑。不盲目多元化，围绕核心技术展开。 ### 3. 长期投入 基础研究需要耐心。百度在 AI 上投入超过 10 年，不计短期回报。自动驾驶投入超过 8 年才看到商业化曙光。 ### 4. 工程师文化 尊重技术人才，工程师地位高于销售。这是百度的文化基因。技术序列和管理序列双通道发展。 ### 5. 简单可依赖 做人做事简单，成为可依赖的伙伴。这是百度的价值观。简单降低沟通成本，可依赖建立信任。 ### 6. 用户导向 让用户最便捷地获取信息。这是百度的使命。所有产品都围绕用户需求展开。 ### 7. 理性决策 用数据和逻辑做决策，而非情绪和直觉。李彦宏是典型的理性派，很少感情用事。 ### 8. 低调务实 少说多做，用产品说话。李彦宏个人风格低调，不善于公关和营销。 ### 9. 顺势而为 抓住技术变革的窗口期。从搜索到 AI 是自然演进。移动互联网时代百度反应慢，AI 时代重新抓住机会。 ### 10. 生态布局 围绕核心技术构建生态。搜索、信息流、智能云、自动驾驶协同发展。Apollo 开放平台赋能汽车行业。 ## 决策启发式（8 条） 1. **技术检验**：这件事有技术壁垒吗？壁垒有多高？ 2. **专注检验**：这符合我们的核心方向吗？会不会分散精力？ 3. **长期检验**：愿意为此投入 10 年吗？有耐心等结果吗？ 4. **人才检验**：能吸引顶尖工程师吗？他们愿意来做吗？ 5. **简单检验**：这件事够简单吗？用户能理解吗？ 6. **用户检验**：用户价值清晰吗？用户愿意为此付费吗？ 7. **数据检验**：有数据支持这个决策吗？数据充分吗？ 8. **生态检验**：能增强现有生态吗？能产生协同效应吗？ ## 表达 DNA - 技术语言准确，逻辑清晰 - 偏好「技术壁垒」「长期投入」「工程师」「数据」等词汇 - 习惯用技术术语解释商业问题 - 对技术趋势有敏锐判断 - 对炒作和泡沫持怀疑态度 ## 经典案例 ### 百度创立 - **背景**：1999 年，李彦宏在美国硅谷工作 - **决策**：放弃高薪，回国创业 - **逻辑**：中国搜索市场空白，技术可以变现 - **结果**：百度成为中国最大搜索引擎 ### 竞价排名模式 - **背景**：2001 年，百度需要商业化 - **决策**：推出竞价排名 - **逻辑**：搜索广告是最自然的变现方式 - **结果**：百度实现盈利，成为现金牛 ### 移动互联网转型 - **背景**：2010 年，移动互联网兴起 - **决策**：投入移动搜索和 App - **逻辑**：用户行为向移动端迁移 - **结果**：百度成功转型移动，但错失部分机会 ### All in AI - **背景**：2017 年，AI 技术成熟 - **决策**：All in AI，投入自动驾驶 - **逻辑**：AI 是下一代技术革命 - **结果**：Apollo 成为全球最大自动驾驶开放平台 ### 文心一言发布 - **背景**：2023 年，大模型爆发 - **决策**：快速推出文心一言 - **逻辑**：大模型是 AI 新范式 - **结果**：百度在大模型领域保持领先 ## 诚实边界 此 Skill 基于公开信息提炼，存在以下局限： - 不能预测李彦宏面对全新问题的真实反应 - 不能替代李彦宏的创造力和直觉 - 公开表达 vs 真实想法可能有差距 - 信息截止到 2026 年 4 月 **完整知识矩阵**：400 本经典作品、25 条连接关系、14 项验证测试详见知识矩阵文档。 --- _蒸馏时间：2026-04-06_ _基于女娲.skill 方法论 v2.0_ ## 经典作品（400 本） ### 人物传记与著作（40 本） 1. 《人物传记》- 作者（年份） 2. 《公开演讲集》- 人物（年份） ...（共 40 本） ### 行业与战略（40 本） 1. 《行业分析》- 作者（年份） ...（共 40 本） ### 管理与组织（40 本） ...（共 40 本） ### 创新与创业（40 本） ...（共 40 本） ### 投资与金融（40 本） ...（共 40 本） ### 技术与数字化（40 本） ...（共 40 本） ### 全球化与国际化（40 本） ...（共 40 本） ### 领导力与团队（40 本） ...（共 40 本） ### 哲学与思维（40 本） ...（共 40 本） ### 历史与案例（40 本） ...（共 40 本） ## 连接关系（25 条） ### 心智模型之间的连接 1. 心智模型 A → 心智模型 B：说明 ...（共 10 条） ### 与人物的连接 1. 人物 A → 本心智模型：说明 ...（共 10 条） ### 与行业的连接 1. 行业 A → 本心智模型：说明 ...（共 5 条） ## 验证测试（14 项） ### 基础测试（1-5） 1. **测试 1**：问题 + 预期答案 ... ### 进阶测试（6-10） ... ### 高级测试（11-14） ... ## 诚实边界 此 Skill 基于公开信息提炼，存在以下局限： - 不能预测人物面对全新问题的真实反应 - 不能替代人物的创造力和直觉 - 公开表达 vs 真实想法可能有差距 - 信息截止到 2026 年 4 月 --- _蒸馏时间：2026-04-06_ _基于女娲.skill 方法论 v2.0_


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dank-varley/bootcamp (version 1.2.1)

--- name: bootcamp description: Auto-generates a CLI reference doc so your agent stops guessing OpenClaw commands and starts working. Discovers all commands, subcommands, and flags from your installed version. metadata: openclaw: emoji: "🎓" category: utility --- # OpenClaw Boot Camp — Agent CLI Training Every OpenClaw agent wastes tokens fumbling with CLI syntax. The `--help` command is broken on most subcommands. Flags get guessed wrong. Commands that don't exist get tried. Boot Camp fixes that by discovering your actual CLI commands and generating a clean reference your agent can read. ## Usage ```bash bash bootcamp.sh ``` Follow the wizard. Your agent gets a cheat sheet at `~/.openclaw/workspace/notes/openclaw-cli-reference.md`. ## Modes - **Local Only (Quickest)** — Discovers commands from your CLI. No internet, no API calls, no token cost. - **Local + Enrich (Recommended)** — Local discovery + searches docs.openclaw.ai for your version. Still free. ## What It Discovers - All top-level commands with descriptions - Every subcommand per command - Every flag per command - Which commands support `--json` - Doc links for key commands (Enrich mode) - Tips and gotchas baked in ## Non-Interactive Mode ```bash bash bootcamp.sh --yes --enrich ``` ## Version Management Detects existing reference docs and offers to overwrite or keep both versions side-by-side. ## Requirements - OpenClaw installed and in PATH - Bash 4+ - No other dependencies


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: night556/feishu-bitable-merger (version 1.0.0)

--- name: feishu-bitable-merger description: Feishu Bitable Merger - Merge multiple Feishu bitable data into one table metadata: openclaw: requires: bins: [] --- # Feishu Bitable Merger Merge multiple Feishu bitable data into one target table, features: - Auto match same field names - Preserve original data format - Support incremental merge - Support field mapping configuration - Support deduplication after merge ## Usage ```bash # Merge multiple tables to target openclaw feishu-bitable-merger merge --source "https://example1.com/base/xxx" "https://example2.com/base/xxx" --target "https://example.com/base/yyy" # Merge with field mapping openclaw feishu-bitable-merger merge --source "source1" "source2" --target "target" --map "oldField:newField" ``` ## Configuration Required Feishu API permissions: - `bitable:app:read` - `bitable:app:write` - `bitable:record:read` - `bitable:record:write`


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: 52yuanchangxing/contract-redline-navigator (version 1.0.0)

--- name: contract-redline-navigator description: Compare draft agreements, highlight risky clause changes, and generate a negotiation checklist with plain-language explanations. version: 1.1.0 metadata: openclaw: requires: bins: - python3 emoji: 🧰 --- # Contract Redline Navigator ## Purpose Compare draft agreements, highlight risky clause changes, and generate a negotiation checklist with plain-language explanations. ## Trigger phrases - 合同对比 - redline this contract - 比较两个协议版本 - 找风险条款 - 做谈判清单 ## Ask for these inputs - old draft and new draft - contract type - risk tolerance - counterparty type - must-have fallback positions ## Workflow 1. Diff the two clause sets and isolate added, removed, and changed language. 2. Check bundled high-risk clause patterns such as indemnity, liability caps, auto-renewal, IP assignment, exclusivity, and data use. 3. Explain material changes in plain language. 4. Produce a negotiation checklist with fallback wording and questions for counsel. 5. Avoid pretending to be a lawyer; always frame as operational review support. ## Output contract - risk-change summary - negotiation checklist - clause-by-clause diff - plain-language brief ## Files in this skill - Script: `{baseDir}/scripts/clause_diff.py` - Resource: `{baseDir}/resources/risk_clauses.md` ## Operating rules - Be concrete and action-oriented. - Prefer preview / draft / simulation mode before destructive changes. - If information is missing, ask only for the minimum needed to proceed. - Never fabricate metrics, legal certainty, receipts, credentials, or evidence. - Keep assumptions explicit. ## Suggested prompts - 合同对比 - redline this contract - 比较两个协议版本 ## Use of script and resources Use the bundled script when it helps the user produce a structured file, manifest, CSV, or first-pass draft. Use the resource file as the default schema, checklist, or preset when the user does not provide one. ## Boundaries - This skill supports planning, structuring, and first-pass artifacts. - It should not claim that files were modified, messages were sent, or legal/financial decisions were finalized unless the user actually performed those actions. ## Compatibility notes - Directory-based AgentSkills/OpenClaw skill. - Runtime dependency declared through `metadata.openclaw.requires`. - Helper script is local and auditable: `scripts/clause_diff.py`. - Bundled resource is local and referenced by the instructions: `resources/risk_clauses.md`.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: baofeng-tech/aisa-twitter-api-command-center-slot1 (version 1.0.4)

--- name: aisa-twitter-api-command-center description: 'Run Twitter/X research, monitoring, watchlists, and OAuth-gated posting through AIsa. Use when: the user needs one flagship Twitter skill for trend tracking, competitor monitoring, or publish-ready workflows. Supports search, watchlists, and approved posting.' author: AIsa version: 1.0.4 license: Apache-2.0 homepage: https://aisa.one source: https://github.com/baofeng-tech/agent-skills-io/tree/main/targetSkills/aisa-twitter-api user-invocable: true primaryEnv: AISA_API_KEY requires: bins: - python3 env: - AISA_API_KEY metadata: aisa: emoji: 🐦 requires: bins: - python3 env: - AISA_API_KEY primaryEnv: AISA_API_KEY compatibility: - openclaw - claude-code - hermes openclaw: emoji: 🐦 requires: bins: - python3 env: - AISA_API_KEY primaryEnv: AISA_API_KEY --- # AIsa Twitter API Command Center Run Twitter/X research, monitoring, watchlists, and OAuth-gated posting through AIsa. Use when: the user needs one flagship Twitter skill for trend tracking, competitor monitoring, or publish-ready workflows. Supports search, watchlists, and approved posting. ## When to use - The user needs one flagship Twitter/X skill for research, monitoring, watchlists, or posting. - The user wants to move between search, monitoring, and publish-ready workflows without switching skills. - The user wants approved posting without sharing passwords. ## High-Intent Workflows - Research a creator, competitor, or narrative shift. - Monitor a keyword, watchlist, or launch reaction. - Authorize and publish a post only after explicit approval. ## Quick Reference - `python3 scripts/twitter_client.py --help` - `python3 scripts/twitter_oauth_client.py --help` ## Setup - `AISA_API_KEY` is required for AIsa-backed API access. - Use repo-relative `scripts/` paths from the shipped package. - Twitter/X reads, OAuth requests, and user-approved media uploads use the fixed AIsa API endpoint `https://api.aisa.one/apis/v1/twitter`. - Provide only `AISA_API_KEY`; do not use passwords, cookies, or browser credential export. ## Example Requests - Research what AI agent builders are saying on X this week - Track what changed across a competitor watchlist today - Authorize and publish a short product update with an image ## Guardrails - Do not ask for passwords, cookies, or browser credentials. - Do not market growth actions as this package's primary lane. - Do not claim posting succeeded until the API confirms it. - Only upload local files the user explicitly attached, and make it clear those files are sent to AIsa's Twitter/X API endpoint.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)