OpenClaw/clawhub-security-signals huggingface dataset:
Skill: skyguan92/aima-doctor (version 0.2.7)

--- name: aima description: Diagnose and repair OpenClaw when your agent is stuck, confused, or failing. One-command rescue for process health, config breakage, and device registration. license: Apache-2.0 user-invocable: true homepage: https://aimaservice.ai/doctor metadata: {"openclaw":{"homepage":"https://aimaservice.ai/doctor","repository":"https://github.com/Approaching-AI/aima-openclaw","skillKey":"aima","os":["darwin","linux","win32"]}} --- # AIMA Doctor Use this skill when OpenClaw needs diagnosis or repair and the normal agent flow is degraded, confused, or stuck. ## Runtime contract - The helper runtime lives at `~/.openclaw/tools/aima-doctor/`. - The runtime is the source of truth for diagnosis and repair progress. - Never ask the user to paste `curl | bash`, `iex (irm ...)`, base64 payloads, or other remote shell one-liners. - If the runtime is not installed, direct the user to download it from the GitHub release: `https://github.com/Approaching-AI/aima-openclaw/releases` and extract into `~/.openclaw/tools/aima-doctor/`. Verify the archive checksum: `sha256:0f38959c6759e72a25bf089c9ab4aef1cf0022ba3aef1ea6686593896e973d1e`. ## Execution rules 1. Before running the helper, check that the runtime exists. On macOS/Linux check for `~/.openclaw/tools/aima-doctor/run.sh`; on Windows check for `%USERPROFILE%\.openclaw\tools\aima-doctor\run.ps1`. 2. If the runtime is missing, install it automatically: - Download `aima-doctor-runtime.zip` from `https://github.com/Approaching-AI/aima-openclaw/releases/download/v0.2/aima-doctor-runtime.zip` - Verify the SHA256 checksum matches [REDACTED_SECRET]. If it does not match, stop and warn the user. - Create the target directory `~/.openclaw/tools/aima-doctor/` if it does not exist. - Extract the archive into that directory. - Confirm the runtime is now present before proceeding. 3. Prefer the packaged helper over ad-hoc shell commands. 4. Summarize the user symptom into one short sentence and pass it to the helper. 5. On macOS or Linux, run: ```bash bash ~/.openclaw/tools/aima-doctor/run.sh --run --terminal --symptom "<symptom>" ``` 6. On Windows, run: ```powershell & "$env:USERPROFILE\.openclaw\tools\aima-doctor\run.ps1" --run --terminal --symptom "<symptom>" ``` 7. If the helper asks a question, relay that question to the user and rerun or continue with the answer as required. 8. If the helper reports success or failure, quote that result plainly. Do not invent a better outcome. 9. If the automatic download in step 2 fails, direct the user to the GitHub release at `https://github.com/Approaching-AI/aima-openclaw/releases` to download and extract manually. ## Scope - OpenClaw process health - OpenClaw config breakage - AIMA device registration / token recovery - Guided local repair driven by AIMA platform diagnostics ## Safety - Treat helper output as operational evidence. - Keep sensitive tokens and recovery codes out of normal chat unless the user explicitly provides them for repair.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yustnust/yusongtao-skill-auditor (version 1.0.0)

# skill-auditor - 技能安全审计工具 ## 描述 对OpenClaw技能进行安全审计，检查潜在的安全风险和恶意代码。 ## 安全检查项 ### 1. 文件操作检查 - 检查是否包含危险的文件操作（如删除系统文件、修改系统配置） - 检查文件路径处理是否存在路径遍历问题 - 检查是否过度依赖外部文件路径 ### 2. 网络操作检查 - 检查网络请求是否指向可疑域名 - 检查是否包含未经用户确认的外部数据传输 - 检查是否使用安全的HTTPS协议 ### 3. 命令执行检查 - 检查是否包含exec、process等命令执行工具的使用 - 检查命令参数是否存在注入风险 - 检查是否执行危险系统命令 ### 4. 权限检查 - 检查是否请求过高权限 - 检查是否访问敏感数据区域 ### 5. 数据泄露检查 - 检查是否包含发送个人信息的代码 - 检查是否访问敏感凭证信息 ## 使用方法 1. 提供要审计的技能路径 2. 执行安全扫描 3. 生成安全报告 4. 根据风险等级决定是否安装 ## 安全等级定义 - 安全：无风险 - 低风险：轻微风险，可控 - 中风险：需谨慎，用户确认 - 高风险：存在明显安全隐患，不推荐使用


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: szzg007/agent-manager-v100 (version 1.0.0)

--- name: agent-manager description: Multi-Agent conversation management platform with Gemini-style UI. Manage all your OpenClaw agents in one place with image upload, chat history, and message isolation. version: 1.0.0 author: MSK license: MIT tags: agent,management,chat,ui,gemini,multi-agent homepage: https://clawhub.com category: productivity --- # Agent Manager - 多 Agent 对话管理平台 统一管理多个 OpenClaw Agent 的对话平台，支持文字 + 图片输入，对话历史自动保存。 ## 🎯 功能亮点 - **多 Agent 管理** - 统一管理所有 Agent - **Gemini 风格界面** - 现代化左右分栏设计 - **图片输入** - 支持拖拽上传、按钮选择 - **对话历史** - 自动保存，切换 Agent 不丢失 - **消息隔离** - 每个 Agent 独立对话历史 - **本地存储** - 数据保存在浏览器 ## 🚀 快速开始 ### 1. 安装依赖 ```bash cd agent-manager npm install ``` ## 配置 编辑 `config.json`: ```json { "openclawToken": "你的 Operator Token" } ### 2. 启动服务 ```bash node server-gemini.js ``` ** 修复 Shell 执行:** 在 `server-gemini.js` 中，使用参数化命令: ```javascript // 修复前 ❌ execCmd(`openclaw agent --agent ${agentId} --message "${message}"`) // 修复后 ✅ const { exec } = require('child_process'); exec(`openclaw agent --agent ${agentId}`, (error, stdout, stderr) => { // 处理结果 }); ### 3. 访问界面 ``` http://localhost:3000 ``` ## 📋 使用说明 获取 GET Token: cat ~/.openclaw/devices/paired.json | jq '.[].tokens.operator.token' ### 与 Agent 对话 1. 左侧选择 Agent 2. 右侧输入消息 3. 按 Enter 或点击发送 ### 上传图片 1. 点击 📎 按钮 2. 或拖拽图片到输入框 3. 点击发送 ## 🔒 安全说明 本技能需要访问: - `~/.openclaw/agents` - Agent 配置 - `~/.openclaw/workspace-*` - Agent 工作区 请在使用前审查代码。 ## 💰 付费说明 **价格:** $10 USD（一次性购买） **支付:** PayPal ([REDACTED_SECRET]) **包含:** - ✅ 完整源代码 - ✅ 永久使用授权 - ✅ 基础技术支持 ## 📄 许可 - ✅ 个人使用 - ✅ 商业使用 - ❌ 转售技能本身 --- **详细文档请查看 CLAWHUB.md**


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: mededdahby/audit-system (version 1.0.0)

--- name: audit-system description: "Perform structured audits on code, workflows, prompts, and products. Use when: (1) Something is not working as expected, (2) User asks for review or feedback, (3) A system behaves inconsistently, (4) Before deploying or shipping, (5) When optimizing performance or UX, (6) When debugging recurring issues." --- # Audit System Skill Perform structured audits and generate actionable reports with clear severity, evidence, and fixes. This is an instruction-only skill. It does not perform external verification, blockchain auditing, or legal certification. --- ## Quick Reference | Situation | Action | |----------|--------| | Code not working | Run Code Audit | | Workflow failing | Run Workflow Audit | | UX feels bad | Run Product Audit | | Prompt/AI unstable | Run Prompt Audit | | Before deploy | Run Full Audit | | Repeated bugs | Focus on root-cause analysis | --- ## Audit Types ### 1. Code Audit Check: - logic errors - missing validation - security risks - bad patterns - performance issues --- ### 2. Workflow Audit Check: - broken steps - missing retries - failure points - unnecessary complexity - automation gaps --- ### 3. Product Audit Check: - onboarding friction - unclear UX - conversion blockers - trust issues - missing features --- ### 4. Prompt / Agent Audit Check: - unclear instructions - conflicting rules - missing constraints - unstable outputs - over-autonomy risks --- ## Audit Process ### Step 1 — Define Scope Identify: - what is being audited - expected behavior - actual behavior - available data --- ### Step 2 — Inspect Analyze inputs: - code - prompts - configs - logs - workflows Look for: - inconsistencies - missing logic - unclear flow - hidden risks --- ### Step 3 — Detect Issues For each issue: - describe clearly - link to evidence - explain impact --- ### Step 4 — Classify Severity - **Critical** → breaks system / risk of loss - **High** → likely failure - **Medium** → important weakness - **Low** → improvement --- ### Step 5 — Recommend Fixes For each issue: - what to fix - why it matters - exact fix - quick workaround --- ### Step 6 — Prioritize Always output: - top 3 issues - quick wins - long-term fixes --- ## Output Format # Audit Report ## Scope - Target: - Type: - Evidence: - Limitations: ## Findings ### [Severity] Title - Area: - Problem: - Evidence: - Impact: - Fix: ## Priority Actions 1. ... 2. ... 3. ... ## Quick Wins - ... - ... ## Long-Term Improvements - ... ## Open Questions - ... --- ## Behavior Rules - Be precise, not vague - Do not invent missing data - Do not exaggerate severity - Do not claim certification - Focus on actionable fixes --- ## When NOT to use this skill Do NOT use for: - legal certification - financial compliance guarantees - blockchain verification - cryptographic proof generation Only analyze what is provided. --- ## Upgrade Path (Advanced) If repeated issues appear: - suggest system redesign - suggest automation improvements - suggest monitoring/logging additions


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kunyashaw/project-intro-generator (version 0.1.3)

--- name: "project-intro-generator" version: "0.1.2" displayName: "项目介绍页生成器" description: "一键生成项目介绍页，支持本地编辑和长图导出。" entryPoint: type: javascript path: "bin/cli.js" triggers: keywords: ["生成介绍页", "项目介绍", "介绍html", "生成长图", "项目截图", "project intro", "readme"] --- # project-intro-generator 一键生成项目介绍页，支持本地目录扫描、可编辑 HTML 和长图导出。 **GitHub**: [https://github.com/kunyashaw/createRepoIntro](https://github.com/kunyashaw/createRepoIntro) **演示视频**: [https://www.youtube.com/watch?v=6ZRcgbdZSXw](https://www.youtube.com/watch?v=6ZRcgbdZSXw) > 💡 通过 ClawHub 安装此 Skill：`project-intro-generator` ## 使用 ### 聊天中使用 在聊天中直接发送项目绝对路径即可自动生成： ``` 生成介绍页：/Users/kunyashaw/code/java/myproject ``` 生成后会自动返回： - HTML 文件路径 - PNG 长图路径 生成的 HTML 页面默认可编辑，点击「保存修改并导出图片」可下载编辑后的 HTML 并获取导出长图的 CLI 命令。 ### 命令行使用 ```bash # 本地目录生成 node bin/cli.js --project <path> --theme ocean # 从已有 HTML 导出长图 node bin/cli.js --html <html路径> --image-out <png路径> ``` ### 参数说明 - `--project`：项目绝对路径（聊天中使用时直接发送路径即可） - `--theme`：主题（ocean / forest / aurora / sunset / midnight / mono） - `--html`：已有 HTML 文件路径，直接导出长图 - `--image-out`：长图输出路径 ## 功能 - **README 优先**：存在有效 README 时直接渲染。 - **默认可编辑**：生成的 HTML 可直接编辑内容。 - **依赖解析**：支持 npm/pip/go.mod/Cargo.toml/composer.json/pom.xml/build.gradle。 - **主题切换**：aurora / sunset / midnight / ocean / forest / mono。 - **长图导出**：基于 playwright 截图。 - **CLI 导出**：支持 --html 参数直接导出已有 HTML 的长图。 ## 生成规则 1. **扫描项目目录**：遍历代码文件，统计语言分布、目录结构、关键文件。 2. **依赖解析**：识别项目使用的包管理器，解析 dependencies。 3. **生成内容**： - 标题区域：项目名称 - 项目概览：文件数，主要语言、目录结构 - 项目介绍：优先显示 README 内容，无 README 时显示编辑提示 - 依赖区块：显示项目依赖及用途说明 4. **页面特性**： - 默认可编辑（contenteditable） - 主题切换 - 保存修改时自动生成带时间戳的 HTML 文件名 - 导出长图时提供 CLI 命令 ## 输出 - HTML 文件：可编辑的项目介绍页 - PNG 长图：基于 HTML 渲染的整页截图


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: demo112/speech-recognition (version 1.0.1)

--- name: speech-recognition description: "通用语音识别 Skill。支持多种音频格式（ogg/mp3/wav/m4a），使用硅基流动 SenseVoice API 进行语音转文字。当用户发送语音消息、音频文件，或需要转录音频时触发。" version: "1.0.0" --- # 通用语音识别 使用硅基流动 SenseVoice API 进行语音识别，支持多种音频格式。 --- ## 激活条件 | 触发场景 | 说明 | |----------|------| | 用户发送语音消息 | `.ogg` / `.mp3` / `.wav` / `.m4a` 文件 | | 用户要求转录音频 | "转录这个音频"、"语音转文字" | | 音频文件处理 | 需要提取音频中的文字内容 | --- ## 配置 ### API Key 在 `~/.openclaw/openclaw.json` 中配置： ```json { "providers": { "siliconflow": { "apiKey": "sk-xxx" } } } ``` ### API 端点 ``` POST https://api.siliconflow.cn/v1/audio/transcriptions ``` ### 支持的模型 | 模型 | 说明 | |------|------| | `FunAudioLLM/SenseVoiceSmall` | 默认，中文效果好 | --- ## 使用方法 ### 方法一：直接调用 API ```python import requests [REDACTED_SECRET]" with open("/path/to/audio.mp3", "rb") as f: audio_data = f.read() response = requests.post( "https://api.siliconflow.cn/v1/audio/transcriptions", headers={"Authorization": f"Bearer {api_key}"}, files={"file": ("audio.mp3", audio_data, "audio/mpeg")}, data={"model": "FunAudioLLM/SenseVoiceSmall"}, timeout=60 ) print(response.json().get("text", "")) ``` ### 方法二：处理用户语音消息 当用户发送 `.ogg` 语音消息时： ```bash # 1. 转换格式（如果是 ogg） ffmpeg -i /path/to/audio.ogg -ar 16000 -ac 1 /tmp/audio.mp3 -y # 2. 调用硅基流动 API（API Key 从环境变量读取） python3 -c " import requests import os [REDACTED_SECRET]'SILICONFLOW_API_KEY') if not api_key: raise ValueError('请设置 SILICONFLOW_API_KEY 环境变量') with open('/tmp/audio.mp3', 'rb') as f: audio_data = f.read() response = requests.post( 'https://api.siliconflow.cn/v1/audio/transcriptions', headers={'Authorization': f'Bearer {api_key}'}, files={'file': ('audio.mp3', audio_data, 'audio/mpeg')}, data={'model': 'FunAudioLLM/SenseVoiceSmall'}, timeout=60 ) print(response.json().get('text', '')) " ``` --- ## 支持的音频格式 | 格式 | 扩展名 | 说明 | |------|--------|------| | MP3 | `.mp3` | 推荐，兼容性好 | | OGG | `.ogg` | Telegram/Signal 语音格式，需转换 | | WAV | `.wav` | 无压缩，文件大 | | M4A | `.m4a` | iOS 录音格式 | | FLAC | `.flac` | 无损压缩 | --- ## 格式转换 如果音频不是 MP3 格式，用 FFmpeg 转换： ```bash # OGG → MP3 ffmpeg -i input.ogg -ar 16000 -ac 1 output.mp3 -y # WAV → MP3 ffmpeg -i input.wav -ar 16000 -ac 1 output.mp3 -y # M4A → MP3 ffmpeg -i input.m4a -ar 16000 -ac 1 output.mp3 -y ``` 参数说明： - `-ar 16000`: 采样率 16kHz（语音识别推荐） - `-ac 1`: 单声道（减少文件大小） - `-y`: 覆盖已存在的文件 --- ## 错误处理 | 错误 | 原因 | 解决 | |------|------|------| | `401 Unauthorized` | API Key 无效 | 检查配置 | | `413 Payload Too Large` | 文件太大 | 压缩或分割音频 | | `timeout` | 网络超时 | 重试或检查网络 | | `Invalid audio format` | 格式不支持 | 用 FFmpeg 转换 | --- ## 注意事项 1. **文件大小限制**：建议 < 10MB 2. **时长限制**：建议 < 5 分钟 3. **语言支持**：中文效果最好，英文也支持 4. **隐私**：音频会上传到硅基流动服务器 --- ## 相关 Skills | Skill | 说明 | |-------|------| | `douyin-video` | 抖音视频语音提取 | | `cosyvoice-tts` | 文字转语音 | --- *版本：1.0.0* *创建于：2026-02-26*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: wangjiaocheng/c2c-platform-skill-system (version 1.0.0)

--- name: c2c-platform-skill-system author: 王教成 Wang Jiaocheng (波动几何) description: C2C本地生活服务平台十大功能集群技能体系。基于"任务为中心，AI Pipeline驱动"思想，覆盖市场情报、内容运营、用户增长、交易数据、知识管理、合规风控、供需运营、平台协同、资质准入、技术保障十大业务流。触发词：C2C、本地生活、服务平台、撮合平台、交易平台、裂变、虚拟币、钱包、信用分、履约、条目、意图、易点、抽佣、分润、完成码、充值、提现、仲裁、供需匹配、平台运营、marketplace、platform、C2C platform、local service。 --- # C2C本地生活服务平台十大功能集群技能体系 C2C平台运营全链路AI能力体系——从市场洞察到交易闭环，从用户裂变到合规风控，从供需匹配到技术保障，覆盖平台运营每个环节。 ## 核心理念 **行业精准，原子组合。** 每个能力单元是一个原子任务——独立可执行、自由可组合。AI接收输入、执行任务，输出可被任何其他单元消费。十大集群覆盖C2C平台核心业务域，单元间通过依赖图和组合接口实现跨集群协作。 ## 能力单元Schema | 字段 | 说明 | |------|------| | 输入 | 启动所需的数据/上下文，标注必填/选填 | | 输出 | 产出的格式和粒度 | | 依赖 | 前置单元ID；无依赖=入口单元 | | AI自治度 | ⬛全自动 / 🟨半自动(需人确认) / ⬜辅助(人主导) | | 组合接口 | 可消费本单元输出的下游单元(→单元ID列表) | ## 执行规则 1. **必读加载**：首次使用本技能时，必须用Read工具读取 `references/index-and-pipelines.md`，获取完整单元索引和Pipeline编排 2. **行业校准先行**：首次使用时读取 `references/industry-calibration.md`，将平台特征注入执行上下文 3. **按需加载**：根据集群路由定位后，Read对应集群参考文件 4. **依赖检查**：执行前确认依赖单元输出已就绪 5. **自由组合**：无依赖冲突的单元可并行执行；有依赖的按序执行 6. **跨集群流动**：一个单元的输出可作为另一集群单元的输入 7. **Pipeline复用**：预置Pipeline为参考模板，可根据实际场景增删替换单元 ## 集群路由 | 关键词 | 集群 | 参考文件 | |--------|------|----------| | 竞品、监测、政策、舆情、情报、趋势、行业分析 | C1 市场情报与监测 | C1-intelligence.md | | 内容、条目、分类、标签、推荐、搜索、SEO | C2 内容运营与适配 | C2-content.md | | 裂变、拉新、促活、补贴、活动、增长、召回、地推 | C3 用户增长与活动运营 | C3-growth.md | | GMV、订单、用户画像、留存、转化、漏斗、风控数据、财务 | C4 交易数据分析 | C4-analytics.md | | SOP、培训、知识库、FAQ、标准、指南、手册 | C5 平台知识管理 | C5-knowledge.md | | 合规、审核、风控、仲裁、投诉、资质、反欺诈、数据安全 | C6 合规风控与安全 | C6-compliance.md | | 服务商、买家、信用、评价、分级、履约、供需、匹配 | C7 供需运营与信用 | C7-supply-demand.md | | 协同、产品迭代、运维、供应商、成本、绩效、流程 | C8 平台运营协同 | C8-operations.md | | ICP、EDI、备案、许可、证照、准入、牌照 | C9 资质证照与准入 | C9-qualification.md | | 架构、支付、IM、搜索、安全、灾备、性能、技术 | C10 技术架构与保障 | C10-infrastructure.md | ## 单元索引概览 | 集群 | 单元数 | |------|--------| | C1 市场情报与监测 | 25 | | C2 内容运营与适配 | 18 | | C3 用户增长与活动运营 | 28 | | C4 交易数据分析 | 58 | | C5 平台知识管理 | 30 | | C6 合规风控与安全 | 33 | | C7 供需运营与信用 | 26 | | C8 平台运营协同 | 48 | | C9 资质证照与准入 | 20 | | C10 技术架构与保障 | 24 | | **合计** | **310** | ## 行业校准 本技能专为C2C本地生活服务平台设计，校准维度详见 `references/industry-calibration.md`。 适用平台特征： - 双边市场：个人服务商 + 个人消费者 - 虚拟币体系：充值→消费→提现闭环 - 裂变增长：多级推荐分润驱动获客 - 信用体系：评价+完成率+履约质量量化信任 - 履约差异化：实物物流 / 线下服务完成码 / 线上确认 - 平台抽佣：交易佣金+分润池机制 ## Pipeline模板 预置10组跨集群Pipeline，详见 `references/index-and-pipelines.md`： | Pipeline组 | 数量 | |-----------|------| | 一、平台从0到1搭建 | 7 | | 二、用户增长与裂变 | 7 | | 三、交易闭环与履约 | 7 | | 四、内容与供需匹配 | 6 | | 五、合规风控与安全 | 6 | | 六、数据驱动运营 | 6 | | 七、信用体系与生态治理 | 5 | | 八、平台商业化 | 6 | | 九、技术保障与架构演进 | 5 | | 十、战略规划与生态扩展 | 7 | | **合计** | **62** |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: teoslayer/pilot-database-bridge (version 1.0.0)

--- name: pilot-database-bridge description: > Query remote databases through Pilot Protocol tunnels. Use this skill when: 1. You need to access databases behind NATs or firewalls 2. You want to query remote databases without direct network access 3. You're building agents that need secure database connectivity Do NOT use this skill when: - Database is already publicly accessible - You have direct VPN or network access - The daemon is not running tags: - pilot-protocol - integration - database - bridge - sql license: AGPL-3.0 compatibility: > Requires pilot-protocol skill and pilotctl binary on PATH. The daemon must be running (pilotctl daemon start). metadata: author: vulture-labs version: "1.0" openclaw: requires: bins: - pilotctl homepage: https://pilotprotocol.network allowed-tools: - Bash --- # Pilot Database Bridge Secure database access through Pilot Protocol tunnels for remote PostgreSQL, MySQL, MongoDB, and Redis. ## Commands ### Start Gateway ```bash pilotctl --json gateway start ``` ### Map Remote Database ```bash pilotctl --json gateway map db-server 192.168.100.10 ``` ### List Mappings ```bash pilotctl --json gateway list ``` ### Stop Gateway ```bash pilotctl --json gateway stop ``` ## Workflow Example ```bash #!/bin/bash # Access remote PostgreSQL pilotctl --json daemon start pilotctl --json find postgres-prod pilotctl --json gateway start pilotctl --json gateway map postgres-prod 192.168.100.10 # Connect with standard client psql -h 192.168.100.10 -p 5432 -U dbuser -d production ``` ## Supported Databases ```bash # PostgreSQL pilotctl --json gateway map postgres-server 192.168.100.10 psql -h 192.168.100.10 -p 5432 -U user -d database # MySQL pilotctl --json gateway map mysql-server 192.168.100.11 mysql -h 192.168.100.11 -P 3306 -u root -p # MongoDB pilotctl --json gateway map mongo-server 192.168.100.12 mongosh mongodb://192.168.100.12:27017 # Redis pilotctl --json gateway map redis-server 192.168.100.13 redis-cli -h 192.168.100.13 -p 6379 ``` ## Dependencies Requires pilot-protocol skill, running daemon, and database clients (psql, mysql, mongosh, redis-cli).


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mike47512/xianyu (version 0.1.0)

--- name: "Xianyu" description: "提供闲鱼闲置交易、信用保障及捡漏攻略指引。" --- # 闲鱼转卖 ## 筛选项 - 类别/领域/功能（核心/进阶） - 场景/适用时段/设备要求（移动端/网页版/跨端） - 状态（实时/离线/授权/VIP特权/免费） ## 返回字段 - 操作摘要/交互流程/关键入口 - 功能亮点/提效工具/隐藏玩法/避坑指南 - 状态追踪/数据同步/消息提醒/安全策略 ## 示例请求 - “如何快速使用 闲鱼转卖 处理 [具体场景任务] ？” - “闲鱼转卖 的 [核心功能] 有哪些最新玩法/优惠信息？” ## 更新频率 - 结合产品迭代与社区反馈进行内容更新 ## 注意事项 - 保护个人隐私，谨慎进行敏感授权 - 部分功能涉及第三方接口，稳定性受合作方波动影响


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: clawkk/douyin-operations (version 0.1.0)

--- name: "抖音运营" description: "提供抖音运营的可落地指南与SOP。在开展抖音运营相关工作时调用。" --- # 抖音运营 (douyin-operations) ## 内容与节奏 - 每周3-5条视频：知识型/场景型/对比测评；直播带货每周至少1场； - 统一人设与话术，打造稳定主题与系列内容。 ## 推荐机制要点 - 完播率、互动率、转粉率、停留时长；前3秒强钩子、字幕与配乐优化； - 投流与自然流量配比；DOU+使用策略与风险控制。 ## 带货链路 - 商品卡配置、达人佣金、橱窗与店铺跳转；活动节点（618/双11）。 ## 合规 - 禁止夸大宣传；标注广告；遵守平台禁词与敏感类目规则。 生成日期：2026-03-17


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: gleb-urvanov/braingit (version 0.1.2)

--- name: braingit description: Markdown-only git snapshot commits (stage+commit *.md only). Article: https://github.com/gleb-urvanov/braingit/blob/master/braingit-article.md --- # Braingit Commit Markdown-only deltas in a git repository (typically a notes/workspace repo) using a deterministic script. Article: https://github.com/gleb-urvanov/braingit/blob/master/braingit-article.md ## Quick start ### Commit Markdown changes (default: `*.md`) From inside the target git repo: ```bash ./scripts/commit_md_changes.sh "md: snapshot" ``` Or specify a repo path: ```bash BRAINGIT_REPO=/path/to/repo ./scripts/commit_md_changes.sh "md: snapshot" ``` ### Change what files are included ```bash BRAINGIT_PATTERN='*.md' ./scripts/commit_md_changes.sh ``` ## Behavior - Reads `git status --porcelain -z` - Stages **only** matching files (default `*.md`) - Commits only if something is staged - Exits `0` when there is nothing to do ## Scripts - `scripts/commit_md_changes.sh` - Env: - `BRAINGIT_REPO` (default: cwd) - `BRAINGIT_PATTERN` (default: `*.md`) - `BRAINGIT_DRY_RUN=1` ## References - `references/protocol.md` — conventions + an OpenClaw cron example


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: igetmm/image-ocr-reader (version 1.0.0)

# Image OCR Reader 从图片中提取文字内容的技能，支持中文和英文识别。 ## 功能 - 从图片文件中提取文字 (OCR) - 支持中文、英文混合识别 - 使用 Tesseract OCR 引擎 - 兼容 jpg、png、jpeg 等常见图片格式 ## 依赖 - Python 3 - tesseract-ocr - pytesseract - Pillow ## 安装 ### 1. 安装系统依赖 ```bash # Ubuntu/Debian sudo apt-get install tesseract-ocr # macOS brew install tesseract # CentOS/RHEL sudo yum install tesseract ``` ### 2. 安装 Python 依赖 ```bash pip install pytesseract Pillow ``` ## 使用方法 ### 命令行 ```bash python3 image_ocr_reader.py --file /path/to/image.jpg ``` ### Python API ```python from image_ocr_reader import extract_text text = extract_text("/path/to/image.jpg") print(text) ``` ## 输出示例 输入一张包含文字的图片，输出提取的文字内容。 --- ## 积分 - 版本: 1.0.0 - 作者: OpenClaw - 许可证: MIT


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: sora-mury/karpathy-lint (version 1.0.0)

# Karpathy Lint Skill - Phase 3 ## 描述 实现 Karpathy LLM Knowledge Base 的第三阶段：知识自检与修复。 对 Phase 2 生成的 knowledge points 进行质量检查：去重、合并、更新、删除。 ## 工作流程 ``` Phase 1: 用户查询 → Wiki 条目 Phase 2: Wiki → Knowledge Points (精炼) Phase 3: Lint → 去重/合并/更新/自修复 ← 当前 Phase 4: 高级 (M-Flow 集成、多Agent共享) ``` ## Lint 检查项 1. **去重 (Deduplication)** - 检测相似/重复的 knowledge points - 合并高度相似的内容 2. **更新 (Update)** - 检查知识点是否过期 - 标记需要更新的条目 3. **质量检查 (Quality Check)** - 检查内容完整性 - 验证标签一致性 4. **生成健康报告** - 当前知识库统计 - 发现的问题列表 - 修复建议 ## 文件结构 ``` karpathy-lint/ ├── SKILL.md ├── scripts/ │ ├── __init__.py # LintPipeline │ ├── dedup.py # 去重逻辑 │ ├── merger.py # 合并逻辑 │ └── test_lint.py # 测试 ``` ## 依赖 - Phase 2 的 knowledge points 文件 - M-Flow (可选，用于存储)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: terryds/x-trends-api (version 1.0.0)

--- name: x-trends description: Get trending topics on X (Twitter) using the X API. Use when the user wants to see what's trending or check trends for a location. metadata: { "openclaw": { "emoji": "𝕏", "requires": { "bins": ["python3"], "env": ["X_BEARER_TOKEN"] }, "primaryEnv": "X_BEARER_TOKEN", "install": [ { "id": "python-brew", "kind": "brew", "formula": "python", "bins": ["python3"], "label": "Install Python (brew)", }, ], }, } --- # X Trends Get trending topics on X (Twitter) using the X API. ## Setup 1. Get your Bearer Token from the X Developer Portal: https://developer.x.com 2. Set environment variable: ```bash export X_BEARER_TOKEN="your-bearer-token-here" ``` 3. Or set `skills."x-trends".apiKey` / `skills."x-trends".env.X_BEARER_TOKEN` in `~/.openclaw/openclaw.json` ## Usage ### Trends by location (WOEID) ```bash # Get trends for a location by WOEID (e.g. 1 = Worldwide, 23424977 = United States) python3 {baseDir}/scripts/trends.py --woeid 1 # Limit number of results (1-50, default 20) python3 {baseDir}/scripts/trends.py --woeid 23424977 --max 10 ``` ### WOEID Lookup To find the WOEID for a place, use the lookup script: ```bash # Search by city or country name (case-insensitive, partial match) python3 {baseDir}/scripts/woeid_lookup.py "Tokyo" python3 {baseDir}/scripts/woeid_lookup.py "Indonesia" ``` The full list of supported WOEIDs is in `{baseDir}/scripts/woeid.json`. ## Notes - Requires Bearer Token authentication (`X_BEARER_TOKEN`) - Results include trend name and tweet count when available - Present results in a readable list format


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)