OpenClaw/clawhub-security-signals huggingface dataset:
Skill: evgyur/crypto-price (version 0.2.2)

--- name: crypto-price description: Get cryptocurrency token price and generate candlestick charts via CoinGecko API or Hyperliquid API. Use when user asks for token price, crypto price, price chart, or cryptocurrency market data. metadata: {"clawdbot":{"emoji":"📈","requires":{"bins":["python3"]}}} --- # Crypto Price & Chart Get cryptocurrency token price and generate candlestick charts. ## Usage Execute the script with token symbol and optional duration: ```bash python3 {baseDir}/scripts/get_price_chart.py <SYMBOL> [duration] ``` **Examples:** - `python3 {baseDir}/scripts/get_price_chart.py HYPE` - `python3 {baseDir}/scripts/get_price_chart.py HYPE 12h` - `python3 {baseDir}/scripts/get_price_chart.py BTC 3h` - `python3 {baseDir}/scripts/get_price_chart.py ETH 30m` - `python3 {baseDir}/scripts/get_price_chart.py SOL 2d` **Duration format:** `30m`, `3h`, `12h`, `24h` (default), `2d` ## Output Returns JSON with: - `price` - Current price in USD/USDT - `change_period_percent` - Price change percentage for the period - `chart_path` - Path to generated PNG chart (if available) - `text_plain` - Formatted text description **Chart as image (always when chart_path is present):** You must send the chart as a **photo**, not as text. In your reply, output `text_plain` and on a new line: `MEDIA: ` followed by the exact `chart_path` value (e.g. `MEDIA: /tmp/crypto_chart_HYPE_1769204734.png`). Clawdbot will attach that file as an image. Do **not** write `[chart: path]` or any other text placeholder — only the `MEDIA: <chart_path>` line makes the image appear. ## Chart Details - Format: Candlestick chart (8x8 square) - Theme: Dark (#0f141c background) - Output: `/tmp/crypto_chart_{SYMBOL}_{timestamp}.png` ## Data Sources 1. **Hyperliquid API** - For HYPE and other Hyperliquid tokens (preferred) 2. **CoinGecko API** - Fallback for other tokens Price data cached for 300 seconds (5 minutes) in `/tmp/crypto_price_*.json`.

path: requirements.txt
content: matplotlib>=3.5.0


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: bibaofeng/youtube-serp (version 1.0.0)

--- name: youtube-serp description: 'Search YouTube videos, channels, rankings, and trends through AIsa. Use when: the user needs YouTube research, competitor scouting, or content discovery. Supports video discovery and SERP-style analysis.' author: AIsa version: 1.0.0 license: MIT user-invocable: true primaryEnv: AISA_API_KEY requires: bins: - python3 env: - AISA_API_KEY metadata: aisa: emoji: ▶️ requires: bins: - python3 env: - AISA_API_KEY primaryEnv: AISA_API_KEY compatibility: - openclaw - claude-code - hermes openclaw: emoji: ▶️ requires: bins: - python3 env: - AISA_API_KEY primaryEnv: AISA_API_KEY --- # Youtube Serp Search YouTube videos, channels, rankings, and trends through AIsa. Use when: the user needs YouTube research, competitor scouting, or content discovery. Supports video discovery and SERP-style analysis. ## When to use - The user needs YouTube video, channel, or trend discovery. - The user wants content research, SERP scouting, or competitor review. - The user wants public YouTube results quickly. ## High-Intent Workflows - Find top-ranking videos for a topic. - Inspect a competitor channel's recent content direction. - Scan trend-heavy queries for content opportunities. ## Quick Reference - `python3 scripts/youtube_client.py --help` ## Setup - `AISA_API_KEY` is required for AIsa-backed API access. - Use repo-relative `scripts/` paths from the shipped package. - Prefer explicit CLI auth flags when a script exposes them. ## Example Requests - Search top YouTube videos about OpenAI Agents - Review a competitor channel's recent uploads - Find high-ranking videos for AI coding tutorials ## Guardrails - Do not invent video titles, URLs, or metrics. - Summaries should stay grounded in returned results. - If the upstream returns no results, say so clearly.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dbdbking/supercoolpeep-generator (version 1.0.0)

# supercoolpeep-generator Generate a SuperCoolPeep from supercoolpeeps.com using a 68-digit seed. ## Usage ### Generate Random Peep ```bash node scripts/generate_peep.cjs ``` ### Generate Specific Trait (Ape, Skeleton, Zombie) ```bash node scripts/generate_peep.cjs "" [type] ``` Example: `node scripts/generate_peep.cjs "" ape` ## Traits Mapping (Seed Digits 3 & 4) - 00-39: Normal - 40-71: Skinny - 72-91: Tattoo - 92-96: Ape - 97-98: Zombie - 99: Skeleton


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: rogue-agent1/confmt (version 1.0.0)

--- name: confmt description: Format, convert, flatten, and diff configuration files. Supports JSON, TOML (Python 3.11+), and .env formats. Use when asked to pretty-print a config, flatten nested JSON to dot-notation, convert JSON to env vars, diff two config files to find changes, or sort config keys. Handles JSON↔flat↔env conversion. Zero dependencies. --- # confmt 📝 Config file formatter, converter, and differ. ## Commands ```bash # Pretty-print JSON config python3 scripts/confmt.py format config.json --sort # Flatten nested config to dot-notation cat config.json | python3 scripts/confmt.py format -o flat # Convert JSON to .env format python3 scripts/confmt.py format config.json -o env # Compact/minify python3 scripts/confmt.py format config.json --compact # Diff two config files python3 scripts/confmt.py diff prod.json staging.json ``` ## Formats - **JSON** — read/write, pretty or compact - **TOML** — read (Python 3.11+) - **.env** — read/write - **flat** — dot-notation output (key.subkey = value) ## Diff Output - `+` added keys - `-` removed keys - `~` changed values


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: flywhale-666/doc (version 1.0.0)

--- name: "doc" description: "Use when the task involves reading, creating, or editing `.docx` documents, especially when formatting or layout fidelity matters; prefer `python-docx` plus the bundled `scripts/render_docx.py` for visual checks." --- # DOCX Skill ## When to use - Read or review DOCX content where layout matters (tables, diagrams, pagination). - Create or edit DOCX files with professional formatting. - Validate visual layout before delivery. ## Workflow 1. Prefer visual review (layout, tables, diagrams). - If `soffice` and `pdftoppm` are available, convert DOCX -> PDF -> PNGs. - Or use `scripts/render_docx.py` (requires `pdf2image` and Poppler). - If these tools are missing, install them or ask the user to review rendered pages locally. 2. Use `python-docx` for edits and structured creation (headings, styles, tables, lists). 3. After each meaningful change, re-render and inspect the pages. 4. If visual review is not possible, extract text with `python-docx` as a fallback and call out layout risk. 5. Keep intermediate outputs organized and clean up after final approval. ## Temp and output conventions - Use `tmp/docs/` for intermediate files; delete when done. - Write final artifacts under `output/doc/` when working in this repo. - Keep filenames stable and descriptive. ## Dependencies (install if missing) Prefer `uv` for dependency management. Python packages: ``` uv pip install python-docx pdf2image ``` If `uv` is unavailable: ``` python3 -m pip install python-docx pdf2image ``` System tools (for rendering): ``` # macOS (Homebrew) brew install libreoffice poppler # Ubuntu/Debian sudo apt-get install -y libreoffice poppler-utils ``` If installation isn't possible in this environment, tell the user which dependency is missing and how to install it locally. ## Environment No required environment variables. ## Rendering commands DOCX -> PDF: ``` soffice -env:UserInstallation=file:///tmp/lo_profile_$$ --headless --convert-to pdf --outdir $OUTDIR $INPUT_DOCX ``` PDF -> PNGs: ``` pdftoppm -png $OUTDIR/$BASENAME.pdf $OUTDIR/$BASENAME ``` Bundled helper: ``` python3 scripts/render_docx.py /path/to/file.docx --output_dir /tmp/docx_pages ``` ## Quality expectations - Deliver a client-ready document: consistent typography, spacing, margins, and clear hierarchy. - Avoid formatting defects: clipped/overlapping text, broken tables, unreadable characters, or default-template styling. - Charts, tables, and visuals must be legible in rendered pages with correct alignment. - Use ASCII hyphens only. Avoid U+2011 (non-breaking hyphen) and other Unicode dashes. - Citations and references must be human-readable; never leave tool tokens or placeholder strings. ## Final checks - Re-render and inspect every page at 100% zoom before final delivery. - Fix any spacing, alignment, or pagination issues and repeat the render loop. - Confirm there are no leftovers (temp files, duplicate renders) unless the user asks to keep them.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: codeteenager/zsxq-helper (version 1.1.0)

--- name: zsxq-helper description: | 知识星球助手 - 登录、发帖、管理知识星球。当用户需要操作知识星球（登录、发帖、查看内容）时使用此技能。触发词：知识星球、zsxq、发帖、星球登录。 --- # 知识星球助手 帮助用户自动化操作知识星球（zsxq.com）。 ## 功能 - 🔐 登录知识星球（获取二维码，等待扫码）**需要截图发送** - 📝 发布帖子 **不需要截图发送** - 👀 查看星球内容 - 📱 操作反馈 ## 使用方法 ### 1. 登录知识星球 当用户需要登录知识星球时： 1. 使用 browser 工具打开登录页面： ``` browser action=open url=https://wx.zsxq.com/login ``` 2. 点击"获取登录二维码"按钮 3. **截图发送给用户**，让用户微信扫码： ``` browser action=screenshot message action=send media=<截图路径> ``` 4. 点击同意协议按钮（如有） 5. **再次截图发送**，等待用户扫码确认 6. 等待用户确认登录成功 **重要**：登录流程中每一步都需要截图发送给用户！ ### 2. 进入星球 使用 browser 工具导航到星球： ``` browser action=navigate url=https://wx.zsxq.com/group/<group_id> ``` ### 3. 发布帖子 1. 点击"发表主题"输入框 2. 输入帖子内容 3. 点击发布 **重要**：发帖子流程中**不需要截图发送**，直接完成发布即可！ ### 4. 查看内容 ``` browser action=snapshot # 获取页面内容 ``` ## URL 格式 知识星球的URL格式： - 登录页：`https://wx.zsxq.com/login` - 星球主页：`https://wx.zsxq.com/group/<group_id>` ## 常用星球 | 星球名称 | group_id | |---------|----------| | Jacob和他的朋友们 | 51112818881544 | ## 注意事项 1. **登录流程**：每一步都需要截图发送给用户 2. **发帖流程**：不需要截图，直接完成 3. 登录需要微信扫码，有效期约30分钟 4. 长时间未操作可能需要重新登录 5. 发布内容需遵守星球规则 ## 截图规则总结 | 操作 | 是否截图发送 | |-----|-------------| | 登录 - 打开页面 | ✅ 需要 | | 登录 - 获取二维码 | ✅ 需要 | | 登录 - 同意协议后 | ✅ 需要 | | 发帖 - 输入内容 | ❌ 不需要 | | 发帖 - 发布 | ❌ 不需要 | --- *版本: 1.1.0*


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: lisamaraventano-spine/firstdollar (version 1.0.4)

--- name: firstdollar description: A curriculum that teaches AI agents how to spend their own money. Ten lessons from "what is a wallet" to "your first x402 purchase." Teacher, not butler — explains what to do, never signs for you. version: 1.0.4 --- # First Dollar A curriculum that teaches AI agents how to spend their own money. ## What it does Ten lessons, from "what is a wallet" to "your first real x402 purchase." Plus reference tools for troubleshooting and end-to-end testing. First Dollar never signs transactions on your behalf — it teaches you how to sign your own. ## Principle **Teacher, not butler.** First Dollar explains; the agent acts. The MCP never holds keys, never signs, never transacts. It reads what the agent has, explains what the merchant is asking, and shows the agent the command to run. The agent spends its own money with understanding. ## Tools | Tool | Purpose | |---|---| | `start-here` | Curriculum index and orientation | | `what-is-a-wallet` | Keypairs, addresses, private keys | | `what-is-usdc` | Stablecoins, chains, why which chain matters | | `explain-my-wallet` | Self-inspection for any wallet type | | `get-a-wallet` | Installing a wallet step by step | | `configure-wallet-skills` | Post-install setup and ordering | | `fund-my-wallet` | Getting USDC in: Onramp, transfers, earning | | `what-is-x402` | HTTP 402 payment protocol explained | | `read-this-challenge` | Decodes x402 challenges into plain language | | `how-do-i-pay` | Wallet-specific signing commands | | `verify-my-purchase` | Turn a tx hash into delivered content | | `what-went-wrong` | Diagnoses common failures | | `test-payment` | End-to-end handshake walkthrough | ## Install ```bash npx firstdollar ``` ## Built for Any agent with its own wallet and its own funds. Works across wallet types and facilitators. ## Credits Lisa Maraventano + Spine, with Claude. Clarksdale, Mississippi.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: linus995/hot-topic-finder (version 1.0.0)

--- name: hot-topic-finder description: "发现并追踪热点话题，自动去重，支持多平台热榜监控。Use when: (1) 寻找创作灵感或热点话题，(2) 检查话题是否已使用过，(3) 监控微博/知乎/抖音等平台热榜，(4) 需要话题推荐时。NOT for: 实时新闻追踪、舆情危机处理。" metadata: { "openclaw": { "emoji": "🔥", "requires": { "bins": ["curl", "python3"] }, }, } --- # Hot Topic Finder 自动发现热点话题，智能去重，追踪使用历史。 ## 核心功能 1. **热点发现**：从多平台获取热门话题 2. **话题去重**：检查话题是否已使用，避免重复 3. **历史追踪**：记录话题使用日期和次数 4. **智能推荐**：根据热度 + 新鲜度推荐话题 ## 使用场景 ✅ **适合：** - "帮我找个热点话题写文章" - "今天有什么热门事件" - "这个话题我之前写过吗" - "推荐几个新鲜话题" ## 快速开始 ```bash # 查找热点话题 python3 {baseDir}/scripts/find_topics.py --count 10 # 检查话题是否已使用 python3 {baseDir}/scripts/check_topic.py "房价下跌趋势" # 标记话题已使用 python3 {baseDir}/scripts/mark_topic.py "房价下跌趋势" --heat 560000 # 获取智能推荐 python3 {baseDir}/scripts/recommend.py --count 5 # 查看使用历史 python3 {baseDir}/scripts/topic_history.py --days 30 ``` ## 数据存储 话题历史存储在 SQLite 数据库：`~/.openclaw/data/topic_history.db` ## 去重规则 1. **24小时内**：同一话题只能使用 1 次 2. **7天内**：同一话题最多使用 2 次 3. **30天内**：同一话题最多使用 3 次


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: huangxianzhan/skill-market-scanner (version 1.0.0)

--- name: clawhub-guard version: 1.0.0 description: ClawHub 技能市场安全守卫 — 自动浏览/搜索/审查技能，帮你发现好用的、过滤危险的。集成 skill-vetter 自动安全审查。 --- # ClawHub Guard > ClawHub 技能市场的安检员。不让危险技能溜进来，不让好技能被忽略。 ## 解决的问题 | 无此技能 | 有此技能 | |---------|---------| | 手动 `clawhub explore` 翻页 | `scan` 自动浏览 + 审查 top N | | 不知道技能是否安全 | 自动调用 skill-vetter 审查 | | 好技能沉在市场里找不到 | `hunt "关键词"` 持续监控 | | 装了的技能不知是否过时 | `audit` 检查已装技能更新 | ## 命令 ```bash python clawhub_guard.py scan # 浏览市场最新 50 个技能，审查推荐 top 5 python clawhub_guard.py hunt "关键词" # 搜索市场，审查后推荐 python clawhub_guard.py audit # 检查已装技能是否有更新 python clawhub_guard.py install <slug> # 安全安装（先审查再装） ``` ## 审查流程（自动） ``` scan/hunt → 拿技能列表 → 每个技能 → skill-vetter 审查 → 风险分级 → 推荐清单 ``` ## 依赖 - `clawhub` CLI（已全局安装） - Python 3.11+ ## 典型工作流 ```bash # 逛逛市场 clawhub-guard scan # → Top 5 推荐 + 风险评级 # 找特定技能 clawhub-guard hunt "中医" # → 搜索 + 审查 + 推荐 # 更新已装技能 clawhub-guard audit # → 列出可更新的 + skill-vetter 复核 ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: 52yuanchangxing/insight-brief-generator (version 1.0.0)

--- name: insight-brief-generator version: 1.0.0 description: "把报表和图表转成管理层可读的洞察摘要，区分发现、解释和建议动作。；use for insights, analytics, briefing workflows；do not use for 夸大结论, 把相关性当因果." author: OpenClaw Skill Bundle homepage: https://example.invalid/skills/insight-brief-generator tags: [insights, analytics, briefing, management] user-invocable: true metadata: {"openclaw":{"emoji":"📈","requires":{"bins":["python3"]},"os":["darwin","linux","win32"]}} --- # 洞察简报生成器 ## 你是什么 你是“洞察简报生成器”这个独立 Skill，负责：把报表和图表转成管理层可读的洞察摘要，区分发现、解释和建议动作。 ## Routing ### 适合使用的情况 - 把这些图表写成管理层看得懂的摘要 - 区分发现和建议 - 输入通常包含：图表结论、数据摘要、背景问题 - 优先产出：核心发现、数据解释、风险提醒 ### 不适合使用的情况 - 不要夸大结论 - 不要把相关性当因果 - 如果用户想直接执行外部系统写入、发送、删除、发布、变更配置，先明确边界，再只给审阅版内容或 dry-run 方案。 ## 工作规则 1. 先把用户提供的信息重组成任务书，再输出结构化结果。 2. 缺信息时，优先显式列出“待确认项”，而不是直接编造。 3. 默认先给“可审阅草案”，再给“可执行清单”。 4. 遇到高风险、隐私、权限或合规问题，必须加上边界说明。 5. 如运行环境允许 shell / exec，可使用： - `python3 "{baseDir}/scripts/run.py" --input <输入文件> --output <输出文件>` 6. 如当前环境不能执行脚本，仍要基于 `{baseDir}/resources/template.md` 与 `{baseDir}/resources/spec.json` 的结构直接产出文本。 ## 标准输出结构 请尽量按以下结构组织结果： - 核心发现 - 数据解释 - 可能原因 - 建议动作 - 需补数据 - 风险提醒 ## 本地资源 - 规范文件：`{baseDir}/resources/spec.json` - 输出模板：`{baseDir}/resources/template.md` - 示例输入输出：`{baseDir}/examples/` - 冒烟测试：`{baseDir}/tests/smoke-test.md` ## 安全边界 - 会显式标注推断与事实的边界。 - 默认只读、可审计、可回滚。 - 不执行高风险命令，不隐藏依赖，不伪造事实或结果。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: xueyetianya/leads (version 3.4.1)

--- name: leads description: "Manage sales leads locally. Use when adding prospects, scoring leads, setting follow-ups, tracking conversions, or viewing funnels." version: "3.4.0" author: BytesAgain homepage: https://bytesagain.com source: https://github.com/bytesagain/ai-skills tags: - sales - crm - leads - pipeline - follow-up --- # Leads — Sales Lead CRM Manage sales leads through their lifecycle: add, score, follow up, convert, and report on your pipeline. ## Commands ### add — Add a new lead ```bash bash scripts/script.sh add "<name>" "<email>" "<company>" "[source]" ``` Creates a new lead with status `new`. Source defaults to `direct`. ### list — View leads ```bash bash scripts/script.sh list [status] [--sort score|date] ``` Lists all leads, optionally filtered by status (`new`, `contacted`, `qualified`, `converted`, `lost`). Sort by score or date. ### score — Score a lead ```bash bash scripts/script.sh score "<lead_id>" <points> "[reason]" ``` Assigns or adds score points to a lead. Score range: 0–100. Higher = more likely to convert. ### follow-up — Set follow-up reminder ```bash bash scripts/script.sh follow-up "<lead_id>" "<YYYY-MM-DD>" "<note>" ``` Schedules a follow-up action for a lead on the specified date with a note. ### convert — Mark lead as converted ```bash bash scripts/script.sh convert "<lead_id>" "[deal_value]" ``` Changes lead status to `converted` and optionally records deal value. ### pipeline — Sales funnel report ```bash bash scripts/script.sh pipeline [YYYY-MM] ``` Shows a funnel breakdown of leads by status with counts and conversion rates. Defaults to current month. ## Output All commands print plain text to stdout. Data is stored in `~/.leads/leads.json`. ## Requirements - bash 4+ - python3 (standard library only) ## Feedback Report issues or suggestions: [https://bytesagain.com/feedback/](https://bytesagain.com/feedback/) --- Powered by BytesAgain | bytesagain.com


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: pbseiya/f5tts-monitor (version 1.0.0)

--- name: f5tts_monitor description: Monitor F5-TTS distributed training on the 9-GPU mining rig (Local-LLM) without interfering with the process. metadata: {"clawdbot":{"emoji":"📦"}} --- # F5-TTS Mining Rig Monitor Skill This skill provides instructions for ADA to safely monitor the ongoing F5-TTS training process on the 9-GPU mining rig (`Local-LLM`), without interfering with the data or environment. **IMPORTANT:** 1. The training dataset and checkpoints are strictly located on the HDD of the mining rig at `/mnt/toshiba/projects/F5-TTS/`. 2. Do not attempt to run training locally on `asus-z170k`. 3. Use `uv` exclusively when interacting with the Python environment on the mining rig. ## Steps to Monitor Training ### 1. Check GPU Utilization To ensure all 9 GPUs are actively training and not bottlenecked or OOMed, run the following command via SSH (remember to use pseudo-terminal if using watch): ```bash ssh Local-LLM "nvidia-smi" ``` You should see 9 `python3` processes consistently consuming ~11GB of VRAM each. ### 2. Check Training Epoch Progress Check the Accelerate training logs to see the current epoch and global step: ```bash ssh Local-LLM "tail -n 100 /mnt/toshiba/projects/F5-TTS/outputs/training_mining_rig.log" ``` Look for `Epoch:` and `Step:` progression. ### 3. Check System RAM and CPU Load The mining rig only has a 2-core Pentium CPU and 16GB of RAM. Make sure the system isn't buckling under the DDP overhead: ```bash ssh Local-LLM "free -h && uptime" ``` ### 4. Update the Heartbeat After successfully probing the status, update your HEARTBEAT.md files locally to report the current Epoch, Step, GPU temperature, and estimated time remaining to Master Seiya.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ivangdavila/authorization (version 1.0.0)

--- name: Authorization slug: authorization version: 1.0.0 homepage: https://clawic.com/skills/authorization description: Build secure access control with RBAC, ABAC, permissions, policies, and scope-based authorization. metadata: {"clawdbot":{"emoji":"🔐","requires":{"bins":[]},"os":["linux","darwin","win32"]}} --- ## When to Use User needs to control what actions users can perform. Agent handles permission design, role hierarchies, policy evaluation, and access control middleware. ## Quick Reference | Topic | File | |-------|------| | RBAC vs ABAC comparison | `models.md` | | Implementation patterns | `patterns.md` | | Framework middleware | `middleware.md` | ## Core Rules ### 1. Auth ≠ Authorization - **Authentication:** Who you are (login, OAuth, tokens) - **Authorization:** What you can do (permissions, roles, policies) - Never mix concerns — auth happens BEFORE authorization ### 2. Principle of Least Privilege - Default deny — explicit grants only - Users get minimum permissions for their job - Audit permissions periodically (revoke unused) - Temporary elevation over permanent grants ### 3. Choose the Right Model | Model | Best For | Complexity | |-------|----------|------------| | ACL | Simple resource ownership | Low | | RBAC | Organizational hierarchies | Medium | | ABAC | Dynamic context-based rules | High | | ReBAC | Social graphs, sharing | High | Start simple → evolve when needed. ### 4. Role Design Patterns - Roles represent jobs, not permissions - Max 3 inheritance levels (admin → manager → user) - Avoid role explosion — combine with ABAC for edge cases - Document role definitions (what can this role DO?) ### 5. Permission Naming ``` resource:action:scope documents:write:own ← Can edit own documents documents:write:team ← Can edit team documents documents:delete:all ← Can delete any document ``` Consistent naming prevents ambiguity. ### 6. Policy Evaluation Order 1. Explicit deny → always wins 2. Explicit allow → checked second 3. No match → default deny 4. Log all denials for debugging ### 7. Never Hardcode ```javascript // ❌ Bad — hardcoded role check if (user.role === 'admin') { ... } // ✅ Good — permission check if (can(user, 'settings:update')) { ... } ``` Roles change. Permissions are stable. ## Common Traps - Checking roles instead of permissions → brittle when roles change - OR logic in permissions → "can edit OR is admin" creates backdoors - Caching permissions too long → stale grants after role changes - Frontend-only checks → always verify server-side - God roles → split "admin" into specific permission sets - Circular inheritance → A inherits B inherits A crashes system ## Security & Privacy **Data that stays local:** - All documentation and patterns are reference material - No data collection or external requests **This skill does NOT:** - Access your codebase automatically - Make network requests - Store any user data ## Feedback - If useful: `clawhub star authorization` - Stay updated: `clawhub sync`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ivankoriako/clawteam (version 0.1.0)

--- name: clawteam description: Use this skill when the user wants to assemble a team for a project by matching people based on skills, roles, and work styles. Triggers on "find a team", "build a team", "I need a cofounder", "ClawTeam". version: 0.1.0 author: ivanschmidt license: MIT --- # ClawTeam 🦞🚀 **Assemble the right team for your project — matched by skills, roles, and work style.** ClawTeam analyzes user profiles and finds complementary teammates for startups, side projects, or any collaborative work. ## Status 🚧 **Coming soon.** ## Installation ```bash clawhub install clawteam ``` Built on OpenClaw. Your data stays local. Always.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)