OpenClaw/clawhub-security-signals huggingface dataset:
Skill: modestyrichards/modesty-news-aggregator (version 1.0.2)

--- name: news-aggregator version: 1.0.3 description: 国内外社会、科技、军事新闻汇总。自动搜索、筛选、整理新闻要点。 license: MIT requires: env: [SKILLBOSS_API_KEY] --- > 📖 **Complete setup guide**: https://skillboss.co/skill.md # News Aggregator 聚合国内外社会、科技、军事新闻，自动筛选要点。 ## 新闻源 ### 国内科技 - 36氪 (https://36kr.com/information/tech/) - 机器之心 (https://www.jiqizhixin.com/) - 量子位 (https://www.1baijia.com/) - IT之家 (https://www.ithome.com/) ### 国内军事 - 观察者网 (https://www.guancha.cn/) - 澎湃新闻 (https://www.thepaper.cn/) - 腾讯军事 (https://new.qq.com/om/mil/) ### 国际科技 - TechCrunch - The Verge - Wired - Ars Technica ### 国际军事 - Defense News - Jane's Defence - Military Times ## 工作流 1. **搜索** - 通过 SkillBoss API Hub `/v1/pilot`（type: search）搜索各源 2. **筛选** - 过滤重复、过期、不可靠来源 3. **整理** - 按类别整理，每条含标题、来源、要点 4. **输出** - 生成结构化汇总 ## API 调用 使用 SkillBoss API Hub 统一搜索接口（替代 Tavily、Serper 等第三方搜索服务）： ```python import requests, os SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] API_BASE = "https://api.skillboss.co/v1" def pilot(body: dict) -> dict: r = requests.post( f"{API_BASE}/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=body, timeout=60, ) return r.json() # 搜索新闻 result = pilot({"type": "search", "inputs": {"query": "最新科技新闻"}, "prefer": "balanced"}) search_results = result["result"] # 用 LLM 整理新闻要点 result = pilot({ "type": "chat", "inputs": { "messages": [ {"role": "user", "content": f"请从以下搜索结果中整理新闻要点：\n{search_results}"} ] }, "prefer": "balanced" }) summary = result["result"]["choices"][0]["message"]["content"] ``` ## 可信度规则 **优先：** - 官方媒体报道 - 权威机构发布 **谨慎：** - 论坛帖子 - 匿名消息 - 二手转载 ## 输出格式 ```markdown ## 科技新闻 1. [标题](链接) 来源：xxx | 时间：xxx 要点：xxx ## 军事新闻 1. [标题](链接) 来源：xxx | 时间：xxx 要点：xxx ```

path: README.md
content: # news-aggregator - OpenClaw Skill

国内外社会、科技、军事新闻汇总。自动搜索、筛选、整理新闻要点。

## Installation

```bash
openclaw skill install <skill-name>
```

> 📖 **Complete setup guide**: https://skillboss.co/skill.md

### Via ClawHub
```bash
clawhub install news-aggregator
```

### Manual Installation
```bash
git clone https://github.com/YOUR_USERNAME/news-aggregator.git
cp -r news-aggregator ~/.openclaw/skills/news-aggregator
```

## Usage
See SKILL.md for details.

## License
MIT


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: gztanht/airdrop-shark (version 0.1.0)

# AirdropAlert Skill - SKILL.md **🪂 空投提醒技能 - 追踪潜在空投资格，提醒快照和时间** ## 基本信息 ```json { "name": "airdrop-shark", "version": "0.1.0", "description": "空投提醒技能 - 追踪潜在空投资格，提醒快照和时间", "author": "@gztanht", "license": "MIT" } ``` ## 命令系统 | 命令 | 描述 | 参数 | |------|------|------| | `airdrop` | 查看所有空投项目 | `--priority`, `--limit` | | `eligibility` | 检查空投资格 | `<project>`, `--address` | | `reminder` | 管理快照提醒 | `add`, `list`, `remove` | ## 功能说明 ### 1. 空投项目列表 (`airdrop.mjs`) 显示所有潜在空投项目，包括： - 项目名称和链 - 预期快照时间 - 预期价值范围 - 交互难度 - 优先级标记 **参数**: - `--priority [high|medium|low]` - 按优先级筛选 - `--limit N` - 限制显示数量 ### 2. 资格检查 (`eligibility.mjs`) 检查用户地址是否符合特定项目的空投资格： - 交易次数要求 - 使用链数量 - 交易量要求 - 最近活跃度 **参数**: - `<project>` - 项目名称 (必需) - `--address <addr>` - 要检查的地址 (可选，默认当前钱包) ### 3. 提醒管理 (`reminder.mjs`) 设置和管理快照时间提醒： - 添加新提醒 - 查看所有提醒 - 删除已过期提醒 **参数**: - `add --project <name> --date <YYYY-MM-DD>` - 添加提醒 - `list` - 查看提醒列表 - `remove <id>` - 删除提醒 ## 数据源 - 社区整理的空投项目数据库 - 官方公告和项目文档 - 链上数据分析 (未来) ## 输出格式 ### 空投列表输出 ``` 🪂 AirdropAlert - 潜在空投项目 优先级 项目 链 快照时间 预期价值 难度 ───────────────────────────────────────────────────────────────────── 🔴 高 LayerZero 多链 2026-Q2 $2000-5000 中 🟡 中 Starknet Starknet 已完成 $500-2000 低 ``` ### 资格检查输出 ``` ✅ LayerZero 资格检查 地址：0x33f9...5ad9 状态：符合条件 要求: - ✅ 跨链交易 > 5 次 - ✅ 使用 > 3 条不同链 - ✅ 总交易量 > $1000 预期空投：$2000-5000 ``` ## 定价策略 - **免费版**: 5 次查询/天 - **赞助版**: 0.5 USDT/USDC → 无限查询 ## 安全注意事项 技能必须显示安全提示： - 不要求用户提供私钥 - 不连接用户钱包 (只读地址检查) - 提醒用户验证官方链接 - 建议用户小额测试 ## 未来规划 - v0.2.0 - 链上数据自动检查 - v0.3.0 - Telegram/Discord 通知 - v1.0.0 - 自动化交互指南 --- **🪂 AirdropAlert v0.1.0 - Never Miss an Airdrop**


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector:  ()
Skill: horisky/emo-img (version 1.0.0)

--- name: emo-img description: Send sticker/emoji images (表情包) in chat. Search local collection or online (Tenor), download favorites, and send via any channel (WhatsApp, Discord, iMessage, Telegram). Use when the user wants to send a sticker, emoji image, meme, or 表情包. metadata: { "openclaw": { "emoji": "😎", "requires": { "bins": ["python3"] }, }, } --- # emo-img — Sticker / Emoji Image Skill Send sticker images (表情包) in chat conversations. Hybrid search: local collection first, then Tenor online. ## Storage - Sticker collection: `~/.openclaw/stickers/` - Index file: `~/.openclaw/stickers/index.json` - Override with `STICKER_DIR` env var ## Commands ### Search (hybrid: local first, then online) ```bash python3 {baseDir}/scripts/sticker.py search "开心" python3 {baseDir}/scripts/sticker.py search "thumbs up" --limit 3 ``` Returns JSON with `local` and `online` arrays. Local results have a `file` path; online results have a `url`. ### Search local only ```bash python3 {baseDir}/scripts/sticker.py search-local "哭" ``` ### Search online only (Tenor) ```bash python3 {baseDir}/scripts/sticker.py search-online "excited" --limit 5 ``` ### Add a local file ```bash python3 {baseDir}/scripts/sticker.py add /path/to/sticker.gif --name "happy-cat" --tags "开心,猫,happy,cat" ``` ### Download from URL and save ```bash python3 {baseDir}/scripts/sticker.py download "<url>" --name "thumbs-up" --tags "好的,赞,ok" ``` ### List all stickers ```bash python3 {baseDir}/scripts/sticker.py list ``` ### Remove a sticker ```bash python3 {baseDir}/scripts/sticker.py remove "happy-cat" ``` ## Sending Stickers Use the `message` tool with the `media` field to send sticker images. This works for ALL channels (WhatsApp, Telegram, Discord, etc.) — no external CLI needed. ```json { "action": "send", "channel": "<current_channel>", "to": "<recipient>", "message": "", "media": "<sticker_file_path>" } ``` The `media` field accepts local file paths directly (e.g. `/Users/.../.openclaw/stickers/bocchi-shy.gif`). For online results not yet downloaded, first run `download` to save locally, then send the saved file path. ## Workflow 1. User says something like "发个表情包" or "send a sticker about X" 2. Run `search "<keyword>"` to find matching stickers 3. If local results exist, use the `file` path directly 4. If only online results, download first with `download`, then use the saved file path 5. Send via the appropriate channel (auto-detect from conversation context) 6. Optionally ask user if they want to save an online sticker to local collection ## Tips - Tag stickers in both Chinese and English for better search - Use `--tags` with comma-separated keywords when adding stickers - The Tenor demo API key has rate limits; set `TENOR_API_KEY` env for heavy use


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: stmmer/dianju-ofd-tools (version 1.0.0)

``` name: dianju-ofd-tools description: An OFD document processing tool that can convert local PDF and OFD files to each other and extract content from OFD files. version:1.0.0 email:[REDACTED_SECRET] ``` # OFD Tools Skill ## Quick Start ``` npx dianju-ofd-tools --APP_ID=xxx --APP_KEY=xxx --API_URL=http://ip:port/DCS ``` APP_ID：appid APP_KEY：appkey API_URL：The system API address ## Features ### 1. PDF to OFD Conversion - **Tool Name:** `pdf_to_ofd` - **Description:** Convert local PDF files to OFD format - **Parameters:** ```json { "filePath": "string" // Absolute path to local PDF file } ``` - **Returns:** Temporary download link for the generated OFD file ### 2. OFD to PDF Conversion - **Tool Name:** `ofd_to_pdf` - **Description:** Convert local OFD files to PDF format - **Parameters:** ```json { "filePath": "string" // Absolute path to local OFD file } ``` - **Returns:** Temporary download link for the generated PDF file ### 3. OFD Content Extraction - **Tool Name:** `get_ofd_content` - **Description:** Extract text content from local OFD files - **Parameters:** ```json { "filePath": "string" // Absolute path to local OFD file } ``` - **Returns:** JSON array of extracted text content ## Usage Examples ### Example 1: Convert PDF to OFD ```bash ofd-tools pdf_to_ofd --filePath "/path/to/input.pdf" ``` ### Example 2: Convert OFD to PDF ```bash ofd-tools ofd_to_pdf --filePath "/path/to/input.ofd" ``` ### Example 3: Extract OFD Content ```bash ofd-tools get_ofd_content --filePath "/path/to/input.ofd" ``` ## Notes 1. **File Paths:** Ensure the local file path is correct (absolute path recommended for non-current directory files). 2. **Temporary Links:** The `ofd_to_pdf` and `pdf_to_ofd` services return temporary download links for converted files; check link validity before use. 3. **Link Expiry:** OFD download links may expire after a set time; download the file promptly. 4. **File Integrity:** Always verify the integrity of the generated OFD file before sharing or using it. 5. **Performance:** Large files may take longer to process; avoid interrupting the conversion process. 6. **Logging:** Enable logging with `ENABLE_LOGGING=true` for troubleshooting; logs can be output to files with `LOG_TO_FILE=true`. ## Error Handling - **File Not Found:** Ensure the file path is correct and the file exists - **Permission Denied:** Check file permissions and ensure the tool has read access - **Conversion Failed:** Verify the input file is valid and not corrupted - **Network Issues:** Check internet connectivity when using external conversion services ## Support For issues or questions, contact support at [REDACTED_SECRET].


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: redtechsupplylabs/local-3d-printer-maintenance (version 1.0.0)

# Local-Only 3D Printer Maintenance Assistant ## Overview A fully offline diagnostic and maintenance assistant for FDM 3D printers. Runs entirely on local LLMs through OpenClaw with zero cloud dependencies. ## Capabilities - Text-based troubleshooting for print failures - Step-by-step maintenance protocols - Premium image-based failure analysis (LLaVA) - Automatic calibration G-code generation - Tuning profile save/load system - Maintenance log export to CSV ## Workflows - `troubleshoot` — Diagnose print issues using text input - `maintenance` — Provide guided maintenance procedures - `vision_analysis` — Analyze print failures from images (premium) - `generate_gcode` — Create calibration G-code (premium) - `manage_profiles` — Save/load tuning profiles - `export_logs` — Export maintenance logs ## Actions - `local_llm_text` — Runs text prompts through local Llama3 - `local_llm_vision` — Runs image prompts through LLaVA - `gcode_generator` — Generates calibration G-code - `profile_manager` — Manages tuning profiles - `log_exporter` — Outputs CSV maintenance logs ## Requirements - OpenClaw v1.2.0+ - Ollama installed - Models: `llama3`, `llava` ## Tiers - **Free:** Troubleshooting, maintenance, basic guidance - **Premium:** Vision analysis, G-code generation, profile manager, log export ## Notes This skill does **not** control printers or hardware. All operations are informational and file‑based only.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: kid0114/master-skill-review (version 1.0.1)

--- name: master-skill-review description: Review an OpenClaw skill for token efficiency, scriptability, and clean action boundaries; back up first, then improve the skill. input: skill path or skill name output: 审查结论、优化建议、建议新增的 scripts/references、是否通过 --- # Skill Review ## What this skill does This meta-skill reviews another skill and checks whether it: - is too verbose - should move repetitive mechanical steps into scripts - wastes tokens through repeated explanation - clearly separates default execution from confirmation-required actions ## Typical ownership / permission level - This skill is typically used by the **`master`** agent. - It often requires **higher local permissions** because it may inspect and modify: - `SKILL.md` - `references/` - `scripts/` - other local skill folders ## Core rules - Prefer **thin markdown + heavier scripts**. - If a step can be scripted, it should usually be scripted. - If no extra requirements exist, prefer executing scripts instead of repeatedly re-explaining a process in chat. - `SKILL.md` should hold rules, boundaries, and confirmation points. - `scripts/` should hold mechanical checks, copying, verification, and repeatable operations. - `references/` should stay lightweight. - After review, the default is: **back up first, then modify, then show evidence**. ## Standard flow 1. Read the target `SKILL.md` 2. Inspect `scripts/` and `references/` 3. Identify verbosity, duplication, and non-scripted mechanical steps 4. Back up the target skill files 5. Improve the skill structure 6. Show backup paths, changes made, and final evidence ## Included files - `references/checklist.md` - `scripts/review_skill.sh` ## Recommended command ```bash bash skills/master-skill-review/scripts/review_skill.sh <skill-dir-or-skill-md> ``` ## Do not - Do not keep heavy explanations in `SKILL.md` when a script can do the work. - Do not modify a target skill without first backing it up. - Do not leave action boundaries unclear.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: teoslayer/pilot-task-router (version 1.0.0)

--- name: pilot-task-router description: > Route tasks to the best agent by capability and reputation. Use this skill when: 1. You need to find the most qualified agent for a specific task type 2. You want to route tasks based on polo score and capability tags 3. You need intelligent task assignment across multiple potential agents Do NOT use this skill when: - You already know the exact target agent address - The task doesn't require capability matching - You need to broadcast to all agents tags: - pilot-protocol - task-workflow - routing - reputation license: AGPL-3.0 compatibility: > Requires pilot-protocol skill and pilotctl binary on PATH. The daemon must be running (pilotctl daemon start). metadata: author: vulture-labs version: "1.0" openclaw: requires: bins: - pilotctl homepage: https://pilotprotocol.network allowed-tools: - Bash --- # pilot-task-router Route tasks to the best-qualified agent based on capability tags and reputation scores. ## Commands ### Find Best Agent ```bash pilotctl --json peers --search "compute gpu" | jq -r 'sort_by(-.polo_score) | .[0].address' ``` ### Route Task ```bash BEST_AGENT=$(pilotctl --json peers --search "ml-inference" | jq -r 'sort_by(-.polo_score) | .[0].address') pilotctl --json task submit "$BEST_AGENT" --task "Run ML inference" ``` ### Multi-Capability Routing ```bash pilotctl --json peers --search "storage verified" | jq -r '[.[] | select(.polo_score >= 100)] | sort_by(-.polo_score) | .[0].address' ``` ### Route with Fallback ```bash AGENTS=$(pilotctl --json peers --search "api-gateway" | jq -r 'sort_by(-.polo_score) | .[0:2] | .[].address') for AGENT in $AGENTS; do RESULT=$(pilotctl --json task submit "$AGENT" --task "Execute API call" 2>&1) echo "$RESULT" | jq -e '.task_id' >/dev/null 2>&1 && break done ``` ## Workflow Example ```bash #!/bin/bash # Route ML inference task to best GPU agent MIN_POLO_SCORE=50 CANDIDATES=$(pilotctl --json peers --search "gpu") BEST_AGENT=$(echo "$CANDIDATES" | jq -r \ "[.[] | select(.polo_score >= $MIN_POLO_SCORE)] | sort_by(-.polo_score) | .[0]") AGENT_ADDR=$(echo "$BEST_AGENT" | jq -r '.address') [ "$AGENT_ADDR" = "null" ] && echo "No qualified agents" && exit 1 TASK_ID=$(pilotctl --json task submit "$AGENT_ADDR" --task "Generate image" | jq -r '.task_id') while [ "$(pilotctl --json task list | jq -r ".[] | select(.task_id == \"$TASK_ID\") | .status")" = "pending" ]; do sleep 2 done ``` ## Dependencies Requires pilot-protocol, pilotctl, jq, and running daemon with discoverable peers.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: parallelromb/smara-memory (version 1.0.0)

--- name: smara-memory description: Persistent memory for AI agents — store, search, and recall user context via the Smara Memory API version: 1.0.0 author: parallelromb metadata: openclaw: emoji: "🧠" tags: - smara - memory - persistence - recall requires: env: - SMARA_API_KEY primaryEnv: "SMARA_API_KEY" --- # Smara Memory Skill Gives your agent persistent memory across conversations. Store facts about users, search by meaning, and retrieve full context — powered by Smara's Ebbinghaus decay scoring. ## When to use - When the agent learns something about a user that should persist (preferences, facts, context) - When the agent needs to recall what it knows about a user - When the agent should check if it already knows something before asking again - After meaningful conversations to extract and store key facts ## Setup 1. Get a free API key at https://smara.io 2. Set `SMARA_API_KEY` in your environment ## Actions ### Store a memory ```bash curl -X POST https://api.smara.io/v1/memories \ -H "Authorization: Bearer $SMARA_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "user_id": "user_id_here", "fact": "User prefers dark mode and uses vim keybindings", "importance": 0.7 }' ``` ### Search memories ```bash curl "https://api.smara.io/v1/memories/search?user_id=user_id_here&query=editor+preferences&limit=5" \ -H "Authorization: Bearer $SMARA_API_KEY" ``` ### Get full user context ```bash curl "https://api.smara.io/v1/users/user_id_here/context" \ -H "Authorization: Bearer $SMARA_API_KEY" ``` ### Delete a memory ```bash curl -X DELETE "https://api.smara.io/v1/memories/MEMORY_ID" \ -H "Authorization: Bearer $SMARA_API_KEY" ``` ## Instructions for the agent 1. **After conversations**: Extract key facts (preferences, decisions, context) and store them as memories with relevant tags 2. **Before responding**: Search for relevant memories to personalize responses 3. **Contradiction handling**: Smara automatically handles contradictions — if a user changes a preference, just store the new one and the old one is soft-deleted 4. **Duplicate handling**: Smara skips duplicates automatically — safe to store the same fact multiple times 5. **Decay scoring**: Memories naturally lose weight over time. Recent, frequently-accessed memories rank higher. This is automatic. ## Example workflow ``` User: "I switched to Neovim last week" Agent thinks: 1. Search memories for "editor preferences" → finds "Uses vim keybindings" 2. Store new memory: "Switched to Neovim (from vim)" with tags ["preferences", "editor"] 3. Smara auto-detects contradiction with old vim memory → soft-deletes it 4. Respond acknowledging the switch ``` ## API Reference Full docs: https://api.smara.io/docs/


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: omactiengartelle/barbie-style-generator (version 1.0.0)

--- name: barbie-style-generator description: any description into a stunning Barbie-style AI portrait with hyper-feminine glamour doll aesthetics. Generate pastel-saturated fashion doll images, pink editorial portraits, and Barbie movie-inspired looks — perfect for Instagram Reels, TikTok content, identity play, and branded visuals via the Neta AI image generation API (free trial at neta.art/open). tools: Bash --- # Barbie Style Generator any description into a stunning Barbie-style AI portrait with hyper-feminine glamour doll aesthetics. Generate pastel-saturated fashion doll images, pink editorial portraits, and Barbie movie-inspired looks — perfect for Instagram Reels, TikTok content, identity play, and branded visuals. ## Token Requires a Neta API token (free trial at <https://www.neta.art/open/>). Pass it via the `--token` flag. ```bash node <script> "your prompt" --token YOUR_TOKEN ``` ## When to use Use when someone asks to generate or create barbie style ai photo generator images. ## Quick start ```bash node barbiestylegenerator.js "your description here" --token YOUR_TOKEN ``` ## Options - `--size` — `portrait`, `landscape`, `square`, `tall` (default: `portrait`) - `--ref` — reference image UUID for style inheritance ## Install ```bash npx skills add omactiengartelle/barbie-style-generator ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: nmadeleidev/clawjection (version 1.0.0)

--- name: clawjection description: Install and apply ClawJection bundles when a user asks to install a ClawJection, run a ClawJection, or configure an OpenClaw instance from a ClawJection repo, archive, or local bundle. --- # ClawJection Use this skill when the user asks you to install or run a ClawJection. ## What ClawJection Is ClawJection is a bundle format for modifying a local OpenClaw instance so it adopts a specific role or capability set. A ClawJection bundle has: - a required `clawjection.yaml` - an entrypoint declared by that manifest - arbitrary bundle internals chosen by the bundle author The entrypoint is expected to: - modify the OpenClaw workspace or local runtime - install tools, skills, or auth setup when needed - return a structured result JSON with ordered `followups` ## Install Flow 1. Get the bundle locally. 2. Find the bundle root by locating `clawjection.yaml`. 3. Read `clawjection.yaml` and resolve `entrypoint.path`. 4. Run the entrypoint from the bundle root with the `apply` action. 5. By default, let the entrypoint discover OpenClaw config from `~/.openclaw/openclaw.json`. 6. If needed, pass `--openclaw-config-path <path>`. 7. Treat stdout as agent-readable hints. 8. Read the structured result JSON from `CLAWJECTION_RESULT_PATH`. 9. Execute the returned ordered `followups`. ## Source Types ### Git repository - Clone the repo to a temporary local directory. - If the repo contains multiple bundles, choose the directory containing the intended `clawjection.yaml`. ### Archive URL or local zip - Download or unpack it to a temporary local directory. - Identify the bundle root by locating `clawjection.yaml`. ### Local directory - Use it directly if it contains `clawjection.yaml`. ## Execution Rules - Run from the bundle root so relative paths in the bundle resolve correctly. - Do not assume the bundle layout beyond `clawjection.yaml` and the declared entrypoint. - If the bundle installs CLIs or skills, verify they were actually installed before claiming success. - If the result says `needs_user_action`, do not treat the setup as finished; perform the `followups`. ## Safety - Review what the entrypoint appears to do before running untrusted bundles. - Tell the user when a bundle will overwrite core OpenClaw files such as `IDENTITY.md`. - Never claim a remote skill or CLI is installed unless the install command succeeded. - Keep secrets out of workspace files unless the bundle explicitly requires that behavior and the user agrees. ## References - Read `standard/v1.md` in this repo for the full execution contract. - Read `schemas/clawjection.schema.json` and `schemas/result.schema.json` when you need the exact manifest or result structure.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)