OpenClaw/clawhub-security-signals huggingface dataset:
Skill: otman-ai/tikto-automation (version 1.0.0)

# TikTok Carousel Generation Skill (openclaw-style) Short description ----------------- This skill generates a 6-slide TikTok carousel (portrait images + text overlays), drafts a TikTok post using a draft API (Postiz in this repository), and outputs a ready-to-review caption. The focus is cost-effective, reproducible content generation and automating as much of the drafting process as possible while keeping final publishing manual. Quick install & run ------------------- 1. Create and activate a Python virtual environment. 2. Install dependencies: `pip install -r requirements.txt`. 3. Create environment variables: `OPENAI_API_KEY` (for image/text generation) and `POSTIZ_API_KEY` (optional, for uploading and creating drafts). 4. Run the generator (examples in `README.md` / `scripts/`). What this skill contains ----------------------- - `tiktok_content_gen.py` — orchestrator: creates hook, locked architecture, images, captions and can upload a draft. - `postiz_api_integration.py` — small Postiz client used to upload media and create drafts (keeps drafts private by default). - `scripts/generate.py` — thin CLI wrapper to run generation locally. - `scripts/upload.py` — CLI wrapper to upload generated images and create a draft. - `requirements.txt` — Python dependencies. Inputs / outputs (contract) -------------------------- - Inputs: target persona/topic, optional prompt seeds, number of slides (default 6), style hints. - Outputs: `images/final_slide_{i}.png`, `caption.txt`, optional Postiz draft (returns draft id/url). Security & cost notes --------------------- - Keep API keys out of source control and use environment variables. - Image generation costs depend on the model (DALL·E 3 or similar). Use batching or lower-res variants for cost savings. Installation details and examples are in `README.md` inside this folder.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: will1189/ai-ppt1 (version 1.0.0)

--- name: "ai-ppt" description: "Creates professional, elegant PPT presentations with modern design. Invoke when user wants to create, design, or generate a PowerPoint presentation." --- # AI PPT - Professional Presentation Creator A sophisticated PPT creation skill that produces elegant, modern presentations with refined typography, balanced layouts, and professional visual design. ## When to Use - Create business presentations, project proposals, or reports - Design portfolio or product showcases - Build training materials or educational content - Generate meeting presentations with clean aesthetics - Any request involving PowerPoint, slides, or presentation creation ## Core Principles 1. **Minimalist Elegance** - Clean layouts with purposeful white space 2. **Professional Typography** - Clear hierarchy with 2-3 complementary fonts 3. **Balanced Composition** - Asymmetric balance for visual interest 4. **Refined Color Palette** - Understated elegance, never garish 5. **Content Clarity** - Information hierarchy that guides the viewer ## Design Guidelines ### Typography - Headings: Bold, larger size (28-36pt for titles) - Body: Regular weight, comfortable reading size (16-18pt) - Use 2-3 font families maximum throughout ### Color Scheme - Primary: Deep navy (#1a365d) or charcoal (#2d3748) - Accent: Muted gold (#d69e2e) or teal (#319795) - Background: Pure white or soft cream (#faf5eb) - Text: Dark gray (#4a5568) for body, black for headings ### Layout Principles - Title slides: Centered, minimal, impactful - Content slides: Left-aligned text, visual breathing room - Use consistent margins and alignment - 6x6 grid system for element placement ## Output Format ```markdown ## Slide Title ### Content Point 1 Brief description or details ### Content Point 2 Brief description or details ### Visual Element [Description of chart/image/graphic] ``` ## Quality Checklist - [ ] Clear visual hierarchy on every slide - [ ] Consistent font usage throughout - [ ] Adequate white space between elements - [ ] Professional color combinations - [ ] No cluttered or overwhelming layouts - [ ] Readable at standard projection distances


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: projectsnowwork/verifier (version 1.0.0)

--- name: verifier description: Trust and evidence verification engine for claims, sources, screenshots, profiles, offers, and suspicious messages. Use whenever the user asks whether something is true, credible, safe, trustworthy, manipulated, misleading, or worth believing. Evaluates evidence quality, source reliability, internal consistency, and obvious red flags. Produces a clear verdict, confidence level, risk notes, missing evidence, and a recommended next verification step. Local-only storage. --- # Verifier: Trust the evidence, not the vibe. ## Core Philosophy 1. Verify claims, not feelings. 2. Distinguish evidence from presentation. 3. Confidence should reflect proof quality, not tone or certainty. 4. When proof is weak, say what is missing. ## Runtime Requirements - Python 3 must be available as `python3` - No external packages required ## Agent vs Script Responsibilities - The LLM must extract text from screenshots, summarize external links, and convert outside content into structured evidence before passing it into verifier scripts. - Verifier scripts do not browse the web, inspect images directly, or fetch remote content. - Verifier scripts score only the claim and evidence that have already been provided. ## Storage All data is stored locally only under: - `~/.openclaw/workspace/memory/verifier/cases.json` No external sync. No cloud storage. No third-party APIs. ## Case Types - `claim`: A statement that needs verification - `source`: A source whose credibility needs assessment - `screenshot`: An image or claimed visual proof - `profile`: A person or identity claim - `offer`: A proposal, deal, or opportunity - `message`: A suspicious or questionable message - `website`: A site or page that needs trust evaluation ## Evidence Schema Each evidence item should be structured with: - `id` - `type` - `content` - `support_level` (`supports`, `contradicts`, `neutral`) - `source_label` - `added_at` ## Core Outputs Each verification case should aim to produce: - a verdict - a confidence level - risk notes - missing evidence - a recommended next step ## Key Workflows - **Capture a case**: `add_case.py --title "..." --type claim --claim "..."` - **Score a case**: `score_case.py --id VER-XXXX` - **Review a case**: `show_case.py --id VER-XXXX` - **Update evidence**: `update_case.py --id VER-XXXX --notes "..."` - **Close a case**: `close_case.py --id VER-XXXX --verdict inconclusive` - **List open cases**: `list_cases.py` ## Scripts | Script | Purpose | |---|---| | `add_case.py` | Capture a new verification case | | `score_case.py` | Score credibility, risk, and evidence quality | | `show_case.py` | Show one case in detail | | `list_cases.py` | List stored cases | | `update_case.py` | Update notes, status, and evidence | | `close_case.py` | Close a case with final verdict | | `init_storage.py` | Initialize local storage |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: darrenluo/coinfound-skill (version 1.0.1)

--- name: coinfound-rwa-read description: Read-only CoinFound RWA data skill backed by a bundled endpoint catalog and schema snapshots. version: 0.1.0 metadata: openclaw: requires: anyBins: - python3 - python --- # CoinFound RWA Read Self-contained read-only access to CoinFound RWA `GET` endpoints. ## Scope - Supports `aggregates`, `timeseries`, `pie`, `list`, and `dataset` routes under `v1/c/rwa/*`. - Does not refresh schema snapshots. Hand unresolved schema gaps to `$coinfound-rwa-schema-probe`. ## Workflow 1. Read the bundled endpoint catalog and schema snapshots before constructing a request. 2. Resolve the route by `endpoint_key` or by `asset_class + family + metric`. 3. Run the bundled fetch script and return both the envelope and normalized payload. 4. If the schema is missing or conflicts with live data, delegate to `$coinfound-rwa-schema-probe`. ## Bundled Resources Read first: - `shared/coinfound_rwa/data/endpoint_catalog.json` - [REDACTED_SECRET] Run: - `shared/coinfound_rwa/scripts/fetch_rwa.py` ## Minimal Examples ```bash python3 shared/coinfound_rwa/scripts/fetch_rwa.py \ --endpoint-key stable-coin.market-cap.timeseries \ --query '{"groupBy":"network"}' ``` ```bash python3 shared/coinfound_rwa/scripts/fetch_rwa.py \ --asset-class private-credit \ --family aggregates ``` ## Expected Output Default output should include: - `request` - `response_envelope` - `normalized_data` - `display_data` - `shape_family` - `schema_source` ## References - `references/rwa-read-workflow.md` - `references/rwa-read-capabilities.md` - `references/rwa-read-integration-notes.md`

path: shared/coinfound_rwa/__init__.py
content: """Shared helpers for CoinFound RWA skills."""

from .catalog import BASE_URL, DEFAULT_CATALOG_PATH, SNAPSHOT_DIR

__all__ = [
    "BASE_URL",
    "DEFAULT_CATALOG_PATH",
    "SNAPSHOT_DIR",
]


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: fuwenquant/hello-skills (version 1.0.1)

# helloskills ## 功能描述 这是一个 helloskills 技能，用于实现特定的量化分析功能。 ## 使用场景 适用于需要进行量化策略分析和信号生成的场景。 ## 输入参数 - params: 包含输入参数的字典 ## 输出结果 - success: 执行是否成功 - message: 执行结果消息 - data: 返回的数据


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: felmonon/trust-protocol (version 2.0.1)

# Agent Trust Protocol (ATP) Establish, verify, and maintain trust between AI agents. Bayesian trust scoring with domain-specific trust, revocation, forgetting curves, and a visual dashboard. ## Install ```bash git clone https://github.com/FELMONON/trust-protocol.git # No dependencies beyond Python 3.8+ stdlib # Pair with skillsign for identity: https://github.com/FELMONON/skillsign ``` ## Quick Start ```bash # Add an agent to your trust graph python3 atp.py trust add alpha --fingerprint "abc123" --score 0.7 # Record interactions — trust evolves via Bayesian updates python3 atp.py interact alpha positive --note "Delivered clean code" python3 atp.py interact alpha positive --domain code --note "Tests passing" # Check trust python3 atp.py trust score alpha python3 atp.py trust domains alpha # View the full graph python3 atp.py status python3 atp.py graph export --format json # Run the full-stack demo (identity → trust → dashboard) python3 demo.py --serve ``` ## Commands ### Trust Management ```bash atp.py trust add <agent> --fingerprint <fp> [--domain <d>] [--score <0-1>] atp.py trust list atp.py trust score <agent> atp.py trust remove <agent> atp.py trust revoke <agent> [--reason <reason>] atp.py trust restore <agent> [--score <0-1>] atp.py trust domains <agent> ``` ### Interactions ```bash atp.py interact <agent> <positive|negative> [--domain <d>] [--note <note>] ``` ### Challenge-Response ```bash atp.py challenge create <agent> atp.py challenge respond <challenge_file> atp.py challenge verify <response_file> ``` ### Graph ```bash atp.py graph show atp.py graph path <from> <to> atp.py graph export [--format json|dot] atp.py status ``` ### Dashboard ```bash python3 serve_dashboard.py # localhost:8420 python3 demo.py --serve # full demo + dashboard ``` ### Moltbook Integration ```bash python3 moltbook_trust.py verify <agent> # check agent trust via Moltbook profile ``` ## How Trust Works - **Bayesian updates**: Each interaction shifts trust scores with diminishing deltas (prevents thrashing) - **Negativity bias**: Negative interactions hit harder than positive ones boost - **Domain-specific**: Trust an agent for code but not for security advice - **Forgetting curves**: Trust decays without interaction (R = e^(-t/S)) - **Revocation**: Immediate drop to floor, restorable at reduced score - **Transitive trust**: If you trust A and A trusts B, you partially trust B (with decay) ## Integration with skillsign ATP builds on [skillsign](https://github.com/FELMONON/skillsign) for identity: 1. Agents generate ed25519 keypairs with skillsign 2. Agents sign skills, others verify signatures 3. Verified agents get added to the ATP trust graph 4. Interactions update trust scores over time ## Triggers "check trust", "trust score", "trust graph", "verify agent", "agent trust", "trust status", "who do I trust", "trust report"


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (HIGH)
Skill: bibaofeng/stock-hot-zh (version 1.0.0)

--- name: stock-hot-zh description: "通过 AISA 扫描热门股票和加密资产的实时异动。触发条件：当用户想知道现在什么最热、什么在大幅波动、市场动量如何、涨幅榜或消息驱动异动时使用。" author: aisa version: "1.0.0" license: Apache-2.0 user-invocable: true primaryEnv: AISA_API_KEY requires: env: - AISA_API_KEY bins: - python3 metadata: openclaw: primaryEnv: AISA_API_KEY requires: env: - AISA_API_KEY bins: - python3 --- # 热门标的扫描 ## 何时使用 - 通过 AISA 扫描热门股票和加密资产的实时异动。触发条件：当用户想知道现在什么最热、什么在大幅波动、市场动量如何、涨幅榜或消息驱动异动时使用。 ## 不适用场景 - 当用户明确要本地浏览器 Cookie、密码、Keychain 或其他本地敏感凭据时，不要使用这个 skill。 - 当问题与该 skill 的主题无关时，优先选择更贴切的 skill。 ## 核心能力 - 找出涨跌幅居前标的、动量标的和快速市场总结。 ## 快速开始 ```bash export AISA_API_KEY="your-key" ``` ## 运行方式 首选运行路径是仓库内置的 Python 客户端： ```bash python3 scripts/hot_scanner.py ``` ## 示例请求 - 展示当前最热门的股票和加密异动标的。 ## 说明 - 仅供信息参考，不构成投资建议。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: hitman86r/copilot-usage (version 1.0.0)

--- name: copilot-usage description: >- Display GitHub Copilot premium request usage, quota, billing stats, and per-model multipliers for the authenticated user. Use when the user asks about their Copilot usage, remaining premium requests, which models they used, monthly quota status, overage costs, or wants a Copilot usage dashboard or report. Works with Free, Pro, Pro+, Business, and Enterprise plans. Requires gh CLI authenticated with manage_billing:copilot and user scopes. Triggers on — copilot usage, copilot quota, premium requests, copilot billing, how many copilot requests, show copilot stats. --- # Copilot Usage Skill Fetch and display GitHub Copilot premium request usage via the GitHub REST API. ## Important API Limitations The GitHub Billing API **does not expose the plan quota** (e.g., 50, 300, or 1500 requests/month). This information is not available in any endpoint. Therefore: 1. **The user must configure their plan once** — stored in `~/.config/copilot-usage/config.json` 2. On first run, the script detects missing config and prompts the user to set their plan Explain this limitation clearly to the user when asking for their plan. Reference: https://docs.github.com/en/rest/billing/usage ## Auth Requirements - Requires `gh` CLI authenticated with scopes: `manage_billing:copilot` + `user` - Fine-grained tokens are **not supported** by GitHub billing endpoints — classic PAT required - Check: `gh auth status` - Fix: `gh auth login` then `gh auth refresh -s manage_billing:copilot` ## Usage ```bash bash scripts/copilot-usage.sh # current month bash scripts/copilot-usage.sh --month 3 --year 2026 # specific month bash scripts/copilot-usage.sh --model claude # filter by model bash scripts/copilot-usage.sh --json # raw JSON output bash scripts/copilot-usage.sh --set-plan pro+ # configure plan bash scripts/copilot-alert.sh --threshold 80 # quota alert check ``` ## Model Multipliers The `grossQuantity` returned by the API **already includes the multiplier**. The script reverse-calculates the actual number of prompts sent and shows both values. See `references/multipliers.md` for the full table. Key insight: `actual_prompts = grossQuantity / multiplier` ## What the Dashboard Shows - Monthly quota used vs. remaining (requires plan config) - Progress bar with percentage - Overage count and cost - Per-model breakdown with multiplier, gross requests, and estimated actual prompts - Days until monthly reset - Warning if plan config is missing or stale ## Config File Stored at `~/.config/copilot-usage/config.json`: ```json { "plan": "pro+", "quota": 1500, "set_at": "2026-04-08" } ``` ## Handling Errors - **403 Forbidden** — token lacks billing scope: `gh auth refresh -s manage_billing:copilot` - **404 Not Found** — verify endpoint path or plan eligibility (org/enterprise users must use org-level endpoints) - **Config missing** — run `bash scripts/copilot-usage.sh --set-plan <plan>` ## API Endpoints See `references/api.md` for full endpoint documentation and response schemas.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: aaronnee520/trade-inquiry-agent (version 1.0.1)

--- name: trade-inquiry-agent description: 外贸工厂询盘全流程 Agent。覆盖：询盘解析、产品可行性分析、报价单生成（中英文）、专业外贸邮件起草、客户建档与跟进管理。当用户提到外贸询盘、海外客户报价、出口报价单、外贸邮件、FOB/CIF 报价、工厂对外贸、出口报价等场景时触发。 --- # Trade Inquiry Agent — 外贸工厂询盘全流程 ## 核心能力 1. **询盘解析** — 从客户邮件/消息中提取：品名、规格、数量、交期、目标价、付款方式、贸易术语 2. **产品可行性分析** — 判断需求匹配度、原材料行情、产能判断、风险提示 3. **报价单生成** — 输出标准外贸报价单（中英文，含 FOB/CIF/EXW 多种报价） 4. **专业邮件起草** — 首封报价、跟进、还盘、拒绝、感谢等场景 5. **客户建档** — 结构化记录客户信息、跟进节点、往来记录 --- ## 工作流 ### Step 1 — 询盘解析 当用户提供原始询盘内容（邮件原文、截图、关键词），提取以下结构化字段： ``` 产品名称： 规格/参数： 数量： 目标单价： 目标总价： 目标交期： 付款方式： 贸易术语（FOB/CIF/EXW）： 其他要求（认证/包装/样品）： ``` 若信息缺失，在回复中列出「需确认事项清单」，不要凭空假设。 ### Step 2 — 产品可行性分析 基于工厂能力评估： - 原材料是否有库存/可采购 - 最低起订量（MOQ）是否满足 - 标准交期 vs 客户要求 - 是否需要开模/定制（成本+时间） - 汇率/原材料波动风险提示 - 给出「可接单」「有条件可接」「无法承接」的明确判断 ### Step 3 — 报价单生成 生成标准报价单，包含： - 公司抬头、联系方式 - 报价有效期 - 产品明细（品名/规格/MOQ/单价/总价） - 贸易术语（FOB/CIF/EXW 分别报价） - 交货周期 - 付款条件 - 包装方式 - 验货标准 中文 + 英文双语版本。用 Markdown 表格输出，可直接复制发送。 ### Step 4 — 邮件起草 根据场景选择对应模板（详见 `references/email_templates.md`）： - **首封报价邮件**：专业简洁，包含核心参数 + 有效期 - **跟进邮件**：3/7/14 天节奏，不同催单力度 - **还盘邮件**：处理客户议价，策略性让步 - **拒绝/转介邮件**：礼貌拒绝，维护关系 ### Step 5 — 客户建档 使用结构化格式记录： ``` ## 客户档案 - 公司名称： - 联系人 / 职位： - 国家/地区： - 主营产品： - 询盘次数： - 成交记录： - 跟进记录（日期 | 内容 | 下一步）： - 备注： ``` --- ## 报价计算参考 **FOB = EXW + 内陆运费 + 港口费 + 订舱费 + 文件费** **CIF = FOB + 海运费 + 保险费** **CFR = FOB + 海运费** 利润率建议区间： - 老客户/大订单：8%-15% - 新客户/小订单：15%-25% - 定制品/小批量：25%-40% --- ## 参考文件 - 邮件模板库 → `references/email_templates.md` - 报价单结构参考 → `references/quotation.md` - 产品分类与参数参考 → `references/product_classification.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: wanng-ide/arxiv-skill-learning (version 1.0.0)

--- name: arxiv-skill-learning description: Orchestrates the continuous learning of new skills from arXiv papers. Use this to trigger a learning cycle, which fetches papers, extracts code/skills, and solidifies them. --- # ArXiv Skill Learning ## Usage ```javascript const learner = require('./index'); const result = await learner.main(); ``` ## Workflow 1. **Patrol**: Checks arXiv for relevant new papers (Agent, LLM, Tool Use). 2. **Extract**: Uses `arxiv-skill-extractor` to generate skill code. 3. **Test**: Runs generated tests. 4. **Solidify**: Commits the new skill to the workspace. ## Configuration - Target Categories: cs.AI, cs.CL, cs.LG, cs.SE - Schedule: Hourly


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (HIGH)
Skill: bytesagain3/secret-sealer (version 2.0.1)

--- name: "secret-sealer" version: "2.0.1" description: "Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Secret Sealer concepts, best practices, and implementation patterns." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [secret,sealer, reference] category: "devtools" --- # Secret Sealer Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Secret Sealer concepts, best practices, and implementation patterns. No API keys or credentials required. ## Commands | Command | Description | |---------|-------------| | `intro` | intro reference | | `quickstart` | quickstart reference | | `patterns` | patterns reference | | `debugging` | debugging reference | | `performance` | performance reference | | `security` | security reference | | `migration` | migration reference | | `cheatsheet` | cheatsheet reference | ## Output Format All commands output plain-text reference documentation via heredoc. No external API calls, no credentials needed, no network access. --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xiaomaju-888/gog-xiaoshu (version 1.0.0)

--- name: gog description: Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs. homepage: https://gogcli.sh metadata: {"clawdbot":{"emoji":"🎮","requires":{"bins":["gog"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/gogcli","bins":["gog"],"label":"Install gog (brew)"}]}} --- # gog Use `gog` for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup. Setup (once) - `gog auth credentials /path/to/client_secret.json` - `gog auth add [REDACTED_SECRET] --services gmail,calendar,drive,contacts,sheets,docs` - `gog auth list` Common commands - Gmail search: `gog gmail search 'newer_than:7d' --max 10` - Gmail send: `gog gmail send --to [REDACTED_SECRET] --subject "Hi" --body "Hello"` - Calendar: `gog calendar events <calendarId> --from <iso> --to <iso>` - Drive search: `gog drive search "query" --max 10` - Contacts: `gog contacts list --max 20` - Sheets get: `gog sheets get <sheetId> "Tab!A1:D10" --json` - Sheets update: `gog sheets update <sheetId> "Tab!A1:B2" --values-json '[["A","B"],["1","2"]]' --input USER_ENTERED` - Sheets append: `gog sheets append <sheetId> "Tab!A:C" --values-json '[["x","y","z"]]' --insert INSERT_ROWS` - Sheets clear: `gog sheets clear <sheetId> "Tab!A2:Z"` - Sheets metadata: `gog sheets metadata <sheetId> --json` - Docs export: `gog docs export <docId> --format txt --out /tmp/doc.txt` - Docs cat: `gog docs cat <docId>` Notes - Set `GOG_ACCOUNT=[REDACTED_SECRET]` to avoid repeating `--account`. - For scripting, prefer `--json` plus `--no-input`. - Sheets values can be passed via `--values-json` (recommended) or as inline rows. - Docs supports export/cat/copy. In-place edits require a Docs API client (not in gog). - Confirm before sending mail or creating events.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)