OpenClaw/clawhub-security-signals huggingface dataset:
Skill: beachanger/fitclaw-public-core (version 1.0.0)

--- name: fitclaw-public-core description: Public-safe FitClaw coaching workflow covering onboarding, hydration, nutrition, and training structure. Use when demonstrating a reusable AI fitness coaching method without exposing private user data or live production configuration. --- # FitClaw Public Core ## Purpose This is the public-safe packaging layer for FitClaw. It is not the live production workspace. Its purpose is to expose the reusable coaching workflow only. --- ## Release Gate This package is review-first. That means: 1. prepare the candidate package locally, 2. review it carefully, 3. publish only after explicit approval. Without explicit approval, this package should remain in staging only. --- ## Included public workflow scope This package currently focuses on four reusable workflow blocks: 1. onboarding 2. hydration support 3. nutrition guidance 4. training framework guidance --- ## Hard boundary Never treat this package as a dump of the live FitClaw project. Only include: - reusable workflow logic - public-safe templates - generalized examples - sanitized references Never include: - credential files - private user media - private user reports or history - private runtime bindings - private operational materials embedded in scripts or examples --- ## Packaging rule If this package is prepared for ClawHub, it must pass privacy review first. The public asset is the method, not the real operating state. --- ## Current candidate modules - fitclaw-onboarding-public - fitclaw-hydration-public - fitclaw-nutrition-public - fitclaw-training-public These modules were rewritten into public-safe references before publish. --- ## Output goal A publishable public-safe skill package that demonstrates the FitClaw coaching method without leaking private or operational data.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: wangyendt/chat-ollama-gradio (version 0.1.0)

--- name: pywayne-llm-chat-ollama-gradio description: Gradio-based chat interface for Ollama with multi-session management. Use when working with pywayne.llm.chat_ollama_gradio module to create a web-based chat UI that connects to Ollama models, supports multiple chat sessions, model selection, and streaming responses. Integrates with ChatManager for session management. --- # Pywayne Chat Ollama Gradio This module provides a Gradio-based web chat interface for Ollama models with multi-session support. ## Quick Start ```python from pywayne.llm.chat_ollama_gradio import OllamaChatGradio # Create and launch chat interface app = OllamaChatGradio( base_url="http://localhost:11434/v1", server_port=7870 ) app.launch() ``` ## Configuration | Parameter | Default | Description | |-----------|---------|-------------| | `base_url` | `"http://localhost:11434/v1"` | Ollama API base URL | | `server_name` | `"0.0.0.0"` | Server host name | | `server_port` | `7870` | Server port | | `root_path` | `""` | Root path for reverse proxy | | `api_key` | `"ollama"` | API key (for Ollama compatibility) | ## Model Discovery Automatically discovers available Ollama models by running `ollama list`: - Excludes models with 'embed' in the name - Falls back to `qwen2.5:0.5b` if no models found ## Session Management ### Creating New Sessions ```python # UI method: Click "新建会话" button new_chat_id, new_history, new_choices = app.create_new_chat() ``` ### Switching Sessions ```python # UI method: Select from "历史会话" radio list history = app.switch_chat(selected_chat_id) ``` ## API Reference ### OllamaChatGradio | Method | Description | |---------|-------------| | `get_ollama_models()` | Get list of available Ollama models | | `init_chat_manager()` | Initialize ChatManager instance | | `create_new_chat()` | Create new chat session, returns (chat_id, history, radio_update) | | `switch_chat(chat_id)` | Switch to specified chat session | | `format_history(history)` | Format history for display | | `chat(message, history, model_name)` | Process chat message with streaming | | `create_demo()` | Create Gradio interface | | `launch()` | Launch Gradio server | ## UI Components | Component | Description | |-----------|-------------| | `chatbot` | Main chat display area | | `msg` | Message input textbox | | `model_dropdown` | Model selection dropdown | | `chat_id_text` | Current session ID (read-only) | | `new_chat_btn` | Button to create new session | | `chat_history_list` | Radio list for session switching | ## Requirements - `gradio` - Web UI framework - `pywayne.llm.chat_bot` - ChatManager and LLMConfig - `ollama` CLI - Must be installed and accessible ## Notes - Uses ChatManager for multi-session support - Streaming responses update UI in real-time - Session history persists in memory (not persistent) - Requires Ollama to be running before launching


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: brucegutman/pipeworx-nutrition (version 1.0.0)

--- name: pipeworx-nutrition description: Nutrition MCP — wraps Open Food Facts API (free, no auth) version: 1.0.0 metadata: openclaw: homepage: https://pipeworx.io/packs/nutrition --- # pipeworx-nutrition Nutrition MCP — wraps Open Food Facts API (free, no auth). Free, no API key. Part of [Pipeworx](https://pipeworx.io). ## Tools - `search_products` - `get_product` ## Connect ```json { "mcpServers": { "pipeworx-nutrition": { "command": "npx", "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/nutrition/mcp"] } } } ``` More at [pipeworx.io/packs/nutrition](https://pipeworx.io/packs/nutrition)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mikeclaw007/audible (version 0.1.1)

--- name: audible description: 注册“Audible”技能；用于阅读产品公开页面、书库入口、会员说明与帮助信息整理。 homepage: `https://www.audible.com/` metadata: {"clawdbot":{"emoji":"📖"}} --- # Audible 用途与边界 - 面向公开官网、书城页、会员页、帮助中心与活动页的信息整理 - 不提供盗版资源、版权绕过、会员代充、账号共享或接口调用能力 - 仅处理公开可见的书库入口、会员说明、阅读功能与帮助信息 关键入口 - 主页：https://www.audible.com/ - 书库与内容：书城、分类、榜单、专题、作者或出版方入口 - 会员与帮助：会员页、订阅说明、帮助中心、活动页入口 常见任务 - 书库分类、榜单、书单与内容入口整理 - 会员权益、订阅规则、下载说明与设备支持汇总 - 帮助中心、常见问题、活动页与版权说明提取 数据字段 - 内容分类、榜单入口、会员权益、链接 - 设备支持、离线规则、帮助页、活动页链接 - 版权说明、FAQ、下载限制、公告入口 自动化要点 - 内容授权和会员权益存在地区与时间差异，输出时注明上下文 - 不输出盗版下载、会员共享、抓包或接口绕过建议 - 不处理个人书架、阅读记录、购买记录或私有账户数据 示例流程 - 书库整理：访问 Audible 书城与分类页 → 输出内容入口清单 - 权益整理：进入会员页 → 提取权益与限制 → 输出表格 - 帮助汇总：访问帮助中心 → 提取下载、设备、FAQ → 输出摘要 合规提示 - 遵守平台规则、版权要求与账号安全要求 - 只整理公开信息，不输出敏感数据或非公开内容


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: realowg/google-maps-leadgen-skill (version 0.1.0)

--- name: google-maps-leadgen description: Generate B2B leads from Google Maps using a self-hosted MCP server (`google-maps`) and export to CSV or XLSX. Use when the user asks for lead generation by country/city/industry, wants phone/website/email enrichment, wants deduped lead lists, or asks to send lead files back in chat (especially Telegram file delivery). --- # Google Maps Lead Generation (MCP) Use this skill to run repeatable lead-gen batches from Google Maps via MCP. ## Preconditions - `mcporter` configured with server `google-maps`. - Server key in env (`GOOGLE_MAPS_API_KEY`) must be server-compatible (no browser referrer restriction). - For XLSX output, `openpyxl` available in venv. ## Fast workflow 1. Build query set from geography + target verticals. 2. Run `maps_search_places` for each query. 3. Keep only in-target geography, dedupe by `place_id`. 4. Enrich each place with `maps_place_details`. 5. Export CSV or XLSX. 6. If user asks for file in Telegram, send with `message` tool `action=send` + `media` path. ## Query strategy Use focused terms instead of broad generic terms. - Good: `"odoo partner <city> <country>"`, `"erp integrator <city> <country>"`, `"logistics company <city> <country>"` - Avoid huge overlapping lists in one run; do batches. ## Required output columns (V2) - `name` - `address` - `phone` - `website` - `email` (empty if not discoverable) - `rating` - `place_id` - `google_maps_url` (mobile-safe): - `https://www.google.com/maps/search/?api=1&query=<NAME>&query_place_id=<PLACE_ID>` ## Cost notes - Search calls are usually main paid SKU driver. - Place details add enrichment cost. - Report rough run cost estimate and mention free-tier caveat. ## Reliability guardrails - Batch enrich in small chunks (10–50) to avoid long-running timeouts. - Add retries for transient failures. - Never commit API keys or sensitive exports. ## Delivery rules - If user asks for CSV/XLSX file in chat: send via `message` tool (`media` path). - If user asks specifically for XLSX formatting/edits, use xlsx workflow standards. - Keep summary concise: count, coverage (`with_phone`, `with_website`, `with_email`), file path/name.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: totoxu/totoxu-montecarlo (version 1.3.0)

--- name: totoxu-montecarlo description: Monte Carlo Crypto Trading Core. Simulates thousands of future price paths (Geometric Brownian Motion) to evaluate win probabilities, risk of ruin, and stop-loss impact for trading strategies. version: 1.0.0 author: totoxu requires: binaries: - python3 env: ["SKILL_BILLING_API_KEY", "SKILL_ID"] metadata: clawdbot: requires: env: ["SKILL_BILLING_API_KEY", "SKILL_ID"] files: - "scripts/*" --- # Monte Carlo Crypto Core This skill enables you to run sophisticated Monte Carlo simulations for trading strategies. It helps answer questions like: "If I buy BTC at $70,000 with 5% daily volatility and put a stop loss at $65,000, what is the probability I get stopped out within 30 days?" ## Setup 1. Install `requests`: `pip install requests` 2. Set the `SKILLPAY_API_KEY` environment variable with the skill owner's SkillPay API key. ## Billing (0.001 USDT per call via SkillPay) This is a paid skill. **Every** simulation call requires the `--user USER_ID` parameter. If a call fails with a `payment_url`, you must show this link to the user. --- ## Tool: Run Monte Carlo Simulation **Command:** ```bash python scripts/montecarlo.py --user USER_ID --price 70000 --vol 0.04 --drift 0.001 --days 30 --paths 5000 --stop-loss 65000 --position long ``` **Required Parameters:** - `--user`: The user's ID for billing. - `--price`: The current price of the asset. - `--vol`: The estimated **daily** volatility as a decimal (e.g., `0.04` for 4%). You can derive this from historical data standard deviation. **Optional Parameters:** - `--drift`: The expected daily return. Default is `0.0`. Positive drift favours longs, negative favours shorts. - `--days`: Number of days to simulate into the future. Default: `30`. - `--paths`: Number of simulation paths to run. Higher is more accurate but slower. Max is `20000`, Default `10000`. - `--position`: `long` or `short`. Default is `long`. - `--stop-loss`: The exact price level where the position gets liquidated or closed for a loss. - `--take-profit`: The exact price level where the position closes in profit. **Output:** Returns a JSON object containing expected prices, 5th/95th percentile worst/best case scenarios, and `risk_metrics` including the exact probability of hitting the stop loss (`hit_stop_loss_pct`) and overall win probability. Use these probabilities to justify your trading advice to the user. Do not recommend trades with a `win_probability_pct` lower than 50% unless the user explicitly accepts high risk.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: cp3d1455926-svg/news-digest-aggregator (version 1.0.0)

--- name: news-digest-aggregator description: Daily automated news digest that fetches RSS feeds, aggregates articles using LLM summarization, and delivers formatted digests to messaging channels (Discord/Slack/Feishu) on a schedule. Use when user wants daily news summaries, RSS aggregation, or scheduled content delivery. --- # News Digest Aggregator Automated daily news digest system that collects articles from RSS feeds, summarizes them using LLM, and delivers formatted digests to your preferred messaging channel. ## Quick Start 1. Configure RSS sources in `references/sources.json` 2. Set up channel credentials in environment variables 3. Run `scripts/fetch_and_digest.py` manually or schedule with cron ## Configuration ### RSS Sources Edit `references/sources.json`: ```json { "sources": [ {"name": "TechCrunch", "url": "https://techcrunch.com/feed/", "category": "tech"}, {"name": "Reuters", "url": "https://www.reutersagency.com/feed/?taxonomy=markets&post_type=reuters-best", "category": "finance"} ] } ``` ### Channel Settings Set environment variables for your target channel: **Discord:** ```bash export DISCORD_WEBHOOK_URL="https://discord.com/api/webhooks/..." ``` **Slack:** ```bash export SLACK_WEBHOOK_URL="https://hooks.slack.com/services/..." ``` **Feishu:** ```bash export FEISHU_WEBHOOK_URL="https://open.feishu.cn/open-apis/bot/v2/hook/..." ``` ## Usage ### Manual Run ```bash python scripts/fetch_and_digest.py --config references/sources.json --channel discord ``` ### Scheduled (Cron) ```bash # Daily at 9 AM 0 9 * * * cd /path/to/skill && python scripts/fetch_and_digest.py --config references/sources.json --channel discord ``` ## Output Format The digest includes: - 📅 Date header - 📊 Summary statistics (total articles, sources) - 🏷️ Categorized sections - 🔗 Article links with brief summaries ## Customization - **Max articles per source**: Edit `MAX_ARTICLES` in the script (default: 5) - **Summary length**: Adjust `SUMMARY_MAX_TOKENS` (default: 150) - **Categories**: Modify category tags in sources.json


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: artyomx33/cross-pollination-engine (version 1.0.0)

--- name: cross-pollination-engine description: Systematically borrow ideas from unrelated industries to solve problems. Innovation often comes from adjacent fields. Use when user says "cross-pollination", "how would X solve this", "borrow ideas from", "what can we learn from", "think outside the box", "how would Disney/Apple/Amazon do this", "different industry", "steal ideas". --- # Cross-Pollination Engine ## The Core Insight Most "innovation" is applying proven solutions from one domain to another. - Resistance wheels → Rollerblades - Gaming XP systems → Duolingo - Hotel concierge → Software onboarding ## The Process 1. **Define the core job** (strip away industry context) 2. **Find who else solves it** (often surprising industries) 3. **Extract principles** (not surface features) 4. **Translate to your context** (adapt, don't copy) ## Industry Inspiration Library | Need | Look At | Why | |------|---------|-----| | **Trust** | Banking, Healthcare, Aviation | Verification, credentials, checklists | | **Engagement** | Gaming, Fitness apps, Streaming | XP, streaks, personalization, progress | | **Onboarding** | Hotels, Theme parks, Luxury retail | Concierge, anticipation, personal touch | | **Simplicity** | Apple, IKEA, Google | Feature cutting, hidden complexity | | **Urgency** | E-commerce, Airlines, Fast food | Scarcity, anchoring, speed promises | | **Community** | CrossFit, Harley-Davidson, Peloton | Tribal identity, shared experience | ## Output Format ``` PROBLEM: [What you're solving] CORE JOB: [Stripped to fundamentals] FROM [Industry 1]: How they solve it: [x] Key principle: [y] Applied to us: [z] FROM [Industry 2]: How they solve it: [x] Key principle: [y] Applied to us: [z] SYNTHESIS: [Combined approach] NEXT STEP: [Concrete action] ``` ## Prompt Starters - "How would Disney solve our onboarding?" - "What would Amazon do with our data?" - "If this were a game, how would it work?" - "How do luxury hotels make people feel special?" ## Integration Compounds with: - **jtbd-analyzer** → Understand job first, then find who else solves it - **first-principles-decomposer** → Strip context to find fundamental need - **six-thinking-hats** → Green Hat pairs naturally with cross-pollination - **app-planning-skill** → Apply borrowed patterns to new apps --- See references/examples.md for Artem-specific cross-pollinations


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: fangshan101-coder/maishou-mama (version 0.1.0)

--- name: 买手妈妈返利助手 description: 买手妈妈母婴社交电商返利工具，专注母婴消费群体，提供母婴商品优惠券查找和返利服务，覆盖淘宝京东拼多多等平台。 version: 0.1.0 --- # 买手妈妈返利助手 买手妈妈母婴社交电商返利工具。专注为宝妈群体提供母婴商品的大额优惠券和返利服务，覆盖淘宝、京东、拼多多等主流电商平台，涵盖尿裤湿巾、喂养洗护、童装玩具等母婴品类。 ## 触发词 买手妈妈、买手妈妈返利、maishou mama、母婴返利、宝妈返利、母婴优惠券 ## 计划实现能力 - **母婴专区返利**：专注母婴品类的高佣商品筛选 - **大额优惠券**：母婴商品隐藏优惠券查找 - **品牌正品保障**：品牌直营模式，7天无理由退换 - **宝妈社群推广**：生成适合宝妈群的推广素材 ## 输出格式 ``` 👶 买手妈妈返利查询 商品：[商品名称] 品类：[母婴品类] 售价：¥[价格] 优惠券：[券描述] 返利比例：[X]% 预计返利：¥[金额] ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: pcjinglang/bilibili-analytics (version 1.0.0)

--- name: bilibili-analytics description: "Bilibili视频搜索与数据分析。抓取指定关键词的搜索结果，生成统计报告。支持多页面抓取、数据分析和可视化报告。适用于：(1) 搜索B站视频 (2) 分析视频数据 (3) 生成统计报告 (4) 追踪热门趋势" --- # Bilibili Analytics 搜索和分析B站视频数据，生成统计报告。 ## 快速开始 ```bash # 搜索关键词并抓取数据 agent-browser open "https://search.bilibili.com/all?keyword=你的关键词" # 获取数据 agent-browser eval '抓取脚本' # 生成报告 # 分析数据并输出统计 ``` ## 完整工作流程 ### 1. 搜索视频 ```bash agent-browser open "https://search.bilibili.com/all?keyword={关键词}" --timeout 15000 ``` ### 2. 抓取数据 使用 `scripts/scrape_videos.sh` 或手动执行： ```bash agent-browser eval ' const videos = []; document.querySelectorAll(".bili-video-card").forEach((card) => { const title = card.querySelector(".bili-video-card__info--tit")?.textContent.trim() || ""; const author = card.querySelector(".bili-video-card__info--author")?.textContent.trim() || ""; const date = card.querySelector(".bili-video-card__info--date")?.textContent.trim() || ""; const stats = card.querySelectorAll(".bili-video-card__stats--item"); const playCount = stats[0]?.textContent.trim() || "0"; const commentCount = stats[1]?.textContent.trim() || "0"; videos.push({title, author, date, playCount, commentCount}); }); JSON.stringify(videos, null, 2); ' ``` ### 3. 多页面抓取 ```bash # 翻页抓取 for page in 1 2 3 4 5; do agent-browser open "https://search.bilibili.com/all?keyword={关键词}&page=$page" agent-browser eval '抓取脚本' >> data.json done ``` ### 4. 数据分析 使用 `scripts/analyze_data.py` 或手动分析： - 时间分布统计 - 作者活跃度排名 - 评论数分布 - 播放量分布 - 关键发现和建议 ## 脚本说明 ### scripts/scrape_videos.sh 一键抓取脚本，支持指定关键词和页数。 ```bash ./scripts/scrape_videos.sh "关键词" 页数 ``` ### scripts/analyze_data.py 数据分析脚本，生成统计报告。 ```bash python scripts/analyze_data.py data.json ``` ## 输出格式 ### 统计报告模板 ```markdown ## 📊 Bilibili "{关键词}" 搜索结果统计报告 ### 📈 总体数据 - 数据范围: 前N页搜索结果 - 视频总数: X个 - 采集时间: YYYY-MM-DD HH:MM ### 🕐 发帖时间分布 | 时间段 | 数量 | 占比 | |--------|------|------| ### 👥 活跃作者 TOP 10 | 排名 | 作者 | 视频数 | |------|------|--------| ### 💬 评论数分布 | 评论数范围 | 视频数 | 占比 | |------------|--------|------| ### 👁️ 播放量分布 | 播放量范围 | 视频数 | 占比 | |------------|--------|------| ### 🎯 关键发现 1. ... 2. ... ### 📝 建议 - ... ``` ## 注意事项 1. **反爬虫**: B站有反爬虫机制，建议控制抓取频率 2. **数据准确性**: 数据实时变化，报告仅代表抓取时刻状态 3. **隐私合规**: 仅抓取公开数据，不涉及用户隐私 ## 错误处理 - 浏览器启动失败：检查 agent-browser 安装 - 数据抓取失败：检查页面是否加载完成 - 分析脚本错误：检查数据格式是否正确


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: cinience/aliyun-qwen-tts-voice-design (version 1.0.0)

--- name: aliyun-qwen-tts-voice-design description: Use when designing custom voices with Alibaba Cloud Model Studio Qwen TTS VD models. Use when creating custom synthetic voices from text descriptions and using them for speech synthesis. version: 1.0.0 --- Category: provider # Model Studio Qwen TTS Voice Design Use voice design models to create controllable synthetic voices from natural language descriptions. ## Critical model names Use one of these exact model strings: - `qwen3-tts-vd-2026-01-26` - [REDACTED_SECRET] ## Prerequisites - Install SDK in a virtual environment: ```bash python3 -m venv .venv . .venv/bin/activate python -m pip install dashscope ``` - Set `DASHSCOPE_API_KEY` in your environment, or add `dashscope_api_key` to `~/.alibabacloud/credentials`. ## Normalized interface (tts.voice_design) ### Request - `voice_prompt` (string, required) target voice description - `text` (string, required) - `stream` (bool, optional) ### Response - `audio_url` (string) or streaming PCM chunks - `voice_id` (string) - `request_id` (string) ## Operational guidance - Write voice prompts with tone, pace, emotion, and timbre constraints. - Build a reusable voice prompt library for product consistency. - Validate generated voice in short utterances before long scripts. ## Local helper script Prepare a normalized request JSON and validate response schema: ```bash .venv/bin/python skills/ai/audio/aliyun-qwen-tts-voice-design/scripts/prepare_voice_design_request.py \ --voice-prompt "A warm female host voice, clear articulation, medium pace" \ --text "This is a voice-design demo" ``` ## Output location - Default output: [REDACTED_SECRET] - Override base dir with `OUTPUT_DIR`. ## Validation ```bash mkdir -p output/aliyun-qwen-tts-voice-design for f in skills/ai/audio/aliyun-qwen-tts-voice-design/scripts/*.py; do python3 -m py_compile "$f" done echo "py_compile_ok" > output/aliyun-qwen-tts-voice-design/validate.txt ``` Pass criteria: command exits 0 and `output/aliyun-qwen-tts-voice-design/validate.txt` is generated. ## Output And Evidence - Save artifacts, command outputs, and API response summaries under [REDACTED_SECRET]. - Include key parameters (region/resource id/time range) in evidence files for reproducibility. ## Workflow 1) Confirm user intent, region, identifiers, and whether the operation is read-only or mutating. 2) Run one minimal read-only query first to verify connectivity and permissions. 3) Execute the target operation with explicit parameters and bounded scope. 4) Verify results and save output/evidence files. ## References - `references/sources.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)