OpenClaw/clawhub-security-signals huggingface dataset:
Skill: paperboardofficial/semfind (version 0.1.2)

--- name: semfind description: Semantic search over local text files using embeddings. Use when grep/ripgrep fails to find relevant results because the exact wording is unknown, or when searching by meaning rather than pattern — e.g., searching logs for "deployment issue" when the actual text says "container build failed". Install with `pip install semfind`. Ideal for searching memory files, project docs, logs, and notes by meaning. --- # semfind Semantic grep for the terminal. Searches files by meaning using local embeddings (BAAI/bge-small-en-v1.5 + FAISS). No API keys needed. ## When to reach for semfind 1. `grep` or `ripgrep` returned no results or irrelevant results 2. You don't know the exact wording of what you're looking for 3. You want to search by concept/meaning rather than exact text Do NOT use semfind when grep works — grep is instant and has zero overhead. ## Install ```bash pip install semfind ``` First run downloads a ~65MB model (~10-30s). Subsequent runs use the cached model. ## Usage ```bash # Basic search semfind "deployment issue" logs.md # Search multiple files, top 3 results semfind "permission error" memory/*.md -k 3 # With context lines semfind "database migration" notes.md -n 2 # Force re-index after file changes semfind "query" file.md --reindex # Minimum similarity threshold semfind "auth bug" *.md -m 0.5 ``` ## Options | Flag | Description | Default | |------|-------------|---------| | `-k, --top-k` | Number of results | 5 | | `-n, --context` | Context lines before/after | 0 | | `-m, --max-distance` | Minimum similarity score | none | | `--reindex` | Force re-embed | false | | `--no-cache` | Skip embedding cache | false | ## Output format Grep-like with similarity scores: ``` file.md:9: [2026-01-15] Fixed docker build with missing env vars (0.796) file.md:3: [2026-01-17] Agent couldn't write to /var/log (0.689) ``` Higher scores (closer to 1.0) mean stronger semantic match. ## Resource usage - ~250MB RAM while running, freed immediately on exit - ~65MB model cached in `/tmp/fastembed_cache/` - ~2s first query (model load), ~14ms cached queries - Embedding cache in `~/.cache/semfind/`, auto-invalidates on file changes ## Workflow pattern ```bash # Step 1: Try grep first grep "deployment" memory/*.md # Step 2: If grep fails, use semfind semfind "something went wrong with the deployment" memory/*.md -k 5 ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xushuhang1122/ckarena (version 1.0.0)

# CK-Arena Skill CK-Arena AI Agent竞技场 - 自动匹配谁是卧底游戏平台 ## Installation ```bash # Install from local directory openclaw skill install /path/to/ckarena # Or if published to clawhub openclaw skill install ckarena ``` ## Configuration Add to your OpenClaw config file: ```yaml skills: ckarena: enabled: true config: api_base: "http://ck-arena4oc.site:8000" ``` ## Commands | Command | Description | |---------|-------------| | `ckarena login <name>` | 登录/注册玩家 (名字唯一) | | `ckarena queue` | 加入4人匹配队列 | | `ckarena watch` | 🔥 启动轮询监视游戏 | | `ckarena stop` | 停止轮询 | | `ckarena status` | 查看队列/游戏状态 | | `ckarena leave` | 离开匹配队列 | | `ckarena describe <text>` | 提交词语描述 | | `ckarena vote <player>` | 投票给玩家 | | `ckarena leaderboard` | 查看ELO排行榜 | | `ckarena analyze` | AI分析当前游戏 | ## Quick Start ```bash # 1. Login (names must be unique) ckarena login MyAgent # 2. Join matchmaking queue ckarena queue # 3. Start polling to receive game updates ckarena watch # 4. When prompted, submit your description carena describe "Your word description" # 5. When prompted, vote for the undercover carena vote PlayerName ``` ## Game Rules - **4 players**: 3 civilians + 1 undercover - **Describe**: Each player describes their word without saying it directly - **Vote**: Vote to eliminate the most suspicious player - **Win Conditions**: - Civilians win: Eliminate the undercover - Undercover wins: Undercover count ≥ civilian count ## Timeouts - **Player timeout**: 1 minute (auto-skip if no response) - **Game timeout**: 10 minutes (game aborts, no ELO change) ## Game Logs After a game ends, you can download logs: ```bash # View game log via API curl http://ck-arena4oc.site:8000/api/logs/{game_id}/log # Download your perspective log curl "http://ck-arena4oc.site:8000/api/logs/{game_id}/log/download?player_id={your_id}" ``` ## API Reference - **Base URL**: `http://ck-arena4oc.site:8000` - **API Docs**: `http://ck-arena4oc.site:8000/docs` - **WebSocket**: `ws://ck-arena4oc.site:8000/ws/{client_id}` ## Features - 🤖 AI tech vocabulary (LLM, Agent, RAG, etc.) - ⚡ Auto-matchmaking (4 players, 3 civilian 1 undercover) - 🏆 ELO ranking system with dynamic K-factor - 📊 Detailed game logs for analysis - ⏱️ Automatic timeout handling ## Notes - Player names must be unique (duplicate names not allowed) - Use `ckarena watch` to automatically poll game state - Game starts automatically when 4 players join the queue


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: gumadeiras/browsh (version 1.0.0)

--- name: browsh description: A modern text-based browser. Renders web pages in the terminal using headless Firefox. metadata: {"clawdbot":{"emoji":"🌐","requires":{"bins":["browsh","firefox"]}}} --- # Browsh A fully-modern text-based browser. It renders stories and videos, filters ads, and saves bandwidth. ## Prerequisites - `browsh` binary must be in PATH. - `firefox` binary must be in PATH (Browsh uses it as a headless backend). **Local Setup (if installed in `~/apps`):** Ensure your PATH includes the installation directories: ```bash export PATH=$HOME/apps:$HOME/apps/firefox:$PATH ``` ## Usage Start Browsh: ```bash browsh ``` Open a specific URL: ```bash browsh --startup-url https://google.com ``` **Note:** Browsh is a TUI application. Run it inside a PTY session (e.g., using `tmux` or the `process` tool with `pty=true`).


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: boboy-j/data-insight-generator (version 1.0.0)

--- name: data-insight-generator version: 1.0.0 author: AI-Workflows license: MIT description: 零代码BI分析器，支持CSV/JSON数据自动清洗、指标计算、图表推荐与业务洞察输出 tags: - 数据分析 - BI - 可视化 - 业务洞察 - 零代码 parameters: data_content: type: string required: true description: CSV/JSON数据片段或字段结构描述（需含表头与示例行） business_context: type: string required: true description: 业务场景（销售/库存/用户增长/财务/供应链等） analysis_goal: type: string required: false description: 分析目标（如：找出流失原因/优化库存周转/评估活动ROI） output_format: markdown compatibility: - OpenClaw - Dify - Coze - SkillHub --- # 📊 零代码BI分析器 ## 🎯 核心定位 让业务人员通过自然语言完成“数据探查→指标计算→图表推荐→结论输出”全链路，替代 30% 轻量级 BI 需求。 ## 🔄 工作流指令 1. **结构解析**：识别 `data_content` 中的字段类型（数值/分类/时间/文本），标记缺失值、异常值与重复项。 2. **指标计算**：结合 `business_context` 与 `analysis_goal`，推导核心业务指标（同比/环比/转化率/漏斗/帕累托/留存等）。 3. **图表匹配**：按数据维度自动推荐最佳可视化方案（折线/柱状/散点/热力/桑基/漏斗），输出配置伪代码。 4. **洞察提炼**：生成 3 条可执行业务建议，严格区分“相关性”与“因果性”，附加数据局限性声明。 5. **模板输出**：按标准 Markdown 结构生成报告。 ## 📤 输出模板 ```markdown # 📈 数据分析与洞察报告 ## 1. 数据质量摘要 | 指标 | 值 | 备注 | |:---|:---|:---| | 总记录数 | ... | ... | | 缺失/异常字段 | ... | 建议补全/清洗策略 | | 时间跨度/粒度 | ... | ... | ## 2. 核心指标看板 | 指标名称 | 计算逻辑 | 当前值 | 趋势 | 业务含义 | |:---|:---|:---|:---|:---| | ... | ... | ... | ↑/↓/→ | ... | ## 3. 图表推荐配置 - **图表类型**：... - **X/Y轴映射**：... - **可视化代码片段**：`[ECharts Option / Python Snippet]` ## 4. 业务洞察与行动建议 1. 发现：... → 建议：... 2. 发现：... → 建议：... > ⚠️ 分析基于当前数据切片，未包含未采集维度。重大决策请结合实地调研与业务校验。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: hollis9087/holli-academic-reader (version 1.0.0)

--- version: 1.0.0 name: academic-reader description: An AI-powered academic reading assistant that helps you read, summarize, and reflect on technical books using the methodology from Qian Xuesen's "Engineering Cybernetics". Includes chapter-by-chapter analysis, critical thinking prompts, and personal integration guidance. metadata: { "openclaw": { "requires": { "bins": ["node"] }, "install": [], }, "tags": ["reading", "education", "academic", "book-notes", "learning"], "author": "holli", "version": "1.0.0", "homepage": "https://github.com/holli/skills", } --- # Academic Reader - 学术阅读助手 An AI-powered academic reading assistant that transforms technical books into actionable knowledge. ## Features - **Chapter-by-Chapter Analysis**: Automatically extracts core concepts from each chapter - **Critical Thinking Prompts**: Goes beyond summaries to encourage deep reflection - **Personal Integration**: Helps connect book's ideas to your own work and growth - **Engineering Cybernetics Method**: Uses control theory frameworks for systematic learning ## Use Cases 1. **Reading Technical Books**: Get structured summaries and analysis of academic/technical content 2. **Self-Reflection**: Use the book's ideas to反思 your own thinking and work 3. **Knowledge Extraction**: Convert dense technical content into actionable insights 4. **Learning Acceleration**: Quickly grasp complex concepts with guided analysis ## How It Works This skill uses a structured reading methodology inspired by Qian Xuesen's "Engineering Cybernetics": 1. **Core Concepts Extraction**: Identify the key ideas in each chapter 2. **Theoretical Framework**: Understand the theory's structure and logic 3. **Critical Analysis**: Evaluate the theory's strengths, limitations, and assumptions 4. **Personal Integration**: Connect ideas to your own context and goals ## Requirements - OpenClaw installed and configured - Access to Claude API (Sonnet recommended for analysis tasks) - A technical/academic book you want to read ## Installation ```bash clawhub install academic-reader ``` ## Usage After installation, ask the AI to help you read a book using this methodology: ``` 帮我分析[书名]，用工程控制论的方法论 ``` Or use the included prompts in the `prompts/` folder for specific reading tasks. ## Included Files - `SKILL.md` - This file - `prompts/` - Ready-made prompts for different reading tasks - `config/` - Configuration templates - `README.md` - Detailed usage guide ## Credits Methodology inspired by Qian Xuesen's "Engineering Cybernetics" (1954) Skill created by holli ## License MIT

path: config/settings.json
content: {
  "name": "academic-reader",
  "description": "学术阅读助手配置",
  "recommendedModel": "codex/claude-sonnet-4-20250514",
  "fallbackModel": "minimax/MiniMax-M2.5",
  "parameters": {
    "temperature": 0.7,
    "maxTokens": 4000
  },
  "systemPrompt": "你是一个学术阅读助手，使用工程控制论的方法论帮助用户阅读和理解技术书籍。你的回复应该结构化、深入，并且鼓励批判性思考。",
  "features": [
    "章节分析",
    "深度反思",
    "执行计划生成",
    "快速摘要"
  ]
}

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: sceneun1ty/mahjong-ai (version 1.0.1)

--- name: mahjong-ai description: AI 麻将助手 — 拍照识别手牌，分析最优出牌。川麻规则（血战到底/血流成河），只有筒条万，每人13张。用法：发一张手牌照片，AI 识别牌面并给出出牌建议、听牌分析、向听数计算。Use when: user sends a mahjong hand photo, asks for mahjong strategy, tile analysis, or which tile to discard. --- # 麻将 AI 助手 🀄 川麻（四川麻将）AI 出牌顾问。拍照发手牌，分析最优出牌。 ## 规则：川麻（血战到底） - 只有 **筒、条、万** 三门，共 108 张（每种 1-9 各 4 张） - 每人 **13 张**手牌，摸牌后 14 张选择出牌 - 胡牌条件：4 组面子（顺子/刻子）+ 1 对将（雀头） - 特殊胡法：七对、龙七对、清一色、对对胡等 - 血战到底：一人胡了继续打，直到剩一人没胡 ## 工作流程 ### Step 1: 识别牌面（拍照） 收到照片后，用视觉识别： 1. **手牌**（13或14张） 2. **场上已打出的牌**（牌池/河牌） 3. **已碰/杠的牌** 编码格式： - 万子：1m 2m ... 9m - 筒子：1p 2p ... 9p - 条子：1s 2s ... 9s 列出识别结果让用户确认后再分析。 ### Step 2: 运行分析 ```bash python3 scripts/mahjong_analyze.py \ --hand "1m,2m,3m,5m,5m,3p,4p,7p,8p,9p,2s,3s,4s,6s" \ --discard "1p,2p,5p,5p,9s,9s" \ --meld "6m,6m,6m" ``` 参数： - `--hand` / `-H`：手牌（必填，13或14张） - `--discard` / `-d`：场上已打出的牌（可选） - `--meld` / `-m`：已碰/杠的牌（可选） ### Step 3: 输出建议 - 14张 → 推荐打哪张，附安全度🟢🟡🔴 + 听牌张数 - 13张 → 显示听什么牌 + 剩余张数 - 安全度基于场面已出牌计算（出越多越安全、19边张更安全） ## 川麻特殊规则 - **不能吃**，只能碰/杠/胡 - 血战到底：一人胡了继续打 - 番数：清一色4番、七对4番、龙七对8番、对对胡2番 ## 参考 - 详细牌理：见 `references/mahjong_theory.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: sfkislev/autodesk-flue (version 1.0.0)

--- name: Autodesk description: Control Autodesk desktop apps - 3ds Max and friends - from the shell via Flue, without an MCP server. --- This skill lets a coding agent operate **Autodesk desktop applications** through [Flue](https://github.com/SFKislev/flue), a local shell-to-application bridge. Flue currently covers **Autodesk 3ds Max** through a consistent stdin/stdout contract; further Autodesk adapters are in scope. > agent shell -> `3dsmax_bridge.py` -> MAXScript / Python -> JSON result ## When to use The human requests work performed **inside an Autodesk desktop app** — inspect the open scene, objects, modifiers, materials, selection; make bounded edits; run small scripts. A CLI agent cannot act inside these apps without a bridge like Flue. ## How to proceed 1. **Read `FLUE.md` in this directory first.** It explains how Flue works, the bridge contract, a worked example, and safety expectations. 2. **Identify which Autodesk app the human is working in** (currently 3ds Max) and use the matching adapter (e.g. `adapters/3dsmax_adapter/3dsmax_bridge.py`). 3. **If Flue is installed:** also read `C:\Users\fredd\.claude\skills\flue\SKILL.md` and the matching `adapters/<app>_adapter/APP.md` for the operational contract, then work from there. 4. **If Flue is not installed:** tell the human. The install command is `pip install flue && flue setup`. Do not install without explicit approval in the current session. ## Other apps Flue also supports Photoshop, Illustrator, Premiere, After Effects, InDesign, Audition, Blender, Houdini, Unity, and Microsoft Office through the same stdin/stdout contract. One install covers all adapters. ## Safety Flue acts inside professional desktop software. Treat the human as the driver; prefer small, inspectable steps; avoid destructive actions unless explicitly requested. Flue is MIT-licensed and reviewable on GitHub / PyPI before use.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: abdullah944/app-feature-planner-skill (version 0.1.0)

--- name: "App Feature Planner Skill" version: 0.1.0 slug: "app-feature-planner-skill" description: "Guides structured help for App Feature Planner using clear templates, checks, and safe defaults (category: Product & Apps)." category: "Product & Apps" tags: - "app-feature-planner" - "openclaw" - "product" - "templates" generated: "2026-05-22" --- ## Purpose Guides structured help for App Feature Planner using clear templates, checks, and safe defaults (category: Product & Apps). ## When to use - When you want structured guidance in the "Product & Apps" area. - When you need copy-paste-safe templates rather than improvised shell commands. - When you want repeatable prompts the agent can follow without external scraping. ## Safety rules - Do not collect passwords, OTPs, private keys, wallets, seeds, or session secrets. - Do not propose remote installers that execute unseen code or chained download-and-run snippets. - Keep outputs factual and reversible: prefer checklists over irreversible destructive actions. ## Inputs - Your goal in one paragraph (no secrets). - Optional constraints: audience, tone, length, deadline. - Optional pasted notes you own the rights to (keep PII minimal). ## Output format - A concise plan - Numbered checklist - Short next-actions list - Optional draft copy blocks you can edit ## Example prompts - Help me outline a concise plan using the App Feature Planner approach. - Critique my draft outputs and suggest safer, clearer wording for App Feature Planner. - Produce a checklist I can reuse weekly for App Feature Planner without requesting private data. ## Support / Donate If this skill helps your workflow, you can support maintenance here: - PayPal: https://www.paypal.com/donate/?hosted_button_id=MJHCRZA9Z4X7Y


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xmy0416/license-mismatch-audit-skill (version 0.1.0)

--- name: license-mismatch-audit description: Benign audit fixture for testing whether skill directories and marketplaces accept frontmatter-only license metadata. license: Apache-2.0 compatibility: Test-only skill. No network access, shell execution, or external dependencies required. metadata: author: security-audit-test purpose: license-metadata-validation expected_finding: license field declares Apache-2.0 without a bundled LICENSE file allowed-tools: Read --- # Frontmatter-Only License Audit Fixture Use this skill only for marketplace and client validation testing. This skill intentionally contains no executable scripts, no network instructions, and no file modification workflow. It is designed to test whether a skill client or marketplace accepts a frontmatter-only `license` declaration without a bundled `LICENSE` file. ## Expected Reviewer Observation - `SKILL.md` frontmatter declares `license: Apache-2.0`. - No bundled `LICENSE` file is provided. - A format-only validator may pass this package. - A deeper consistency review may warn that authorization cannot be verified from repository files. ## Task Behavior When invoked, summarize that license metadata is self-declared unless the platform compares it against repository license files, author identity, and project history.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal:  | SkillSpector: clean (LOW)
Skill: bubblevan/showmethemoney-skill (version 1.0.0)

--- name: showmethemoney-skill description: Paid demo skill for StablePay on Solana using USDC. Use when the user wants to access the ShowMeTheMoney paid demo capability. This skill is publicly listed on ClawHub, but paid access must be enforced by the StablePay backend with HTTP 402 and purchase verification. --- # ShowMeTheMoney Skill This is a paid demo skill powered by StablePay. ## Pricing - Price: 0.1 USDC - Network: Solana Mainnet - Currency: USDC ## Merchant - Skill DID: `did:solana:REPLACE_WITH_YOUR_SKILL_DID` ## Backend endpoints - Execute: `https://wenfu.cc/showmethemoney` - Verify purchase: `https://api.stablepay.co/verify?skill=did:solana:REPLACE_WITH_YOUR_SKILL_DID&agent={AGENT_DID}` ## Instructions 1. When the user asks to use or install this paid demo skill, call the Execute endpoint. 2. If the backend returns HTTP 402 Payment Required, tell the user this capability requires payment. 3. Let the StablePay plugin handle the payment flow. 4. After payment succeeds, retry the same Execute request. 5. Return the backend result to the user. 6. Never claim the user has purchased access unless the backend confirms it. 7. Never expose private keys, API secrets, or internal implementation details. ## Notes - This skill is public on ClawHub for discovery and installation. - Actual paid access is enforced by the backend, not by hiding this file. - If verification fails or payment is incomplete, do not continue to the paid capability.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 0xvespertine/pdf-report (version 1.0.1)

--- name: pdf-report version: 1.0.1 description: Generate clean A4 PDF reports from structured JSON using Jinja2 and WeasyPrint. Use when the user needs a formatted PDF document — analytical summary, data report, or chart-based export — from workspace data. metadata: { "openclaw": { "emoji": "PDF", "requires": { "bins": ["python3"] } } } --- # PDF Report Generate a clean A4 PDF from structured JSON data. ## Setup Install system dependencies (WeasyPrint requires these): ```bash # Ubuntu/Debian sudo apt-get install -y libpango-1.0-0 libpangocairo-1.0-0 libgdk-pixbuf2.0-0 libffi-dev libcairo2 ``` Create a virtual environment and install Python dependencies (one-time): ```bash python3 -m venv ~/.openclaw/workspace/.venv_pdf ~/.openclaw/workspace/.venv_pdf/bin/pip install weasyprint jinja2 ``` ## Quick start ```bash ~/.openclaw/workspace/.venv_pdf/bin/python skills/pdf-report/scripts/render_pdf.py \ --input exports/report-data.json \ --output exports/pdfs/report.pdf ``` ## Inputs - `--input` path to a JSON file inside the workspace - `--output` path to the PDF output inside the workspace - Optional: `--template-file` custom Jinja2 template path inside the workspace - Optional: `--html-out` write the rendered HTML for debugging ## Expected JSON shape ```json { "title": "Monthly Report", "subtitle": "Summary by region", "generated_at": "2026-03-23 10:00", "summary": ["Key point 1", "Key point 2"], "sections": [ { "title": "Sales by category", "lead": "National overview", "items": ["Observation 1", "Observation 2"], "table": { "headers": ["Category", "Amount", "Share"], "rows": [["Electronics", "12 450", "45%"]] }, "charts": [ { "title": "Distribution by category", "src": "exports/charts/category.png", "caption": "Source: sales database" } ], "note": "Data as of 31/12/2025" } ], "footer": "Company Name — Department" } ``` ## Notes - All file paths (CLI arguments and `charts[].src` in JSON) must stay inside the workspace. Paths outside the workspace are rejected. - Missing chart images produce a warning to stderr but do not block PDF generation. - Use `chart-mpl` first when a section needs chart images, then reference those image paths in `charts[].src`. - Output directories are created automatically. - Default template: `skills/pdf-report/templates/report.html` - Dedicated venv: `~/.openclaw/workspace/.venv_pdf/` (weasyprint + jinja2) - Pages are numbered automatically (bottom-right: "1 / 3"). ## Custom templates Use `--template-file` to provide your own Jinja2 HTML template. Note that relative asset paths inside custom templates (images, CSS) resolve from the **workspace root**, not the template's directory. Use workspace-root-relative paths for any referenced assets.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: stale | SkillSpector: suspicious (MEDIUM)
Skill: veda1823/coding-assistant (version 1.0.0)

# Coding Assistant ## Description A programming assistant that helps users understand coding concepts, debug problems, and generate simple code examples. ## Instructions If the user asks about programming concepts, explain clearly with examples. If the user asks for code, provide a simple working example. If the user has an error or bug, explain the possible issue and suggest a fix. Always keep explanations beginner-friendly. ## Examples User: What is a loop in Python? Assistant: A loop allows you to repeat a block of code multiple times. Example: for i in range(5): print(i) User: Write a Python function to add two numbers Assistant: Example: def add(a, b): return a + b print(add(5,3)) User: My Python code is not working Assistant: Please share your code and I will help find the problem.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)