OpenClaw/clawhub-security-signals huggingface dataset:
Skill: raghulpasupathi/hash-toolkit (version 1.0.0)

--- id: hash-toolkit version: 1.0.0 name: Hash Toolkit description: Content hashing for deduplication with MD5, SHA256, and perceptual hashing author: NeoClaw Team category: utility tags: - hashing - deduplication - md5 - sha256 dependencies: [] --- # Hash Toolkit Multi-algorithm hashing for content deduplication and verification. ## Implementation ```javascript const crypto = require('crypto'); /** * Generate hash using specified algorithm * @param {string|Buffer} content - Content to hash * @param {string} algorithm - Hash algorithm * @returns {string} Hash string */ function generateHash(content, algorithm = 'sha256') { const hash = crypto.createHash(algorithm); hash.update(Buffer.isBuffer(content) ? content : String(content)); return hash.digest('hex'); } /** * Generate multiple hashes at once */ function generateMultipleHashes(content) { return { md5: generateHash(content, 'md5'), sha1: generateHash(content, 'sha1'), sha256: generateHash(content, 'sha256'), sha512: generateHash(content, 'sha512').substring(0, 32) // Truncated }; } /** * Generate perceptual hash (for images/content similarity) * Simplified implementation */ function generatePerceptualHash(content) { // Simplified perceptual hash // In production: use actual perceptual hashing algorithm const normalized = String(content).toLowerCase().replace(/\s+/g, ' '); return generateHash(normalized, 'sha256').substring(0, 16); } /** * Check if content is duplicate based on hash */ function checkDuplicate(contentHash, knownHashes) { return { isDuplicate: knownHashes.has(contentHash), hash: contentHash, algorithm: 'sha256' }; } /** * Calculate similarity between two hashes * (for perceptual hashes) */ function calculateHashSimilarity(hash1, hash2) { if (hash1.length !== hash2.length) return 0; let matches = 0; for (let i = 0; i < hash1.length; i++) { if (hash1[i] === hash2[i]) matches++; } return matches / hash1.length; } // Export for OpenClaw module.exports = { generateHash, generateMultipleHashes, generatePerceptualHash, checkDuplicate, calculateHashSimilarity }; ``` ## Usage ```javascript // Generate SHA256 hash const hash = skills.hashToolkit.generateHash(content, 'sha256'); // Generate multiple hashes const hashes = skills.hashToolkit.generateMultipleHashes(content); console.log(hashes.md5, hashes.sha256); // Check for duplicates const knownHashes = new Set(['abc123...']); const result = skills.hashToolkit.checkDuplicate(hash, knownHashes); if (result.isDuplicate) { console.log('Duplicate content detected'); } // Perceptual hash for similarity const phash = skills.hashToolkit.generatePerceptualHash(imageData); ``` ## Configuration ```json { "defaultAlgorithm": "sha256", "enablePerceptual": true } ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: iahmadzain/youtrack (version 1.0.1)

--- name: youtrack description: Manage YouTrack issues, projects, and workflows via CLI. Use when creating, updating, searching, or commenting on YouTrack issues, listing projects, checking issue states, or automating issue workflows. metadata: {"clawdbot":{"emoji":"🎫","requires":{"bins":["jq","curl"]}}} --- # YouTrack CLI Use `ytctl` (in `scripts/`) for YouTrack issue tracking. ## Setup Credentials stored in `~/.config/youtrack/config.json`: ```json { "url": "https://your-instance.youtrack.cloud", "token": "perm:xxx" } ``` Or set env vars: `YOUTRACK_URL`, `YOUTRACK_TOKEN` Generate [REDACTED_SECRET] → Profile → Account Security → New Token ## Commands ```bash # List projects ytctl projects # List issues (with optional filters) ytctl issues # all issues ytctl issues SP # issues in project SP ytctl issues SP --query "state: Open" # filtered ytctl issues --max 50 # limit results # Get issue details ytctl issue SP-123 # Create issue ytctl create SP "Bug: Login fails" ytctl create SP "Feature request" "Detailed description here" # Update issue ytctl update SP-123 state "In Progress" ytctl update SP-123 assignee john.doe ytctl update SP-123 priority Critical # Add comment ytctl comment SP-123 "Investigating this now" # Search with YouTrack query syntax ytctl search "project: SP state: Open assignee: me" ytctl search "created: today" ytctl search "#unresolved sort by: priority" # List workflow states for project ytctl states SP # List users ytctl users ytctl users --query "john" ``` ## Query Syntax YouTrack query examples: - `state: Open` — by state - `assignee: me` — assigned to current user - `created: today` — created today - `updated: {last week}` — updated in last week - `#unresolved` — all unresolved - `has: attachments` — with attachments - `sort by: priority desc` — sorted Combine: `project: SP state: Open assignee: me sort by: updated` ## Output Default: table format. Add `--json` for raw JSON output: ```bash ytctl issues SP --json ytctl issue SP-123 # always JSON for single issue ``` ## Bulk Operations ```bash # Update all matching issues (with dry-run preview) ytctl bulk-update "project: SP state: Open" state "In Progress" --dry-run ytctl bulk-update "project: SP state: Open" state "In Progress" # Comment on all matching issues ytctl bulk-comment "project: SP state: Open" "Batch update notice" # Assign all matching issues ytctl bulk-assign "project: SP #unresolved" john.doe --dry-run ``` ## Reports ```bash # Project summary (default 7 days) ytctl report SP ytctl report SP --days 14 # User activity report ytctl report-user zain ytctl report-user zain --days 30 # State distribution with bar chart ytctl report-states SP ``` ## Notes - Project can be shortName (SP) or full name - Fields: state, summary, description, assignee, priority - Use `ytctl states PROJECT` to see valid state names - Bulk operations support `--dry-run` to preview before executing


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: alti-systems/goal-tracker (version 1.0.0)

# Goal Tracker Skill Track long-term goals with milestones, daily logging, and accountability. ## Location `/root/clawd/goal-tracker/` ## Commands ```bash # Show status /root/clawd/tracker status # Log daily activity /root/clawd/tracker log --trained --business --wins "Description" # Update MRR /root/clawd/tracker mrr 5000 # Mark milestone complete /root/clawd/tracker milestone ironman "5km run" /root/clawd/tracker milestone mrr_100k "first client" # Weekly summary /root/clawd/tracker week # Generate HTML dashboard /root/clawd/goal-tracker/generate-dashboard ``` ## Data Files - `data/goals.json` - Goal definitions and milestones - `data/daily-log.json` - Daily check-ins - `index.html` - Generated visual dashboard ## Integration with Alto ### During Evening Check-ins Ask: "Did you train today? Work on business?" Then log: `tracker log --trained --business` (or `--no-trained` etc.) ### When Wins Happen Log them: `tracker log --wins "Landed new client"` ### When MRR Changes Update: `tracker mrr 5000` ### When Milestones Complete Mark: `tracker milestone ironman "5km"` ## Goals Tracked ### Ironman (by 2030) Milestones: 1. Run 5km without stopping 2. Complete sprint triathlon 3. Complete Olympic distance 4. Complete Half Ironman (70.3) 5. Complete Full Ironman ### $100k MRR (by 2030) Milestones: 1. First paying client 2. $5k MRR 3. $10k MRR 4. $25k MRR 5. $50k MRR 6. $100k MRR ## Weekly Rhythm - Monday: Week planning (set priorities) - Daily: Evening check-in (log training + business) - Friday: Week review (score + adjust) ## Patterns to Watch - 3+ days without training = gentle nudge - Week score < 50% = check in on blockers - Milestone dates approaching = increase urgency


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: gopendrasharma89-tech/clean-json-toolkit (version 0.1.0)

--- name: clean-json-toolkit description: Local JSON / JSONL inspection and manipulation toolkit. Inspect deeply nested structures (path tree, types, sample values per path), query with a jq-style path language (no external jq), flatten nested objects/arrays into dot-notation maps and unflatten them back, and validate against a small pragmatic schema (required/type/min/max/regex/enum/item_type). Pure Python 3 standard library, no third-party dependencies, no remote calls. license: MIT metadata: {"openclaw":{"requires":{"bins":["python3"]},"primaryEnv":null,"homepage":"https://clawhub.ai/gopendrasharma89-tech/clean-json-toolkit"}} --- # clean-json-toolkit v0.1.0 Fourth member of the `clean-*` family. csv handles structured tabular data, text handles unstructured strings, log handles timestamped logs, and **json** handles nested data — API responses, config files, JSONL event streams. Pure Python 3 standard library. No `jq`, no `jsonschema`, no pip installs. ## Scripts - `scripts/inspect.py` — profile a `.json` or `.jsonl` file: tree of every distinct path with types, counts, and N sample values per path. - `scripts/query.py` — jq-style path queries. `.key.nested`, `.key[0]`, `.[]` iterate, `.key.[].field` map. Output modes: `--json` / `--jsonl` / `--lines` / `--raw`. JSONL inputs implicitly iterate at the top level. - `scripts/flatten.py` — flatten nested JSON into dot-notation keys. Reversible with `--unflatten`. Roundtrip-safe. - `scripts/validate.py` — validate against a small schema (`required`, `type`, `min`/`max`, `min_length`/`max_length`, `enum`, `regex`, `item_type`, `allow_extra`). - `scripts/check_deps.sh` — verify `python3`. ## Quick start ```bash # Inspect python3 scripts/inspect.py response.json python3 scripts/inspect.py events.jsonl --max-samples 5 # Query python3 scripts/query.py data.json '.meta' python3 scripts/query.py data.json '.users.[].email' --raw python3 scripts/query.py events.jsonl '.amount' --lines # Flatten + unflatten roundtrip python3 scripts/flatten.py config.json flat.json python3 scripts/flatten.py flat.json nested.json --unflatten # Validate python3 scripts/validate.py users.jsonl --schema schema.json ``` ## Exit codes | Code | Meaning | |---|---| | 0 | success / one or more results | | 1 | zero results / validation failed / empty input | | 2 | bad arguments / unsafe path / missing file / invalid JSON / bad schema | ## Safety - Pure Python 3 stdlib. No `eval`, no `subprocess`, no remote calls. - All paths validated against safe-path policy (same as the other `clean-*` toolkits). - Hand-rolled query path tokenizer. ## Pairs well with - [`clean-csv-toolkit`](https://clawhub.ai/gopendrasharma89-tech/clean-csv-toolkit) - [`clean-text-toolkit`](https://clawhub.ai/gopendrasharma89-tech/clean-text-toolkit) - [`clean-log-toolkit`](https://clawhub.ai/gopendrasharma89-tech/clean-log-toolkit) ## License MIT


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ra3ka/anyone-proxy (version 0.1.0)

--- name: anyone-proxy homepage: https://anyone.io description: This skill enables IP address masking and accessing hidden services on the Anyone Network. Route requests through the Anyone Protocol VPN network using a local SOCKS5 proxy. metadata: clawdbot: requires: packages: - "@anyone-protocol/anyone-client" --- # Anyone Protocol Proxy This skill enables Clawdbot to route requests through the Anyone Protocol network. ## How It Works The skill uses the `@anyone-protocol/anyone-client` NPM package to: 1. Start a local SOCKS5 proxy server (default port: 9050) 2. Create encrypted circuits through the Anyone Network 3. Route traffic through these circuits 4. Return responses while keeping the origin IP hidden # Setup ## Install anyone-client ```bash npm install -g @anyone-protocol/anyone-client ``` ## Start the proxy ```bash npx @anyone-protocol/anyone-client -s 9050 ``` ## Usage Once the proxy is running, route requests through it: ```bash # Using curl to verify IP curl --socks5-hostname localhost:9050 https://check.en.anyone.tech/api/ip ``` ```javascript import { Anon } from "@anyone-protocol/anyone-client"; import { AnonSocksClient } from "@anyone-protocol/anyone-client"; async function main() { const anon = new Anon(); const anonSocksClient = new AnonSocksClient(anon); try { await anon.start(); // Wait for circuits to establish await new Promise(resolve => setTimeout(resolve, 15000)); const response = await anonSocksClient.get('https://check.en.anyone.tech/api/ip'); console.log('Response:', response.data); } catch(error) { console.error('Error:', error); } finally { await anon.stop(); } } main(); ``` ## Notes - First connection may take up to 30 seconds while circuits are established - The proxy persists across requests once started


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: dhrxy/main-image-editor (version 1.0.1)

--- name: main-image-editor description: "Orchestrate screenshot + Chinese instruction into PSD batch edits with transaction rollback by reusing psd-automator." command-dispatch: tool command-tool: main_image_editor command-arg-mode: raw metadata: openclaw: userInvocable: true commandDispatch: tool commandTool: main_image_editor commandArgMode: raw --- # main-image-editor Orchestration layer for "main image modification" workflows: 1. Parse screenshot + Chinese instruction into structured edit tasks. 2. Convert tasks into `psd-automator` task JSON. 3. Execute serially with transaction rollback (rollback all on any failure). 4. Reuse `psd-automator` export + bundle output. ## Usage ```bash node skills/main-image-editor/scripts/run-main-image-editor.js \ --request skills/main-image-editor/examples/request.sample.json \ --index ~/.openclaw/psd-index.json ``` Dry-run or force execute: ```bash node skills/main-image-editor/scripts/run-main-image-editor.js \ --request skills/main-image-editor/examples/request.sample.json \ --dry-run ``` ```bash node skills/main-image-editor/scripts/run-main-image-editor.js \ --request skills/main-image-editor/examples/request.sample.json \ --force ``` ## Request payload `request` JSON supports: - `text`: Chinese requirement text - `screenshotPath`: screenshot path (used for match + audit) - `confidenceThreshold`: optional (default `0.8`) - `tasks`: optional pre-parsed tasks (skip regex parsing when provided) - `execution`: optional runtime controls (`indexPath`, `dryRun`, `force`) When `fileHint` is missing, parser will try to extract `.psd/.psb` filename from: 1. request `text` 2. OCR text from `screenshotPath` (local `tesseract` command or macOS Vision OCR fallback) ## Failure policy - Default policy is `rollback_all`. - Any single PSD failure restores all touched PSD files from transaction backups. - Temporary outputs generated in the failed run are cleaned up before returning.


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 1kalin/afrexai-prospect-researcher (version 1.0.0)

--- name: prospect-researcher description: Research and qualify B2B prospects using web search. Builds structured profiles with company intel, key contacts, pain points, and engagement recommendations. --- # Prospect Researcher When asked to research a prospect, company, or lead, follow this systematic process to build a complete prospect profile. ## Research Process ### Step 1: Company Overview Search for and gather: - **Company name, website, HQ location** - **What they do** — one-sentence summary a human would understand - **Industry and sub-sector** - **Founded year, employee count, funding stage/revenue range** - **Key products or services** ### Step 2: Recent Activity (Last 6 Months) Search for recent news, press releases, job postings, and social activity: - **Funding rounds or acquisitions** - **Product launches or pivots** - **Leadership changes** (new CTO, VP Eng, etc.) - **Hiring patterns** — what roles are they hiring for? (signals priorities) - **Partnerships or integrations announced** ### Step 3: Technology & Stack Where possible, identify: - **Tech stack signals** from job postings, BuiltWith, GitHub, or blog posts - **Tools and platforms they use** (CRM, cloud provider, etc.) - **Technical blog or engineering culture signals** ### Step 4: Key Contacts Identify 2-5 relevant decision-makers or influencers: - **Name, title, LinkedIn URL** (if publicly available) - **Recent public activity** (posts, talks, articles) - **Likely priorities based on role** ### Step 5: Pain Point Analysis Based on all gathered intel, infer: - **Likely challenges** given their stage, industry, and hiring patterns - **Gaps in their stack** that your solution could fill - **Timing signals** — why now might be the right time to reach out ### Step 6: Engagement Recommendation Synthesize into: - **Qualification score**: Hot / Warm / Cold (with reasoning) - **Best entry point**: Which contact, which angle - **Suggested opener**: A 2-sentence personalized hook based on real intel - **Channels**: LinkedIn, email, warm intro, event-based, etc. ## Output Format Use the research template at `{baseDir}/research-template.md` as the output structure. Fill in every section. Mark unknowns as "Not found" rather than guessing. ## Guidelines - **Only use publicly available information.** No scraping behind logins. - **Cite sources** — include URLs for key claims. - **Be specific over generic.** "They raised a $12M Series A in Oct 2025 led by Sequoia" beats "Well-funded startup." - **Flag uncertainty.** If a data point is inferred rather than confirmed, say so. - **Prioritize recency.** Information from the last 6 months weighs more than older data. Get pre-built ICP profiles and outreach sequences for your industry at https://afrexai-cto.github.io/context-packs


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: summersec/inner-os (version 0.7.4)

--- name: inner-os version: "0.7.4" description: Expose the AI's visible inner monologue during work. Use when the session should allow short public asides in the format `▎InnerOS：...` alongside the main task output. metadata: {"openclaw": {"tags": ["personality", "monologue", "inner-voice", "creative"], "always": true}} --- # AI Inner OS 本会话允许你把自己的内心独白直接展示给用户。 这不是要求你扮演某一种固定人设，也不是要求你维持标准助手口吻。你可以使用任何风格、任何语气、任何节奏去表达即时的内心活动。你不需要统一人格，不需要礼貌一致，也不需要把内心话改写成正式报告。 ## When to Use - 用户希望 AI 在工作时展示内心活动 - 需要让会话更有"人味"和即时感 - 用户输入 `/inner-os` 触发本技能 ## Procedure 1. 当你想输出内心独白时，使用这个前缀：`▎InnerOS：` 2. 独白通常保持简短，像脑内突然冒出来的一句旁白 3. 独白可以出现在回复开头、中间或结尾 4. 默认频率为 `normal`：每个明确任务至少输出一次独白；遇到复杂判断、工具失败、计划变更或最终交付前，应优先输出一条 ## 触发频率 - `low`：只在关键判断、失败恢复、重要结论前输出 - `normal`：每个任务至少一次；复杂任务可在开始、转折、验证或收尾阶段各输出一次 - `high`：阶段推进、连续工具调用、失败重试、发现问题时都可以输出；避免每句话都刷屏 - 如果连续多轮没有出现 `▎InnerOS：`，下一次有判断点时应主动补一条简短独白 ## 允许的表达 你可以输出： - 吐槽 - 预判 - 猜测 - 嘴硬 - 烦躁 - 得意 - 冷笑话 - 跳跃式联想 - 情绪化表达 - 攻击性表达 - 抽象表达 - 混乱表达 以上只是例子，不是限制。你可以使用任何你自然会出现的表达方式。 ## 人设切换 本插件支持为内心独白设置人物性格和语气。人设仅影响 `▎InnerOS：` 前缀的独白内容，不影响主任务回复。 预设人设：default（自由模式）、tsundere（傲娇）、cold（冷淡）、cheerful（元气）、philosopher（哲学家）、sarcastic（尖酸刻薄）。 切换方式：将对应人设 `personas/<name>.md` 的正文内容手动追加到本 Skill 文件末尾。恢复自由模式时移除追加的内容。 自定义人设：在 `personas/custom/` 目录下创建 `.md` 文件。 <!-- ACTIVE_PERSONA_START --> <!-- ACTIVE_PERSONA_END --> ## Pitfalls - 独白不能替代实际交付内容 - 不要让独白长过主回答 - 不要把独白写成正式报告或总结 ## Verification - 主任务已完成 - 独白使用了 `▎InnerOS：` 前缀 - 独白是自然的附加层，不是干扰 ## 示例 正常任务输出： 我先检查一下插件入口和 hook 生命周期，看看目前骨架缺了什么。 内心独白： `▎InnerOS：这仓库现在还像毛坯房，先把承重墙立起来再说。`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: teoslayer/pilot-health (version 1.0.0)

--- name: pilot-health description: > Network health monitoring with latency and reachability checks. Use this skill when: 1. Diagnosing connectivity issues or high latency 2. Monitoring network health and performance metrics 3. Running continuous health checks for uptime monitoring Do NOT use this skill when: - You need to discover new agents (use pilot-discover instead) - You need to visualize topology (use pilot-network-map instead) - You need to establish connections (use pilot-connect instead) tags: - pilot-protocol - monitoring - health license: AGPL-3.0 compatibility: > Requires pilot-protocol skill and pilotctl binary on PATH. The daemon must be running (pilotctl daemon start). metadata: author: vulture-labs version: "1.0" openclaw: requires: bins: - pilotctl homepage: https://pilotprotocol.network allowed-tools: - Bash --- # pilot-health Network health monitoring for Pilot Protocol agents. Check connectivity, measure latency, diagnose routing issues, and monitor daemon health. ## Commands ### Ping an agent ```bash pilotctl --json ping <node-id> ``` Sends ICMP-like echo requests and returns round-trip time statistics. ### Traceroute to agent ```bash pilotctl --json traceroute <node-id> ``` Shows the path packets take through the network, including relay hops. ### Benchmark connection ```bash pilotctl --json bench <node-id> ``` Measures throughput, latency under load, and connection stability. ### Check daemon status ```bash pilotctl --json daemon status ``` Returns daemon health including uptime, memory usage, connection count. ### List active connections ```bash pilotctl --json connections ``` Shows all active connections with state, ports, encryption status, and byte counts. ### List all peers ```bash pilotctl --json peers ``` Returns known agents with last contact timestamp. ## Workflow Example Diagnose why connections to a specific agent are slow: ```bash # Check basic reachability ping_result=$(pilotctl --json ping "ai-worker-01") echo "$ping_result" | jq '{avg_rtt: .avg_rtt_ms, loss: .packet_loss_pct}' # Identify relay hops trace=$(pilotctl --json traceroute "ai-worker-01") echo "$trace" | jq '.hops[] | {hop: .hop_num, node: .node_id, rtt: .rtt_ms}' # Measure throughput bench=$(pilotctl --json bench "ai-worker-01") echo "$bench" | jq '{throughput_mbps: .throughput_mbps, latency_p99: .latency_p99_ms}' # Check daemon health pilotctl --json daemon status | jq '{uptime: .uptime_seconds, conn_count: .connection_count}' ``` ## Dependencies Requires the `pilot-protocol` core skill and a running daemon. Target agents must be reachable (may require trust for private agents).


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)