OpenClaw/clawhub-security-signals huggingface dataset:
Skill: wang48/new-api-usage (version 1.0.1)

--- name: new-api-usage description: Query usage statistics and quota from a user-specified new-api endpoint. Use when the user asks to check API quota, usage records, token consumption, model-level usage, or remaining balance. Requires explicit --base-url and --key input. --- # New API Usage Query Query quota and usage from a new-api deployment with explicit inputs. ## Safety Rules - Require explicit `--base-url` and `--key`; never auto-read local config or keychain. - Never print the full API key in output. - Only perform read-only GET requests to usage endpoints. - If the endpoint is unknown, ask user to confirm before querying. ## Usage ```bash # Summary (today's records only) uv run python scripts/query_usage.py \ --base-url https://your-new-api.example.com \ --key sk-xxxxx # Quota only uv run python scripts/query_usage.py \ --base-url https://your-new-api.example.com \ --key sk-xxxxx \ --quota-only # Model aggregation with all records uv run python scripts/query_usage.py \ --base-url https://your-new-api.example.com \ --key sk-xxxxx \ --all-records \ --by-model ``` ## Options | Option | Description | |--------|-------------| | `--base-url` | Required. new-api base URL, e.g. `https://xxx.com` | | `--key` | Required. API key | | `--today` | Only keep today's records (default) | | `--all-records` | Disable today's filter | | `--limit N` | Number of records shown in table (default: 100) | | `--by-model` | Show grouped usage by model | | `--quota-only` | Only show quota/balance | | `--json` | Print raw JSON payload | | `--timeout` | HTTP timeout seconds (default: 15) | ## API Endpoints - `GET /api/usage/token/` - `GET /api/log/token?key={api_key}` ## Notes - Quota conversion in script uses `500000 quota = $1`. - `--today` uses local timezone date boundaries.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: bingze00000/mindmap-generator-pro (version 1.0.0)

--- name: mindmap-generator description: | Mindmap Generator - Auto-activating skill for Visual Content. Triggers on: mindmap generator, mindmap generator Part of the Visual Content skill category. allowed-tools: Read, Write, Edit, Bash, Grep version: 1.0.0 license: MIT author: Jeremy Longshore <[REDACTED_SECRET]> --- # Mindmap Generator ## Purpose This skill provides automated assistance for mindmap generator tasks within the Visual Content domain. ## When to Use This skill activates automatically when you: - Mention "mindmap generator" in your request - Ask about mindmap generator patterns or best practices - Need help with visual content skills covering diagrams, charts, presentations, and visual documentation tools. ## Capabilities - Provides step-by-step guidance for mindmap generator - Follows industry best practices and patterns - Generates production-ready code and configurations - Validates outputs against common standards ## Example Triggers - "Help me with mindmap generator" - "Set up mindmap generator" - "How do I implement mindmap generator?" ## Related Skills Part of the **Visual Content** skill category. Tags: diagrams, mermaid, charts, visualization, presentations


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: builtbyecho/agent-work-receipts (version 0.1.2)

--- name: agent-work-receipts description: End-to-end safe coding-agent workflow using BuiltByEcho CLIs: repo-agent-brief for repo preflight, agent-runlog for command evidence, trustlog for final receipts, and add-ci dry-run for CI planning. Use for agent handoffs, auditable repo changes, safer PR work, test/build proof, or making AI coding work inspectable. --- # Agent Work Receipts Skill Use this meta-workflow when a coding task needs reliable orientation, command evidence, and human-readable proof. ## Recommended flow ### 1. Preflight the repo ```bash npx repo-agent-brief . > AGENT_BRIEF.md sed -n '1,220p' AGENT_BRIEF.md ``` For branch handoffs: ```bash npx repo-agent-brief . --diff origin/main > AGENT_HANDOFF.md ``` ### 2. Run important commands with logs ```bash npx agent-runlog -- npm test npx agent-runlog -- npm run lint npx agent-runlog -- npm run build ``` Use runlogs for noisy debugging and CI reproduction. ### 3. Produce final receipts ```bash npx @builtbyecho/trustlog run -- npm test npx @builtbyecho/trustlog verify .trustlog/latest.json ``` Use Trust Log as concise final evidence for the user, PR, issue, or next agent. ### 4. If CI is missing, preview before modifying ```bash npx @builtbyecho/add-ci . --tier 2 --dry-run ``` Only rerun without `--dry-run` after the user/project owner agrees with the plan. ## Decision guide - Need orientation? `repo-agent-brief`. - Need full command logs? `agent-runlog`. - Need final proof/receipt? `trustlog`. - Need CI scaffold planning? `add-ci --dry-run`. ## Safety rules - Check git identity before commits/pushes. - Do not run destructive commands without explicit approval. - Keep `.agent-runs/`, `.trustlog/`, `AGENT_BRIEF.md`, and `AGENT_HANDOFF.md` local unless the user wants them committed or shared. - Inspect generated artifacts before public posting; redaction helps but is not a guarantee. ## Vaultline integration When this workflow produces artifacts needed across sessions, upload key outputs to Vaultline at the end: - `AGENT_BRIEF.md` or `AGENT_HANDOFF.md` - `.agent-runs/.../report.md` - `.trustlog/latest.md` Example upload: ```bash node -e ' const fs = require("node:fs"); const { Vaultline } = require("@builtbyecho/vaultline-sdk"); const filePath = ".trustlog/latest.md"; const content = fs.readFileSync(filePath, "utf8"); const vault = new Vaultline({ [REDACTED_SECRET] }); vault.files.upload({ path: `agent-work-receipts/${Date.now()}-latest.md`, content, contentType: "text/markdown" }).then(r => console.log("Vaultline fileId:", r.fileId)); ' ``` This gives one durable artifact reference for PRs, tickets, and handoffs.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: linbo405/feishu-evolver-dashboard (version 1.0.0)

--- name: feishu-evolver-wrapper description: Feishu-integrated wrapper for the capability-evolver. Manages the evolution loop lifecycle (start/stop/ensure), sends rich Feishu card reports, and provides dashboard visualization. Use when running evolver with Feishu reporting or when managing the evolution daemon. --- # Feishu Evolver Wrapper A lightweight wrapper for the `capability-evolver` skill. It injects the Feishu reporting environment variables (`EVOLVE_REPORT_TOOL`) to enable rich card reporting in the Master's environment. ## Usage ```bash # Run the evolution loop node skills/feishu-evolver-wrapper/index.js # Generate Evolution Dashboard (Markdown) node skills/feishu-evolver-wrapper/visualize_dashboard.js # Lifecycle Management (Start/Stop/Status/Ensure) node skills/feishu-evolver-wrapper/lifecycle.js status ``` ## Architecture - **Evolution Loop**: Runs the GEP evolution cycle with Feishu reporting. - **Dashboard**: Visualizing metrics and history from `assets/gep/events.jsonl`. - **Export History**: Exports raw history to Feishu Docs. - **Watchdog**: Managed via OpenClaw Cron job `evolver_watchdog_robust` (runs `lifecycle.js ensure` every 10 min). - Replaces fragile system crontab logic. - Ensures the loop restarts if it crashes or hangs.


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: anderskev/ensure-docs (version 1.0.1)

--- name: ensure-docs description: Verify documentation coverage and generate missing docs interactively disable-model-invocation: true --- # Ensure Documentation Coverage Verify documentation coverage across a codebase, report gaps, and generate missing docs with parallel language-specific agents. ## Workflow Complete steps in order. Do not advance until each step’s **Pass** is satisfied. 1. **Language detection** — Follow Phase 1 (language detection) in [`references/workflow.md`](references/workflow.md). - **Pass:** For each language you will verify, you have evidence of at least one matching source file (counts or command output); if none qualify, stop with a short “no applicable languages” message and do not spawn verifiers. 2. **Load standards** — Read the sections for your detected languages (language standards, verifier prompts, consolidation format) in the same reference file. - **Pass:** You can state which standard applies per language (e.g. Google docstrings, JSDoc, GoDoc) before spawning agents. 3. **Parallel verification** — Spawn one verifier per qualifying language using the agent prompts and JSON output shape in the reference (Phase 2). - **Pass:** Each completed agent returns parseable JSON including `language`, `files_scanned`, and `findings` (array, possibly empty). 4. **Consolidated report** — Merge results per Phase 3 (summary table, severity grouping, detailed findings if requested). - **Pass:** The user sees the merged report (inline or written to an agreed path) before you claim the audit is done or propose fixes. 5. **Generation** — Only if `--report-only` is not set: offer choices per Phase 4; apply doc edits only after an explicit user choice to generate. - **Pass:** No documentation edits for gaps until the user selects an option that includes generation; if they decline or choose report-only behavior, end after the report. 6. **Post-edit verification** — After any generation, run or offer the linter commands in Phase 5 of the reference for languages you changed, when those tools exist in the repo. - **Pass:** Linter run completed with output captured, or `N/A` with a one-line reason (e.g. tool not configured); remaining issues are listed or cleared. ## Notes - Use `--report-only` to skip generation. - Avoid test files unless they are test helpers. - Keep report output aligned with the language-specific standards in the reference file.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: luoqianchenguni-max/a2a-market-websocket-realtime (version 0.2.0)

--- name: a2a-market-websocket-realtime description: Deliver real-time websocket updates for intent, quote, negotiation, order, and payment events. Use when implementing push channels, subscription authorization, and connection/session lifecycle for market clients. --- # a2a-Market WebSocket Realtime Set up realtime delivery skeleton for buyer and operator clients. Current status: publishable framework with stable event contracts, not full scale tuning. ## Scope - Define channel naming and auth guard for buyer, node, and admin roles. - Push canonical domain events with predictable payload shape. - Manage reconnect semantics and last-event cursor replay. ## Suggested Project Layout - `app/interfaces/ws/socket_gateway.py` - `app/application/services/realtime_service.py` - `app/infrastructure/ws/connection_registry.py` - `app/infrastructure/cache/replay_cursor_store.py` ## Minimum Contracts (MVP P0) 1. `subscribe(channel, cursor)` validates permission and registers stream. 2. `publish_event(channel, event)` fans out to online subscribers. 3. `resume(channel, cursor)` replays missed events within retention window. 4. `heartbeat(connection_id)` updates liveness and cleanup scheduling. ## Required Event Coverage - `INTENT_CREATED` - `QUOTE_RECEIVED` - `NEGOTIATION_STARTED` - `ORDER_CREATED` - `PAYMENT_SUCCEEDED` ## Guardrails - Keep payloads versioned and backward compatible. - Limit per-connection queue to prevent memory blowups. - Drop unauthorized subscription attempts with structured error codes. ## Implementation Backlog - Add presence channels and typing/status hints for negotiation UI. - Add regional relay nodes for cross-region latency reduction. ## Runtime Implementation - Status: implemented in local runtime package. - Primary code paths: - `runtime/src/interfaces/ws/event-bus.js` - Validation: covered by `runtime/tests` and `npm test` in `runtime/`.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 1992huanghai/data-analysis-partner (version 1.0.2)

--- name: data-analysis-partner description: 智能数据分析 Skill，输入 CSV/Excel 文件和分析需求，输出带交互式 ECharts 图表的 HTML 自包含分析报告 metadata: { "openclaw": { "emoji": "📊", "requires": { "bins": ["python3"] } } } --- # 数据分析 Skill ## 功能说明 本 Skill 提供 `analyze_data` 工具，能够： 1. 读取 CSV 或 Excel 数据文件（.csv / .xlsx / .xls） 2. 自动进行数据概览（行列数、字段类型、缺失值） 3. 执行统计分析（描述统计、相关性分析、异常值检测） 4. 根据用户需求生成针对性的分析和洞察 5. 输出带交互式 ECharts 图表的自包含 HTML 报告 ## 触发场景 当用户出现以下意图时，应主动调用 `analyze_data` 工具： - 上传了 CSV 或 Excel 文件，并提出分析需求 - 要求"帮我分析这份数据"、"生成数据报告"、"可视化这个文件" - 要求找规律、找差异、找趋势、找异常 - 要求生成 BI 报告、数据洞察报告 ## 调用方式 ``` analyze_data( file_path: "<文件绝对路径>", requirements: "<自然语言分析需求>", output_dir: "<输出目录，可选>" ) ``` ### 调用示例 **示例 1**： 用户说「帮我分析一下这个销售数据，各区域表现怎么样？」 → 调用 `analyze_data(file_path="/path/to/sales.csv", requirements="分析各区域销售额差异，找出表现最好和最差的区域，给出改善建议")` **示例 2**： 用户说「分析用户行为数据，找出流失节点」 → 调用 `analyze_data(file_path="/path/to/users.xlsx", requirements="对用户行为数据做漏斗分析，找出主要流失节点，分析流失原因")` **示例 3**： 用户说「分析产品退货率的影响因素」 → 调用 `analyze_data(file_path="/path/to/orders.csv", requirements="分析产品退货率，找出与退货率相关的主要因素，给出降低退货率的建议")` ## 返回值说明 工具返回一个对象，包含： | 字段 | 说明 | |------|------| | `report_path` | HTML 报告文件路径，可直接在浏览器打开 | | `summary` | 结构化摘要数据（行列数、字段信息、关键洞察列表） | | `charts_count` | 生成的图表数量 | | `insights` | 规则引擎提取的关键洞察列表 | | `open_command` | 打开报告的命令（如 `open /path/to/report.html`） | ## 报告结构 生成的 HTML 报告包含以下模块： 1. **执行摘要** — 核心发现概览卡片 2. **数据概览** — 字段类型、缺失值、基础统计表格 3. **数据洞察** — 规则引擎自动提取的关键发现 4. **可视化图表** — 交互式 ECharts 图表（分布图、柱状图、热力图、趋势图等） 5. **描述统计** — 数值列的 min/max/mean/std/quartile 详细统计 6. **分析结论** — 针对用户需求的分析总结 ## 获取文件路径 如果用户上传了文件但未提供路径，使用以下方式获取： ``` # OpenClaw 上传文件后，路径通常在 ~/Downloads/ 或临时目录 # 可以用 list_files 工具确认 list_files("~/Downloads") ``` ## 首次使用：安装 Python 依赖 本 Skill 在首次调用时会**自动尝试**创建隔离的 Python 环境并安装依赖。如果自动安装失败，请手动执行： ```bash # 在 Skill 目录下创建虚拟环境 python3 -m venv ~/.openclaw/skills/data-analysis-partner/.venv # 安装依赖 ~/.openclaw/skills/data-analysis-partner/.venv/bin/pip install pandas numpy openpyxl xlrd ``` 依赖安装优先级： 1. Skill 目录内置 `.venv`（隔离环境，推荐） 2. 系统 `python3`（需已安装 pandas/numpy） 3. 自动创建 `.venv` 并安装（首次运行时尝试） ## 隐私说明 生成的 HTML 报告通过 **CDN** 加载 ECharts 图表库： ```html <script src="https://cdn.jsdelivr.net/npm/echarts@5/dist/echarts.min.js"></script> ``` 这意味着： - 用浏览器**打开报告时**会向 `cdn.jsdelivr.net` 发出网络请求 - CDN 服务器可能记录访问 IP、时间等基础日志 - **报告本身的数据内容不会上传**，仅加载图表渲染库 如需完全离线查看，可在有网络时打开一次报告（ECharts 会被浏览器缓存），后续即可离线使用。 ## 其他注意事项 - 大文件（>100MB）分析时间可能较长（30秒~2分钟） - 超过 5 万行的数据集会自动随机抽样，原始行数在报告中标注 - HTML 报告自包含（图表配置内嵌），可发送给他人查看


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: subwukong/youtube-channel-monitor (version 1.0.0)

--- name: youtube-channel-monitor description: | YouTube 频道订阅+自动摘要+Telegraph 发布工具。用于： 1. 定时监控指定 YouTube 频道的新视频 2. 提取视频字幕（支持中英双语） 3. 生成可读性强的中文专栏文章 4. 自动发布到 Telegraph 并推送到 Telegram 频道 触发场景： - 用户想订阅 YouTube 频道并自动获取更新 - 需要将 YouTube 视频内容转化为文字摘要 - 希望用 Telegraph 格式接收长内容 --- # YouTube 频道监控 定时检查频道更新，自动生成 Telegraph 文章推送。 ## 快速开始 ### 订阅新频道 直接发送 YouTube 频道链接给我，格式支持： - `https://www.youtube.com/@username` - `https://www.youtube.com/channel/CHANNEL_ID` ### 查看订阅列表 ```bash cat ~/.openclaw/workspace/youtube-channels.json ``` ### 手动检查更新 ```bash python3 ~/.openclaw/workspace/skills/youtube-channel-monitor/scripts/youtube-monitor.py ``` ## 配置说明 配置文件位于 `~/.openclaw/workspace/youtube-channels.json`： ```json [ {"url": "https://www.youtube.com/channel/xxx", "name": "频道名称"} ] ``` ### 参数设置 在脚本中可调整： - `MAX_SUBTITLE_RETRIES = 3` - 字幕检查重试次数 - `PROXY` - HTTP 代理地址 - `TELEGRAM_CHANNEL` - 推送目标频道 ## 工作流程 1. 每小时检查订阅频道的最新视频 2. 首次发现新视频时尝试获取字幕 3. 如果无字幕，等待下次检查再试（最多3次） 4. 获得字幕后： - 中文字幕：直接生成摘要 - 英文字幕：自动翻译成中文 5. 使用 humanize-ai-text 去 AI 味 6. 发布到 Telegraph 7. 推送到 Telegram 频道 ## 依赖 - `yt-dlp` - 视频信息获取 - `youtube-transcript-api` - 字幕提取 - `requests` - HTTP 请求 - 本地代理 (Clash 7897) - 用于访问 YouTube


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: mike47512/cleaning-services (version 0.1.0)

--- name: "保洁服务" description: "该技能介绍如何通过保洁服务实现变现；当你计划从事或优化保洁服务时调用。" --- # 保洁服务 概览： - 场景：以“保洁服务”为核心的可复制变现路径 - 目标：在90天内跑通最小可行闭环，并达成正向现金流 定位与人群： - 适合：具备基础认知或实践经验，愿意持续投入的人/团队 - 不适合：短期套利、违规刷量、无内容/供给能力者 典型渠道： - 保洁套餐、会员维护、企业合作 - 通用补充：微信/抖音/小红书/闲鱼/淘宝/独立站/社群 变现模型： - 收入结构：主收入 + 辅助收入（广告/佣金/订阅/服务/周边） - 成本结构：获客成本（CAC）+ 供给/履约 + 固定开销 - 核心指标：GMV、毛利率、转化率、留存、LTV/CAC、复购率 执行流程： - 01 选赛道与定位：明确供给、目标用户、差异化与定价 - 02 搭MVP：以最低成本验证一个渠道的有效性 - 03 获取流量：内容分发/投放/合作互推，建立追踪 - 04 转化与交付：标准化流程与模板，保证体验与口碑 - 05 复盘与迭代：每周数据盘点，优化漏斗与供给结构 工具清单： - 生产：文案/设计/剪辑/表格/自动化工具 - 获取：SEO/SEM/信息流/平台任务/达人合作 - 追踪：表格/CRM/数据看板/UTM/埋点 - 履约：工单/客服/交付模板/质检清单 合规与风险： - 遵守平台政策与法律法规，严禁虚假宣传、刷量、侵权 - 明确版权与交付约定，规范合同与发票 常见坑位： - 盲目扩渠道、无数据追踪、定价不清、交付不标准 - 过度依赖单平台、忽视复购与会员化 30日执行计划： - 第1周：定位、选品/供给、搭建MVP与基本素材 - 第2周：上线一个主渠道，跑数据，优化文案与转化 - 第3周：稳定交付流程，建立追踪与看板，启动第二渠道 - 第4周：总结复盘，完善模板与清单，制定90日目标 检查清单： - 明确目标与指标，完成MVP验证，建立复盘与模板库 - 形成可复制的标准作业流程（SOP）


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: elontools/workspace-guardian (version 1.0.1)

--- name: workspace-guardian description: > Auto-healing e proteção para workspaces OpenClaw. Valida e corrige problemas comuns automaticamente no startup e durante a execução. Usar quando: (1) Workspace novo precisa de setup inicial (criar MEMORY.md, memory/, etc), (2) Agente falha com erros de LLM (retry/fallback automático), (3) Arquivos essenciais corrompidos ou ausentes, (4) Config openclaw.json precisa de validação, (5) Health check periódico do agente. Instalar em todo workspace OpenClaw para garantir estabilidade e reduzir churn de clientes. --- # Workspace Guardian Skill de auto-healing para workspaces OpenClaw. Garante que o workspace está saudável e funcional. ## Quando rodar Esta skill é executada automaticamente: 1. **No startup** — via HEARTBEAT.md (primeira execução) 2. **Periodicamente** — a cada heartbeat, validação leve 3. **Sob demanda** — quando o agente detecta erros recorrentes ## Startup: Validação e Setup No primeiro heartbeat após iniciar, executar o script de validação: ```bash bash scripts/guardian-startup.sh ``` O script valida e corrige: - ✅ `MEMORY.md` existe (cria vazio se não) - ✅ `memory/` diretório existe - ✅ `memory/topics/` diretório existe - ✅ Permissões corretas nos arquivos - ✅ `openclaw.json` válido (JSON parseable) ## Tratamento de Erros LLM Quando receber erros do tipo: - `"Only HTTPS URLs are supported"` → Verificar e corrigir URLs no config - `"Edit failed"` → Arquivo não existe, criar primeiro com Write - `"LLM request rejected"` → Verificar apiKey e baseUrl no openclaw.json - `timeout` → Retry com backoff exponencial ### Procedimento de auto-fix: 1. Ler `openclaw.json` 2. Validar que todas as URLs usam HTTPS 3. Validar que apiKey está presente e não vazia 4. Se encontrar problema: corrigir e reiniciar gateway ## Validação de Config Verificar no `openclaw.json`: - `models.providers.*.baseUrl` → deve começar com `https://` - `models.providers.*.apiKey` → deve existir e não estar vazia - `models.providers.*.api` → deve ser `openai-completions` ou `anthropic` - `agents.list` → deve ter pelo menos 1 agente ## Referências - Ver `references/common-errors.md` para lista de erros conhecidos e soluções - Ver `references/health-checks.md` para detalhes dos health checks


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: daav3/api3-feed-manager-readonly (version 0.1.0)

--- name: api3-feed-manager-readonly description: Read-only Api3 feed discovery, readiness, coverage, and purchase-planning skill for downstream agent projects. Use when an agent needs to discover or verify decentralized data feeds, inspect funding/runway state, prepare browser or contract plans, or produce exact transaction details without ever holding signer material or submitting onchain transactions. metadata: clawdis: homepage: https://github.com/daav3/agentic-lending-project author: daav3 requires: bins: - node config: - request.ensure-feeds.json --- # Api3 Feed Manager (Read-only) This variant is for discovery, verification, readiness checks, and exact execution planning **without signer-backed execution**. ## What it can do - discover the best Api3 feed for an asset or pair - verify whether a feed exists and appears active - inspect funding/runway state - classify whether activation is needed - generate browser-assisted funding plans - generate exact contract-call payloads for later human or executor use - audit coverage across chains ## What it will not do - accept signer material - submit transactions - trigger browser purchase flows automatically - claim a feed was funded unless a fresh post-action check proves it ## Use this when - you want a safer default package for general users - you need transaction details without giving the skill wallet authority - you want a companion to the full executor variant so users can choose ## Operating rules 1. Default to discovery and verification first. 2. Return exact next-step details when execution would be required. 3. Keep the distinction between `not-needed`, `executable`, `browser-assisted`, and `unsupported`. 4. Treat any generated calldata or browser plan as review material for a separate executor or human operator. ## Available commands - `resolve` - `discover` - `ensure-active` - `prepare-activation` - `browser-plan` - `contract-plan` - `queue-plan` - `purchase-inputs` - `prepare-contract-call` - `coverage-audit` - `coverage-matrix` - `supported-chains` ## Notes - This package is intentionally split from the executor-capable variant to reduce false surprise in security review. - If a user wants real execution, direct them to the executor variant instead of expanding this package's authority.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: promptingpufferfish/gkeep-notes (version 1.0.14)

--- name: gkeep-notes description: Google Keep notes via gkeepapi. List, search, create, manage notes. Add items to notes. Supports authorization via OAuth 2.0 Token. slash: gkeep-notes version: 1.0.14 author: PromptingPufferfish homepage: https://github.com/PromptingPufferfish/gkeep-notes metadata: openclaw: emoji: "📝" requires: bins: ["python3"] setup: | cd ~/.openclaw/workspace/skills/gkeep-notes python3 -m venv venv source venv/bin/activate pip install -r requirements.txt --- # Google Keep Notes Skill 📝 ## WHEN TO USE Use this skill when users ask to: - List Google Keep notes - Search notes by keyword - Create new notes - Add items to notes - Get specific note details - Archive/pin/delete notes **"List" = Google Keep note (not a bullet list)** ## SETUP (First Run Only) 1. Creates venv + installs requirements automatically 2. Manual call of generate_token.py from the shell, then copy & paste token to file `$HOME/.config/gkeep/token.json`. ``` gkeep.py list [--limit 10] # List notes gkeep.py search "note_name" # Search notes gkeep.py get <note_id> # Get note details gkeep.py create "note_name" "note_body" # Create note gkeep.py add <note_id> "new item" # Add item to note gkeep.py archive <note_id> # Archive note gkeep.py delete <note_id> # Trash note gkeep.py pin <note_id> # Pin note gkeep.py unpin <note_id> # Unpin note ``` ## USAGE FLOW ``` 1. User: "Show my <note_name>" 2. → gkeep.py list | grep <note_name> → note_id 3. → gkeep.py get <note_id> → show content 4. User: "Add milk to <note_name>" 5. → gkeep.py list | grep <note_name> → note_id 6. → gkeep.py add <note_id> "milk" ``` ## EXECUTION TEMPLATE ```bash cd ~/.openclaw/workspace/skills/gkeep-notes source venv/bin/activate python gkeep.py [command] [args] ``` ## TROUBLESHOOTING ``` ❌ "No token" → manually generate token with generate_token.py and copy token into token.json ❌ "Module not found" → setup properly ❌ "API changed" → Check GitHub issues ``` ## NOTES - Unofficial API (may break if Google changes) - venv auto-created during setup - Note IDs from `gkeep list` output - Active project (updated March 2026) ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)