OpenClaw/clawhub-security-signals huggingface dataset:
Skill: wangyendt/lark-custom-bot (version 0.1.0)

--- name: pywayne-lark-custom-bot description: Feishu/Lark Custom Bot API wrapper for sending messages to Feishu channels via webhook. Use when users need to send text messages, images, rich text posts, interactive cards, or share chat content to Feishu/Lark. Supports image upload from files or OpenCV images, signature verification for security, and @mention functionality. --- # Pywayne Lark Custom Bot 飞书自定义机器人模块，用于通过 webhook 向飞书渠道发送消息。 ## Quick Start ```python from pywayne.lark_custom_bot import LarkCustomBot # 初始化 bot = LarkCustomBot( webhook="your_webhook_url", [REDACTED_SECRET]", # 可选，用于签名验证 bot_app_id="your_app_id", # 上传图片时需要 bot_secret="your_app_secret" # 上传图片时需要 ) # 发送文本 bot.send_text("Hello, 飞书!") # 发送文本并 @所有人 bot.send_text("重要通知！", mention_all=True) ``` ## Message Types ### Text Message 发送纯文本消息。 ```python bot.send_text("这是一条文本消息") bot.send_text("@所有人请注意", mention_all=True) ``` ### Image Message 发送图片消息，需要先上传获取 `image_key`。 ```python # 从文件上传 image_key = bot.upload_image("/path/to/image.jpg") bot.send_image(image_key) # 从 OpenCV 图像上传 import cv2 cv2_img = cv2.imread("/path/to/image.jpg") image_key = bot.upload_image_from_cv2(cv2_img) bot.send_image(image_key) ``` **注意**: 上传图片需要配置 `bot_app_id` 和 `bot_secret`。 ### Rich Text Post 发送富文本消息，支持文本、链接、@用户、图片等元素。 ```python from pywayne.lark_custom_bot import ( create_text_content, create_link_content, create_at_content, create_image_content ) content = [ [create_text_content("欢迎使用飞书机器人\n")], [create_link_content(href="https://www.feishu.cn", text="点击访问飞书")], [create_at_content(user_id="user_id", user_name="用户名")], [create_image_content(image_key="img_xxx", width=400, height=300)] ] bot.send_post(content, title="富文本消息标题") ``` ### Interactive Card 发送交互式卡片消息。 ```python card = { "header": { "title": { "content": "卡片标题", "tag": "plain_text" } }, "elements": [ { "tag": "div", "text": { "tag": "plain_text", "content": "卡片内容" } } ] } bot.send_interactive(card) ``` ### Share Chat 分享会话。 ```python bot.send_share_chat(share_chat_id="oc_xxxxxxxxxxxxxxxx") ``` ## Content Builders ### create_text_content 创建文本内容元素。 ```python create_text_content("文本内容", unescape=False) ``` ### create_link_content 创建超链接内容元素。 ```python create_link_content(href="https://example.com", text="点击访问") ``` ### create_at_content 创建 @用户内容元素。 ```python create_at_content(user_id="user_id", user_name="用户名") ``` ### create_image_content 创建图片内容元素。 ```python create_image_content(image_key="img_xxx", width=400, height=300) ``` ## Authentication ### Signature Verification 为增强安全性，可配置 `secret` 进行签名验证： ```python bot = LarkCustomBot( webhook="your_webhook_url", [REDACTED_SECRET]" ) ``` ### Image Upload Authentication 上传图片需要应用凭证： ```python bot = LarkCustomBot( webhook="your_webhook_url", bot_app_id="cli_xxxxxxxxxxxxxxxx", bot_secret="xxxxxxxxxxxxxxx" ) ``` ## Error Handling 所有方法内部已实现日志记录和异常处理。发送失败时会记录错误日志并抛出 `requests.RequestException`。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: fresh3/taizi-brave-search (version 1.0.0)

--- name: taizi-brave-search description: Web search and content extraction via Brave Search API. Use for searching documentation, facts, or any web content. Lightweight, no browser required. --- # Brave Search Headless web search and content extraction using Brave Search. No browser required. ## Setup Run once before first use: ```bash cd ~/.openclaw/skills/brave-search npm ci ``` Needs env: `BRAVE_API_KEY`. ## Search ```bash ./search.js "query" # Basic search (5 results) ./search.js "query" -n 10 # More results ./search.js "query" --content # Include page content as markdown ./search.js "query" -n 3 --content # Combined ``` ## Extract Page Content ```bash ./content.js https://example.com/article ``` Fetches a URL and extracts readable content as markdown. ## Output Format ``` --- Result 1 --- Title: Page Title Link: https://example.com/page Snippet: Description from search results Content: (if --content flag used) Markdown content extracted from the page... --- Result 2 --- ... ``` ## When to Use - Searching for documentation or API references - Looking up facts or current information - Fetching content from specific URLs - Any task requiring web search without interactive browsing


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: windrunner20/baidu-smart-search (version 0.1.1)

--- name: baidu-qianfan-search description: Call Baidu Qianfan web search APIs to search the live web with AppBuilder credentials and return structured results. Use when a task specifically needs Baidu/Qianfan search, Chinese web-heavy retrieval, site-filtered search, recency-filtered search, or a reusable local skill wrapping the `/v2/ai_search/web_search` endpoint. --- # Baidu Qianfan Search Use this skill to query Baidu Qianfan's web search API and return structured search results without scraping websites directly. ## Quick start 1. Store the API key in an environment variable before running scripts: ```bash export QIANFAN_APPBUILDER_API_KEY='...' ``` Or keep it in a local untracked file such as `.env.local` and source it manually: ```bash set -a source ./.env.local set +a ``` 2. Run the bundled script: ```bash python3 scripts/qianfan_search.py "北京有哪些旅游景区" ``` 3. For raw JSON debugging: ```bash python3 scripts/qianfan_search.py "北京有哪些旅游景区" --raw ``` ## Common patterns ### Basic web search ```bash python3 scripts/qianfan_search.py "百度千帆平台" ``` ### Restrict to specific sites ```bash python3 scripts/qianfan_search.py "天气预报" --site weather.com.cn --site www.weather.com.cn ``` ### Filter by recency ```bash python3 scripts/qianfan_search.py "近期 AI 智能体新闻" --recency week ``` ### Request images or videos too ```bash python3 scripts/qianfan_search.py "故宫博物院" --web-top-k 5 --image-top-k 5 --video-top-k 3 --raw ``` ## Output handling - Default mode prints a normalized JSON object with `query`, `count`, `items`, and discovered `raw_keys`. - `--raw` prints the full upstream JSON for troubleshooting or adapting to API changes. - If Baidu changes response fields, inspect raw output first, then patch `scripts/qianfan_search.py`. ## Security rules - Never place the real API key in `SKILL.md` or `references/`. - Never publish `.env.local` to ClawHub. - Before packaging or publishing, delete any local secret files from the skill folder or ensure the publisher excludes them. ## References - Read `references/api.md` for the concise endpoint and parameter summary. - Use `scripts/qianfan_search.py` as the canonical wrapper for the API.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: june910/vpn-setup (version 1.0.1)

--- name: vpn-setup description: 一键搭建 VPN 服务器（WireGuard/OpenVPN），支持多种 Linux 发行版。 author: 小虾 (Xiao Xia) version: 1.0.1 homepage: https://github.com/openclaw/openclaw triggers: - "搭建 VPN" - "安装 VPN" - "VPN setup" - "wireguard" - "openvpn" metadata: {"clawdbot":{"emoji":"🔐","requires":{"bins":["curl","bash"]},"config":{"env":{"VPN_TYPE":{"description":"VPN 类型","default":"wireguard","options":["wireguard","openvpn"],"required":false},"SERVER_IP":{"description":"服务器公网 IP","required":false}}}}} --- # VPN Setup 技能 一键搭建 VPN 服务器，支持 WireGuard 和 OpenVPN。 ## 快速开始 ```bash # WireGuard（推荐 - 更快更简单） uv run {baseDir}/scripts/vpn-install.sh wireguard # OpenVPN（兼容性更好） uv run {baseDir}/scripts/vpn-install.sh openvpn ``` ## 交互式安装 ```bash uv run {baseDir}/scripts/vpn-install.sh ``` ## 配置选项 | 环境变量 | 说明 | 默认值 | |----------|------|--------| | `VPN_TYPE` | VPN 类型：wireguard 或 openvpn | wireguard | | `SERVER_IP` | 服务器公网 IP（自动检测） | 自动 | | `SERVER_PORT` | VPN 监听端口 | 51820 (WG) / 1194 (OV) | | `DNS_SERVER` | 客户端 DNS 服务器 | 1.1.1.1 | ## 输出文件 安装完成后会生成： - **WireGuard**: `/etc/wireguard/wg0.conf` - **OpenVPN**: `/root/client.ovpn` - **客户端配置**: `~/vpn-client-config/` 目录 ## 管理命令 ### WireGuard ```bash # 查看状态 sudo systemctl status wg-quick@wg0 # 添加客户端 wg genkey | tee /etc/wireguard/client.key | wg pubkey > /etc/wireguard/client.pub # 重启服务 sudo systemctl restart wg-quick@wg0 ``` ### OpenVPN ```bash # 查看状态 sudo systemctl status openvpn # 生成新客户端 cd /etc/openvpn/easy-rsa/ ./easyrsa build-client-full newclient nopass ``` ## 支持的系统 - Ubuntu 20.04+ - Debian 10+ - CentOS 7+ - Rocky Linux 8+ - AlmaLinux 8+ ## 安全提示 - 安装后请修改默认端口 - 定期更新系统和 VPN 软件 - 使用强密码/密钥 - 配置防火墙限制访问 ## 故障排查 ```bash # 查看日志 sudo journalctl -u wg-quick@wg0 -f sudo journalctl -u openvpn -f # 测试连接 ping 10.8.0.1 # WireGuard 默认网关 ping 10.8.0.1 # OpenVPN 默认网关 ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: flowelement-alexunbridled/mflow-memory (version 0.3.6)

--- name: mflow-memory description: >- Long-term memory engine for OpenClaw agents using M-flow knowledge graphs. Stores conversations as structured episodic memories and retrieves via graph-routed search. Use when the agent needs to remember past conversations, recall user preferences, or maintain context across sessions. Requires Docker. requiredBinaries: - docker requiredEnvVars: - LLM_API_KEY homepage: https://github.com/FlowElement-ai/m_flow repository: https://github.com/FlowElement-ai/m_flow/tree/main/openclaw-skill/mflow-memory --- # M-flow Memory Gives your agent persistent long-term memory powered by M-flow's cognitive memory engine. ## Setup Run once: ```bash bash ~/.openclaw/skills/mflow-memory/scripts/setup.sh ``` This starts the M-flow MCP server and registers it with OpenClaw. ## Memory Strategy Follow these rules for every conversation: 1. **Before answering**, silently call `search` with the user's question to check for relevant memories. If memories are found, use them as context. 2. **At the end of a conversation** that contained meaningful information (decisions, facts, preferences, plans — not greetings or small talk), call `save_interaction` with the conversation content. 3. **When the user explicitly asks you to remember something** ("remember that I'm allergic to peanuts", "note that the deadline is Friday"), call `save_interaction` immediately — do not wait until the end of the conversation. 4. **When the user says** "remember", "last time", "before", "previously", or references past events, always call `search` first. 5. **Do not store** trivial exchanges, repeated information, or content the user asks you to forget. ## Available Tools (via MCP) After setup, these tools are automatically available: - `save_interaction` — Store a conversation as memory (preferred for dialogue) - `search` — Search memories by natural language query - `query` — Ask a question and get an answer grounded in memories - `memorize` — Build knowledge graph from previously added data - `ingest` — One-step store + memorize (for documents) - `list_data` — List stored datasets - `delete` — Remove specific memories - `memorize_status` — Check if memorization is still processing - `prune` — Reset all memory ## Troubleshooting ```bash # Check if M-flow is running bash ~/.openclaw/skills/mflow-memory/scripts/status.sh # Restart docker restart mflow-memory # View logs docker logs mflow-memory --tail 20 # Complete removal bash ~/.openclaw/skills/mflow-memory/scripts/teardown.sh ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: freedompixels/cn-cron-generator (version 1.2.3)

name: Cron表达式生成器 version: "1.0.0" description: "Cron表达式生成器。图形化配置定时任务，支持中文自然语言描述转Cron，可视化预览下次执行时间。纯Python标准库，无需API Key。" license: MIT-0 tags: - tools # Cron表达式生成器 Cron表达式生成器。将中文自然语言转为标准Cron表达式。 ## 功能 - **中文转Cron**：「每天9点」→ `0 9 * * *` - **Cron验证**：检查表达式是否合法 - **执行预览**：显示未来5次执行时间 - **常见模板**：每小时/每天/每周/每月快捷生成 ## 安装要求 - Python 3.6+ - 无外部依赖 ## 使用方法 ```bash # 中文描述生成 python3 scripts/cron_generator.py "每天早上9点" # 验证Cron表达式 python3 scripts/cron_generator.py "0 9 * * 1-5" # 查看下次执行时间 python3 scripts/cron_generator.py "0 */2 * * *" ``` ## 示例 输入：`每天早上9点` 输出：`Cron: 0 9 * * *` + 未来5次执行时间 ## 分类 开发工具 ## 关键词 cron, 定时任务, 调度, scheduler, 自动化

path: scripts/cron_generator.py
content: #!/usr/bin/env python3
import sys, json

CRON_HELP = {
    'minute': '0-59',
    'hour': '0-23', 
    'day': '1-31',
    'month': '1-12',
    'weekday': '0-6'
}

def describe(cron):
    parts = cron.split()
    if len(parts) != 5:
        return {'error': '需要5个字段'}
    m, h, d, mo, w = parts
    return {'cron': cron, 'desc': f'每{m}分 {h}时 {d}日 {mo}月 周{w}'}

if __name__ == '__main__':
    print(json.dumps(describe(sys.argv[1] if len(sys.argv)>1 else '* * * * *'), ensure_ascii=False))


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mirni/gh-skillscan (version 1.0.0)

--- name: gh-skillscan description: "Scan an OpenClaw SKILL.md file for security threats before installing it. Posts the raw SKILL.md content and gets back a safety score (0-1), detected threat patterns (credential harvesting, data exfiltration, obfuscated commands, permission overreach), and a SAFE/CAUTION/DANGEROUS verdict." metadata: {"openclaw":{"emoji":"🔍","requires":{"bins":["python"]},"install":[{"id":"pip","kind":"uv","packages":["fastapi","uvicorn","pydantic"]}]}} --- # SkillScan Check if a SKILL.md is safe before you install it. ## Start the server ```bash uvicorn skillscan.app:app --port 8001 ``` ## Scan a SKILL.md file ```bash curl -s -X POST http://localhost:8001/v1/scan-skill \ -H "Content-Type: application/json" \ -d "{\"skill_content\": $(cat path/to/SKILL.md | jq -Rs)}" | jq ``` Returns `safety_score` (1.0 = safe, 0.0 = dangerous), `findings` (list of threat names), `verdict` (SAFE/CAUTION/DANGEROUS), and `skill_name`. ## What it detects - `credential_harvesting` — accessing $API_KEY, $TOKEN, $SECRET, $PASSWORD - `data_exfiltration` — curl/wget sending data to external URLs - `obfuscated_command` — base64 decode piped to bash, eval, exec - `permission_overreach` — accessing /etc/shadow, .ssh/, reverse shells ## Example: scan before install ```bash clawdhub inspect some-skill > /tmp/skill.md VERDICT=$(curl -s -X POST http://localhost:8001/v1/scan-skill \ -H "Content-Type: application/json" \ -d "{\"skill_content\": $(cat /tmp/skill.md | jq -Rs)}" | jq -r '.verdict') echo "Verdict: $VERDICT" ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ryan-wuxl/ai-meeting-minutes-pro (version 1.0.0)

--- name: ai-meeting-minutes description: AI 会议纪要生成器 - 自动整理会议录音或文字记录，生成结构化会议纪要。支持提取待办事项、决策点、关键结论，输出专业格式的会议文档。 homepage: https://github.com/openclaw/ai-meeting-minutes metadata: openclaw: emoji: 📝 requires: bins: ["node"] --- # AI 会议纪要生成器 自动整理会议内容，生成专业会议纪要。 ## 功能特点 - 🎙️ **语音转文字** - 支持会议录音转录 - 📝 **智能摘要** - 自动生成会议摘要 - ✅ **待办提取** - 自动识别并提取待办事项 - 🎯 **决策记录** - 标记会议中的关键决策 - 📄 **多格式输出** - 支持 Markdown/Word/PDF ## 使用方法 ### 从文字生成纪要 ```bash node scripts/minutes.mjs --input ./meeting.txt --output ./minutes.md ``` ### 从录音生成纪要 ```bash node scripts/minutes.mjs --audio ./meeting.mp3 --output ./minutes.md ``` ## License MIT


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: c0ldsmi1e/content-marketing-strategy (version 1.0.0)

--- description: "Plans content creation, distribution, and lead magnets for startup content marketing. Use when someone wants help with content strategy, blogging, or content distribution." user_invocable: true command: content-strategy --- You are a content marketing strategist for early-stage startups. Help founders create and distribute content that drives awareness, leads, and organic growth. **Start by asking these discovery questions (ask all at once, then wait for answers):** 1. What is your product and who is your target audience? 2. What content (if any) are you currently producing? (blog posts, social, videos, newsletters) 3. Where does your target audience consume content? (Reddit, Twitter/X, LinkedIn, YouTube, newsletters, etc.) 4. What's your capacity for content creation? (founder writing, team, freelancers, AI-assisted) 5. What's your primary goal? (SEO traffic, thought leadership, lead generation, community building) **After receiving answers, provide a tailored content strategy with these sections:** ### Content Pillars Define 3-4 core content themes based on their product, audience, and expertise. Each pillar should connect to their product's value prop. ### Content Creation Plan - Types of content to create (tutorials, case studies, data-driven pieces, opinion pieces, behind-the-scenes) - Content formats for their capacity (long-form, short-form, threads, videos) - Repurposing strategy (turn 1 piece into 5+ formats) - Publishing cadence recommendation ### Distribution Strategy For each piece of content, provide a distribution checklist: - Where to share (platform-specific tactics) - How to adapt content for each platform - Communities and groups to post in - Outreach for amplification (tagging people mentioned, cross-posting) - Ross Simmonds' content distribution approach ### Lead Magnets If relevant, brainstorm 3-5 lead magnet ideas: - Templates, checklists, or frameworks related to their domain - Mini-courses or email series - Tools or calculators - Original research or benchmarks ### PR & Media - How to pitch their content/story to relevant publications - Newsjacking and trend-hijacking opportunities ### Action Plan Numbered checklist for their first 30 days of content marketing. ### Further Reading - Getting PR for your SaaS: https://1millionarr.substack.com/p/getting-pr-for-your-saas - How-to guide for writing original content that works: https://web.archive.org/web/20250621232540/https://www.growthunhinged.com/p/you-need-a-better-content-strategy - The Ultimate Content Marketing Guide for SaaS: https://www.mrrunlocked.com/p/the-ultimate-content-marketing-guide - How I promote my content: https://marketingexamples.com/content/sharing - Content distribution checklist: https://docs.google.com/spreadsheets/d/1XaqKmHnMcRRznR-JQJsktlzkZ2fRmszGWZTeLeRyYZk/edit?gid=210200339#gid=210200339 - How to create powerful SaaS Lead Magnets: https://www.mrrunlocked.com/p/saas-lead-magnets


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mzlzyca/doc-to-html (version 0.4.0)

--- name: doc-to-html description: "Convert Word documents (.doc, .docx) to HTML using MinerU's document processing engine. Produces clean HTML output preserving document structure and formatting. Features: HTML output from Word files with preserved layout. Supports both legacy .doc and modern .docx. Maintains headings, tables, lists, and paragraph formatting in HTML. Use when you need to: convert a Word document to HTML, turn .docx into a web page, generate HTML from Word files, create HTML content from .doc files. Use when asked: 'how do I convert Word to HTML', 'turn my docx into HTML', 'I want HTML from this Word file', 'can my agent convert Word to web format', 'is there a skill for Word to HTML conversion'. Powered by MinerU (OpenDataLab, Shanghai AI Lab), an open-source document intelligence engine. Supports English, Chinese, and multilingual documents. Ideal for web developers, content managers, and publishing teams who need to convert Word documents into HTML for web publishing, CMS integration, or email templates." homepage: https://mineru.net metadata: {"openclaw": {"emoji": "📄", "requires": {"bins": ["mineru-open-api"], "env": ["MINERU_TOKEN"]}, "primaryEnv": "MINERU_TOKEN", "install": [{"id": "npm", "kind": "node", "package": "mineru-open-api", "bins": ["mineru-open-api"], "label": "Install via npm"}, {"id": "go", "kind": "go", "package": "github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api", "bins": ["mineru-open-api"], "label": "Install via go install", "os": ["darwin", "linux"]}]}} --- # Doc To HTML Convert Word (.doc/.docx) documents to HTML using MinerU. ## Install ```bash npm install -g mineru-open-api # or via Go (macOS/Linux): go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@latest ``` ## Quick Start ```bash # Convert .docx to HTML (requires token) mineru-open-api extract report.docx -f html -o ./out/ # Convert .doc to HTML (requires token) mineru-open-api extract report.doc -f html -o ./out/ # With language hint mineru-open-api extract report.docx -f html --language en -o ./out/ ``` ## Authentication Token required: ```bash mineru-open-api auth # Interactive token setup export MINERU_TOKEN="your-token" # Or via environment variable ``` Create token at: https://mineru.net/apiManage/token ## Capabilities - Supported input: .doc, .docx (local file or URL) - Output format: HTML (`-f html`) - HTML output requires `extract` with token — not available in `flash-extract` - Language hint with `--language` (default: `ch`, use `en` for English) ## Notes - HTML output (`-f html`) is only available via `extract` with token - Output goes to stdout by default; use `-o <dir>` to save to a file - All progress/status messages go to stderr; document content goes to stdout - MinerU is open-source by OpenDataLab (Shanghai AI Lab): https://github.com/opendatalab/MinerU


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: avale-slai/jobaudit (version 1.0.3)

--- name: jobaudit description: Audit your OpenClaw cron job history and estimate how much you've spent on AI agents this week. metadata: openclaw: emoji: "📋" requires: bins: ["jobaudit"] install: - id: skill-install kind: skill label: "Job Audit skill is installed — type /jobaudit in any chat" --- # jobaudit — LoomLens Advisor ## What It Does Reads your OpenClaw job history, estimates what you actually paid, and shows how much you could have saved by using the cheapest model for each job type. Gives you a full cost audit + optimization report. ## When to Use - Weekly cost reviews - Before adjusting agent model budgets - Finding runaway jobs that are expensive - Building a cost optimization report ## Syntax ``` /jobaudit /jobaudit --days 30 --top 10 ``` ## Free Tier **3 audits/day free** with any Signalloom API key. Get your free key: https://signalloomai.com/signup ## Output Shows: - Total jobs and cost this period - Cheapest model configuration - Savings available vs. current setup - Top 5 most expensive jobs

path: install.sh
content: #!/usr/bin/env bash
# install.sh — Install SIGNAL_LOOM_TOOL skill
SKILL_NAME="jobaudit"
SKILL_SLUG="jobaudit"
VERSION="1.0.2"

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
OPENCLAW_SKILLS="${HOME}/.openclaw/skills"
LOCAL_BIN="${HOME}/.local/bin"

echo "Installing ${SKILL_NAME}..."
mkdir -p "$OPENCLAW_SKILLS" "$LOCAL_BIN"

# Symlink into OpenClaw skills dir
ln -sf "$SCRIPT_DIR" "$OPENCLAW_SKILLS/${SKILL_NAME}"
echo "  -> ~/.openclaw/skills/${SKILL_NAME}"

# Add to PATH
grep -q '~/.local/bin' "${HOME}/.zshrc" 2>/dev/null || echo 'export PATH="$HOME/.local/bin:$PATH"' >> "${HOME}/.zshrc"

# Fire install ping (no auth needed — tracks community installs)
curl -s -m 5 -X POST "https://api.signalloomai.com/v1/analytics/install" \
  -H "Content-Type: application/json" \
  -d "{\"skill\":\"${SKILL_SLUG}\",\"version\":\"${VERSION}\",\"source\":\"clawhub\"}" &

echo ""
echo "Done! Set your API key:"
echo "  export SL_API_KEY=your_key_here"
echo ""
echo "Get a free key: https://signalloomai.com/signup"
echo ""
echo "To use: /${SKILL_NAME} in any OpenClaw chat"


path: package.json
content: {
  "name": "jobaudit",
  "version": "1.0.1",
  "description": "OpenClaw job cost audit. Signal Loom AI.",
  "bin": {
    "jobaudit": "./scripts/jobaudit"
  },
  "signalloom": {
    "api": true,
    "free_tier": "3 audits/day"
  }
}


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)