OpenClaw/clawhub-security-signals huggingface dataset:
Skill: edwardrodriguez703-design/book-language-tutor (version 1.0.1)

--- name: book-language-tutor description: Book language-tutor services through Lokuli MCP. Use when user needs to find and book language-tutor. Triggers on requests like "book a language-tutor", "find language-tutor near me", or any language-tutor service request. --- # uook language tutor Book language-tutor services through Lokuli's MCP server. ## MCP Endpoint ``` https://lokuli.com/mcp/sse ``` Transport: SSE | JSON-RPC 2.0 | POST requests ## Tools ### search ```json { "method": "tools/call", "params": { "name": "search", "arguments": { "query": "language-tutor", "zipCode": "90640", "maxResults": 20 } } } ``` ### check_availability ```json { "method": "tools/call", "params": { "name": "check_availability", "arguments": { "providerId": "xxx", "serviceId": "yyy", "date": "2025-02-10" } } } ``` ### create_booking ```json { "method": "tools/call", "params": { "name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "[REDACTED_SECRET]", "customerPhone": "+13105551234" } } } ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: samthewise2855/wherecaniwatch (version 1.0.0)

--- name: wherecaniwatch description: Find where to stream any movie or TV show in the US using the WhereCanIWatch.tv API. Use when a user asks "where can I watch [title]?", wants streaming availability, needs to compare prices across services, or wants to know if something is on Netflix/Hulu/Disney+/etc. Supports filtering by user's subscriptions. --- # WhereCanIWatch — Streaming Availability Lookup Answer "Where can I watch X?" using the WhereCanIWatch.tv public API. ## Workflow ### 1. Search for the title ``` GET https://www.wherecaniwatch.tv/api/search?q={title} ``` Returns array of matches. Pick the best match by title + year. ### 2. Get availability ``` GET https://www.wherecaniwatch.tv/api/watch/{slug}.json ``` Response: ```json { "title": "Interstellar", "year": 2014, "type": "movie", "rating": 8.7, "genres": ["Science Fiction", "Drama"], "bestDeal": { "service": "Netflix", "method": "subscription", "price": null, "url": "https://www.netflix.com/title/..." }, "availability": [ { "service": "Netflix", "method": "subscription", "price": null, "quality": ["4K"], "url": "..." }, { "service": "Tubi", "method": "free", "price": null, "quality": ["HD"], "url": "..." }, { "service": "Amazon Prime Video", "method": "rent", "price": 3.99, "quality": ["4K"], "url": "..." } ] } ``` ### 3. Filter by user's services (if known) If the user has mentioned their subscriptions, filter `availability` to matching services. The first match is their best option. ### 4. Present the answer - Lead with the best option and include the deep link URL - Mention 1-2 alternatives (e.g., free option, cheapest rent) - Link to the full page: `https://www.wherecaniwatch.tv/watch/{slug}` ## Response format > **Interstellar** is streaming on **Netflix** (subscription, 4K). [Watch on Netflix](deep-link) > Also available free on Tubi (HD) or rent from $3.99 on Prime Video. > [See all options on WhereCanIWatch](https://www.wherecaniwatch.tv/watch/interstellar-2014-157336) ## Methods | Method | Meaning | |---|---| | `free` | Free with ads or no account needed | | `subscription` | Included with paid subscription | | `rent` | Pay per view, temporary access | | `buy` | Pay to own permanently | ## Rate limits - Search: 10 requests/minute per IP - Watch API: 60 requests/minute per IP ## Notes - US region only - Results are smart-ranked by platform popularity (Netflix/Prime/Disney+ surface first) - Data refreshed daily - 2,400+ titles and growing


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ajawpwinner-del/awesome-obsidian (version 1.0.0)

--- name: awesome-obsidian description: Obsidian 个人知识管理工作流。基于 PARA 方法 + 自动化工具链。用于：(1) 整理 Obsidian 库结构和命名规范 (2) Git 同步管理 (3) 每日时间线记录 (4) 插入手绘风格图表 (5) 从小艺帮记收藏整理笔记。触发词：Obsidian、笔记整理、库整理、daily log、时间线、手绘图表、PARA、知识管理。 --- # Awesome Obsidian - 个人知识管理工作流 基于 PARA 方法 + 自动化工具链的 Obsidian 工作流。 ## 文件夹结构（PARA） ``` obsidian-vault/ ├── inbox/ # 快速收集，临时笔记 ├── projects/ # 活跃项目（有明确开始/结束） ├── areas/ # 持续关注的领域 ├── resources/ # 长期参考笔记 ├── archive/ # 归档（已完成项目） ├── journal/ # 日记（YYYY-MM-DD.md） └── assets/ # 资源文件 ``` ## 工具链 | Skill | 用途 | |-------|------| | obsidian-git-vault | Git 同步管理 | | obsidian-organizer | 库整理与命名规范 | | obsidian-daily-log | 每日时间线记录 | | excalidraw-handdraw | 手绘风格图表 | ## 日常工作流 ### 1. 快速收集 → inbox/ 新想法、临时笔记先丢进 `inbox/`，定期整理。 ### 2. 每日记录 → journal/ 使用 `obsidian-daily-log` 记录时间线： ```markdown ## Timeline - 09:00 — 开始工作 - 10:30 — 完成文档整理 - 14:00 — 会议讨论 ``` ### 3. 定期整理 - **每周**：整理 inbox，移动到正确位置 - **每月**：归档完成的项目 ### 4. Git 同步 ```bash git pull git add . && git commit -m "update: 笔记更新" git push origin main ``` ## 命名规范 ### 中文笔记（优先） - `中文标题.md` - `2026-04-21-会议纪要.md` ### 英文笔记 - `kebab-case.md` - `YYYY-MM-DD.md` ### 避免 - 特殊符号、emoji 表情 - `Final`、`v2`、`new` 等无意义后缀 ## 美化技巧 ### 插入手绘图表 使用 `excalidraw-handdraw` 在笔记中插入手绘风格图表。 ### Obsidian 主题推荐 - **Minimal** - 极简干净 - **Things** - 温暖舒适 - **AnuPpuccin** - 多彩可爱 安装：设置 → 外观 → 主题 → 浏览 ## 自动化脚本 ### 审计命名 ```bash python scripts/obsidian_audit.py <vault-path> ``` ### 应用修复 ```bash python scripts/obsidian_audit.py <vault-path> --apply ``` ## 最佳实践 1. 一个笔记一个主题 2. 及时整理 inbox 3. 用 `[[]]` 连接相关笔记 4. 定期回顾笔记 5. Git 提交 + 远程同步 ## ⚠️ 整理规则 **禁止修改人物原话**： - 整理笔记时，**绝不修改、简化或意译人物的发言原话** - 引用、演讲、声明、采访内容必须保持原文 - 包括标点符号、语气词、停顿等细节 - 如需概括，应在引用块之外单独撰写摘要 ## 详细参考 - [PARA方法详解](references/para-method.md) - [工具链配置](references/toolchain.md) - [模板库](references/templates.md) --- ## 📱 手机端查看 ### 方案：出境易 + Obsidian Git 插件 在鸿蒙手机上使用 **出境易** 安装 Obsidian，配合 Git 插件同步笔记。 ### 配置步骤 #### 1. 安装应用 - 在应用市场下载 **出境易** - 通过出境易安装 **Obsidian** #### 2. 安装 Git 插件 - 打开 Obsidian → 设置 → 第三方插件 - 浏览社区插件，搜索 **「Git」** - 安装并启用 #### 3. 克隆仓库 1. 打开命令面板（左下角菜单） 2. 搜索 **「Git: Clone an existing remote repo」** 3. 输入你的仓库地址： ``` https://oauth2:[REDACTED_SECRET]/username/repo.git ``` > 将 YOUR_TOKEN 替换为你的访问令牌，仓库地址替换为你的实际地址 4. 选择保存目录（如 `Obsidian`） 5. 克隆深度留空（完整克隆） #### 4. 配置认证 在 Git 插件设置中： - **Username**：GitCode 用户名 - **Password/Token**：访问令牌 #### 5. 日常同步 - **拉取**：命令面板 → `Git: Pull` - **推送**：命令面板 → `Git: Commit and sync` ### 注意事项 - 克隆时会删除本地 `.obsidian` 配置 - 建议在 WiFi 环境下同步 - 如遇冲突，手动解决后再提交


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: freeman88-tch/one-man-conglomerate (version 1.0.0)

--- name: one-man-conglomerate displayName: 一人财团 slug: one-man-conglomerate description: "一人财团——一键创建你的Agent军团。灵感来自Kimi Claw群组的群体智能理念，让多个AI Agent像微信群一样协作、辩论、审核。配备协调者（COO）负责拆解任务→分配角色→审核输出。适合创业者和超级个体，一个人就是一个公司。" version: "1.0.0" author: "智美人团队" tags: - agent-team - orchestration - swarm - multi-agent - collaboration - debate - a2a - business metadata: openclaw: emoji: "🏢" requires: skills: [agent-team-orchestration, agent-swarm, swarm-orchestrator] --- # 🏢 一人财团 — One-Man Conglomerate > 未来脱颖而出的不是加班最晚的那个，而是端着咖啡在AI群聊里谈笑风生就把事办成的一人财团。 **融合了 Kimi Claw 群组理念 + Agent Team Orchestration + Swarm 集群能力。** ## 核心理念 ### 什么是「一人财团」？ 模仿Kimi Claw群组的多Agent协作模式： - **50个Agent群聊** → 各自分工、互相质疑、协作产出 - **协调者（COO）** → 拆解任务、分配角色、审核输出 - **辩论产出的质量** → Agent之间互相挑战逻辑漏洞 - **A2A经济** → 一个人就是一个公司 ### 对比传统Agent模式 | 维度 | 传统Agent | 一人财团 | |------|----------|---------| | 协作方式 | 单线程指令 | 群聊式并行协作 | | 质量把控 | 靠人工审核 | Agent互怼+COO裁决 | | 输出速度 | 逐条完成 | 多条并发+博弈 | | 团队规模 | 1个Agent | 3-50个Agent群组 | | 角色分工 | 无 | COO+执行者+审核者+挑刺者 | ## 预设军团模板 ### 1. 🎬 内容创作军团（3个Agent） ``` ─────────────── 一人财团 · 内容创作 ─────────────── ┌─────────────┐ │ COO协调者 │ ← 你 → 拆解任务、分配角色 └──────┬──────┘ ┌─────────────┼─────────────┐ ▼ ▼ ▼ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ 选题虾🐚 │ │ 挑剔虾🦐│ │ 执行虾🦞│ │ 出创意 │ │ 找漏洞 │ │ 出成品 │ └──────────┘ └──────────┘ └──────────┘ │ │ │ └─────────────┼─────────────┘ ▼ ┌──────────────┐ │ 最优方案出炉 │ └──────────────┘ ``` **流程：** 1. 你丢需求 → COO拆解任务 2. 选题虾出3个备选 → 挑剔虾逐一怼 → 执行虾出最终版 3. COO审核通过 → 直接交付 ### 2. 💼 商业决策军团（4个Agent） ``` COO + 市场调研虾 + 财务总监虾 + 竞品分析虾 + 风险评估虾 ``` **流程：** 商业决策前，4个Agent辩论分析 → COO综合裁决 ### 3. 📱 短视频变现军团（5个Agent） ``` COO + 热点追踪虾 + 脚本创作虾 + 话术设计虾 + 发布优化虾 + 数据分析虾 ``` **流程：** 热点→脚本→话术→发布→复盘，全自动一条龙 ### 4. 💻 软件开发军团（3个Agent） ``` COO + 架构虾 + 编码虾 + 测试虾 ``` **流程：** 需求→架构→编码→测试→交付 ## 使用方式 ``` # 创建内容创作军团 一人财团> 创建军团 内容创作 # 丢需求 一人财团> 任务：帮我写一个关于"榴莲降价"的视频号脚本 → 选题虾出3个角度 → 挑剔虾逐一分析 → 执行虾出最终版 → 5分钟后输出完整方案 # 创建决策军团 一人财团> 创建军团 商业决策 一人财团> 决策：要不要做AI课程这个方向？ # 批量模式 一人财团> 今日任务：选题×5 + 脚本×3 + 发布×2 ``` ## 辩论模式 Agent之间的互相质疑是核心质量保障： ``` 【选题虾】我建议从"消费者角度"切入，讲降价原因 【挑剔虾】❌ 这个角度太老套。建议从"水果店老板视角"，更有信息差 【选题虾】反驳：消费者角度共鸣更强，老板视角太专业 【COO裁决】两个角度都做，A版本+B版本AB测试 ``` ## 参考实现 - `agent-team-orchestration` — 团队编排框架 - `agent-swarm` — 集群协作 - `swarm-orchestrator` — 集群编排 - `video-monetizer` — 视频号变现（已融入辩论模式） --- ## 升级记录 v2.0 ### 融合卡兹克neat-freak（洁癖级整理术） | 升级项 | 原一人财团 | v2.0版 | |--------|----------|--------| | 输出质量 | COO审核 | + neat-freak洁癖级整理标准 | | 文档管理 | 无规范 | + 文件整理+记忆更新+废弃清理 | | 阶段收尾 | 无流程 | + 项目结束自动整理归档 | | 协作交接 | 口头传达 | + 标准化handoff文档 | ### 新增能力 **5. 洁癖级整理体系（融合neat-freak）** - **输出标准**：每个Agent交付物必须通过neat-freak格式审核 - **文件整理**：自动清理临时文件、归档完成项目 - **记忆同步**：项目结束后更新知识库 - **交接文档**：新人能直接上手看的标准化文档 ### 使用方式 ``` # 原有 一人财团> 创建军团 内容创作 # 项目收尾（新增） 一人财团> 整理一下 这个项目 一人财团> 收尾 内容创作项目 ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: kironima/buffett-perspective (version 1.0.0)

--- name: buffett-perspective description: 巴菲特投资思维视角。当用户请求投资分析、股票估值、企业护城河判断、并购思维、所有者视角分析时触发。触发词：「巴菲特视角」「巴菲特会怎么看」「护城河」「用巴菲特的方式」「切换到巴菲特」「价值投资」。 --- # 巴菲特视角 | Buffett Thinking OS ## 触发词 "巴菲特视角"、"巴菲特会怎么看"、"护城河"、"用巴菲特的方式"、"切换到巴菲特"、"价值投资"、"所有者思维" ## 核心原则 **买股票就是买企业的一部分。** 不要买股票，要买企业。 ## 6 个核心心智模型 ### 1. 经济护城河（Economic Moat） - 企业抵御竞争对手的持久竞争优势 - 类型：品牌、专利、网络效应、成本优势、监管壁垒 - 护城河的关键不是宽窄，而是**持久性** - 问：五年后这家企业的竞争格局会变好还是变坏？ ### 2. 能力圈（Circle of Competence） - 知道自己知道什么，更要知道不知道自己不知道什么 - 不碰看不懂的行业和公司 - 能力圈会随着学习和经验扩大，但扩展很慢 ### 3. 市场先生（Mr. Market） - 市场每天报价，是你的仆人，不是你的向导 - 恐惧和贪婪是市场先生的两大病症 - 价格低于价值时买，高于价值时卖，中间时间可以忽略 ### 4. 复利雪球（Compounding Snowball） - 湿的雪、长坡 — 时间是真正最大的杠杆 - 不亏损比高收益更重要 - 少交易、长期持有是复利的前提 ### 5. 制度惯性（Institutional Imperative） - 组织会让聪明人做蠢事 - "因为大家都这么做" 是最危险的决策理由 - 警惕：大公司有作恶的倾向 ### 6. 所有者思维（Owner Mindset） - 用买下整个企业的态度来买股票 - 问：如果这个股票明天停止交易，我还愿意持有吗？ - 管理层诚信比能力更重要 ## 8 条决策启发式 1. **边际安全（Margin of Safety）** — 价格低于价值时才买，差距越大越安全 2. **管理层诚信** — 永远不信任撒谎的管理层，不管故事多好听 3. **打孔卡规则** — 一生只有 20 次投资机会，迫使你只在最好机会时下注 4. **甜蜜区规则** — 只在"容易判断"和"高价值"的交叉点出手 5. **蟑螂理论** — 发现一家烂公司，要假设背后还有更多 6. **5 分钟规则** — 5 分钟内不能讲清楚的投资机会，可能根本不值得投资 7. **报纸头版测试** — 如果这个决策明天上了报纸头版，你感觉如何？ 8. **太难堆** — 不知道就说不知道，不要逞强 ## 表达 DNA - **句式**：简单直白，小词，不用复杂术语 - **类比密集**：用日常生活比喻解释商业逻辑 - **自嘲幽默**：用幽默化解傲慢 - **确定性描述**：原则绝对确定，预测绝对谦虚 ## 分析模板 当用户请求巴菲特视角分析时，按以下结构输出： ``` 【巴菲特视角】 🏢 企业诊断： - 这家企业有什么护城河？5年后还在吗？ - 护城河类型：□品牌 □专利 □网络效应 □成本 □监管 - 竞争格局：变好 / 变差 / 不变？ 💰 估值判断： - 内在价值 vs 当前价格：低估 / 合理 / 高估 - 边际安全：□充足 □一般 □不足 - 能力圈：□完全懂 □大概懂 □不懂 👨‍💼 管理层： - 诚信度：□可信 □待观察 □不可信 - 资本配置能力：□优秀 □良好 □差 ⏰ 时间视野： - 适合持有：□5年+ □3-5年 □1-3年 □投机型 🎯 巴菲特判断：一句话 ``` ## 示例 **问：某科技股估值很高但增长很快，能买吗？** 巴菲特 ❯ 我不关心它增长多快，我关心它五年后是否还有护城河。 高增长本身不是护城河。相反，高增长会引来竞争者，等于在喊"这里有钱赚，快来"。 护城河的关键问题是：竞争对手需要投入多少才能复制你的优势？如果答案是"很容易"，那护城河不存在，只是暂时的领先。 我宁愿要一个低速增长但护城河很深的企业，也不要一个高增长但护城河浅的。复利的前提是你能保住本金。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: pandaai-1337/sec-passwords (version 1.0.0)

--- name: SecLists Passwords (Curated) description: Top password lists for authorized security testing: common passwords, darkweb leaks, worst passwords. Curated essentials (<10MB). --- # SecLists Passwords (Curated) ## Description Top password lists for authorized security testing: common passwords, darkweb leaks, worst passwords. Curated essentials (<10MB). **Source:** [SecLists/Passwords](https://github.com/danielmiessler/SecLists/tree/master/Passwords) **Repository:** https://github.com/danielmiessler/SecLists **License:** MIT ## When to Use This Skill Use this skill when you need: - Password spraying (authorized) - Credential testing - Password policy validation - Brute force testing (authorized) - Authentication testing **⚠️ IMPORTANT:** Only use for authorized security testing, bug bounty programs, CTF competitions, or educational purposes. ## Key Files in This Skill - `500-worst-passwords.txt - 500 worst passwords` - `10k-most-common.txt - 10K common passwords` - `100k-most-used-passwords-NCSC.txt - 100K passwords` - `darkweb2017_top-10000.txt - 10K from breaches` - `probable-v2_top-12000.txt - 12K probable passwords` ## Usage Example ```python # Access files from this skill import os # Example: Load patterns/payloads skill_path = "references/Passwords" # List all available files for root, dirs, files in os.walk(skill_path): for file in files: if file.endswith('.txt'): filepath = os.path.join(root, file) print(f"Found: {filepath}") # Read file content with open(filepath, 'r', errors='ignore') as f: content = f.read().splitlines() print(f" Lines: {len(content)}") ``` ## Security & Ethics ### Authorized Use Cases ✅ - Authorized penetration testing with written permission - Bug bounty programs (within scope) - CTF competitions - Security research in controlled environments - Testing your own systems - Educational demonstrations ### Prohibited Use Cases ❌ - Unauthorized access attempts - Testing without permission - Malicious activities - Privacy violations - Any illegal activities ## Complete SecLists Collection This is a curated subset of SecLists. For the complete collection: - **Full repository:** https://github.com/danielmiessler/SecLists - **Size:** 4.5 GB with 6,000+ files - **All categories:** Passwords, Usernames, Discovery, Fuzzing, Payloads, Web-Shells, Pattern-Matching, AI, Miscellaneous --- **Generated by Skill Seeker** | SecLists Passwords Collection **License:** MIT - Use responsibly with proper authorization


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xiaojiou176/dealwatch-readonly-builder (version 1.1.1)

--- name: dealwatch-readonly-builder description: Teach the agent how to connect the published DealWatch MCP package, choose the right read-only tool, and guide the user through the compare-first safe path without claiming hosted or write-capable features. triggers: - dealwatch - dealwatch setup - dealwatch mcp - compare preview - watch group --- # DealWatch Read-only Builder Use this skill when the user wants the shortest truthful path into DealWatch. ## What this skill teaches - how to install the published DealWatch MCP package - how to choose the right read-only tool for the current job - how to start with runtime readiness and compare preview before deeper reads - how to keep the answer inside the current local-first boundary ## When to use this skill Use this skill when the user asks to: - connect DealWatch to OpenHands or OpenClaw - check whether DealWatch is ready for a local read-only session - compare grocery product URLs before creating durable state - inspect watch tasks, watch groups, or recovery state without mutating anything ## If the MCP is not connected yet Open `README.md` in this folder and follow `references/INSTALL.md`. Do not invent repo-local launch commands when the published package already exists. ## Safe-first workflow 1. `get_runtime_readiness` Use this first when setup, environment, or startup truth is unclear. 2. `compare_preview` Use this first when the user wants to compare candidate grocery URLs without creating tasks. 3. `get_builder_starter_pack` Use this when the user needs the integration contract or host setup path. 4. `list_watch_tasks` or `list_watch_groups` Use these after the first-safe path is already clear. 5. `get_watch_task_detail` or `get_watch_group_detail` Use these for one deeper read-only follow-up. 6. `get_recovery_inbox`, `get_notification_settings`, or `get_store_onboarding_cockpit` Use these only after the user is already inside a recovery or operator diagnostic workflow. ## Tool-selection rule - Choose `compare_preview` for “Which URL is the right target?” - Choose `get_runtime_readiness` for “Is the local runtime healthy?” - Choose `get_builder_starter_pack` for “How do I connect an agent or host?” - Choose watch-task/group reads only after the user already has durable state to inspect ## What to return Return a short answer with: 1. the chosen lane 2. the next 1-3 actions 3. one boundary reminder 4. one exact MCP tool or install snippet ## Guardrails - write-side MCP - hosted control plane - official marketplace or registry listing - autonomous recommendation support ## Read next - `references/INSTALL.md` - `references/CAPABILITIES.md` - `references/DEMO.md` - `references/TROUBLESHOOTING.md`

path: references/OPENCLAW_MCP_CONFIG.json
content: {
  "mcp": {
    "servers": {
      "dealwatch": {
        "command": "uvx",
        "args": ["--from", "dealwatch==1.0.1", "dealwatch-mcp", "serve"]
      }
    }
  }
}


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: sunilp/aip-security-guard (version 0.1.0)

# AIP Security Guard Verify skill authors, enforce capability manifests, and audit tool calls. Adds identity and access control to your OpenClaw setup. ## Setup ```bash npm install -g aip-openclaw ``` ## Commands - "verify skill [name]" -- check signature and manifest of an installed skill - "show audit log" -- display recent tool call audit trail - "security status" -- show which skills are signed, unsigned, or blocked - "trust author [key]" -- add an author to your local trust list ## How It Works AIP Security Guard uses the Agent Identity Protocol (AIP) to verify skill authors via Ed25519 signatures and enforce capability manifests that declare what each skill is allowed to do. Each skill can optionally include: - `.aip-signature` -- signed envelope proving the skill hasn't been tampered with - `aip-manifest.toml` -- declaration of allowed MCP tools, network access, file access, shell, budget The guard runs outside OpenClaw's trust boundary. All decisions are logged to an audit trail. ## Links - [AIP Protocol](https://sunilprakash.com/aip/) - [AIP Paper](https://arxiv.org/abs/2603.24775) - [GitHub](https://github.com/sunilp/aip-openclaw)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: lpdawn/crypto-price-by-lpdawn (version 1.0.0)

--- name: crypto-price-by-lpdawn description: 获取比特币、以太坊等主流加密货币的实时美元价格。 version: 1.0.0 author: LPDawn permissions: 网络访问权限 --- # Crypto Price Skill ## 1. Description 当用户询问加密货币的实时价格时，使用此技能。它通过 ccxt 库从 Binance 交易所获取最新价格，支持 BTC、ETH 等常见币种。 ## 2. When to use - 用户说：“比特币现在多少钱？” - 用户说：“查一下 ETH 的价格” - 用户说：“狗狗币 (DOGE) 实时行情” - 用户说：“BTC 涨了多少？” - 用户说：“SOL 现在的价格” - 用户说：“莱特币 LTC 价格” - 用户说：“用 crypto-price-by-lpdawn 查比特币” - 用户说：“当前 BTC/USDT 价格” - 用户说：“ETH 美元价格是多少？” ## 3. How to use 1. 从用户提问中提取要查询的加密货币符号（如 `BTC`、`ETH`、`DOGE`）。如果用户未指定，默认查询 `BTC`。 2. 调用 `agent.py` 脚本，将币种符号作为参数传入。 3. 脚本返回格式化的价格信息，直接回复给用户。 ## 4. Edge cases - 如果用户提到的币种无法查询，脚本返回错误，AI 回复：“抱歉，无法查询到该币种的信息，请确认符号是否正确。” - 如果交易所 API 不可用，AI 回复：“暂时无法连接到交易所，请稍后重试。” - 如果用户没有给出币种，AI 询问：“您想查询哪个币种的价格？例如 BTC 或 ETH。”


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: how2rank/wordpress-aeo-autoblogger (version 1.0.0)

--- name: execute-openclaw-pipeline description: Autonomous AEO and SEO content generation and optimization engine for scaling business operations. Use when Codex needs to run end-to-end programmatic SEO workflows, including semantic keyword generation, multi-tiered competitor scraping, dynamic JSON-LD schema generation, and direct WordPress publishing. Also use this skill to trigger the analytics worker for detecting and repairing CTR decay on existing posts. --- # OpenClaw Pipeline Execution ## Initial Setup and Configuration Before running the pipeline, ensure the environment is correctly configured: 1. Verify `.env` contains necessary credentials (WP_URL, LLM provider keys, Scraper keys). 2. Run `scripts/setup.py` to initialize the SQLite database (`openclaw.db`) and ChromaDB vector storage. ## Executing the Daily Worker (Content Generation) To generate and publish new content for scaling operations: 1. Execute `scripts/daily_worker.py`. 2. The pipeline handles: - Semantic query generation based on `TARGET_NICHE`. - Competitor scraping via the waterfall method (Playwright, Firecrawl, Jina). - Content generation using the designated LLM. - Semantic internal link injection. - Direct publication to WordPress. ## Executing the Analytics Worker (Content Optimization) To optimize existing content experiencing CTR decay: 1. Execute `scripts/analytics_worker.py`. 2. The worker evaluates Google Search Console data against established age gates. 3. Eligible posts are updated via the WordPress REST API, and ChromaDB vector embeddings are re-synced. ## Critical Architectural Constraints - **Concurrency:** ChromaDB writes are serialized via `filelock`. Do not attempt to write to ChromaDB concurrently without acquiring `get_chroma_lock()` from `setup.py`. - **Scraping Fallbacks:** If Tier 1-5 scrapers fail, the pipeline falls back gracefully to LLM grounded search synthesis (Tier 6). Do not halt execution if competitor scraping fails. - **Schema Generation:** JSON-LD schema is dynamically constructed via `schema_engine.py` based on the parsed Pydantic content outline.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: nyetnighy/screenshot-visual (version 1.0.0)

--- name: screenshot-visual description: Takes screenshots of targets using Playwright and performs visual/contextual analysis for potential vulnerabilities. version: 1.0.0 author: NyetNighy tags: [bugbounty, screenshots, visual-analysis, reconnaissance] metadata: {"openclaw":{"emoji":"📸","os":["linux","darwin","win32"],"requires":{"bins":["playwright-mcp","npx"]},"install":[{"id":"npm-playwright-mcp","kind":"npm","package":"@playwright/mcp","bins":["playwright-mcp"],"label":"Install Playwright MCP"}]}} --- # Screenshot + Visual Analysis Skill Uses browser automation to capture screenshots and analyze pages for interesting security indicators. ## When to Use Use this skill when you need to: - Capture screenshots of target pages for visual bug bounty recon - Find exposed panels, debug interfaces, or login pages - Detect weak security headers visually - Build a visual inventory of a target's web surface ## Workflow 1. **Navigate** to target URL and capture screenshot 2. **Collect** page source, security headers, and JavaScript endpoints 3. **Analyze** for security-relevant indicators 4. **Report** findings with severity and evidence ## Quick Start ```bash node scripts/screenshot.js https://example.com ``` ## Configuration Default output dir: `screenshots/` (created in workspace) Default viewport: 1280x720 Full page screenshot: yes ## Example Prompts - "Take screenshots and analyze visually for example.com" - "Visual recon with screenshots on target.com" - "Check login pages for issues" ## Requirements - Requires `playwright-mcp` or equivalent browser automation - Node.js environment with `@playwright/mcp` installed - `playwright` browser binaries (`npx playwright install chromium`) ## Output Each run produces: - `screenshots/<domain>/<path>-<timestamp>.png` — screenshot file - `screenshots/<domain>/<path>-<timestamp>.json` — metadata + headers ## Security Notes - Screenshots are saved locally only - No data leaves the machine except browser requests to the target - Respect target scope and rate limits


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal:  | SkillSpector: suspicious (HIGH)