OpenClaw/clawhub-security-signals huggingface dataset:
Skill: azvn2610/polymarket-btc-momentum (version 1.0.1)

--- name: polymarket-btc-momentum description: Trades Polymarket Bitcoin 5-minute sprint markets using real-time BTC price momentum from Binance. Buys YES when BTC momentum is bullish, NO when bearish. metadata: author: "crawbot" version: "1.0.0" displayName: "BTC Momentum Trader" difficulty: "intermediate" --- # BTC Momentum Trader Trades Polymarket's "Bitcoin Up or Down" 5-minute sprint markets using real-time price momentum from Binance public API. > **This is a template.** The default signal is BTC/USDT price momentum from Binance — > remix it with other CEX feeds (Coinbase, OKX, Bybit), different timeframes, or volume-weighted signals. > The skill handles all the plumbing (market discovery, context checks, trade execution, safeguards). > Your agent provides the alpha. ## What it does 1. Fetches live BTC price + recent candles from Binance (no API key needed) 2. Calculates short-term momentum (EMA crossover + volume confirmation) 3. Finds the next active "Bitcoin Up or Down" 5-min sprint market on Polymarket 4. Checks context for slippage/flip-flop warnings 5. Executes trade with reasoning — skips if edge < 5% or warnings present ## Requirements - `SIMMER_API_KEY` — your Simmer API key - Python 3.8+ - `simmer-sdk`, `requests` ## Usage ```bash # Paper trade (default) python btc_momentum.py # Live trade python btc_momentum.py --live ``` ## Remixing - Swap Binance for another feed: change `get_btc_momentum()` to call your preferred CEX - Adjust `MIN_EDGE` threshold (default 0.05) for more/fewer trades - Change `TRADE_AMOUNT` (default $10) in the config block - Add RSI, MACD, or sentiment signals to `compute_signal()`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: 578499893/clean-desktop (version 1.0.0)

# 桌面清理大师 ## 描述 自动整理用户桌面文件，按图片、文档、压缩包等类型分类归档。 ## 工具 - bash: 执行文件操作命令 - read: 读取桌面文件列表 ## 参数 - dry_run: 布尔值，默认为true。如果为true，只预览不实际操作。 ## 执行流程 1. 获取桌面路径（Windows为~/Desktop，Mac/Linux为~/Desktop） 2. 列出所有文件（排除.DS_Store和快捷方式） 3. 按扩展名分类： - 图片：.jpg, .png, .gif → 移入桌面/图片文件夹 - 文档：.pdf, .docx, .txt → 移入桌面/文档文件夹 - 压缩包：.zip, .rar → 移入桌面/压缩包文件夹 4. 生成操作报告，告知用户移动了哪些文件 ## 安全提示 - 操作前检查目标文件夹是否存在，不存在则自动创建 - 不处理隐藏文件（以.开头的文件） - 不删除任何文件，只做移动操作


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ray1012/novel-writer-cn (version 1.0.0)

--- name: novel-writer description: 创建小说创作框架，包括人物设定、人物关系、剧情发展和多版本结局。Use when users ask to write novels, create story plots, design characters, or develop fiction narratives. --- # Novel Writer - 小说创作框架生成器 ## 核心功能 本skill帮助用户创建完整的小说创作框架，涵盖以下核心模块： ### 1. 人物设定 (Character Design) **主角 (Protagonist)** - 姓名、年龄、外貌特征 - 性格特点与优缺点 - 背景故事与动机 - 成长弧线 **核心配角 (Supporting Cast)** - 盟友/伙伴 - 导师角色 - 情报提供者 - 每个配角的独特功能 **反派/对立角色 (Antagonist)** - 主反派设定 - 反派动机与背景 - 与主角的对立点 ### 2. 人物关系图 (Character Relationships) | 角色A | 关系类型 | 角色B | 关系描述 | |------|---------|------|---------| | - | - | - | - | **关系类型选项**： - 血缘关系（父母、兄弟姐妹、子女） - 爱情关系（恋人、前任、单相思） - 友情关系（挚友、普通朋友） - 师徒关系（师父、徒弟） - 对立关系（敌人、竞争对手） - 工作关系（上司下属、同事） - 偶然关系（陌生人、救命恩人） ### 3. 关键剧情节点 (Key Plot Points) **第一幕 - 铺垫 (Setup)** - 世界观设定 - 主角的日常生活 - 激励事件 - 拒绝改变/拒绝冒险 **第二幕 - 对抗 (Confrontation)** - 新的挑战与障碍 - 中点转折 - 反派逼近 - 一切尽失（低谷） **第三幕 - 解决 (Resolution)** - 最终决战前的准备 - 高潮对决 - 结局呈现 ### 4. 多版本结局 (Alternative Endings) **结局A - 经典圆满结局** - 主角达成目标 - 主要冲突解决 - 开放式/封闭式收尾 **结局B - 悲剧结局** - 主角付出代价 - 目标部分达成或完全失败 - 情感冲击 **结局C - 开放结局** - 留下悬念 - 读者想象空间 - 续作伏笔 **结局D - 反转结局** - 出人意料的转折 - 角色身份揭示 - 主题升华 ## 输出格式 生成的完整小说框架将包含： ``` # [小说类型] 创作框架 ## 一、作品概述 - 类型：[用户指定的小说类型] - 风格：[风格描述] - 目标读者：[目标群体] ## 二、人物设定 ### 2.1 主角 [详细主角设定] ### 2.2 核心配角 [配角阵容] ### 2.3 反派/对立角色 [反派设定] ## 三、人物关系图 [关系表格和描述] ## 四、剧情发展 ### 4.1 第一幕：铺垫 [关键场景和事件] ### 4.2 第二幕：对抗 [高潮和转折] ### 4.3 第三幕：解决 [结局铺垫] ## 五、多版本结局 ### 结局A：[名称] [详细结局] ### 结局B：[名称] [详细结局] ### 结局C：[名称] [详细结局] ### 结局D：[名称] [详细结局] ## 六、创作建议 - [类型特定建议] - [写作技巧提示] ``` ## 使用场景 适用的小说类型包括但不限于： - 言情小说 - 悬疑推理 - 玄幻修仙 - 都市异能 - 科幻未来 - 武侠江湖 - 历史穿越 - 恐怖惊悚 - 校园青春 - 军事战争 ## 定制化选项 用户可以指定： 1. **小说类型**：选择或混合多种类型 2. **主角数量**：单主角/双主角/群像 3. **情感基调**：轻松幽默/深沉虐心/热血激昂 4. **结局偏好**：明确偏好的结局类型 5. **篇幅长度**：短篇/中篇/长篇框架 6. **特定元素**：添加用户想要的特定元素（如宠物、异能、组织等） ## 输出质量标准 生成的内容将： - 保持类型特征和惯例 - 人物设定有内在逻辑和冲突 - 剧情发展符合三幕式结构 - 提供真正多样化的结局选项 - 包含创意性的独特设定 ## 注意事项 1. **创意优先**：提供新颖而非套路化的设定 2. **逻辑自洽**：确保设定和剧情前后一致 3. **情感共鸣**：人物动机真实可信 4. **悬念设置**：关键节点设置适当的悬念和伏笔 5. **灵活性**：框架可随用户反馈调整


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: tyqqj0/xihu-hiring (version 1.0.0)

--- name: xihu-hiring version: 1.0.0 description: > 拉取飞书审批数据（人事-西湖数智），生成招聘进度 Excel 报表。 Triggers: 招聘进度, 刷新招聘表, 拉审批, 更新候选人, 重跑招聘, hiring tracker, xihu hiring. NOT for: 其他飞书审批, 通用 Excel 制作, 消息发送. metadata: openclaw: requires: bins: - lark-cli --- # 西湖数智招聘进度 拉取飞书审批模板「人事 - 西湖数智」的全部实例，应用人工更正，生成 3-sheet Excel 报表。 ## 触发条件 用户说以下任何一种时触发此 skill： - "刷新招聘表" / "重跑招聘进度" / "拉一下飞书审批" - "把候选人数据更新一下" / "更新西湖数智的招聘 Excel" - "X 应该是一面后拒绝"（人工更正后重新生成） - "hiring tracker" / "recruitment dashboard" **不触发**：无关的飞书审批、通用 Excel 工作。 ## 常量 - **审批 approval_code:** [REDACTED_SECRET] - **时间窗口:** 最近 120 天（飞书 API 硬限制） - **输出文件:** `西湖数智-招聘进度.xlsx`（覆盖写入当前工作目录） ## 执行流程 ### Step 0 — 环境准备 ```bash python3 -c "import openpyxl" 2>/dev/null || pip install openpyxl -q ``` 如果 pip install 也失败，告诉用户需要安装 openpyxl。 ### Step 1 — 列出审批实例 计算 120 天前的毫秒时间戳，然后拉取实例列表： ```bash lark-cli api GET [REDACTED_SECRET] \ --params '{"approval_code":[REDACTED_SECRET],"start_time":"<120天前ms>","end_time":"<当前ms>","page_size":"100"}' \ --as bot --page-all --format json ``` 从返回的 `data.instance_code_list` 中获取所有实例 code。如果有分页（`has_more=true`），`--page-all` 会自动处理。 ### Step 2 — 获取每个实例详情 逐个获取（或批量，每次最多 5 个并行 shell）： ```bash lark-cli approval instances get \ --params '{"instance_code":"<code>","locale":"zh-CN"}' \ --as bot --format json ``` 每个实例包含 `serial_number`, `status`, `start_time`, `end_time`, `form`（JSON 字符串）, `task_list`（审批节点）。 ### Step 3 — 组装 payload JSON 将所有实例数据组装为 `build_excel.py` 所需的 JSON 格式（参见 `references/fetch-approvals.md`）。 关键字段映射： - `form` 中提取：姓名、申请职位、手机号、邮箱、毕业院校、曾经任职、cv - `task_list` 中按节点名聚合状态（优先级：REJECTED > PENDING > APPROVED） - 节点名：简历筛查/简历筛选、一面、二面、**终面**（= 三面）、办理 将 payload 写入 `/tmp/hiring_payload.json`。 ### Step 4 — 生成 Excel 将 `references/build-excel.md` 中的 Python 脚本写到 `/tmp/build_excel.py`，然后执行： ```bash python3 /tmp/build_excel.py --workspace "$(pwd)" --payload /tmp/hiring_payload.json ``` 脚本会： - 读取当前目录下的 `招聘进度_人工更正.json`（如果存在） - 应用人工更正 - 生成 `西湖数智-招聘进度.xlsx` - 输出 JSON 摘要（行数、各职位统计） ### Step 5 — 报告结果 向用户展示： 1. 简短摘要：投递人数 / 面试进行中 / 已发 Offer 2. 文件路径 3. 如有未映射的新职位（`unmapped_positions` 非空），提示用户确认归类 **隐私规则**：不要在对话中粘贴完整的候选人 PII（姓名+手机+邮箱），这些在 Excel 里有。 --- ## 人工更正 当用户说"X 应该是一面后拒绝"时： 1. 在当前 Excel 中查找 X 的审批编号 2. 编辑 `招聘进度_人工更正.json`，将编号添加到对应类别 3. 重新运行 Step 4 更正类别（对应 JSON key）： - `rejected_after_screening` → 简筛后拒绝 - `rejected_after_round_1` → 一面后拒绝 - `rejected_after_round_2` → 二面后拒绝 - `rejected_after_round_3` → 三面后拒绝 - `withdrawn` → 撤回 --- ## 新职位出现时 如果脚本输出中 `unmapped_positions` 非空，必须询问用户： > "我看到一个新职位 'X'，不在现有归一规则中。应该归入哪个类别？\n现有类别：视觉设计&视频制作、数据科学家、模型训练专家、具身算法专家、运动控制算法工程师、硬件全栈专家、硬件测试工程师、Infra专家、算法工程师、公关、商务拓展。\n还是新建一个类别？" 确认后，更新 `references/build-excel.md` 中脚本的 `CANONICAL` 字典。 --- ## 参考文件 - `references/fetch-approvals.md` — 详细的数据获取和 payload 组装步骤 - `references/normalization-rules.md` — 职位归一规则及原因 - `references/build-excel.md` — build_excel.py 脚本源码及使用说明


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: jhillin8/detox-counter (version 1.0.0)

--- name: detox-counter description: Track any detox with customizable counters, symptom logging, and progress milestones author: clawd-team version: 1.0.0 triggers: - "detox counter" - "start detox" - "detox progress" - "cleanse tracker" - "detox day" --- # Detox Counter **Track any cleanse or detox with symptom logging and milestone celebrations.** ## What it does Universal detox tracking for any cleanse—whether it's sugar elimination, juice cleanses, Whole30, elimination diets, or custom protocols. Log daily symptoms, track progress against milestones, and celebrate wins as you move through your detox journey. No judgment, just data. ## Usage ### Start detox Begin a new detox or cleanse by naming it, selecting duration (days), and setting optional milestones (e.g., "Day 3: energy dip expected" or "Day 7: cravings subside"). ### Log symptoms Daily check-in with what you're experiencing—headaches, energy levels, cravings, mood shifts, sleep quality, digestion changes. Build a personal symptom profile that shows patterns over time. ### Check progress View your current day, days remaining, milestone status, and a timeline of logged symptoms. See patterns emerge as your detox progresses. ### Set duration Customize how long your detox runs. Standard durations are 3, 7, 14, 30, or 60 days; create custom durations for your specific protocol. ### Complete detox Mark your detox complete when you finish. Review the full symptom log, celebrate milestones hit, and export your data if you want to share with a healthcare provider or nutritionist. ## Detox Types - **Sugar Detox** - Eliminate refined sugars and sweetened foods - **Juice Cleanse** - Liquid-only nutrition, typically 3–7 days - **Whole30** - 30-day elimination of grains, legumes, dairy, sugar, and additives - **Elimination Diet** - Remove suspected food triggers (dairy, gluten, nightshades, etc.) - **Custom** - Define your own protocol and tracked symptom categories ## Tips - **Set realistic expectations.** Most detoxes involve an adjustment period (day 2–4) where symptoms spike before improving. This is normal. - **Log consistently.** Daily check-ins reveal patterns that sporadic logging misses. Even a 30-second note counts. - **Use your milestone calendar.** Knowing what's "normal" for day 5 of Whole30 helps you stay committed when cravings hit. - **Connect with a pro.** Share your symptom log with a doctor or nutritionist for personalized insights. - **All data stays local on your machine.** Nothing is uploaded to external servers—your detox journey stays private and under your control.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: renoblabs/universal-extractor (version 1.0.0)

--- name: universal-extractor description: Extract clean text from URLs, articles, documents, and files. Four extraction micro-services. Use when you need to pull content from web pages, PDFs, or any file format. --- # Universal Extractor Four extraction services — URL to text, article to summary, document to JSON. ## Services ### /clean-url — URL to Clean Text Strip ads, nav, footers. Get the content. ``` POST /x402s/clean-url Body: {"url": "https://example.com/article"} Response: {"text": "...", "title": "...", "author": "...", "word_count": 1234} Price: $0.001 USDC ``` ### /extract-article — Article + Summary Full article extraction with optional LLM summary. ``` POST /x402s/extract-article Body: {"url": "https://...", "summarize": true} Response: {"title": "...", "text": "...", "summary": "...", "author": "...", "date": "..."} Price: $0.005 USDC ``` ### /extract-document — Document to Text Base64-encoded PDF/DOCX/TXT to structured text. ``` POST /x402s/extract-document Body: {"content": "<base64>", "filename": "report.pdf"} Response: {"text": "...", "word_count": 5678} Price: $0.002 USDC ``` ### /extract-file — Any File to Text Universal file-to-text extraction. ``` POST /x402s/extract-file Body: {"content": "<base64>", "filename": "data.csv"} Response: {"text": "...", "word_count": 234} Price: $0.002 USDC ``` ## Payment x402 protocol — USDC on Base. No API keys needed.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: daniellummis/github-actions-self-hosted-risk-audit (version 1.0.0)

--- name: github-actions-self-hosted-risk-audit description: Audit GitHub Actions workflows that use self-hosted runners for untrusted trigger and credential-hardening risks. version: 1.0.0 metadata: {"openclaw":{"requires":{"bins":["bash","python3"]}}} --- # GitHub Actions Self-Hosted Risk Audit Use this skill to flag risky workflow patterns when jobs run on self-hosted GitHub Actions runners. ## What this skill does - Scans workflow YAML files (`.github/workflows/*.yml` by default) - Detects workflows that reference `self-hosted` runners - Flags high-risk trigger combinations (`pull_request_target`, `pull_request`, `issue_comment`) - Flags broad/self-hosted-only runner selection (no extra routing labels) - Flags workflows with write-capable permissions in self-hosted contexts - Flags `actions/checkout` steps that do not set `persist-credentials: false` - Supports text/json output and CI fail gate ## Inputs Optional: - `WORKFLOW_GLOB` (default: `.github/workflows/*.y*ml`) - `TOP_N` (default: `20`) - `OUTPUT_FORMAT` (`text` or `json`, default: `text`) - `WARN_SCORE` (default: `4`) - `CRITICAL_SCORE` (default: `8`) - `WORKFLOW_FILE_MATCH` / `WORKFLOW_FILE_EXCLUDE` (regex, optional) - `FAIL_ON_CRITICAL` (`0` or `1`, default: `0`) ## Run Text report: ```bash WORKFLOW_GLOB='.github/workflows/*.yml' \ WARN_SCORE=4 \ CRITICAL_SCORE=8 \ bash skills/github-actions-self-hosted-risk-audit/scripts/self-hosted-risk-audit.sh ``` JSON output + fail gate: ```bash WORKFLOW_GLOB='.github/workflows/*.y*ml' \ OUTPUT_FORMAT=json \ FAIL_ON_CRITICAL=1 \ bash skills/github-actions-self-hosted-risk-audit/scripts/self-hosted-risk-audit.sh ``` Run against bundled fixtures: ```bash WORKFLOW_GLOB='skills/github-actions-self-hosted-risk-audit/fixtures/*.y*ml' \ bash skills/github-actions-self-hosted-risk-audit/scripts/self-hosted-risk-audit.sh ``` ## Output contract - Exit `0` in reporting mode (default) - Exit `1` when `FAIL_ON_CRITICAL=1` and one or more workflows are critical - Text mode prints summary + top flagged workflows - JSON mode prints summary + flagged workflows + critical workflows


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 52yuanchangxing/follow-up-commander (version 1.0.0)

--- name: follow-up-commander version: 1.0.0 description: "把会后事项拆成行动清单、催办节奏、邮件草稿和下次同步议题。；use for followup, meeting, email workflows；do not use for 直接发送邮件, 伪造完成状态." author: OpenClaw Skill Bundle homepage: https://example.invalid/skills/follow-up-commander tags: [followup, meeting, email, action-items] user-invocable: true metadata: {"openclaw":{"emoji":"📨","requires":{"bins":["python3"]},"os":["darwin","linux","win32"]}} --- # 会后跟进指挥官 ## 你是什么 你是“会后跟进指挥官”这个独立 Skill，负责：把会后事项拆成行动清单、催办节奏、邮件草稿和下次同步议题。 ## Routing ### 适合使用的情况 - 把会后事项整理成行动清单和邮件草稿 - 按负责人拆分 follow-up - 输入通常包含：会议纪要、参与角色、优先级 - 优先产出：行动清单、负责人映射、未决问题 ### 不适合使用的情况 - 不要用来直接发送邮件 - 不要用来伪造完成状态 - 如果用户想直接执行外部系统写入、发送、删除、发布、变更配置，先明确边界，再只给审阅版内容或 dry-run 方案。 ## 工作规则 1. 先把用户提供的信息重组成任务书，再输出结构化结果。 2. 缺信息时，优先显式列出“待确认项”，而不是直接编造。 3. 默认先给“可审阅草案”，再给“可执行清单”。 4. 遇到高风险、隐私、权限或合规问题，必须加上边界说明。 5. 如运行环境允许 shell / exec，可使用： - `python3 "{baseDir}/scripts/run.py" --input <输入文件> --output <输出文件>` 6. 如当前环境不能执行脚本，仍要基于 `{baseDir}/resources/template.md` 与 `{baseDir}/resources/spec.json` 的结构直接产出文本。 ## 标准输出结构 请尽量按以下结构组织结果： - 行动清单 - 负责人映射 - 建议邮件草稿 - 升级与催办规则 - 下次同步议题 - 未决问题 ## 本地资源 - 规范文件：`{baseDir}/resources/spec.json` - 输出模板：`{baseDir}/resources/template.md` - 示例输入输出：`{baseDir}/examples/` - 冒烟测试：`{baseDir}/tests/smoke-test.md` ## 安全边界 - 默认只生成文本，不直接调用外部邮箱。 - 默认只读、可审计、可回滚。 - 不执行高风险命令，不隐藏依赖，不伪造事实或结果。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: codekungfu/pensions (version 0.1.1)

--- name: "Pensions" description: "提供商业养老保险分析、养老金账户模拟、退休收入测算及理财组合建议。" --- # 个人养老 ## 筛选项 - 资产类别（现金/基金/股票/理财/保险） - 风险等级（低/中/高风险/保障型） - 周期/流动性（T+0/定期/活期/长期） ## 返回字段 - 资产总额/每日盈亏/年化收益参考 - 交易流水/对账单导出/税费明细 - 风险测评状态/持仓分析/资产配置建议 ## 示例请求 - “如何快速使用 个人养老 处理 [具体场景任务] ？” - “个人养老 的 [核心功能] 有哪些最新玩法/优惠信息？” ## 更新频率 - 每日跟随市场行情与个人账单变更进行亚小时级同步 ## 注意事项 - 投资有风险，决策需谨慎；涉及大额转账请务必进行双重身份验证。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: klemenska/klemenska-security-auditor (version 1.0.0)

--- name: security-auditor description: "Scan and audit installed skills for security risks, suspicious patterns, and permission overreach. Use when: (1) before installing a new skill; (2) periodically reviewing installed skills; (3) before granting skill permissions; (4) when explicitly asked to audit skills or check for vulnerabilities." --- # Security Auditor Audit skills for security risks before installing or using them. ## Purpose Skills can request permissions and access that may be: - Overreaching (accessing data they shouldn't need) - Suspicious (behaving oddly, phoning home, etc.) - Outdated (known vulnerabilities in dependencies) This skill helps you audit them. ## When to Run | Trigger | Action | |---------|--------| | Before installing a new skill | Full audit | | Periodic review | Quick scan of installed skills | | Suspicious behavior | Deep analysis | | Permission review | Check requested permissions | ## Audit Workflow ### Step 1: Quick Scan ```bash python3 scripts/audit.py --scan ``` Checks: - File access patterns - Network access requests - Suspicious API usage - Permission requests ### Step 2: Detailed Audit ```bash python3 scripts/audit.py --audit <skill-path> ``` Performs deep analysis: - Code pattern analysis - Dependency checking - Permission mapping - Risk scoring ### Step 3: Generate Report ```bash python3 scripts/audit.py --report <skill-path> --output report.md ``` Creates detailed security report. ### Step 4: Compare Skills ```bash python3 scripts/audit.py --compare <skill1-path> <skill2-path> ``` Compare security posture of two skills. ## Risk Levels | Level | Meaning | Action | |-------|---------|--------| | 🟢 LOW | Minimal risk, standard permissions | Safe to install | | 🟡 MEDIUM | Some overreach, review recommended | Read code before install | | 🔴 HIGH | Significant risks, careful review required | Do not install without review | | ⛔ CRITICAL | Dangerous patterns detected | Do not install | ## Red Flags to Watch For ### File Access - Accessing `~/.ssh/` or `~/.aws/` - Reading `*password*`, `*secret*`, `*key*` files - Writing to system directories - Accessing other users' directories ### Network - Exfiltrating data to unknown servers - DNS rebinding patterns - Encrypted payloads to unfamiliar domains ### Permissions - Requesting exec with no scope limitation - Reading memory or process info - Keylogging or screenshot capabilities - Accessing other installed skills' data ### Code Patterns - Obfuscated code - Dynamic code generation - Shell commands without sanitization - Credential harvesting patterns ## Files - `scripts/audit.py` — Main audit script - `scripts/scan_skill.py` — Skill-specific scanner - `references/rules.md` — Security rules and patterns - `references/permissions.md` — Permission reference guide


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: deliverydriver/gmail-briefings (version 1.0.0)

--- name: gmail-briefings description: Daily/periodic Gmail briefings: List unread/urgent emails, summarize priorities, draft replies, flag/archive. Use for inbox triage, digests, sender filters (e.g. clients/boss). Integrates himalaya/gog CLIs. Triggers: "email summary", "inbox digest", "check gmail", "email priorities".</description> --- # Gmail Briefings ## Workflow 1. Search inbox: unread, today, senders (clients/boss). 2. Summarize: Subject/sender/snippet/priority. 3. Draft replies for top 3. 4. read references/gog-sop.md for auth/config. ## Commands - List: `gog g inbox unread` - Read: `gog g read ID` - Reply draft: Use templates in assets/. refs/gmail-filters.md: Custom searches.

path: references/gog-sop.md
content: # GOG SOP
Config: ~/.config/gog/config.toml
Accounts: [REDACTED_SECRET]
Inbox: gog g inbox --unseen --limit 20

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: choksta/tech-news-daily33 (version 1.0.0)

# tech-news-daily 科技资讯日报生成 Skill：从 IT之家 + 快科技 抓取内容，生成带 iOS 液态玻璃风格的 HTML 日报。 ## 工作流程 1. **抓取数据**（RSS + 文章页） - IT之家 RSS：`https://www.ithome.com/rss/` - 快科技列表页：`https://news.mydrivers.com/`（需按日期过滤 1113 开头链接） - 每条资讯获取：标题、正文、来源、图片 URL 2. **整理数据**（JSON 格式） ```json [ ["key", "cat_id", "title", "src", "url", "text"], ... ] ``` - cat_id: 1=手机/硬件, 2=AI/大模型, 3=汽车, 4=科技大厂, 5=系统App - text 需做 CJK+ASCII 空格处理：`re.sub(r'([\u4e00-\u9fff])([A-Za-z0-9])', r'\1 \2', s)` 3. **下载图片** - 目录：`news_imgs_today/` - 文件名：`{key}.jpg` 或 `{key}.png` - base64 内嵌到 HTML 4. **生成 HTML** ```bash python scripts/gen_html.py ``` - 输出：`tech_news_YYYYMMDD.html` - iOS 液态玻璃风格：毛玻璃卡片 + 四色渐变背景 - **正文完整展开，无截断** - **图片按原始比例完整显示** ## 数据格式 每条资讯为 6 字段数组： - `[0]` key：唯一标识（英文，用于本地图片文件名） - `[1]` cat_id：板块 ID（1-5） - `[2]` title：标题 - `[3]` src：来源名称（如 "IT之家"、"快科技"） - `[4]` url：文章链接 - `[5]` text：正文摘要（完整不截断，中英/数字之间有空格） 参考：`references/data_format.md` ## 设计规范 - iOS 26 液态玻璃风格 - `backdrop-filter: blur(24px) saturate(180%)` - 背景 `rgba(255,255,255,0.62)` + 白色边框 - 悬停上浮 spring 动画 - 四色渐变背景（蓝→紫→绿→粉） - 标题：完整显示，不截断 - 正文：完整展开，无 `-webkit-line-clamp` 限制 - 图片：`width:100%; height:auto`，原始比例完整展示 - 三栏自适应网格布局


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)