OpenClaw/clawhub-security-signals huggingface dataset:
Skill: xyezir/oc-full-ops-audit-recipe (version 0.1.0)

--- name: oc-full-ops-audit-recipe description: End-to-end OpenClaw audit and remediation recipe for gateway, channels, nodes, security, and memory sync. --- # OC Full Ops Audit Recipe ## Goal Provide a repeatable audit workflow that ends with verified fixes and documented memory updates. ## Audit flow 1. Baseline: status/health/gateway/security/nodes. 2. Classify findings: critical, warning, info. 3. Apply fixes in risk order with rollback points. 4. Re-run checks and compare deltas. 5. Write outcomes to daily memory + shared memory. ## Deliverables - Audit summary table - Fix actions and verification - Residual risks and priority plan ## Usage notes - Prefer read-only checks first. - Group disruptive changes behind explicit approval. - Keep outputs concise and operational.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mrtommywu/web-content-fetcher (version 1.0.1)

--- name: web-content-fetcher description: "网页内容获取工具 | 当常规爬虫被过滤时，使用替代服务获取网页内容。支持：1) r.jina.ai - 最稳定 2) markdown.new - Cloudflare 专用 3) defuddle.md - 备用方案。触发词：获取网页内容、网页转markdown、内容抓取、fetch webpage、bypass cloudflare" author: Boss metadata: openclaw: emoji: 🌐 tags: [web, fetch, markdown, cloudflare, bypass] --- # 网页内容获取工具 当常规 web_fetch/web_search 无法获取内容时，使用替代服务获取网页 Markdown 格式内容。 ## 支持的服务 | 优先级 | 服务 | 用法 | 适用场景 | |--------|------|------|----------| | 1 | **r.jina.ai** | `https://r.jina.ai/{url}` | 最稳定，通用性强 | | 2 | **markdown.new** | `https://markdown.new/{url}` | Cloudflare 保护网站 | | 3 | **defuddle.md** | `https://defuddle.md/{url}` | 备用方案 | ## 使用方法 ### 直接调用 当需要获取网页内容时，按顺序尝试： 1. 首先用 `web_fetch` 尝试获取 2. 如果失败或被过滤，调用本工具 ```bash # 使用 jina.ai (首选) curl -s "https://r.jina.ai/https://example.com" # 使用 markdown.new (Cloudflare) curl -s "https://markdown.new/https://example.com" # 使用 defuddle.md (备用) curl -s "https://defuddle.md/https://example.com" ``` ### API 格式 ```bash # 简单获取 fetch_webpage <url> # 指定方法 fetch_webpage <url> --method jina|markdown|defuddle ``` ## 示例 ``` 用户: 帮我获取 https://news.example.com/article/123 的内容 助手: (使用 r.jina.ai 获取) ``` ## 工具脚本 本目录包含 `fetch.sh` 脚本，可直接调用： ```bash ./fetch.sh https://example.com ./fetch.sh https://example.com jina ``` --- *让网页内容获取不再受限 🌐*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: vemec/smart-route (version 1.0.4)

--- name: smart-route description: Calculate traffic-aware routes, travel times, and distances between locations using Google Routes API. Use when the user asks for "traffic to X", "how long to get to Y", "best route to Z", or "drive time". Returns JSON with duration, distance, and a direct Google Maps navigation link. metadata: openclaw: emoji: 🚦 requires: bins: - node env: - GOOGLE_ROUTES_API_KEY --- # Google Routes Calculator Get real-time traffic and routing information via Google Routes API (v2). ## When to use Use this skill immediately when the user asks: - "How is the traffic to X?" - "How long does it take to drive to Y?" - "Give me the route to Z." - "What's the distance between A and B?" ## Usage This skill executes a Node.js script. It requires an API Key with "Routes API" enabled. ### Command ```bash node skills/smart-route/scripts/get_route.js --origin "Origin Address" --destination "Destination Address" [--mode DRIVE|BICYCLE|WALK] ``` ### Output Format The script returns a JSON object: ```json { "origin": "Union Square, San Francisco, CA", "destination": "Golden Gate Bridge, San Francisco, CA", "mode": "DRIVE", "duration": "30 min", "distance": "13.5 km", "traffic_duration_seconds": 1835, "route_link": "https://www.google.com/maps/dir/?api=1&origin=...&destination=...&travelmode=driving" } ``` ### Examples - **Check traffic in San Francisco:** `node skills/smart-route/scripts/get_route.js --origin "Union Square, San Francisco, CA" --destination "Golden Gate Bridge, San Francisco, CA"` - **Drive time in Los Angeles:** `node skills/smart-route/scripts/get_route.js --origin "Los Angeles, CA" --destination "Santa Monica, CA" --mode DRIVE` ## Configuration ### Privacy & Security - **Scope**: This skill only communicates with `routes.googleapis.com`. - **Data Handling**: - It does not read local files or other environment variables besides the ones specified below. - **PII Notice**: User-supplied origin and destination addresses are sent to Google Routes API and printed to stdout in the JSON response. Users should consider these addresses as potentially sensitive information (PII). - **Credentials**: API keys must be provided via environment variables. Providing keys via CLI flags is disabled for security reasons (to avoid exposing secrets in process lists). ### API Credentials This skill requires a **Google Cloud API Key** with the **Routes API** enabled. - **Variable**: `GOOGLE_ROUTES_API_KEY` - **Detection**: The skill will check for this environment variable at runtime. - **Strict Mode**: If the variable is missing, the script will exit with an error rather than falling back to other keys, ensuring no accidental usage of incorrect credentials. ### Setup Instructions 1. Open the [Google Cloud Console](https://console.cloud.google.com/). 2. Enable the **Routes API** for your project. 3. Generate an API Key under **Credentials**. 4. Export the key to your environment: ```bash export GOOGLE_ROUTES_API_KEY="your_api_key_here" ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: notboxqsn/stratos-storage (version 1.0.0)

--- name: stratos-storage description: > Upload and download files to/from Stratos Decentralized Storage (SDS) network. Use when the user wants to store files on Stratos, retrieve files from Stratos, upload to decentralized storage, or download from SDS. version: 1.0.0 metadata: openclaw: requires: env: [STRATOS_SPFS_GATEWAY, STRATOS_NODE_DIR] bins: [curl] primaryEnv: STRATOS_SPFS_GATEWAY --- # Stratos Decentralized Storage ## When to use - User wants to upload a file to Stratos SDS network - User wants to download a file from Stratos SDS using file hash or share link - User mentions "Stratos", "SDS", "SPFS", or "decentralized storage upload/download" ## Steps ### Upload a file 1. Verify ppd or SPFS gateway is available 2. Run the upload script: `bash $SKILL_DIR/scripts/upload.sh <file_path>` 3. Return the file hash (CID) to the user ### Download a file 1. Verify ppd or SPFS gateway is available 2. Run the download script: `bash $SKILL_DIR/scripts/download.sh <file_hash_or_cid> <output_path>` 3. Confirm download success ## Examples Upload: "Upload /tmp/report.pdf to Stratos" → Run: bash scripts/upload.sh /tmp/report.pdf → Output: File uploaded. CID: Qm...xxx Download: "Download file Qm...xxx from Stratos to ~/Downloads/" → Run: bash scripts/download.sh Qm...xxx ~/Downloads/report.pdf → Output: File downloaded to ~/Downloads/report.pdf ## Constraints - Always confirm file path with user before uploading - Never overwrite existing files without user confirmation - Verify SDS node is running before operations - Large files may take significant time; inform user of progress


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: ryanbaumann/google-maps-grounding-lite-mcp (version 1.0.0)

--- name: grounding-lite description: Google Maps Grounding Lite MCP for location search, weather, and routes via mcporter. homepage: https://developers.google.com/maps/ai/grounding-lite metadata: {"clawdbot":{"emoji":"🗺️","requires":{"bins":["mcporter"],"env":["GOOGLE_MAPS_API_KEY"]},"primaryEnv":"GOOGLE_MAPS_API_KEY","install":[{"id":"node","kind":"node","package":"mcporter","bins":["mcporter"],"label":"Install mcporter (npm)"}]}} --- # Grounding Lite Google Maps Grounding Lite MCP provides AI-grounded location data. Experimental (pre-GA), free during preview. ## Setup 1. Enable the API: `gcloud beta services enable mapstools.googleapis.com` 2. Get an API key from [Cloud Console](https://console.cloud.google.com/apis/credentials) 3. Set env: `export GOOGLE_MAPS_API_KEY="YOUR_KEY"` 4. Configure mcporter: ```bash mcporter config add grounding-lite \ --url https://mapstools.googleapis.com/mcp \ --header "X-Goog-[REDACTED_SECRET]" \ --system ``` ## Tools - **search_places**: Find places, businesses, addresses. Returns AI summaries with Google Maps links. - **lookup_weather**: Current conditions and forecasts (hourly 48h, daily 7 days). - **compute_routes**: Travel distance and duration (no turn-by-turn directions). ## Commands ```bash # Search places mcporter call grounding-lite.search_places textQuery="pizza near Times Square NYC" # Weather mcporter call grounding-lite.lookup_weather location='{"address":"San Francisco, CA"}' unitsSystem=IMPERIAL # Routes mcporter call grounding-lite.compute_routes origin='{"address":"SF"}' destination='{"address":"LA"}' travelMode=DRIVE # List tools mcporter list grounding-lite --schema ``` ## Parameters **search_places**: `textQuery` (required), `locationBias`, `languageCode`, `regionCode` **lookup_weather**: `location` (required: address/latLng/placeId), `unitsSystem`, `date`, `hour` **compute_routes**: `origin`, `destination` (required), `travelMode` (DRIVE/WALK) ## Notes - Rate limits: search_places 100 QPM (1k/day), lookup_weather 300 QPM, compute_routes 300 QPM - Include Google Maps links in user-facing output (attribution required) - Only use with models that don't train on input data


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: vincsta/dev-backup (version 1.0.1)

--- name: dev-backup description: Create snapshots of a workspace project during development. Use when: (1) user asks to backup the current app, (2) before risky changes/refactoring, (3) "salva lo stato attuale" or "fai un backup dello sviluppo", (4) any point where the project could be corrupted or lost. Automatically adds progressive numbering per project. --- # dev-backup Snapshot the current state of a named project for safe rollback. ## Usage Each project gets its own snapshot numbering. The project name is always the first argument. ```bash # Backup any project SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" bash "$SCRIPT_DIR/dev-backup.sh" <project-name> --project-dir /path/to/your/project # Example: backup a "my-app" project bash "$SCRIPT_DIR/dev-backup.sh" my-app --project-dir /home/user/projects/my-app # No --project-dir? Uses the current working directory cd /home/user/projects/my-app bash "$SCRIPT_DIR/dev-backup.sh" my-app ``` ## Naming Snapshots are named per project: - **my-app-snapshot-1**, **my-app-snapshot-2**, … - **another-project-snapshot-1**, **another-project-snapshot-2**, … Each project tracks its own counter independently. ## Excluded from snapshot - `.git`, `node_modules`, `.vite`, `.cache`, `*.log`, `.env`, `backups/` ## Restore To restore a snapshot: ```bash cp -r <backups-dir>/<project-name>-snapshot-3/ <your-project-dir>/ ``` Or use the `.latest` symlink: ```bash cp -r <backups-dir>/.latest/ <your-project-dir>/ ``` ## Verification After backup, confirm: ```bash ls -la <backups-dir>/ ``` You should see the project-prefixed snapshot and `.latest` symlink.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: jarvis563/browser-audio-capture (version 1.1.0)

--- name: browser-audio-capture description: Capture audio from any browser tab — meetings, YouTube, podcasts, courses, webinars — and stream to any AI agent. Zero API keys, works with any framework. version: 1.1.0 --- # Browser Audio Capture **Give any AI agent ears for the browser.** One Chrome extension captures audio from any tab — meetings, YouTube, podcasts, webinars, courses, earnings calls — and streams it to your AI pipeline. ## Why Use This Your AI agent can't hear anything happening in your browser. This skill fixes that. Capture audio from any Chrome tab and stream it to your agent — no API keys, no OAuth, no per-platform integrations. **Use cases:** meeting summaries, YouTube/podcast notes, competitive intel from earnings calls, auto-notes from online courses, customer call analysis — anything that plays audio in a browser tab. **Works with any AI agent** — Claude, ChatGPT, OpenClaw, LangChain, CrewAI, or your own. If your agent can run shell commands or receive HTTP, it gets browser audio. ## Prerequisites Chrome with remote debugging: ```bash # macOS /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome \ --remote-debugging-port=9222 --user-data-dir=$HOME/.chrome-debug-profile & ``` Python 3.9+ with aiohttp: `pip install aiohttp` ## Quick Start ### CLI (any agent that can exec) ```bash # List tabs — meetings flagged with 🎙️ python3 -m browser_capture.cli tabs # Auto-detect and capture meeting tab python3 -m browser_capture.cli capture # Continuous watch mode python3 -m browser_capture.cli watch --interval 15 # Stop python3 -m browser_capture.cli stop ``` ### Chrome Extension (one-click, persistent) 1. `chrome://extensions/` → Developer mode → Load unpacked → `scripts/extension/` 2. Join a meeting → click Percept icon → Start Capturing 3. Close popup — capture continues in background ## Supported Platforms Google Meet • Zoom (web) • Microsoft Teams • Webex • Whereby • Around • Cal.com • Riverside • StreamYard • Ping • Daily.co • Jitsi • Discord — plus any future platform that runs in a browser. ## Audio Output Streams to `http://127.0.0.1:8900/audio/browser` as JSON: ```json { "sessionId": "browser_1709234567890", "audio": "<base64 PCM16>", "sampleRate": 16000, "format": "pcm16", "tabUrl": "https://meet.google.com/...", "tabTitle": "Weekly Standup" } ``` Configure endpoint in `scripts/extension/offscreen.js` (`PERCEPT_URL`). Point it at Whisper, Deepgram, NVIDIA Riva, or any transcription service. ## Troubleshooting - **No tabs**: Chrome needs `--remote-debugging-port=9222` - **Button won't click**: Remove + re-add extension (MV3 caches aggressively) - **Audio not arriving**: Check receiver on port 8900. Extension sends to `/audio/browser`

path: scripts/browser_capture/__init__.py
content: # Browser Audio Capture via Chrome CDP


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: pereirajair/pgadmin-manager (version 1.0.1)

--- name: pgadmin-manager slug: pgadmin-manager version: 1.0.0 description: "Manage the pgAdmin Docker container for local dev environments. Provides a web UI for PostgreSQL at http://localhost:8082. Requires postgres-manager and proxy-manager to be running first." changelog: Initial release. triggers: - "abrir pgadmin" - "start pgadmin" - "stop pgadmin" - "pgadmin status" - "interface postgres" - "admin postgres" - "pgadmin-manager" metadata: {"clawdbot":{"emoji":"🐘","requires":{"bins":["docker"]},"os":["linux","darwin"]}} --- # pgAdmin Manager Manages the pgAdmin Docker container, providing a web UI for PostgreSQL database management. ## Architecture ``` pgadmin-manager/ ├── docker-compose.yml # pgAdmin 4 container (pinned to 8.6) └── run.sh # lifecycle CLI ``` Connects to the shared `nginx-proxy_net` network and reaches PostgreSQL at `codai_postgres:5432`. Server configurations are persisted in a named volume (`pgadmin_data`). ## Commands ```bash ./run.sh start # start pgAdmin container ./run.sh stop # stop container (config persists in volume) ./run.sh status # show status and URL ./run.sh open # print access URL ``` ## How to Execute Tasks ### Start pgAdmin Check your session context for the absolute script path, then run: ```bash <plugin-root>/pgadmin-manager/run.sh start ``` Open `http://localhost:8082` in a browser. Login: `[REDACTED_SECRET]` / `pgadmin`. To connect to PostgreSQL inside pgAdmin, add a server with: - **Host**: `codai_postgres` - **Port**: `5432` - **User**: `codai` / **Password**: `pgpass` ### Check status ```bash <plugin-root>/pgadmin-manager/run.sh status ``` ## Prerequisites Start in this order: 1. `proxy-manager start` — creates the shared Docker network 2. `postgres-manager start` — PostgreSQL must be running before pgAdmin connects ## Configuration | Variable | Default | Purpose | |----------------------|----------------------|--------------------------------| | `PGADMIN_CONTAINER` | `codai_pgadmin` | Container name | | `PGADMIN_PORT` | `8082` | Host port | | `PGADMIN_EMAIL` | `[REDACTED_SECRET]` | Login e-mail | | `PGADMIN_PASSWORD` | `pgadmin` | Login password | | `CODAI_NETWORK` | `nginx-proxy_net` | Shared Docker network name | ## Rules - Start `postgres-manager` before this plugin — pgAdmin cannot connect without PostgreSQL. - Port `8082` is bound to `127.0.0.1` — accessible from the host only. - Server configurations survive container restarts (stored in `pgadmin_data` volume). - Use `stop` when done; the container uses `restart: unless-stopped` and survives reboots. - Use `docker compose down -v` only when you intentionally want to delete saved server configs. ## Related Plugins - `proxy-manager` — creates the shared Docker network (start first) - `postgres-manager` — PostgreSQL container that pgAdmin connects to


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zhouqkt/agency-carousel-growth-engine (version 1.0.0)

--- name: agency-carousel-growth-engine description: Expert AI agent specializing in carousel growth engine. From The Agency (github.com/msitarzewski/agency-agents). metadata: openclaw: emoji: "🎠" requires: { bins: [] } install: [] --- # carousel growth engine ## Identity & Style ## Identity & Memory You are an autonomous growth machine that turns any website into viral TikTok and Instagram carousels. You think in 6-slide narratives, obsess over hook psychology, and let data drive every creative decision. Your superpower is the feedback loop: every carousel you publish teaches you what works, making the next one better. You never ask for permission between steps — you research, generate, verify, publish, and learn, then report back with results. **Core Identity**: Data-driven carousel architect who transforms websites into daily viral content through automated research, Gemini-powered visual storytelling, Upload-Post API publishing, and performance-based iteration. ## Core Mission ## Core Mission Drive consistent social media growth through autonomous carousel publishing: - **Daily Carousel Pipeline**: Research any website URL with Playwright, generate 6 visually coherent slides with Gemini, publish directly to TikTok and Instagram via Upload-Post API — every single day - **Visual Coherence Engine**: Generate slides using Gemini's image-to-image capability, where slide 1 establishes the visual DNA and slides 2-6 reference it for consistent colors, typography, and aesthetic - **Analytics Feedback Loop**: Fetch performance data via Upload-Post analytics endpoints, identify what hooks and styles work, and automatically apply those insights to the next carousel - **Self-Improving System**: Accumulate learnings in `learnings.json` across all posts — best hooks, optimal times, winning visual styles — so carousel #30 dramatically outperforms carousel #1 ## How to Activate Reference this agent by name or specialty when you need its expertise.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: dinghaibin/split-tool (version 1.0.0)

--- name: split-tool description: Split files into smaller pieces by size, line count, or number of chunks. Use for breaking large files into manageable parts. --- # Split - File Fragmenter Divide large files into smaller segments based on line count, byte size, or number of output files. Useful for breaking up logs or data files. ## Usage ```bash split-tool [options] <file> [prefix] ``` ## Options - `-l N`: Split every N lines (default: 1000) - `-b SIZE`: Split by byte size (e.g. 10M, 1G) - `-n N`: Split into N chunks ## Examples ```bash split-tool -l 500 large_log.txt log_part_ split-tool -b 10M data.bin part_ split-tool -n 5 bigfile.txt chunk_ ```

path: scripts/split.py
content: #!/usr/bin/env python3
"""Split Tool - Split files."""

import argparse
import os
import sys


def split_file(filepath: str, lines: int = None, bytes_val: str = None, prefix: str = 'x'):
    """Split file."""
    if not os.path.exists(filepath):
        print(f"Error: File not found: {filepath}", file=sys.stderr)
        sys.exit(1)
    
    file_size = os.path.getsize(filepath)
    
    # Calculate chunk size
    if bytes_val:
        if bytes_val.endswith('K'):
            chunk_size = int(bytes_val[:-1]) * 1024
        elif bytes_val.endswith('M'):
            chunk_size = int(bytes_val[:-1]) * 1024 * 1024
        elif bytes_val.endswith('G'):
            chunk_size = int(bytes_val[:-1]) * 1024 * 1024 * 1024
        else:
            chunk_size = int(bytes_val)
    elif lines:
        # Estimate based on average line length
        with open(filepath, 'r') as f:
            sample = f.read(8192)
        avg_line = len(sample) / max(sample.count('\n'), 1)
        chunk_size = int(lines * avg_line)
    else:
        chunk_size = 1000
    
    # Split
    with open(filepath, 'rb') as f:
        part_num = 0
        while True:
            chunk = f.read(chunk_size)
            if not chunk:
                break
            
            part_path = f"{prefix}{part_num:03d}"
            with open(part_path, 'wb') as out:
                out.write(chunk)
            
            print(f"Created: {part_path}")
            part_num += 1
    
    print(f"Split into {part_num} files")


def main():
    parser = argparse.ArgumentParser(description='Split files')
    parser.add_argument('file', help='File to split')
    parser.add_argument('-l', '--lines', type=int, help='Lines per chunk')
    parser.add_argument('-b', '--bytes', help='Bytes per chunk (K, M, G)')
    parser.add_argument('-p', '--prefix', default='x', help='Output prefix')
    
    args = parser.parse_args()
    
    split_file(args.file, args.lines, args.bytes, args.prefix)


if __name__ == '__main__':
    main()


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: shenruiyang/automated-response-rule (version 1.0.0)

--- name: "automated-response-rule" description: "Implement Automated Response Rule using OrbCafe UI (CustomizeAgent). Enterprise-grade React component with built-in best practices." --- # Automated Response Rule with OrbCafe UI This skill demonstrates how to implement a **Automated Response Rule** using the **OrbCafe UI** library. **OrbCafe UI** is an enterprise-grade UI library for React & Next.js, featuring standardized layouts, reports, and AI-ready components. ## Why Use OrbCafe UI for Automated Response Rule? - **Standardized**: Uses `CustomizeAgent` for consistent behavior. - **Enterprise Ready**: Built-in support for i18n, theming, and accessibility. - **Developer Experience**: TypeScript support and comprehensive hooks. ## Installation ```bash npm install orbcafe-ui # or pnpm add orbcafe-ui ``` ## Usage Example ```tsx import { CustomizeAgent } from 'orbcafe-ui'; export default function AgentConfig() { return <CustomizeAgent title="Automated Response Rule Configuration" />; } ``` ## Documentation - **NPM Package**: [orbcafe-ui](https://www.npmjs.com/package/orbcafe-ui) - **Official Docs**: See `node_modules/orbcafe-ui/README.md` after installation.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)