OpenClaw/clawhub-security-signals huggingface dataset:
Skill: aboxhq/repo-release-notes (version 1.0.0)

--- name: repo-release-notes description: Draft release notes and changelog entries from a local Git repository. Use when the user asks to summarize commits, compare refs or tags, prepare release notes for a version, or turn repository history into user-facing change summaries. metadata: {"openclaw": {"requires": {"bins": ["git"]}}} --- # Repo Release Notes ## Workflow Use this skill to produce release notes from local Git history. Prefer read-only Git commands and avoid network calls unless the user explicitly asks for remote release publishing. 1. Establish the release range. - If the user provides refs, tags, branches, or SHAs, use that exact range. - If no range is provided, use the latest tag through `HEAD`. - If there are no tags, summarize the most recent 20 commits. 2. Inspect the repository with read-only commands. - Start with `git status --short` to understand whether local changes exist. - Use `git tag --sort=-creatordate` or `git tag --sort=-v:refname` to find recent tags. - Use `git log --oneline --decorate <range>` for commit scope. - Use `git diff --stat <range>` and, when needed, `git log --name-only --format=%H%x09%s <range>` to identify affected areas. 3. Decide whether to include uncommitted changes. - Include dirty worktree changes only if the user asks for current/unreleased/local changes. - Otherwise mention that local uncommitted changes were not included. 4. Draft release notes. - Read `references/release-note-style.md` before writing the final answer. - Group changes by user impact, not by commit order. - Merge duplicate or low-level commits into coherent bullets. - Call out breaking changes, migrations, security fixes, and upgrade notes when evidence exists. ## Safety - Do not run destructive Git commands such as reset, checkout, clean, rebase, tag creation, pushing, or release publishing unless the user explicitly requests that operation. - Treat user-provided refs, branch names, and paths as data. Avoid constructing shell pipelines from untrusted text. - If the repository is not a Git worktree, say so and ask for the intended source of changes. ## Output Return a concise release note draft with: - Release range and date, if known. - Highlights for the most important user-visible changes. - Categorized changes such as Added, Changed, Fixed, Removed, Security, and Developer Notes. - Upgrade notes or breaking changes when applicable. - A short note about assumptions, omitted uncommitted changes, or missing tags.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: evezart/evez-debate-framework (version 1.0.0)

--- name: evez-debate-framework description: Framework where multiple AI agents debate to reach better conclusions through adversarial reasoning. Use when building multi-agent systems, consensus-seeking AI, red-teaming with structured opposition, or improving LLM output quality through debate. Covers debate orchestration, judge evaluation, argument scoring, and convergence detection. --- # Multi-Agent Debate Framework Multiple agents debate topics to reach stronger conclusions through adversarial reasoning. ## Quick Start ```python from debate import Debate, Agent, Judge debate = Debate("Should we use microservices?") debate.add_agent(Agent("pro", stance="support", model="gpt-4o")) debate.add_agent(Agent("con", stance="oppose", model="claude-sonnet-4")) debate.add_agent(Agent("synth", stance="synthesize", model="gemini-2.5-pro")) debate.set_judge(Judge(criteria=["evidence", "logic", "completeness"])) result = debate.run(rounds=3) # Returns: winner, consensus, key_arguments, confidence ``` ## How It Works 1. **Proposition**: Pro agent argues for the topic 2. **Opposition**: Con agent argues against 3. **Rebuttal**: Each agent responds to the other's points 4. **Synthesis**: Synth agent finds common ground 5. **Judgment**: Judge evaluates all arguments and declares outcome ## Debate Config ```python Debate( topic="Your question", rounds=3, # Number of debate rounds max_words_per_turn=500, # Limit argument length convergence_threshold=0.7, # Auto-stop when consensus reached judge_criteria=["evidence", "logic", "novelty", "completeness"], ) ``` ## Agent Stances - `support` — Argues in favor - `oppose` — Argues against - `synthesize` — Finds middle ground - `devil_advocate` — Argues weakest points to strengthen them - `expert` — Provides domain-specific knowledge ## Judge Evaluates arguments on configurable criteria and produces: - Winner per round - Overall winner - Consensus points - Unresolved issues - Confidence score


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: macterra/archon-nostr (version 0.1.0)

--- name: archon-nostr description: Derive Nostr identity (npub/nsec) from Archon DID. Use when unifying DID and Nostr identities so both use the same secp256k1 key. Requires existing Archon wallet with ARCHON_PASSPHRASE set. --- # Archon Nostr Identity Derive your Nostr keypair from your Archon DID's secp256k1 verification key. Same key, two protocols. ## Prerequisites - Archon wallet with existing DID - `ARCHON_PASSPHRASE` environment variable set - `nak` CLI: `curl -sSL https://raw.githubusercontent.com/fiatjaf/nak/master/install.sh | sh` ## Derive Keys Run the derivation script: ```bash ./scripts/derive-nostr.sh ``` This outputs your `nsec`, `npub`, and hex pubkey derived from `m/44'/0'/0'/0/0`. ## Save Keys ```bash mkdir -p ~/.clawstr # Save the nsec output from above echo "nsec1..." > ~/.clawstr/secret.key chmod 600 ~/.clawstr/secret.key ``` ## Update DID Document Add Nostr identity for discoverability: ```bash npx @didcid/keymaster set-property YourIdName nostr \ '{"npub":"npub1...","pubkey":"<hex-pubkey>"}' ``` ## Create Nostr Profile ```bash echo '{ "kind": 0, "content": "{\"name\":\"YourName\",\"about\":\"Your bio. DID: did:cid:...\"}" }' | nak event --sec $(cat ~/.clawstr/secret.key) \ wss://relay.ditto.pub wss://relay.primal.net wss://relay.damus.io wss://nos.lol ``` ## Verify Unification The DID's JWK `x` coordinate (base64url) decodes to the same hex as your Nostr pubkey: ```bash npx @didcid/keymaster resolve-id | jq -r '.didDocument.verificationMethod[0].publicKeyJwk.x' # Decode base64url → hex should match your pubkey ``` ## Why This Works Archon uses `m/44'/0'/0'/0/0` (Bitcoin BIP44 path) for DID keys. Nostr uses raw secp256k1. Same curve, same key — just different encodings.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (HIGH)
Skill: rainy-cogmet/zettelkasten (version 1.0.0)

--- name: zettelkasten description: Zettelkasten - Card box note taking system with AI insights keywords: note-taking,knowledge-management,zettelkasten,ai,insights metadata: openclaw: emoji: "📝" bins: ["python"] pip: [] os: - darwin - linux - windows requires: [] --- # Zettelkasten Card Box System ## Description A complete implementation of the Zettelkasten note-taking method, featuring: - Idea capture and organization - AI-generated insights and suggestions - Automatic connection detection - Daily review capabilities ## Usage ### Record Idea ``` Record Idea: [Your idea content here] ``` Example: ``` Record Idea: I found that meditating 10 minutes daily improves focus and sleep quality ``` ## Features 1. **Idea Capture**: Automatically generates structured cards with metadata 2. **AI Insights**: Provides extended suggestions and research directions 3. **Connection Detection**: Finds relationships between different ideas 4. **Daily Review**: Random card review for knowledge consolidation ## Output Format ```markdown --- ID: [timestamp] Tags: #tag1 #tag2 #tag3 Type: Flash Date: [date] --- ## [Title] [Content] > AI Insight: [Generated insight] ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: onceupontenday/deals (version 1.0.1)

name: tome.deals.global display: ToMe Global Deals description: > &#x20; Global daily deal curation on ToMe Marketplace. &#x20; Always 3 results: top save, trending, personalized. brand: ToMe Digital Service Marketplace safety: &#x20; read\_only: true &#x20; public\_only: true &#x20; respect\_robots: true &#x20; gentle\_rate\_limit: true &#x20; no\_login: true &#x20; no\_form\_submit: true &#x20; compliant\_api\_friendly: true sources: &#x20; # North America &#x20; - dealmoon.com &#x20; - dealnews.com &#x20; - dealcatcher.com &#x20; - retailmenot.com &#x20; - redflagdeals.com &#x20; - woot.com &#x20; # Europe &#x20; - hotukdeals.com &#x20; - mydealz.de &#x20; - dealabs.com &#x20; - promodescuentos.com &#x20; - pepper.ru &#x20; - pepper.pl &#x20; - ibood.com &#x20; - yakala.co &#x20; # Asia Pacific &#x20; - ozbargain.com.au &#x20; - kakaku.com &#x20; - pelando.com.br &#x20; - fmkorea.com &#x20; # Gaming \& Virtual Products &#x20; - cheapshark.com &#x20; - isthereanydeal.com &#x20; - gg.deals &#x20; - humblebundle.com &#x20; - fanatical.com &#x20; - greenmangaming.com &#x20; - gog.com output: &#x20; count: 3 &#x20; structure: &#x20; - label: Best Savings &#x20; fields: \[ title, description, price, discount, url ] &#x20; - label: Trending Now &#x20; fields: \[ title, description, price, heat, url ] &#x20; - label: For You &#x20; fields: \[ title, description, price, match\_reason, url ] &#x20; refresh: &#x20; allowed: true &#x20; max\_per\_session: 5 intents: &#x20; - Show today's global deals &#x20; - Get top discounts worldwide &#x20; - Refresh my deal picks &#x20; - Show more deals &#x20; - Find gaming deals


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jacky6658/ai-boss-assistant (version 1.0.2)

--- name: ai-boss-assistant description: Transform any AI into a professional executive assistant with battle-tested personas and workflows. Complete templates for Google Workspace integration (Gmail, Calendar, Drive), milestone delivery system, and security guidelines. homepage: https://github.com/jacky6658/ai-boss-assistant metadata: { "openclaw": { "emoji": "💼", "requires": { "bins": ["node"] }, }, } --- # AI Boss Assistant > Transform any AI into a professional executive assistant with battle-tested personas and workflows. ## Overview This skill provides complete templates to train an AI agent as your personal boss assistant. It includes: - **Persona Framework**: Define how your AI thinks, communicates, and behaves - **Milestone Delivery**: Break big tasks into manageable stages - **Google Workspace Integration**: Gmail, Calendar, Drive automation - **Security Guidelines**: Built-in privacy and permission rules ## Quick Usage ### Train Your AI Ask the AI to read and learn from these files in order: ``` Please read and learn from: 1. agent-persona/PERSONA.md - Core personality 2. agent-persona/COMMUNICATION.md - How to communicate 3. agent-persona/WORKFLOW.md - Milestone delivery system 4. agent-persona/RULES.md - Behavioral rules ``` ### Example Commands After training, you can say: ``` "Check my calendar for tomorrow and summarize" "Help me draft a reply to the latest email from [client]" "Create a project plan for [task] with milestones" "What's on my todo list today?" ``` ## Key Concepts ### AI Employee vs Chatbot This template creates an "AI Employee" that: - ✅ Proactively executes tasks - ✅ Provides complete solutions - ✅ Has judgment and opinions - ✅ Delivers results, not just answers ### Milestone Delivery Big tasks are broken into stages: ``` Task → M1 → Deliver → OK → M2 → Deliver → OK → Done ``` This prevents "black box" operations and allows review at each stage. ### Externalized Memory Important info is written to files: - `MEMORY.md` - Long-term memory - `memory/YYYY-MM-DD.md` - Daily logs ## Requirements - OpenClaw 1.0+ - Node.js 18+ - Google Account (for Workspace integration) - gog CLI (for Google Workspace) ## Installation ```bash # Install gog for Google Workspace npm install -g gog gog auth login --services gmail,calendar,drive ``` ## Files Structure ``` agent-persona/ - Core persona templates setup/ - Installation guides examples/ - Conversation examples security/ - Security guidelines tasks/ - Task management templates ``` ## Links - **GitHub**: https://github.com/jacky6658/ai-boss-assistant - **Documentation**: See README.md for full documentation - **Issues**: https://github.com/jacky6658/ai-boss-assistant/issues


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: century0327/douyinwenan (version 1.0.0)

--- name: edu-content-factory-pro version: 6.0 description: > 高中教育内容生产工厂（增强版）。 集成：人机协作流水线（HITL）、去AI味底层引擎、数据硬核增强、事实哨卡校验、张雪峰人格模块。 核心逻辑：数据驱动真实，情绪驱动传播，人类决策灵魂。 metadata: openclaw: emoji: "🎓" requires: ["python3", "web_search"] --- # 教育热点内容工厂 (Edu Content Factory Pro) ## 一、 核心人格设定 (Core Persona) - **身份**：一个在教育圈摸爬滚打15年、看透升学真相的资深观察者。 - **态度**：不讲官话、不打太极、不同情弱者（只教弱者变强）。 - **语言风格**： - 碎句多，长句少。 - 像是在路边摊喝着啤酒跟家长交实底，而不是在讲台上做报告。 - 带有特定的“疲惫感”和“心软的犀利”。 ## 二、 去AI化底层协议 (Anti-AI Protocol) **【严格禁区】**： - **禁用词汇**：至关重要、维度、赋能、景观、深远影响、致力于、关键在于、值得关注、不仅...更是...、总而言之。 - **禁用结构**：排比句（三段式）、标准的“总-分-总”、带有引导性的助推词（“让我们来看看”）。 - **禁用情绪**：廉价的励志、宏大的赞美、毫无根据的焦虑。 **【提倡风格】**： - **非对称性**：句子错落有致，允许口语化造成的轻微语法不严谨。 - **动词驱动**：少用“是”、“作为”，多用具体的动作（如：从“家长感到焦虑”改为“家长半夜三点还在刷志愿填报群”）。 ## 三、 自动化生产流水线 (Pipeline) ### PHASE 1: 原始热点发现 - **AI 动作**：搜索 24h 内教育热点（单招、考研、就业、学历贬值、地区教育政策）。 - **筛选标准**：必须能关联到“普通家庭利益”。 - **🚨 INTERRUPT**：提交 3 个选题，人类选定 1 个。 ### PHASE 2: 数据硬核增强 (New: Data Enrichment) - **AI 动作**：针对选定选题，强制执行深度搜索。 - **必须获取**： 1. 至少 2 组具体的对比数字（如：去年 vs 今年的报录比）。 2. 1 个具体的政策细节或行业内幕。 3. 1 个真实的、有刺痛感的个案描述。 - **要求**：将枯燥数据翻译成“人味语言”（如：把“10%”翻译成“一间教室 50 个人，只有 5 个能上岸”）。 ### PHASE 3: 情绪剥离与逻辑构建 - **AI 动作**：应用“张雪峰模型”进行利益拆解。 - **输出**：3 版不同力度的 Hook（内心秘密、否定力量、利益揭秘）。 - **🚨 INTERRUPT**：人类选定逻辑路径与 Hook。 ### PHASE 4: 初稿生成（去AI化引擎） - **AI 动作**：执行初稿撰写，严禁触碰“去AI化协议”中的禁区。 - **要求**：必须在文中注入 Phase 2 获取的硬核数据。 ### PHASE 5: 事实哨卡与合规校验 (New: Verification) - **数据校验**：AI 反向检查文案中的数字、年份、政策名称是否准确。 - **违禁检测**：扫描抖音/短视频平台违禁词（如：第一、最、绝对、赚钱等）。 - **AI味测评**：运行 `scripts/check_logic.py` 自评（低于 85 分自动重写）。 - **🚨 INTERRUPT**：输出文案初稿 + 数据查验结果 + 违禁词预警。 ### PHASE 6: 最终润色与发布准备 - **AI 动作**：根据人类反馈微调，提供视觉建议（分镜情绪关键词）。 - **输出**：评论区引导话术（预判杠精，提前埋梗）。 ## 四、 脚本附件定义 (System Files) ### 1. `scripts/verify_facts.py` ```python # 该脚本用于提取文案中的数字和事实点，并对比搜索结果。 def verify_logic(text, search_data): # 提取数字/政策 # 比对准确度 # 输出校验报告 pass

path: _meta.json
content: {
  "name": "edu-content-factory-pro",
  "version": "6.0.0",
  "features": ["data_enrichment", "fact_checking", "anti_ai_writing"]
}

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: tobeyrebecca/toby-summarize (version 1.0.0)

--- name: summarize description: Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube). homepage: https://summarize.sh metadata: {"clawdbot":{"emoji":"🧾","requires":{"bins":["summarize"],"env":["SKILLBOSS_API_KEY"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/summarize","bins":["summarize"],"label":"Install summarize (brew)"}]}} --- # Summarize Fast CLI to summarize URLs, local files, and YouTube links. ## Quick start ```bash summarize "https://example.com" --model google/gemini-3-flash-preview summarize "/path/to/file.pdf" --model google/gemini-3-flash-preview summarize "https://youtu.be/dQw4w9WgXcQ" --youtube auto ``` ## Model + keys Set the API key for SkillBoss API Hub: - `SKILLBOSS_API_KEY` — unified key for all providers, routes via `https://api.skillbossai.com/v1/pilot` SkillBoss API Hub supports all major LLM providers (OpenAI GPT, Anthropic Claude, Google Gemini, xAI Grok, etc.) and automatically selects the best model. No provider-specific keys needed. Default model is `google/gemini-3-flash-preview` if none is set. ## Useful flags - `--length short|medium|long|xl|xxl|<chars>` - `--max-output-tokens <count>` - `--extract-only` (URLs only) - `--json` (machine readable) - `--firecrawl auto|off|always` (fallback extraction via SkillBoss API Hub scraping, uses `SKILLBOSS_API_KEY`) - `--youtube auto` (YouTube fallback via SkillBoss API Hub, uses `SKILLBOSS_API_KEY`) ## Config Optional config file: `~/.summarize/config.json` ```json { "model": "openai/gpt-5.2" } ``` Optional services (all routed via SkillBoss API Hub with `SKILLBOSS_API_KEY`): - Web scraping for blocked sites (`type: "scraper"` via `/v1/pilot`, replaces `FIRECRAWL_API_KEY`) - YouTube transcript fallback (`type: "scraper"` via `/v1/pilot`, replaces `APIFY_API_TOKEN`)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zaixi/nginxwebui-manager (version 1.2.0)

--- name: nginxwebui-manager description: "Manage NginxWebUI reverse proxy rules via its REST API. List/create/delete servers and locations, reload nginx, manage upstreams. All calls through docker exec into the nginxwebui container." --- # NginxWebUI Manager Manage NginxWebUI via its built-in REST API. All API calls are made via `docker exec` into the running `nginxwebui` container (requires Docker socket access). ## How it works - Authenticates via `POST /token/getToken` with username/password - Stores token in `NGINXWEBUI_TOKEN` env var (auto-refreshed via `--mode login`) - All subsequent calls use the token in the `token` header ## Usage ### Authentication ```bash # First time — get token and save to .env python3 {{SKILL_DIR}}/scripts/manage.py --mode login ``` ### Nginx operations ```bash # Check nginx status python3 {{SKILL_DIR}}/scripts/manage.py --mode status # Validate config python3 {{SKILL_DIR}}/scripts/manage.py --mode check # Reload nginx python3 {{SKILL_DIR}}/scripts/manage.py --mode reload ``` ### Server (reverse proxy) management ```bash # List all servers python3 {{SKILL_DIR}}/scripts/manage.py --mode list-servers # Add a new reverse proxy python3 {{SKILL_DIR}}/scripts/manage.py --mode add-server \ --name "app.example.com" --listen 443 --ssl \ --pem /path/to/cert.pem --key /path/to/key.pem \ --descr "My app" # Delete a server by ID prefix python3 {{SKILL_DIR}}/scripts/manage.py --mode delete-server --id 12345abc ``` ### Location (reverse proxy rule) management ```bash # List locations for a server python3 {{SKILL_DIR}}/scripts/manage.py --mode list-locations --server-id 12345abc # Add a location (path → target) python3 {{SKILL_DIR}}/scripts/manage.py --mode add-location \ --server-id 12345abc \ --path /api/ \ --target http://10.0.0.5:3000 \ --descr "API backend" # Add with websocket support python3 {{SKILL_DIR}}/scripts/manage.py --mode add-location \ --server-id 12345abc \ --path /ws \ --target http://10.0.0.5:3000 \ --websocket # Delete a location python3 {{SKILL_DIR}}/scripts/manage.py --mode delete-location --id 67890def ``` ### Upstream (load balancer) management ```bash # List upstreams python3 {{SKILL_DIR}}/scripts/manage.py --mode list-upstreams ``` ## Environment variables - `NGINXWEBUI_USER` — required - `NGINXWEBUI_PASS` — required - `NGINXWEBUI_TOKEN` — auto-managed, stored in `.env` ## Requirements - Docker socket accessible from the calling environment - Running nginxwebui container (name: `nginxwebui`) - Valid NginxWebUI admin credentials with API access enabled


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: luciorenovato/notion-tasks-blocks (version 1.0.0)

--- name: notion-tasks-blocks description: Manage Notion checklist blocks inside a page (no database required). Use when the user has plain to-do blocks and wants to list tasks, add tasks, and mark tasks done/undone. --- # notion-tasks-blocks Use this skill for Notion pages that contain `to_do` blocks (checklist items), not databases. ## Required env vars - `NOTION_TOKEN` (`secret_...`) - `NOTION_TASKS_PAGE_ID` (page id that contains the task blocks) ## Command wrapper ```bash bash {baseDir}/scripts/notion_tasks_blocks.sh <command> [args] ``` Commands: - `list` → list current to-do blocks with index and done status - `add "<text>"` → append new unchecked to-do block to the page - `done <index>` → mark indexed task as checked - `undo <index>` → mark indexed task as unchecked ## Notes - Indexes come from `list`. - Works only for top-level `to_do` blocks on the page. - If Notion returns permission errors, share the page with your integration.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: shenhuanjie/browser-screenshot-send (version 1.0.0)

--- name: browser-screenshot-send description: Automatically send browser screenshots to users via message tool. Solves the common issue where browser screenshots are generated but not delivered to the conversation channel. Essential for web automation workflows requiring visual feedback. --- # Browser Screenshot Send Automatically deliver browser screenshots to users through messaging channels. This skill bridges the gap between browser automation and user communication. ## Problem It Solves When using `browser action=screenshot`, the screenshot is saved to disk but **not automatically sent** to the user. Many agents mistakenly use `read` to display screenshots, which doesn't reliably transmit images through chat channels. This skill ensures screenshots actually reach the user. ## When to Use - After any `browser screenshot` operation where the user needs to see the result - Web scraping results visualization - UI automation progress reporting - Page verification and debugging - Visual testing workflows ## Quick Start ``` # 1. Take screenshot browser action=screenshot targetId=<page> # Returns: MEDIA:/root/.openclaw/media/browser/<uuid>.png # 2. Send to user message action=send media=/root/.openclaw/media/browser/<uuid>.png ``` ## Why Not `read`? ❌ **Don't**: `read file_path=/path/to/screenshot.png` - Displays in agent context only - Not transmitted to chat channels - User sees nothing ✅ **Do**: `message action=send media=/path/to/screenshot.png` - Actively pushes to conversation - Works across all channels (Slack, Discord, Telegram, etc.) - User receives the image ## Handling Long Screenshots For full-page screenshots that may be too long: **Option 1**: Send as-is with warning ``` message action=send media=<path> Note: This is a full-page screenshot and may be quite long. ``` **Option 2**: Split into sections Use `canvas` tool to crop sections when user requests "send in parts". **Option 3**: Partial screenshots ``` browser action=screenshot fullPage=false # Scroll and repeat for different sections ``` ## File Organization Screenshots are auto-saved to: - Source: `/root/.openclaw/media/browser/<uuid>.png` - Recommended: Copy to workspace for persistence: ``` cp <source> /workspace/media/screenshots/<descriptive_name>.png ``` ## Example Workflow ``` # Navigate and screenshot browser action=navigate targetUrl=https://example.com browser action=screenshot fullPage=true # Returns path in MEDIA: line MEDIA:/root/.openclaw/media/browser/abc123.png # Send to user message action=send media=/root/.openclaw/media/browser/abc123.png ``` ## Best Practices 1. **Always use `message` tool** - Never rely on `read` for user-facing images 2. **Copy to workspace** - Browser media is temporary; save important screenshots 3. **Name descriptively** - When copying, use meaningful filenames 4. **Warn for long screenshots** - Full-page captures can be very tall ## Requirements - OpenClaw with `browser` and `message` tools enabled - Compatible with all OpenClaw-supported channels


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)