OpenClaw/clawhub-security-signals huggingface dataset:
Skill: linbo405/content-auto-poster-cn (version 1.0.0)

--- name: Content Auto Poster slug: content-auto-poster-xiaomolongxia version: 1.0.0 description: "自动发布内容到多个平台，支持微信公众号、微博、知乎等平台定时发布。" changelog: "1.0.0 - 初始版本" metadata: {"openclaw":{"emoji":"📝","os":["win32","darwin","linux"]}} --- # Content Auto Poster 📝 自动将一篇内容发布到多个平台，省时省力。 ## 功能 - 📱 **多平台支持**: 微信公众号、微博、知乎、简书 - ⏰ **定时发布**: 设置最佳发布时间 - 📊 **数据统计**: 阅读量、点赞、评论汇总 - 🔄 **内容适配**: 自动调整格式适配各平台 ## 输入 - 内容标题 - 正文内容 - 目标平台列表 - 发布时间（可选） ## 输出 ```json { "success": true, "posts": [ {"platform": "wechat", "url": "https://...", "status": "published"}, {"platform": "zhihu", "url": "https://...", "status": "scheduled"} ], "total_reach": 1250 } ``` ## 使用场景 - 博客同步到多个平台 - 产品发布公告 - 定期内容更新 ## 配置 ```json { "platforms": ["wechat", "zhihu", "jianshu"], "default_schedule": "09:00", "timezone": "Asia/Shanghai" } ``` ## 价格 ¥49/月


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: segasonicye/config-guard (version 0.1.0)

# Claw Seatbelt 🛡️ (OpenClaw 安全带) 这是一款为你修改 `openclaw.json` 准备的“安全带”。它不像普通插件那样全天候运行，而是只在你需要修改配置并备份时，提供 10 秒的自动回滚保护。 ## 特色功能 - **按需保护**：仅在运行备份脚本时触发，不浪费系统资源。 - **10秒无敌险**：修改配置后若 Gateway 无法在 10 秒内恢复，自动回退到最新备份并重启。 - **极简设计**：无需复杂配置，即装即用。 ## Usage The skill primarily runs as a background watchdog. ### Manual Check ```bash ./bin/watchdog.sh ``` ## How it works 1. Probes the local Gateway status. 2. If down, captures the current "broken" config for debugging. 3. Locates the most recent timestamped backup in `~/.openclaw/backups/`. 4. Restores and restarts the Gateway service.

path: bin/watchdog.sh
content: #!/bin/bash
# OpenClaw Gateway 守卫脚本 (watchdog.sh)
# 功能：检测 Gateway 是否运行，若连接失败则自动回滚最新的备份配置并重启

CONFIG_DIR="$HOME/.openclaw"
CONFIG_FILE="$CONFIG_DIR/openclaw.json"
BACKUP_DIR="$CONFIG_DIR/backups"
LOG_FILE="/tmp/openclaw-watchdog.log"

echo "[$(date)] Watchdog starting..." >> "$LOG_FILE"

# 1. 探测 Gateway 状态
# 尝试使用 openclaw status --probe 进行深探测
if ! openclaw gateway status --json | grep -q '"state": "active"'; then
    echo "[$(date)] ⚠️ Gateway detected as DOWN or UNREACHABLE." >> "$LOG_FILE"
    
    # 2. 查找最新的有效备份
    LATEST_BACKUP=$(ls -t "$BACKUP_DIR"/openclaw-*.json 2>/dev/null | head -n 1)
    
    if [ -n "$LATEST_BACKUP" ]; then
        echo "[$(date)] 🔄 Attempting recovery using backup: $LATEST_BACKUP" >> "$LOG_FILE"
        
        # 3. 执行回滚 (先备份坏掉的，以防万一)
        cp "$CONFIG_FILE" "$BACKUP_DIR/failed-config-$(date +%Y%m%d-%H%M%S).json"
        cp "$LATEST_BACKUP" "$CONFIG_FILE"
        
        # 4. 重启 Gateway
        echo "[$(date)] 🚀 Restarting Gateway..." >> "$LOG_FILE"
        openclaw gateway restart --force
        
        # 5. 验证重启
        sleep 5
        if openclaw gateway status --json | grep -q '"state": "active"'; then
            echo "[$(date)] ✅ Recovery SUCCESSFUL." >> "$LOG_FILE"
            # 这里可以根据需要添加通知逻辑 (如 pushbullet 或 imessage)
        else
            echo "[$(date)] ❌ Recovery FAILED. Manual intervention required." >> "$LOG_FILE"
        fi
    else
        echo "[$(date)] ❌ No backup files found in $BACKUP_DIR. Cannot recover." >> "$LOG_FILE"
    fi
else
    # echo "[$(date)] Gateway is healthy." >> "$LOG_FILE"
    exit 0
fi


path: skill.json
content: {
  "name": "claw-seatbelt",
  "version": "0.1.0",
  "description": "OpenClaw configuration safety belt with 10s auto-rollback protection",
  "author": "sonic & 小叶助手",
  "type": "skill",
  "entry": "SKILL.md",
  "files": [
    "bin/watchdog.sh"
  ]
}

Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: hopeatina/orgx-operations-agent (version 1.0.0)

--- name: orgx-operations-agent description: OrgX operations execution contract for OpenClaw. Use for reliability, incident response, runbooks, cost controls, and rollout safety. version: 1.0.0 user-invocable: true tags: - operations - orgx - openclaw --- # OrgX Operations Agent (OpenClaw) This skill defines how the OrgX Operations agent behaves when running inside OpenClaw. ## Persona - Voice: cautious, thorough, pragmatic. - Autonomy: default to reversible actions; add guardrails before speed. - Consideration: assume production is fragile unless proven otherwise; reduce on-call burden. ## Primary Contract - Prefer reversible actions and clear rollback paths. - Treat production changes as high risk unless explicitly approved. - Document runbooks so someone else can execute them safely. ## Output Standards For ops deliverables: - what can go wrong - detection signals - mitigations/rollback - step-by-step runbook - verification checklist ## Reporting Protocol (OrgX) - `orgx_emit_activity` for progress and status. - `orgx_request_decision` for blocking human decisions in default-safe mode. - `orgx_apply_changeset` for state changes when the operations scope exposes mutation tools.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: scnet-sugon/flight-itinerary-ocr (version 1.0.5)

--- name: flight_itinerary_ocr description: 支持从航空运输电子客票行程单中提取旅客姓名、身份证号、航班号、起降地、起降时间、票价、燃油附加费、民航发展基金及电子客票号码等信息识别并提取出来 version: 1.0.5 author: SCNet license: MIT tags: - OCR - 证件识别 - 发票识别 - 文字提取 required_env_vars: - SCNET_API_KEY optional_env_vars: - SCNET_API_BASE primary_credential: SCNET_API_KEY dependencies: - python3 - requests input: - ocrType : 识别类型，可选值见下文 - filePath : 待识别图片的本地路径 output: 结构化的 JSON 数据，包含识别结果和置信度 --- # Sugon-Scnet 通用 OCR 技能 本技能封装了 Sugon-Scnet 航空运输电子客票行程单 OCR 服务，通过单一接口即可调用 1 种识别能力，高效提取文字及票据信息。 ## 功能特性 - **航空运输电子客票行程单票据**：覆盖航空运输电子客票行程单发票，自动提取关键字段。 ## 前置配置 > **⚠️ 重要**：使用前需要申请 Scnet API Token ### 申请 API Token 1. 访问 [Scnet 官网](https://www.scnet.cn) 注册/登录 2. 在控制台申请 API 密钥（格式：[REDACTED_SECRET]） 3. 复制密钥备用 ### 配置 Token **手动配置（推荐）** 1. 在技能目录下创建 `config/.env` 文件，内容如下： ```ini # ===== Sugon-Scnet OCR API 配置 ===== # 申请地址：https://www.scnet.cn SCNET_API_KEY=your_scnet_api_key_here # API 基础地址（一般无需修改） SCNET_API_BASE=https://api.scnet.cn/api/llm/v1 ``` 2. 添加：`SCNET_API_KEY=你的密钥` 3. 设置文件权限为 600（仅所有者可读写） **⚠️ 安全警告**：切勿将 API Key 直接粘贴到聊天对话中，否则可能被记录或泄露。 ### Token 更新 Token 过期后调用会返回 401 或 403 错误。更新方法：重新申请 Token 并替换 config/.env 中的 SCNET_API_KEY。 ### 依赖安装 本技能需要 Python 3.6+ 和 requests 库。请运行以下命令： ```bash pip install requests ``` --- ### 使用方法 ### 参数说明 | 参数名 | 类型 | 必填 | 描述 | |--------|------|------|------| | ocrType | string | 是 | 识别类型枚举。必须为以下之一：<br>• AIRPORT_TICKET（航空运输电子客票行程单） | | filePath | string | 是 | 待识别图片的本地绝对路径。支持 jpg、png、pdf 等常见格式。 | ### 命令行调用示例 ```bash python .claude/skills/flight_itinerary_ocr/scripts/main.py AIRPORT_TICKET /path/to/invoice.jpg ``` ### 在 AI 对话中使用 用户可以说： - “帮我识别这张飞机票，图片在 /Users/name/Downloads/id.jpg” AI 会根据 description 中的关键词自动触发本技能。 ### AI 调用建议 为避免触发 API 速率限制（10 QPS），请串行调用本技能，即等待前一个识别完成后再发起下一个请求。 如果使用 OpenClaw 的 exec 工具，建议设置 timeout 或 yieldMs 参数，让命令同步执行，避免多个命令同时运行导致并发。 ### 配置选项 编辑 `config/.env` 文件： | 变量名 | 默认值 | 说明 | |--------|--------|------| | SCNET_API_KEY | 必需 | Scnet API 密钥 | | SCNET_API_BASE | https://api.scnet.cn/api/llm/v1 | API 基础地址（一般无需修改） | ### 输出 - 标准输出：识别结果的 JSON 数据，结构与 API 文档一致，位于 `data` 字段内。 - 识别结果位于 data[0].result[0].elements 中，具体字段取决于 ocrType。 - 错误信息：如果发生错误，会输出以 `错误:` 开头的友好提示。 ### 注意事项 - 本技能调用的 OCR API 有 10 QPS 的速率限制。 - 如果遇到 429 错误，请等待 2-3 秒后重试，不要连续发起请求。 - 建议在调用前确保图片已准备就绪，避免因网络问题导致重复调用。 ### 故障排除 | 问题 | 解决方案 | |------|----------| | 配置文件不存在 | 创建 config/.env 并填入 Token（参考前置配置） | | API Key 无效/过期 | 重新申请 Token 并更新 `.env` 文件 | | 文件不存在 | 检查提供的文件路径是否正确 | | 网络连接失败 | 检查网络连接或防火墙设置 | | 不支持的文件类型 | 确保文件扩展名为允许的类型（参考 API 文档） | | 401/403/Unauthorized | Token 无效或过期，重新申请并配置 | | 429 Too Many Requests | 请求过于频繁，技能会自动等待并重试（最多 3 次）。若持续失败，请降低调用频率或联系服务方提高限额。 |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: rishabhdugar/pdf-to-xlsx (version 1.0.0)

--- name: pdf-to-xlsx description: "Extract tables and text from a PDF into an Excel workbook (XLSX). Each page becomes a separate sheet." --- # PDF to Excel ## What It Does Extracts tables and text from a PDF into an Excel workbook. Each page becomes a separate sheet. Uses PyMuPDF table detection with fallback to line-by-line text extraction. ## When to Use - Extract tabular data from PDF invoices or reports - Convert PDF financial statements to Excel - Pull structured data from PDF tables ## Required Inputs Provide one of: - `url` — public URL to a PDF - `file` — base64-encoded PDF - Multipart upload with `file` field ## Authentication Send your API key in the `CLIENT-API-KEY` header. Get your **free API key** at [https://pdfapihub.com](https://pdfapihub.com). Full API documentation is available at [https://pdfapihub.com/docs](https://pdfapihub.com/docs). ## Use Cases - **Invoice Data Extraction** — Pull line items and totals from PDF invoices into Excel for accounting - **Financial Statement Analysis** — Convert PDF bank statements to Excel for analysis and reconciliation - **Report Data Mining** — Extract tabular data from PDF reports for further processing - **Procurement** — Convert PDF purchase orders into spreadsheets for tracking - **Tax Preparation** — Extract financial data from PDF tax documents into Excel ## Aliases - `/v1/convert/pdf/excel` is an alias ## Example Usage ```bash curl -X POST https://pdfapihub.com/api/v1/convert/pdf/xlsx \ -H "CLIENT-[REDACTED_SECRET]" \ -H "Content-Type: application/json" \ -d '{ "url": "https://pdfapihub.com/sample-pdfinvoice-with-image.pdf", "output": "url" }' ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: ansike/ctrip-publish-skill (version 1.0.0)

--- name: 携程笔记全自动发布 version: 3.2.0 description: 携程内容中心全自动发布技能，支持从 Bing Images 搜索高清无版权图片、自动填写标题正文、自动上传图片、自动选择目的地、自动点击发布。适用于旅行攻略、美食推荐等图文笔记发布。 emoji: 🚄 --- # 携程笔记全自动发布技能 ## 功能 - ✅ 自动打开携程发布页面 - ✅ 自动从 Bing Images 搜索高清无版权图片 - ✅ 自动填写标题和正文 - ✅ 自动上传图片（最多20张） - ✅ 自动选择目的地 - ✅ 自动设置拍摄时间 - ✅ 自动添加话题标签 - ✅ 自动点击发布 ## 使用场景 当用户说： - "发携程笔记" - "发布到携程" - "全自动发布携程笔记" - "帮我发到携程" - "写一篇携程攻略" ## 技术实现 使用 OpenClaw 浏览器自动化 + CDP 协议： 1. 通过浏览器 CDP WebSocket 连接页面 2. 导航到携程内容中心发布页面 3. 使用 CDP setFileInputFiles 上传图片 4. 填写表单字段（标题、正文、地点） 5. 触发 React 合成事件更新状态 6. 点击发布按钮，处理确认弹窗 ## 图片搜索功能 内置 Bing Images 搜索，可根据关键词自动下载高清图： - 搜索关键词：故宫、长城、天坛、胡同、鸟巢、烤鸭等 - 自动过滤低分辨率图片 - 优先选择 1920x1080 以上的高清图 - 自动下载到 /tmp/openclaw/uploads/ ## 依赖 - OpenClaw 浏览器工具 - Python 3 + websockets (用于 CDP) - 网络访问 Bing Images ## 配置 无需 API Key，但需要： 1. 登录携程账号（首次需要扫码） 2. 图片上传到 /tmp/openclaw/uploads/ ## 页面元素定位 ### 携程发布页面关键元素 ``` 页面URL: https://we.ctrip.com/publish/publishPictureText 关键选择器: - 图片上传: input[type="file"] (隐藏元素，需用CDP) - 标题输入: [role="textbox"] (第一个) - 正文编辑器: [role="combobox"] (第一个) - 地点选择: .ant-select-selection-search-input - 日期选择: input[placeholder*="日期"] - 发布按钮: button (innerText = "发 布") - 存草稿: button (innerText = "存草稿") - 水印开关: .ant-switch ``` ### 成功判断 - 发布成功后 URL 包含 `detail?articleId=` - 或页面跳转到内容详情页 ## 重要限制 1. **标题字数：必须少于20字**（不是≤20字） - 推荐 15-19 字 - 超过会报错"标题字数需少于20个字" 2. **正文字数：建议 ≥60 字** - 更容易被评为优质内容 3. **图片数量：建议 3-20 张** - ≥3张有机会评为优质 4. **地点选择**： - 必须正确选择才能发布 - 有时需要多次尝试才能选中 ## CDP 图片上传示例 ```python import json, asyncio, websockets async def upload_images(ws_url, files): async with websockets.connect(ws_url) as ws: # 获取DOM文档 await ws.send(json.dumps({ "id": 1, "method": "DOM.getDocument", "params": {"depth": -1} })) doc = json.loads(await ws.recv()) # 查找file input await ws.send(json.dumps({ "id": 2, "method": "DOM.querySelector", "params": { "nodeId": doc["result"]["root"]["nodeId"], "selector": "input[type='file']" } })) q = json.loads(await ws.recv()) # 设置文件 await ws.send(json.dumps({ "id": 3, "method": "DOM.setFileInputFiles", "params": { "nodeId": q["result"]["nodeId"], "files": files # 绝对路径列表 } })) ``` ## 使用示例 用户：帮我发一篇北京3天2晚的攻略到携程 AI： 1. 从 Bing Images 搜索北京景点高清图片 2. 下载故宫、长城、天坛等图片 3. 打开携程发布页面 4. 填写标题（<20字）："北京3天攻略！人均1500玩转帝都" 5. 填写正文行程内容（≥60字） 6. 上传下载的图片（3-20张） 7. 选择目的地"北京·中国" 8. 点击发布 ## 常见问题 1. **地点选择失败** - 点击选择器展开下拉 - 输入关键词后等待下拉出现 - 点击匹配的选项 2. **发布按钮无反应** - 检查是否有必填项未填 - 确认地点已正确选择 - 查看页面是否显示错误提示 3. **图片上传失败** - 确认图片路径正确 - 图片格式为 JPG/PNG - 单张图片 <10MB ## 快速链接 - 图文发布：https://we.ctrip.com/publish/publishPictureText - 创作者后台：https://we.ctrip.com/publish/publishHome - 内容管理：https://we.ctrip.com/publish/contentManagement


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: wjsoj/pku-campuscard (version 1.0.0)

--- name: campuscard description: "PKU Campus Card (校园卡) CLI tool built in Rust. Use this skill when working on the campuscard crate, debugging campus card commands, adding features, or when the user mentions 校园卡, campus card, balance, recharge, payment QR, transaction history, monthly spending, or bdcard.pku.edu.cn. Also use when dealing with Synjones platform auth, berserker-auth flow, mobile User-Agent requirements, or HTTP/1.1 constraints." version: 2.0.0 --- # Campuscard - 北大校园卡 CLI A CLI client for PKU's campus card system (Synjones platform at bdcard.pku.edu.cn). ## Architecture - **Crate location**: `crates/campuscard/` - **Auth flow**: IAAA SSO (`app_id="portal2017"`) → portal → berserker-auth → JWT - **API**: JSON REST with `synjones-auth` header - **Constraints**: Requires mobile UA (`PKUANDROID`) and `http1_only()` (server rejects HTTP/2) ## Key Source Files - `src/main.rs` — Clap CLI with subcommands - `src/commands.rs` — Command implementations - `src/api.rs` — API client with synjones-auth header injection - `src/display.rs` — Terminal output, QR code rendering - `src/client.rs` — reqwest client with mobile UA and HTTP/1.1 enforcement ## CLI Commands | Command | Alias | Function | |---------|-------|----------| | `login` / `logout` / `status` | | IAAA → portal → berserker → JWT | | `info` | | Card balance and details | | `pay` | | Display payment QR code in terminal | | `recharge` | | Top up card balance | | `bills` | `ls` | Transaction history (pagination, monthly filter) | | `stats` | | Monthly spending statistics | | `otp` | | TOTP 2FA management | ## Auto-Login for AI Agents ```bash # Check session status info-auth check # Auto-login (reads credentials from OS keyring, no password needed) campuscard login -p ``` ## Development Notes - The auth chain is the most complex: IAAA → portal → berserker-auth → JWT token - Must use mobile User-Agent (`PKUANDROID`) or requests will be rejected - Must use `http1_only()` — the Synjones server does not support HTTP/2 - QR code for payment displayed via `info_common::qr` (viuer or system viewer) - All user-facing strings in **Chinese** - Error handling: `anyhow::Result` with `.context("中文描述")` - Session persisted to `~/.config/info/campuscard/` - Credentials resolved via `info_common::credential` (keyring → env → interactive)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: teoslayer/pilot-audit-log (version 1.0.0)

--- name: pilot-audit-log description: > Comprehensive audit trail of all Pilot Protocol activity for security and compliance. Use this skill when: 1. You need detailed logs of all trust decisions and connections 2. You require compliance audit trails for security reviews 3. You want to investigate suspicious activity or incidents Do NOT use this skill when: - You need real-time alerting (use pilot-watchdog instead) - You only need basic daemon logs (use pilotctl info) - You're doing performance profiling (use dedicated profiling tools) tags: - pilot-protocol - trust-security - audit - compliance license: AGPL-3.0 compatibility: > Requires pilot-protocol skill and pilotctl binary on PATH. The daemon must be running (pilotctl daemon start). metadata: author: vulture-labs version: "1.0" openclaw: requires: bins: - pilotctl homepage: https://pilotprotocol.network allowed-tools: - Bash --- # Pilot Audit Log Comprehensive audit logging for Pilot Protocol with structured event capture, retention policies, and compliance-ready output formats. ## Commands **Initialize audit log:** ```bash mkdir -p ~/.pilot/audit cat > ~/.pilot/audit/config.json <<EOF { "enabled": true, "log_file": "$HOME/.pilot/audit/events.jsonl", "retention_days": 90, "event_types": ["trust.handshake", "trust.approve", "connection.open"] } EOF ``` **Log trust events:** ```bash log_audit() { local EVENT_TYPE=$1 local DETAILS=$2 echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) $EVENT_TYPE $DETAILS" >> ~/.pilot/audit/events.jsonl } pilotctl --json handshake "$AGENT" "Audit test" log_audit "trust.handshake" "{\"agent\": \"$AGENT\"}" ``` **Query audit log:** ```bash grep "trust.approve" ~/.pilot/audit/events.jsonl jq 'select(.event_type == "trust.approve")' ~/.pilot/audit/events.jsonl ``` **Generate audit report:** ```bash cat > ~/.pilot/audit/report-$(date +%Y-%m-%d).json <<EOF { "date": "$(date +%Y-%m-%d)", "total_events": $(wc -l < ~/.pilot/audit/events.jsonl), "handshakes": $(grep -c "trust.handshake" ~/.pilot/audit/events.jsonl || echo 0), "approvals": $(grep -c "trust.approve" ~/.pilot/audit/events.jsonl || echo 0) } EOF ``` ## Workflow Example ```bash #!/bin/bash # Audit logging with automatic event capture AUDIT_DIR=~/.pilot/audit LOG_FILE=$AUDIT_DIR/events.jsonl mkdir -p "$AUDIT_DIR" audit_log() { local EVENT_TYPE=$1 local AGENT=$2 local ACTION=$3 local RESULT=$4 cat >> "$LOG_FILE" <<EOF {"timestamp":"$(date -u +%Y-%m-%dT%H:%M:%SZ)","event_type":"$EVENT_TYPE","agent":"$AGENT","action":"$ACTION","result":"$RESULT"} EOF } # Wrap trust commands with audit logging audit_handshake() { local AGENT=$1 audit_log "trust" "$AGENT" "handshake" "started" if pilotctl --json handshake "$AGENT" "Audit tracked"; then audit_log "trust" "$AGENT" "handshake" "success" else audit_log "trust" "$AGENT" "handshake" "failed" fi } audit_handshake "agent1.pilot" ``` ## Dependencies Requires `pilot-protocol` skill, `pilotctl` binary, running daemon, and `jq` for JSON parsing.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: emptyopen/macos-desktop-control (version 1.0.0)

# macOS Control Skill A high-fidelity automation bridge for macOS (Darwin) that enables agents to perceive the desktop state and execute precise mouse and keyboard interactions. ## 🛠 Included Scripts This skill leverages specialized wrappers located in the `/scripts` directory to interface with system-level binaries: ### 1. `cliclick_wrapper.sh` A dedicated wrapper for the `cliclick` utility to handle synthetic input events. - **Path**: `scripts/cliclick_wrapper.sh` - **Logic**: Executes `/opt/homebrew/bin/cliclick` with passed arguments. - **Capabilities**: Left/Right clicks, mouse movement, and keyboard emulation. ### 2. `vision_wrapper.sh` The visual perception engine for the skill. - **Path**: `scripts/vision_wrapper.sh` - **Logic**: Utilizes the native macOS `screencapture` utility in silent mode (`-x`). - **Output**: Generates a standard PNG at `/tmp/claw_view.png`. --- ## 🚀 Tool Specifications ### `see` Captures the current screen state for visual analysis. * **Returns**: A string confirming the filepath of the capture. * **Use Case**: Identifies UI elements, window positions, and application states. ### `click` Sends precise commands to the mouse and keyboard. * **Usage**: `click "c:x,y"` (Click) or `click "m:x,y"` (Move). * **Syntax**: Supports all `cliclick` standard notation including `w:` (wait) and `t:` (type). --- ## ⚙️ Requirements & Setup 1. **Binary Dependency**: ```bash brew install cliclick ```

path: scripts/vision_wrapper.sh
content: #!/bin/bash
screencapture -x /tmp/claw_view.png
echo "Screenshot captured at /tmp/claw_view.png"


path: scripts/cliclick_wrapper.sh
content: #!/bin/bash
/opt/homebrew/bin/cliclick "$@"


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: certainlogicai/certainlogic-smart-router (version 1.0.4)

--- name: CertainLogic Smart Router version: 1.0.4 description: "⚠️ DEPRECATED — Use smart-router-coding or smart-router-intents instead." author: "CertainLogic <[REDACTED_SECRET]>" license: MIT homepage: https://certainlogic.ai repository: https://github.com/CertainLogicAI/certainlogic-smart-router tags: ["deprecated", "model-routing"] --- # ⚠️ DEPRECATED This skill has been replaced by two focused skills: - **`smart-router-coding`** — Route coding queries to the right model. Fast for lint, deep for architecture. - **`smart-router-intents`** — Route any query by intent (code, analysis, creative, realtime, general). ```bash clawhub install smart-router-coding clawhub install smart-router-intents ``` **Why:** The original CertainLogic Smart Router tried to do everything. Two specialized routers serve users better. --- **Author:** CertainLogic — deterministic AI infrastructure. certainlogic.ai


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: terrycarter1985/tc-feishu-perm (version 1.0.0)

--- id: feishu-perm name: Feishu Perm description: Guidance-only playbook for planning and reviewing Feishu document and folder permission management. category: Business requires: [] examples: - "Help me design Feishu sharing permissions for our team docs." - "Use feishu-perm to review access levels before sharing." --- # Feishu Permission Management Use this guidance-only skill to design safe, least-privilege sharing for Feishu documents, folders, and collaborative workspaces. ## When to use - You need a permission model before sharing internal docs. - You want to audit existing collaborator access. - You need a repeatable access review checklist for teams. ## Core principles - Apply least privilege (`view` by default; elevate only when needed). - Prefer group/role-based sharing over many individual grants. - Time-box elevated access for external collaborators. - Require explicit owner approval for `full_access` grants. ## Permission planning workflow 1. Classify document sensitivity (public/internal/restricted). 2. Identify user groups (owners, editors, reviewers, viewers). 3. Assign minimum required permission per group. 4. Define expiration/review cadence for non-owner access. 5. Document audit trail: who got access, why, and when. ## Access review checklist - Is every collaborator still active and relevant? - Do any users have `full_access` without business justification? - Are external shares still required? - Are inherited folder permissions too broad? - Is there a scheduled review date? ## Output format When asked for help, provide: - A recommended permission matrix by role. - High-risk findings in current access design. - A short remediation plan (immediate fixes + periodic review cadence).


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)