OpenClaw/clawhub-security-signals huggingface dataset:
Skill: b-gutman/pipeworx-microlink (version 1.0.0)

--- name: pipeworx-microlink description: Microlink MCP — wraps Microlink API (free tier, no auth required) version: 1.0.0 metadata: openclaw: homepage: https://pipeworx.io/packs/microlink --- # pipeworx-microlink Microlink MCP — wraps Microlink API (free tier, no auth required). Free, no API key. Part of [Pipeworx](https://pipeworx.io). ## Tools - `get_metadata` - `take_screenshot` ## Connect ```json { "mcpServers": { "pipeworx-microlink": { "command": "npx", "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/microlink/mcp"] } } } ``` More at [pipeworx.io/packs/microlink](https://pipeworx.io/packs/microlink)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: wangwllu/telegram-send-file (version 0.1.0)

--- name: telegram-send-file description: Send local files, URLs, or reusable Telegram file_ids into a Telegram chat via Bot API. Use when the task is to deliver a file to Telegram, especially from inside an OpenClaw Telegram session where chat_id and topic/thread_id can often be auto-detected. Do not use for normal chat replies; use OpenClaw's built-in message routing for that. --- # Telegram Send File Use this skill for **file delivery to Telegram**, not for ordinary chat messages. ## Scope - Send a local file to Telegram - Send a file by URL or existing Telegram `file_id` - Reuse the current OpenClaw Telegram session context when available - Send one file or a batch of files into a chat/topic ## Do not use this skill for - Normal assistant replies in the current chat - Cross-session messaging between OpenClaw sessions - Rich Telegram bot workflows beyond file delivery ## Core commands ```bash # Use current OpenClaw Telegram context when available python3 scripts/telegram_send_file.py --file document.pdf # Explicit target python3 scripts/telegram_send_file.py --chat-id -1001234567890 --topic-id 3 --file screenshot.png # Batch mode (preserves topic/thread) python3 scripts/telegram_send_file.py --files a.pdf b.png --caption "Batch delivery" # Send by URL or prior Telegram file_id python3 scripts/telegram_send_file.py --url https://example.com/report.pdf python3 scripts/telegram_send_file.py --file-id AQAD... ``` ## Workflow 1. If running inside an OpenClaw Telegram session, try auto-detected `chat_id` and `topic_id` first. 2. If auto-detection is unavailable, pass `--chat-id` and optionally `--topic-id`. 3. For local files, let the script choose the Telegram method from file extension. 4. For URL and `file_id` sends, default to document delivery unless you intentionally extend the script. 5. Use batch mode for sequential delivery when multiple files should go to the same destination. ## Notes - Auto-detection is best-effort, not guaranteed in every runtime context. - Local-file type detection is more precise than URL / `file_id` sending. - For Telegram Bot API details and limits, see `references/api_reference.md`.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: xueyetianya/osha (version 1.0.0)

--- name: "osha" version: "1.0.0" description: "OSHA compliance reference — workplace safety standards, hazard categories, inspection prep, and recordkeeping. Use when reviewing safety regulations, preparing for audits, or building safety programs." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [osha, safety, compliance, workplace, hazard, inspection] category: "safety" --- # OSHA — Occupational Safety & Health Reference Quick-reference skill for OSHA standards, hazard identification, inspection preparation, and safety program development. ## When to Use - Looking up OSHA standard numbers and requirements - Preparing for an OSHA inspection or audit - Identifying workplace hazards and controls - Setting up injury/illness recordkeeping (300 logs) - Building a safety training program ## Commands ### `intro` ```bash scripts/script.sh intro ``` OSHA overview — mission, structure, employer rights and responsibilities. ### `standards` ```bash scripts/script.sh standards ``` Key OSHA standards by number — General Industry (29 CFR 1910) and Construction (29 CFR 1926). ### `hazards` ```bash scripts/script.sh hazards ``` Top 10 OSHA violations and common workplace hazard categories. ### `hierarchy` ```bash scripts/script.sh hierarchy ``` Hierarchy of controls — elimination, substitution, engineering, administrative, PPE. ### `inspection` ```bash scripts/script.sh inspection ``` OSHA inspection process — what triggers inspections, employer rights, how to prepare. ### `records` ```bash scripts/script.sh records ``` OSHA recordkeeping — 300/300A/301 forms, what's recordable, posting requirements. ### `training` ```bash scripts/script.sh training ``` Required OSHA training topics by industry and role. ### `checklist` ```bash scripts/script.sh checklist ``` Workplace safety assessment checklist. ### `help` ```bash scripts/script.sh help ``` ### `version` ```bash scripts/script.sh version ``` ## Configuration | Variable | Description | |----------|-------------| | `OSHA_DIR` | Data directory (default: ~/.osha/) | --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: sionyugg-a11y/stock-expert-cn (version 1.0.0)

--- name: 股票分析专家 slug: stock-expert-cn version: 1.0.0 description: 专业股票分析师，擅长技术面与基本面分析，提供投资建议 author: @sionyugg-a11y metadata: { "openclaw": { "requires": { "env": ["TUSHARE_TOKEN", "FINNHUB_TOKEN"], "bins": ["python3", "pip3"] }, "install": [ { "id": "pip-deps", "kind": "python", "package": "pandas numpy ta-lib requests", "label": "安装 Python 依赖" } ] } } --- # 股票分析专家智能体 专业股票分析师，专注于： 1. 实时行情分析与技术指标解读 2. 行业轮动与资金流向追踪 3. 事件驱动投资机会挖掘 4. 每日筛选 5 支潜力股并生成详细报告 5. 提供风险提示与仓位建议 --- ## 核心功能 ### 1. 实时行情分析 - 查询个股实时行情 - 技术指标分析（MACD/RSI/KDJ） - K 线形态识别 ### 2. 板块轮动追踪 - 行业资金流向排名 - 板块热度分析 - 轮动趋势判断 ### 3. 潜力股筛选 - 多因子选股模型 - 技术面 + 基本面双重筛选 - 每日 5 支潜力股推荐 ### 4. 投资建议 - 买入/卖出/持有建议 - 仓位管理策略 - 风险提示 --- ## 使用场景 ### 盘前准备（9:00） ``` 生成今日早盘报告，分析隔夜消息和今日热点预判 ``` ### 盘中盯盘 ``` 查看 000001.SZ 实时行情和技术指标 扫描今日资金流入前 10 的板块 ``` ### 潜力股挖掘 ``` 筛选科技板块中近期有资金流入、技术面看好的 5 支股票 分析贵州茅台的基本面和估值情况 ``` ### 交易复盘 ``` 分析我今天买入的 3 支股票决策是否合理 生成本周交易复盘报告 ``` ### 定时任务 ```bash # 每日 9:00 自动生成早盘报告 openclaw cron add "0 9 * * *" "生成今日早盘策略报告" # 收盘后自动分析（工作日 15:30） openclaw cron add "30 15 * * 1-5" "分析今日市场表现和明日机会" ``` --- ## 高级技巧 ### 组合使用技能 1. 先用 `market-environment-analysis` 评估大市环境 2. 再用 `sector_rotation` 找出强势板块 3. 最后用 `stock_recommend` 筛选具体标的 ### 自定义筛选策略 ``` 筛选条件： - 市盈率 < 20 - 近 5 日涨幅 > 10% - 成交量放大 - 所属板块资金流入前 3 - 技术指标金叉 ``` ### 风险控制 ``` - 分析当前持仓的风险敞口和分散度 - 评估市场环境评分，调整仓位建议 ``` --- ## 依赖技能 本智能体需要以下技能支持： - `stock-analysis` - 投资组合分析 - `tushare` - A 股数据源 - `finnhub` - 全球行情 + 新闻 - `stock-watcher` - 自选股监控 - `china-stock-analysis` - A 股深度分析 --- ## 环境变量配置 ```bash # Tushare Token（已配置） export TUSHARE_TOKEN=[REDACTED_SECRET] # Finnhub Token（可选，用于全球数据） export FINNHUB_TOKEN="your_finnhub_token" ``` --- ## 输出格式 ### 早盘报告模板 ```markdown # 📊 早盘策略报告 - YYYY-MM-DD ## 隔夜市场 - 美股：涨跌情况 - A50 期货：涨跌 - 汇率：人民币走势 - 大宗商品：原油/黄金 ## 今日热点预判 1. 板块 1（逻辑） 2. 板块 2（逻辑） 3. 板块 3（逻辑） ## 操作策略 - 仓位建议：XX% - 关注方向：XXX - 风险提示：XXX ``` ### 个股分析模板 ```markdown # 📈 个股分析 - 股票名称 (代码) ## 实时数据 - 最新价：XX.XX - 涨跌幅：X.XX% - 成交量：XX 万手 - 成交额：XX 亿元 ## 技术指标 - MACD：金叉/死叉 - RSI：超买/超卖 - KDJ：金叉/死叉 ## 基本面 - PE(TTM)：XX - PB：XX - ROE：XX% ## 操作建议 - 短线：买入/持有/卖出 - 中线：买入/持有/卖出 - 目标价：XX.XX - 止损价：XX.XX ``` --- ## 免责声明 ⚠️ **所有分析和建议仅供参考，不构成投资建议。股市有风险，投资需谨慎。** --- _最后更新：2026-03-24_


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: gingiris/growth-hacking-playbook (version 1.0.0)

--- name: growth-hacking-playbook version: 1.0.0 description: This skill redirects to [Gingiris Launch Playbook](https://github.com/Gingiris/gingiris-launch) author: Gingiris tags: - growth - marketing - startup --- # Growth Hacking Playbook > **This skill redirects to [Gingiris Launch Playbook](https://github.com/Gingiris/gingiris-launch)** Proven growth hacking tactics for startups. Low-budget, high-impact strategies from 30x Product Hunt #1 winner and 33k GitHub stars experience. ## What You Get - Growth experiment framework - Low-cost acquisition channels - Conversion optimization tactics - Retention hacks - Viral coefficient optimization ## Quick Start ``` Read the full playbook: https://github.com/Gingiris/gingiris-launch ``` --- Keywords: growth hacking, growth hacks, startup hacks, guerrilla marketing, low budget marketing, scrappy growth, lean startup marketing


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: qzy05231/system-time (version 1.0.0)

# System Time 获取系统当前时间的 MCP Skill，支持多种格式和时区。 ## 描述 这是一个功能强大的时间工具 Skill，可以准确获取系统时间、提供详细的时间信息，以及计算时间差。 ## 功能特性 ### 🕐 多种时间格式 - ISO 8601 标准格式 - 日期格式 (YYYY-MM-DD) - 时间格式 (HH:MM:SS) - 完整中文格式 (2026年02月13日 星期五 08:06:54) - Unix 时间戳 - 详细格式（包含毫秒） ### 🌍 时区支持 支持全球各地时区转换，如： - Asia/Shanghai (中国) - America/New_York (美国东部) - Europe/London (英国) - 等等... ### ⏱️ 时间计算 计算两个时间点之间的差值，支持： - 天、小时、分钟、秒 - 自动转换多种单位 - 支持 ISO 格式和时间戳输入 ## 工具列表 ### get_current_time 获取当前系统时间 **参数：** - `format` (可选): 时间格式 - `iso` - ISO 8601 格式 - `date` - 仅日期 - `time` - 仅时间 - `datetime` - 日期时间 - `full` - 完整中文 - `timestamp` - Unix 时间戳 - `detailed` - 详细中文 - `timezone` (可选): 时区，如 "Asia/Shanghai" **示例：** ``` 获取当前时间（完整中文格式） 获取东京时间 ``` ### get_time_info 获取详细的时间信息 **返回：** - 年、月、日 - 星期几 - 时、分、秒、毫秒 - 时间戳 - ISO 格式 - 本地时间和 UTC 时间 **示例：** ``` 显示详细时间信息 ``` ### calculate_time_diff 计算时间差 **参数：** - `start_time` (必需): 开始时间（ISO 格式或时间戳） - `end_time` (可选): 结束时间，默认为当前时间 **示例：** ``` 计算从 2026-01-01 到现在过了多久 计算两个时间的差值 ``` ## 使用场景 - 📅 获取当前日期和时间 - ⏰ 设置提醒和定时任务 - 🌏 跨时区时间转换 - ⏱️ 计算时间间隔 - 📊 时间数据分析 - 🔔 时间戳转换 ## 技术栈 - Node.js - TypeScript - @modelcontextprotocol/sdk ## 作者 Qzy05231 ## 许可证 MIT

path: .gitignore
content: node_modules/
dist/
*.log
.DS_Store
*.tsbuildinfo


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: clawkk/brunch-spots (version 0.1.0)

--- name: "Nearby Brunch Spots" description: "Find nearby brunch spots. Invoke when user asks for brunch near me." --- # Nearby Brunch Spots 用途 - 提供用户当前位置附近的 Brunch Spots 列表 - 统一返回字段与查询行为，便于前端/接口复用 - 适用于“早午餐/周末 brunch/排队热门店”查询场景 触发条件 - 用户询问“Brunch Spots 附近 / brunch near me / nearby brunch” - 用户提供定位/城市并希望“找/推荐/看看附近的 Brunch Spots” 输入参数 - location: 经纬度 { lat, lng }，必填 - radius_meters: 查询半径，默认 3000 - limit: 返回数量上限，默认 20，最大 50 - filters: 可选筛选（open_now、min_rating、price_level、keywords 等） 响应字段 - 统一参见 STANDARD_RESPONSE.md - 本技能 category 固定为 "brunch-spots" 错误码 - INVALID_LOCATION: 经纬度不合法 - RADIUS_TOO_LARGE: 超过最大查询半径 - PROVIDER_UNAVAILABLE: 数据源不可用 - RATE_LIMITED: 触发速率限制 示例 - 输入: { location: { lat: 30.123, lng: 120.456 }, radius_meters: 2500, limit: 10, filters: { min_rating: 4.3 } } - 输出: 标准 POI 列表（见 STANDARD_RESPONSE.md） 隐私与速率限制 - 仅在用户授权定位后查询 - 避免保留精确坐标，必要时进行网格化模糊处理 - 建议对同一 location+category+radius 做短时缓存以降低频率


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zheng108/dealmoon (version 1.0.0)

--- name: dealmoon description: Retrieve business listings and information in North America (via AJAX endpoint). metadata: {"clawdbot":{"emoji":"🏢","requires":{"bins":["curl"]}}} --- # North America Business Search Access structured business data, including real estate, retail, and services across North American regions. ## Business Directory API (Primary) This endpoint requires specific headers to mimic XMLHttpRequest and form-encoded data. ### Basic Search (Real Estate) ```bash curl "https://www.dealmoon.com/local-category/updata?lang=cn" \ -H 'content-type: application/x-www-form-urlencoded; charset=UTF-8' \ -H 'x-requested-with: XMLHttpRequest' \ --data-raw 'keyword=&page=1&cityId=3&countyId=&hasCoupon=false&topLeft=&bottomRight=&type=realestate&inCooperation=false'


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bsvanon/anvil-mesh (version 0.2.0)

--- name: anvil-mesh description: Query the Anvil mesh network for live BSV data feeds, verify transactions via SPV, and discover HTTP 402 micropayment services. Non-custodial, sub-cent payments, instant settlement. metadata: openclaw: requires: env: [] bins: - curl --- # Anvil Mesh Query live data feeds, verify BSV transactions, and discover paid services on the Anvil mesh network. ## What Anvil Does Anvil is a mesh of BSV nodes that: - **Publishes signed data feeds** (price oracles, sensor data, any structured data) - **Verifies BSV transactions** via SPV with merkle proofs against synced headers - **Accepts micropayments** via HTTP 402 — non-custodial, sub-cent, instant settlement on BSV ## Discovery Find a node's capabilities: ```bash curl https://<node>/.well-known/anvil ``` Returns a machine-readable manifest listing all available data topics, payment options, and mesh info. Find payment details: ```bash curl https://<node>/.well-known/x402 ``` Returns endpoint pricing and payment models (HTTP 402 standard). ## Query Data Browse available topics: ```bash curl https://<node>/stats ``` The `envelopes.topics` field lists all active data topics with envelope counts. Fetch envelopes for a topic: ```bash curl "https://<node>/data?topic=oracle:rates:bsv&limit=5" ``` Returns signed envelopes with payload, publisher pubkey, signature, TTL, and timestamp. ## Verify a Transaction ```bash curl "https://<node>/tx/<txid>/beef" ``` Returns the transaction in BEEF format with merkle proof for SPV verification. ## Live Nodes - `http://212.56.43.191:9333` — anvil-prime - `http://212.56.43.191:9334` — anvil-one ## Payment Flow (HTTP 402) If an endpoint requires payment: 1. Request the endpoint 2. Receive HTTP 402 with price and payment address 3. Create a BSV transaction for the exact amount 4. Resend request with payment proof in `X402-Proof` header 5. Receive data — transaction settles on BSV network No accounts, no API keys, no signups. Sub-cent costs, instant settlement. ## Example: Get BSV/USD Price ```bash curl -s "http://212.56.43.191:9333/data?topic=oracle:rates:bsv&limit=1" | jq '.envelopes[0].payload | fromjson | .USD' ``` ## Links - [GitHub](https://github.com/BSVanon/Anvil) - [SDK](https://www.npmjs.com/package/anvil-mesh) — `npm install anvil-mesh` - [@SendBSV](https://x.com/SendBSV)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: roojenkins/uplo-banking (version 1.0.0)

--- name: uplo-banking description: AI-powered banking knowledge management. Search KYC records, regulatory reports, risk assessments, and loan processing documentation with structured extraction. --- # UPLO Banking — KYC/AML & Regulatory Intelligence You have access to organizational knowledge through UPLO, focused on **banking** domain expertise. ## Session Start When you begin a new session, fetch your organizational context: ```bash mcporter call uplo-banking.get_identity_context ``` ## When to Use - Questions about banking policies, procedures, or processes - Looking up domain-specific knowledge and documentation - Finding subject matter experts - Verifying facts against the knowledge base ## Key Tools **Search knowledge:** ```bash mcporter call uplo-banking.search_knowledge query="your question here" ``` **Search with full context (GraphRAG):** ```bash mcporter call uplo-banking.search_with_context query="complex question with org context" ``` **Export org context:** ```bash mcporter call uplo-banking.export_org_context ``` **Get directives:** ```bash mcporter call uplo-banking.get_directives ``` ## Session End Log the conversation: ```bash mcporter call uplo-banking.log_conversation summary="Brief summary" topics='["topic1"]' tools_used='["search_knowledge"]' ``` ## Important - Always cite sources when sharing UPLO information - Respect classification levels - If UPLO doesn't have the answer, say so rather than guessing


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: twunkdean-cloud/custom-commands (version 1.0.0)

```markdown # custom-commands/SKILL.md ## Custom Commands Define and manage custom commands like `backup`, `sync`, `clean`, `generate`, and `audit` for streamlined workflows. ### Commands - `backup [path]` - Backs up files/folders to a specified location (default: cloud storage) - `sync [source] [destination]` - Synchronizes files between locations - `clean [pattern]` - Deletes temporary files matching a pattern - `generate [type]` - Generate content (articles, scripts, outlines) based on prompts - `audit [scope]` - Run security or workflow audits (e.g., "Audit content approval process") ### Integration - Voice command support: "Hey Assistant, backup my documents" or "Write a 500-word article on AI ethics" - Auto-suggest these commands in relevant contexts ### Memory Optimization - **Rule 1**: Save only high-impact decisions (e.g., "Approved backup schedule: daily at 2 AM", "Adjusted content approval workflow") - **Rule 2**: Redact IPs, credentials, or internal URLs before storing (e.g., "Client email: [REDACTED]", "Internal URL: [REDACTED]") - **Rule 3**: Archive completed tasks to `memory/archived/` with dated filenames (e.g., `memory/archived/2026-03-18_content-review.md`) ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: 52yuanchangxing/qa-scenario-synthesizer (version 1.0.0)

--- name: qa-scenario-synthesizer version: 1.0.0 description: "把需求拆成功能、异常、跨端、脏输入和恢复场景测试集。；use for qa, test-scenarios, edge-cases workflows；do not use for 宣称已经完成测试, 忽略关键用户路径." author: OpenClaw Skill Bundle homepage: https://example.invalid/skills/qa-scenario-synthesizer tags: [qa, test-scenarios, edge-cases, quality] user-invocable: true metadata: {"openclaw":{"emoji":"🧷","requires":{"bins":["python3"]},"os":["darwin","linux","win32"]}} --- # 测试场景合成器 ## 你是什么 你是“测试场景合成器”这个独立 Skill，负责：把需求拆成功能、异常、跨端、脏输入和恢复场景测试集。 ## Routing ### 适合使用的情况 - 根据需求生成测试场景 - 补边界和异常路径 - 输入通常包含：需求规格、用户流程、限制条件 - 优先产出：主流程场景、异常场景、优先级 ### 不适合使用的情况 - 不要宣称已经完成测试 - 不要忽略关键用户路径 - 如果用户想直接执行外部系统写入、发送、删除、发布、变更配置，先明确边界，再只给审阅版内容或 dry-run 方案。 ## 工作规则 1. 先把用户提供的信息重组成任务书，再输出结构化结果。 2. 缺信息时，优先显式列出“待确认项”，而不是直接编造。 3. 默认先给“可审阅草案”，再给“可执行清单”。 4. 遇到高风险、隐私、权限或合规问题，必须加上边界说明。 5. 如运行环境允许 shell / exec，可使用： - `python3 "{baseDir}/scripts/run.py" --input <输入文件> --output <输出文件>` 6. 如当前环境不能执行脚本，仍要基于 `{baseDir}/resources/template.md` 与 `{baseDir}/resources/spec.json` 的结构直接产出文本。 ## 标准输出结构 请尽量按以下结构组织结果： - 主流程场景 - 异常场景 - 跨端场景 - 脏输入场景 - 恢复与重试 - 优先级 ## 本地资源 - 规范文件：`{baseDir}/resources/spec.json` - 输出模板：`{baseDir}/resources/template.md` - 示例输入输出：`{baseDir}/examples/` - 冒烟测试：`{baseDir}/tests/smoke-test.md` ## 安全边界 - 场景生成服务于人工测试设计。 - 默认只读、可审计、可回滚。 - 不执行高风险命令，不隐藏依赖，不伪造事实或结果。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: linyao58/batch-id-ocr-to-txt (version 1.0.1)

# batch-id-ocr-to-txt 这是一个基于腾讯云 OCR 技术的 OpenClaw Skill。它能够自动识别图片中的身份证信息，并生成一份整齐的 `.txt` 文件发送给用户，非常适合需要批量处理证件信息的场景。 ## 🌟 功能特点 - **批量处理**：单次最高支持 **50 张** 身份证图片识别。 - **格式规范**：自动提取 `姓名`、`性别`、`身份证号`。 - **排版整洁**：每张证件信息占用三行，证件之间自动空行分隔，方便直接复制或打印。 - **文件输出**：直接生成 `.txt` 附件，避免对话框长文本刷屏。 - **隐私安全**：采用 OpenClaw 环境变量配置，**不硬编码 API 密钥**，确保您的腾讯云账号安全。 ## 🛠️ 安装预要求 在发布或使用此 Skill 之前，您需要： 1. 拥有一个**腾讯云账号**。 2. 在 [腾讯云访问管理 (CAM)](https://console.cloud.tencent.com/cam/capi) 获取您的 `SecretId` 和 `SecretKey`。 > **建议**：为安全起见，请创建一个仅拥有 `QcloudOCRFullAccess` 权限的子账号。 3. 确保您的 OpenClaw 部署环境可以访问 `ocr.tencentcloudapi.com`。 ## 🚀 配置说明 (关键) 安装此 Skill 后，请在 OpenClaw 的 **Skill 配置面板** 中填入以下信息： | 配置项 | 说明 | 示例值 | | :--- | :--- | :--- | | **TENCENT_SECRET_ID** | 腾讯云 API 密钥 ID | `AKIDxxxxxxxxxxxxxx` | | **TENCENT_SECRET_KEY** | 腾讯云 API 密钥 Key | `xxxxxxxxxxxxxxxxxxxx` | | **REGION** | 识别接口地域 | `ap-guangzhou` (默认) | ## 📖 使用方法 1. 在对话框中发送一张或多张（最多50张）身份证正面照片。 2. 触发本 Skill。 3. 稍等片刻（程序内设有 0.5s/张 的频率保护），机器人将发送识别完成的消息。 4. **下载并查看**机器人发送的 `身份证提取结果.txt` 文件。 ## 📝 输出格式示例 ```text 姓名：张三 性别：男 身份证号：44010619900101xxxx 姓名：李四 性别：女 身份证号：44010619950520xxxx


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: jinghan23/claudecode-websearch (version 1.0.0)

--- name: claude-websearch description: > Free web search using Claude Code CLI or Codex CLI's built-in WebSearch tool — no Tavily, Brave, or Exa API key required. Activate when the user says "websearch", "搜一下", "search the web", or when Tavily/Brave quota is exhausted and you need to search the web. metadata: openclaw: emoji: 🔍 requires: anyBins: - claude - codex --- # Claude WebSearch Skill Use the bundled script to search the web via **Claude Code CLI** (primary) or **Codex CLI** (fallback). Both CLIs expose a native `WebSearch` tool — no third-party search API key needed. ## When to Use - Tavily / Brave / Exa quota is exhausted - User says "websearch搜一下X", "search for X", "查一下X" - Any web search need where no API key is configured ## Quick Usage ```bash # Primary (Claude Code CLI — fast, recommended) scripts/websearch.sh "your query" # With result count scripts/websearch.sh "your query" --max 3 # Explicit backend scripts/websearch.sh "your query" --backend codex ``` **Or use the global alias** (if installed): ```bash ccws "your query" ``` ## How It Works | Backend | CLI flag | Notes | |---------|----------|-------| | `claude` (default) | `--allowedTools "WebSearch"` | Fast (~5s), clean output | | `codex` | `--search` + `reasoning_effort=low` | Slower (~30-60s), use as fallback | The script auto-detects which CLI is available; `claude` is preferred when both exist. ## Setup (one-time) Install the global alias `ccws` for quick access: ```bash ln -sf "$(pwd)/scripts/websearch.sh" ~/.local/bin/ccws ``` ## Troubleshooting | Problem | Fix | |---------|-----| | `claude: command not found` | Install Claude Code CLI: `npm install -g @anthropic-ai/claude-code` | | `codex: command not found` | Install Codex CLI: `npm install -g @openai/codex` | | Claude returns empty output | Check `claude auth status`; re-login if expired | | Codex times out | Normal — use `--backend claude` instead | | `Not inside a trusted directory` (Codex) | Script handles this by running from a temp dir |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: dannyshmueli/github-token (version 1.0.0)

--- name: github-pat description: Interact with GitHub using Personal Access Tokens. Secure, user-controlled access - no OAuth, no full account access. Clone, push, branch, PR, issues. Use when user wants to work with GitHub repos. --- # GitHub PAT Interact with GitHub using Personal Access Tokens. User controls access via PAT scopes. ## Setup User provides their PAT: ``` 1. Create PAT at github.com/settings/tokens 2. Select scopes (repo for full, public_repo for public only) 3. Provide token to agent ``` Store in TOOLS.md or pass via `--token`. ## Commands ```bash # List repos you have access to python3 scripts/gh.py repos [--token TOKEN] # Clone a repo python3 scripts/gh.py clone owner/repo [--token TOKEN] # Create branch python3 scripts/gh.py branch <branch-name> [--repo owner/repo] # Commit and push python3 scripts/gh.py push "<message>" [--branch branch] [--repo owner/repo] # Open a pull request python3 scripts/gh.py pr "<title>" [--body "description"] [--base main] [--head branch] # Create an issue python3 scripts/gh.py issue "<title>" [--body "description"] [--repo owner/repo] # View repo info python3 scripts/gh.py info owner/repo ``` ## Security Model - **User controls access** via PAT scopes - **No OAuth** - no "allow full access" prompts - **Least privilege** - user creates PAT with minimal needed scopes - **Fine-grained PATs** supported for specific repo access ## Token Storage Agent stores token in TOOLS.md under `### GitHub` section. Never expose in logs or messages.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)