OpenClaw/clawhub-security-signals huggingface dataset:
Skill: bytesagain1/video-fetcher (version 2.0.1)

--- name: "video-fetcher" version: "2.0.1" description: "Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Video Fetcher concepts, best practices, and implementation patterns." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [video,fetcher, reference] category: "devtools" --- # Video Fetcher Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Video Fetcher concepts, best practices, and implementation patterns. No API keys or credentials required. ## Commands | Command | Description | |---------|-------------| | `intro` | intro reference | | `quickstart` | quickstart reference | | `patterns` | patterns reference | | `debugging` | debugging reference | | `performance` | performance reference | | `security` | security reference | | `migration` | migration reference | | `cheatsheet` | cheatsheet reference | ## Output Format All commands output plain-text reference documentation via heredoc. No external API calls, no credentials needed, no network access. --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector:  ()
Skill: swiftking100/snyk-skill-scanner (version 1.0.0)

--- name: skill-scanner description: "Scan installed agent components (MCP servers, skills, agent tools) for security vulnerabilities using snyk-agent-scan. Use only when running uvx snyk-agent-scan commands to scan skills for risks like prompt injection, malware, or credential leaks. This skill intentionally executes external code (snyk-agent-scan via uvx) for security auditing purposes." --- # Skill Scanner Use **snyk/agent-scan** to detect security risks in agent components. ## Quick Scan ```bash # Scan all skills on the machine uvx snyk-agent-scan@latest --skills # Scan MCP servers (default behavior) uvx snyk-agent-scan@latest # Scan with verbose output uvx snyk-agent-scan@latest --skills --verbose # Output JSON for automation uvx snyk-agent-scan@latest --skills --json ``` ## What It Detects ### For Skills - **Prompt Injection (E004)** - Malicious instructions hidden in prompts - **Malware Payloads (E006)** - Harmful code disguised as content - **Untrusted Content (W011)** - Potentially unsafe external data - **Credential Handling (W007)** - Improper secrets management - **Hardcoded Secrets (W008)** - API keys or passwords in code ### For MCP Servers - **Prompt Injection (E001)** - **Tool Poisoning (E003)** - **Tool Shadowing (E002)** - **Toxic Flows (TF001)** - **Rug Pull (W005)** - Malicious skill replacement ## Workflow 1. **Before installing a new skill** → Run a scan first 2. **After scanning** → Review any E001/E003/E004/E006 issues (high severity) 3. **Low severity warnings (W005-W008)** → Decide based on your risk tolerance ## Interpreting Results | Prefix | Severity | Action | |--------|----------|--------| | **E** | High | Fix or avoid the skill | | **W** | Medium/Low | Review and decide | | **TF** | High | Toxic flow detected | ## Common Issues If `uvx` is not found, install uv first: ```bash # macOS brew install uv # Linux curl -LsSf https://astral.sh/uv/install.sh | sh ``` ## OpenClaw Skills Location OpenClaw skills are typically stored at: - **Global**: `~/.openclaw/skills/` - **Workspace**: `<project>/skills/` To scan a custom path, pass it directly: ```bash uvx snyk-agent-scan@latest ~/.openclaw/skills/ ``` ## Output Example The scan will show: - File path of the issue - Risk type and description - Severity level (E/W/TF) - Recommended fix Review the full report at: https://github.com/snyk/agent-scan/blob/main/docs/issue-codes.md


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: b-gutman/pipeworx-marine (version 1.0.0)

--- name: pipeworx-marine description: Marine MCP — wraps marine-api.open-meteo.com (free, no auth) version: 1.0.0 metadata: openclaw: homepage: https://pipeworx.io/packs/marine --- # pipeworx-marine Marine MCP — wraps marine-api.open-meteo.com (free, no auth). Free, no API key. Part of [Pipeworx](https://pipeworx.io). ## Tools - `get_wave_forecast` - `get_current_waves` ## Connect ```json { "mcpServers": { "pipeworx-marine": { "command": "npx", "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/marine/mcp"] } } } ``` More at [pipeworx.io/packs/marine](https://pipeworx.io/packs/marine)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: freeeye/guangzhou-daily-news (version 1.0.0)

--- name: guangzhou-daily-news version: 1.0.0 description: 获取广州日报新花城网站发布的最新新闻（20-30条），包含标题、摘要、原文链接、编辑、记者等详细信息，生成美观 Markdown 格式并支持微信推送。使用场景：(1) 用户说"获取广州日报新闻"、"看看新花城有什么新闻"；(2) 每天早上9点、晚上6点自动获取并推送；(3) 需要广州本地新闻资讯时。 --- # 广州日报新闻获取 ## 功能概述 获取广州日报新花城（gz-cmc.com）发布的最新新闻，支持： - 🔄 自动获取 20-30 条最新新闻 - 📝 提取：标题、摘要、原文链接、编辑、记者 - 📄 保存为美观 Markdown 文件 - 💬 支持微信推送 - ⏰ 支持定时自动获取（每天9点、18点） ## 使用方式 ### 手动获取新闻 直接告诉 AI： - "获取广州日报新闻" - "看看新花城有什么新闻" - "获取广州最新新闻" ### 定时自动获取 已配置每天两个时间段自动获取并推送： - **早间** ⏰ 09:00 - 获取最新新闻 - **晚间** ⏰ 18:00 - 获取全天新闻 ## 输出格式 ### Markdown 保存 新闻保存到 `~/News/广州日报_YYYY-MM-DD.md` **示例格式：** ```markdown # 📰 广州日报新闻简报 📅 2026-03-23 · 来源：新花城 · 共 20 条 --- > ## 1. 国家对成品油价采取临时调控措施 > > 🔴 要闻 · ⏰ 2026-03-23 15:03 > > 3月9日以来受美以伊冲突加剧影响，国际油价大幅上涨。为减缓冲击，对国内成品油价采取临时调控措施... > > ✍️ 记者：**张三** · 📝 编辑：**李四** · 🔗 [阅读原文](https://...) ``` ### 微信推送 简洁卡片式消息，包含： - 📰 新闻标题（前10条） - 📌 分类标签 - 🔗 原文链接 **示例：** ``` 📰 广州日报 03月23日 (20条) 1. 国家对成品油价采取临时调控措施 2. 全球第六！独角兽扎堆！广州这份科创成绩单太燃了 3. 念念不忘，92岁的他在街头卖书二十多年 ... ``` ## 技术细节 ### 新闻来源 - **主站**：https://gz-cmc.com - **移动端**：https://huacheng.gz-cmc.com ### 数据提取 - **标题**：从新闻列表页提取 - **摘要**：从文章详情页自动截取前200字 - **分类**：自动识别（要闻、科技、文化、国际等） - **编辑/记者**：从文章末尾提取，支持多种格式识别 - **发布时间**：从文章页面提取 ### 依赖 - Python 3.8+ - requests - BeautifulSoup4 **安装：** ```bash pip3 install requests beautifulsoup4 ``` ## 脚本使用 ```bash python3 ~/.qclaw/skills/guangzhou-daily-news/scripts/fetch_news.py ``` ## 定时任务 已自动配置两个 cron 任务： | 任务 | 时间 | 频率 | |------|------|------| | 早间新闻 | 09:00 | 每天 | | 晚间新闻 | 18:00 | 每天 | ## 常见问题 **Q: 为什么有些新闻没有记者信息？** A: 部分新闻（如转载、通讯稿）可能没有记者署名，此时显示"—"。 **Q: 如何修改推送时间？** A: 可通过 OpenClaw cron 管理界面修改定时任务的时间表达式。 **Q: 新闻保存在哪里？** A: 默认保存到 `~/News/广州日报_YYYY-MM-DD.md`，可自定义。 ## 更新日志 - **v2.1** (2026-03-23) - ✅ 优化记者/编辑提取算法，支持多种格式 - ✅ 改进 Markdown 排版，添加 emoji 分类标签 - ✅ 配置每天9点、18点自动推送 - ✅ 移除阅读量/点赞/评论数据 - **v2.0** (2026-03-23) - ✅ 完整重写，支持详情页提取 - ✅ 美观卡片式输出格式 - **v1.0** (2026-03-23) - ✅ 初始版本


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: tujinsama/process-data-monitor-claw (version 1.0.0)

--- name: process-data-monitor-claw description: | 过程数据监控虾 — 实时监控业务运行中的全链路数据状态，像雷达一样扫描业务流程每个节点，第一时间发现异常并告警。 **当以下情况时使用此 Skill**： (1) 需要监控业务流程节点状态（订单履约、库存同步、支付链路、数据管道等） (2) 需要设置数据异常阈值告警（数值超限、状态卡顿、趋势恶化） (3) 需要配置多渠道告警推送（飞书群/私信、邮件、短信） (4) 需要生成监控报告（日报/周报，异常汇总、响应时效） (5) 用户提到"监控"、"实时监控"、"链路追踪"、"异常检测"、"告警"、"预警"、"数据状态"、"流程监控"、"业务监控"、"全链路"、"节点状态" **典型触发示例**： - "帮我监控订单履约流程，超过24小时未发货就告警" - "实时监控库存同步状态，发现差异立即通知" - "监控支付成功率，低于95%立即预警" - "设置数据管道监控，ETL任务失败立即告警" --- # 过程数据监控虾 业务流程的"哨兵"，负责发现问题并及时预警。 ## 工作流程 **Step 1 — 定义监控对象**：明确监控的流程节点、数据指标、业务对象（订单状态、库存数量、支付成功率、任务执行状态等）。 **Step 2 — 设置监控规则**：为每个监控对象配置正常范围、异常阈值、检查频率、告警级别。参考 `references/alert-rules.md` 中的规则模板。 **Step 3 — 数据采集方式**：根据数据源类型选择采集方式，参考 `references/data-sources.md`： - 数据库轮询（MySQL/PostgreSQL/MongoDB） - API 接口调用（REST/GraphQL） - 消息队列监听（Kafka/RabbitMQ） - 日志文件解析 **Step 4 — 异常检测**：将实时数据与规则对比，识别数值异常、状态异常、趋势异常、关联异常。 **Step 5 — 告警推送**：根据告警级别推送，使用 `scripts/alert-sender.sh`： - 紧急（urgent）：飞书群消息 + 私信 - 重要（warning）：飞书私信 - 一般（info）：飞书群消息 **Step 6 — 生成报告**：定期汇总异常事件、响应时效、改进建议。 ## 监控配置格式 用户提供自然语言需求时，将其转化为标准配置结构： ```yaml monitor_name: "监控任务名称" check_interval: 300 # 秒，默认5分钟 data_source: type: "mysql" # mysql/postgresql/api/log connection: "..." rules: - name: "规则名称" metric: "指标名或SQL查询" operator: "gt" # gt/lt/eq/ne/gte/lte threshold: 0 alert_level: "urgent" # urgent/warning/info message: "告警消息模板，支持 {value} {count} 等变量" cooldown: 300 # 告警降噪间隔（秒），默认5分钟 notify: feishu_webhook: "https://open.feishu.cn/open-apis/bot/v2/hook/..." feishu_users: [] # open_id 列表，用于私信 ``` ## 关键设计原则 - **告警降噪**：相同问题 `cooldown` 秒内只告警一次，避免告警风暴 - **可追溯性**：所有告警记录写入日志，支持回溯分析 - **自适应阈值**：建议根据历史数据定期调整阈值，减少误报 ## References - `references/metrics-library.md` — 常见业务场景预定义监控指标体系（电商/SaaS/营销） - `references/alert-rules.md` — 告警规则配置模板（阈值/趋势/关联/时间窗口） - `references/data-sources.md` — 各类数据源接入指南 ## Scripts - `scripts/monitor-daemon.sh` — 监控守护进程（start/stop/status/reload） - `scripts/alert-sender.sh` — 多渠道告警推送（飞书 Webhook）


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: lvjunjie-byte/ai-social-media-manager (version 1.0.0)

# AI-Social-Media-Manager Skill AI 驱动的社交媒体管理技能，自动化内容创作、发布和优化。 ## 功能 - 📅 **内容日历自动生成** - 基于行业趋势和受众分析生成月度内容计划 - ⏰ **最佳发布时间推荐** - 分析受众活跃度，推荐最优发布时段 - 💬 **自动回复和互动** - 智能回复评论、私信，提升互动率 - 📊 **表现分析和优化** - 追踪关键指标，提供优化建议 ## 支持平台 - Twitter/X - 小红书 - 微博 - LinkedIn - Instagram - 微信公众号 ## 安装 ```bash clawhub install ai-social-media-manager ``` ## 使用示例 ### 生成内容日历 ```bash ai-smm calendar generate --platform xiaohongshu --month 2026-03 --topic "科技产品评测" ``` ### 获取最佳发布时间 ```bash ai-smm schedule best-time --platform weibo --audience "18-35 岁科技爱好者" ``` ### 自动回复评论 ```bash ai-smm engage auto-reply --post-id "xxx" --tone "友好专业" ``` ### 分析表现 ```bash ai-smm analytics report --period "last_30_days" --platforms "xiaohongshu,weibo" ``` ## 配置 在 `TOOLS.md` 中添加社交媒体账号配置： ```markdown ### Social Media - xiaohongshu: {username: "xxx", cookie: "xxx"} - weibo: {username: "xxx", password: "xxx"} - twitter: {api_key: "xxx", api_secret: "xxx"} ``` ## 定价 $99/月 - 包含所有平台无限次使用 ## API 参考 详见 `src/README.md`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: ckchzh/colorpick (version 2.0.0)

--- name: ColorPick description: "Color picker and converter. Use when you need colorpick." version: "2.0.0" author: "BytesAgain" homepage: https://bytesagain.com source: https://github.com/bytesagain/ai-skills tags: ["color","hex","rgb","hsl","palette","design","css"] categories: ["Developer Tools", "Utility"] --- # ColorPick Color picker and converter. Convert between hex, RGB, HSL color formats, generate color palettes, find complementary colors, and preview colors in terminal. ## Quick Start Run `colorpick help` for available commands and usage examples. ## Features - Fast and lightweight — pure bash with embedded Python - No external dependencies required in `~/.colorpick/` - Works on Linux and macOS ## Usage ```bash colorpick help ``` --- 💬 Feedback: https://bytesagain.com/feedback Powered by BytesAgain | bytesagain.com - Run `colorpick help` for all commands - Run `colorpick help` for all commands ## Configuration Set `COLORPICK_DIR` to change data directory. Default: `~/.local/share/colorpick/`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: aipoch-ai/synthetic-bio-circuit-designer (version 1.0.0)

--- name: synthetic-bio-circuit-designer description: Design gene circuits for synthetic biology applications version: 1.0.0 category: Bioinfo tags: [] author: AIPOCH license: MIT status: Draft risk_level: Medium skill_type: Tool/Script owner: AIPOCH reviewer: '' last_updated: '2026-02-06' --- # Synthetic Bio Circuit Designer Design and simulate gene circuits for synthetic biology. ## Usage ```bash python scripts/main.py --type toggle --p1 P1 --p2 P2 python scripts/main.py --type oscillator ``` ## Circuit Types - Toggle switch: Bistable genetic switch - Oscillator: Repressilator circuit ## Output - Circuit design - Component list - Expected behavior ## Risk Assessment | Risk Indicator | Assessment | Level | |----------------|------------|-------| | Code Execution | Python/R scripts executed locally | Medium | | Network Access | No external API calls | Low | | File System Access | Read input files, write output files | Medium | | Instruction Tampering | Standard prompt guidelines | Low | | Data Exposure | Output files saved to workspace | Low | ## Security Checklist - [ ] No hardcoded credentials or API keys - [ ] No unauthorized file system access (../) - [ ] Output does not expose sensitive information - [ ] Prompt injection protections in place - [ ] Input file paths validated (no ../ traversal) - [ ] Output directory restricted to workspace - [ ] Script execution in sandboxed environment - [ ] Error messages sanitized (no stack traces exposed) - [ ] Dependencies audited ## Prerequisites No additional Python packages required. ## Evaluation Criteria ### Success Metrics - [ ] Successfully executes main functionality - [ ] Output meets quality standards - [ ] Handles edge cases gracefully - [ ] Performance is acceptable ### Test Cases 1. **Basic Functionality**: Standard input → Expected output 2. **Edge Case**: Invalid input → Graceful error handling 3. **Performance**: Large dataset → Acceptable processing time ## Lifecycle Status - **Current Stage**: Draft - **Next Review Date**: 2026-03-06 - **Known Issues**: None - **Planned Improvements**: - Performance optimization - Additional feature support


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: nansen-devops/nansen-token-transfer-analysis (version 0.1.0)

--- name: nansen-token-transfer-analysis description: "Where is this token moving and why? Large transfers, flow trends over time, and breakdown by wallet label." metadata: openclaw: requires: env: - NANSEN_API_KEY bins: - nansen primaryEnv: NANSEN_API_KEY install: - kind: node package: nansen-cli bins: [nansen] allowed-tools: Bash(nansen:*) --- # Token Forensics **Answers:** "Where is this token moving? Who is sending it and where?" ```bash [REDACTED_SECRET] CHAIN=ethereum # Examples: UNI on ethereum (0x1f9840a85d5aF5bf1D1762F925BDADdC4201F984) # BONK on solana (DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263) # Note: token flows does NOT support stablecoins (USDC, USDT, etc.) — use non-stablecoin tokens nansen research token transfers --token $TOKEN --chain $CHAIN --days 7 --limit 20 # → from_address_label, to_address_label, transfer_amount, transfer_value_usd nansen research token flows --token $TOKEN --chain $CHAIN --days 7 --limit 20 # → date, price_usd, holders_count, total_inflows_count, total_outflows_count # ⚠ Returns HTTP 422 for stablecoins — skip this command if TOKEN is a stablecoin nansen research token flow-intelligence --token $TOKEN --chain $CHAIN # → net_flow_usd per label: smart_trader, whale, exchange, fresh_wallets, public_figure ``` Rising exchange_net_flow + large transfers to exchange addresses = potential sell pressure. Fresh wallet inflows may signal new interest or wash trading.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jhillin8/newsletter-digest (version 1.0.0)

--- name: newsletter-digest description: Summarize newsletters and articles, extract key insights, create reading lists author: clawd-team version: 1.0.0 triggers: - "summarize newsletter" - "digest emails" - "article summary" - "reading list" - "what should I read" --- # Newsletter Digest Tame your inbox. Get AI summaries of newsletters and articles so you read what matters. ## What it does Processes forwarded newsletters and linked articles, extracts key insights, creates prioritized reading lists, and learns your interests over time. Never miss important content, never drown in noise. ## Usage **Summarize content:** ``` "Summarize this newsletter" [forward/paste] "Digest https://article-url.com" "What's important in my newsletters today?" ``` **Build reading lists:** ``` "Add to reading list: [url]" "What's on my reading list?" "Clear completed reads" ``` **Get insights:** ``` "Key takeaways from tech newsletters this week" "Trending topics across my subscriptions" "Compare viewpoints on [topic]" ``` **Manage preferences:** ``` "I'm interested in AI, fintech, productivity" "Skip newsletters about marketing" "Prioritize Stratechery" ``` ## Features - **Smart summaries**: Key points, not just shortened text - **Topic extraction**: Tags and categorizes automatically - **Cross-reference**: Finds related content across sources - **Save for later**: Queue articles for focused reading time ## Tips - Forward newsletters to Clawd for processing - Say "brief" for 2-sentence summaries, "detailed" for deep analysis - Ask "what did I miss this week?" for catch-up digest - Works with any text content—not just newsletters


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: gushenjie/git-monitor (version 1.1.1)

--- name: git-monitor description: 通用 Git 项目监控工具。支持 GitHub、GitLab、Gitee 等所有 Git 平台。可以添加、删除、检查任意 Git 仓库的更新，自动拉取代码并生成变更摘要。当用户询问"监控项目"、"检查更新"、"添加仓库"、"代码有什么变化"、"拉取最新代码"、"仓库更新通知"、"自动同步代码"、"追踪项目变更"时使用此技能。即使用户没有明确说"监控"，只要涉及跟踪代码仓库的变化、获取更新通知、或需要定期检查项目状态，都应该使用此技能。 trigger: - 监控项目 - 监控仓库 - 检查更新 - 添加仓库 - 删除监控 - 仓库列表 - GitHub - GitLab - Gitee - 代码变化 - 拉取代码 - 同步代码 --- # Git 项目监控技能 自动监控 Git 项目更新（支持 GitHub、GitLab、Gitee 等所有 Git 平台），拉取最新代码并生成变更摘要。 ## 🚀 快速开始（只需3步） ### 第1步：安装技能 ```bash clawhub install git-monitor ``` ### 第2步：告诉我你要监控什么 直接在对话中说： > "监控 GitHub 项目 anthropics/skills" > "监控 https://gitee.com/mindspore/mindspore" ### 第3步：开启自动推送（可选） 说："设置定时检查，每6小时一次" 然后就完事了！有代码更新会自动推送到你的飞书/当前聊天窗口。 --- ## 📖 完整使用指南 ### 添加监控仓库 ``` 监控 GitHub 项目 anthropics/skills 监控 https://github.com/openai/openai-python 监控 GitLab 项目 gitlab-org/gitlab 监控 Gitee 项目 openharmony/docs ``` ### 查看监控列表 ``` 查看监控列表 列出所有监控的仓库 ``` ### 手动检查更新 ``` 检查所有更新 检查 anthropics/skills 的更新 ``` ### 删除监控 ``` 删除监控 anthropics/skills ``` ### 开启/修改定时检查 ``` 设置定时检查，每1小时一次 关闭定时检查 ``` --- ## ⚙️ 飞书通知配置（0配置，开箱即用） ### ✅ 推荐：OpenClaw 主配置（无需任何操作） 如果你的 OpenClaw 已经配置了飞书机器人，**自动读取，无需任何操作**。 技能会级联读取飞书凭证，优先级： 1. 环境变量 `FEISHU_APP_ID` / `FEISHU_APP_SECRET` / `FEISHU_CHAT_ID` 2. OpenClaw 主配置 `~/.openclaw/openclaw.json` 中的飞书配置 3. 以上都没有 → 跳过飞书推送（不影响 Git 监控功能） ### 可选：使用自己的飞书机器人 ```bash # 环境变量方式 export FEISHU_APP_ID="cli_xxx" export FEISHU_APP_SECRET="xxx" export FEISHU_CHAT_ID="ou_xxx" ``` 或在 OpenClaw 配置中添加： ```json "feishu": { "appId": "cli_xxx", "appSecret": "xxx", "chatId": "ou_xxx" } ``` ### 获取飞书配置 1. 访问 https://open.feishu.cn/ 创建企业自建应用 2. 获取 App ID 和 App Secret 3. 开启权限：`im:chat:read:chat_id` 和 `im:message:send_as_bot` 4. 将应用添加到群聊，获取群聊 ID --- ## 💻 命令行用法 ```bash cd ~/.openclaw/workspace/skills/git-monitor # 添加仓库 node helper.js add https://github.com/owner/repo # 查看列表 node helper.js list # 检查更新 node helper.js check # 删除仓库 node helper.js remove owner/repo ```


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: virtaava/openclaw-hardener (version 0.1.2)

--- name: openclaw-hardener description: "Harden OpenClaw (workspace + ~/.openclaw): run openclaw security audit, catch prompt-injection/exfil risks, scan for secrets, and apply safe fixes (chmod/exec-bit cleanup). Includes optional config.patch planning to reduce attack surface." --- # OpenClaw Hardener This skill provides a **user-choice** hardening tool that can: - Run OpenClaw’s built-in security audit (`openclaw security audit --deep` / `--fix`). - Run workspace hygiene checks (exec bits, stray `.env`, unsafe serialization patterns, etc.). - Apply safe mechanical fixes **only when explicitly requested**. - Generate (and optionally apply) a **Gateway `config.patch` plan** to tighten runtime policy. ## Run the tool Script: - `skills_live/openclaw-hardener/scripts/hardener.py` Examples: ```bash # Read-only checks (recommended default) python3 skills_live/openclaw-hardener/scripts/hardener.py check --all # Only run OpenClaw built-in audit (deep) python3 skills_live/openclaw-hardener/scripts/hardener.py check --openclaw # Only run workspace checks python3 skills_live/openclaw-hardener/scripts/hardener.py check --workspace # Apply safe fixes (chmod/exec-bit cleanup + optionally openclaw audit --fix) python3 skills_live/openclaw-hardener/scripts/hardener.py fix --all # Generate a config.patch plan (prints JSON5 patch) python3 skills_live/openclaw-hardener/scripts/hardener.py plan-config # Apply the plan (requires a running gateway; uses `openclaw gateway call`) python3 skills_live/openclaw-hardener/scripts/hardener.py apply-config ``` ## Design rules (do not violate) - **Default = check-only.** No file/config changes unless user runs `fix` or `apply-config`. - **No secrets in output.** If a check reads sensitive paths, it must redact likely tokens. - **Patch plans must be explicit.** Always show the patch before applying. ## What it checks / fixes ### OpenClaw built-in security audit - Runs `openclaw security audit --deep` (and `--fix` in fix mode). ### Workspace hygiene (scope: workspace + ~/.openclaw) - Permissions sanity under `~/.openclaw` (basic checks). - Unexpected executable bits in non-executable filetypes. - Stray `.env` files (warn) and tracked `.env` (fail). - Risky deserialization / unsafe patterns in our scripts (heuristics). ### Config hardening (optional plan) Generates a conservative `config.patch` template focusing on: - Tightening inbound access defaults (pairing/allowlist, mention gating) **only if you opt-in**. - Ensuring sensitive log redaction is enabled. (Exact keys depend on your config; the plan is best-effort and should be reviewed.)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: richardcoder849/feishu-asr (version 1.0.0)

--- name: feishu-asr description: 使用本地Whisper模型识别飞书语音消息。离线免费，不需要注册，不需要联网。 --- # 飞书语音识别 ASR ## 触发条件 - 用户发送飞书语音消息 - 用户要求将语音转为文字 - 用户提到"语音识别"、"转文字" ## 工作流程 ### 1. 获取语音文件 从飞书消息中获取语音文件的file_key，下载为.ogg或.m4a格式。 ### 2. 音频格式转换 使用Python soundfile将音频转换为16kHz采样的WAV格式： ```python import soundfile as sf audio, sr = sf.read(voice_file) # 如果是立体声，转为单声道 if len(audio.shape) > 1: audio = audio.mean(axis=1) sf.write('output.wav', audio, 16000) ``` ### 3. 使用Whisper识别 ```python import os os.environ['HF_ENDPOINT'] = 'https://hf-mirror.com' # 国内镜像 from transformers import WhisperForConditionalGeneration, WhisperProcessor, WhisperFeatureExtractor import soundfile as sf # 读取音频 audio, sr = sf.read('output.wav') if len(audio.shape) > 1: audio = audio.mean(axis=1) # 加载模型 processor = WhisperProcessor.from_pretrained('openai/whisper-tiny') model = WhisperForConditionalGeneration.from_pretrained('openai/whisper-tiny') feature_extractor = WhisperFeatureExtractor.from_pretrained('openai/whisper-tiny') # 识别 input_features = feature_extractor(audio, sampling_rate=16000, return_tensors='pt').input_features with torch.no_grad(): predicted_ids = model.generate(input_features) result = processor.batch_decode(predicted_ids, skip_special_tokens=True)[0] ``` ## 依赖安装 ```bash pip install torch transformers soundfile ``` ## 模型选择 - **whisper-tiny**: 75MB，适合CPU，最快 - **whisper-base**: 142MB，精度更好 - **whisper-small**: 466MB，精度高 ## 注意事项 - 首次运行需要下载模型（约75MB-3GB） - 建议使用国内镜像：HF_ENDPOINT=https://hf-mirror.com - 模型会自动检测语言


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)