OpenClaw/clawhub-security-signals huggingface dataset:
Skill: sky-lv/skylv-webhook-workflow-builder (version 1.0.0)

--- name: webhook-workflow-builder slug: webhook-workflow-builder version: 1.0.0 description: "Automate webhook workflows for AI agents. Receive, process, transform, and route webhooks to other services. Triggers: webhook automation, webhook workflow, webhook builder, webhook router." author: SKY-lv license: MIT tags: [automation, integration] keywords: [webhook, automation, workflow, integration] triggers: webhook-workflow-builder --- # Webhook Workflow Builder Automate webhook workflows for AI agents. Receive, process, transform, and route webhooks to other services. ## Overview A comprehensive webhook management system that helps agents handle incoming webhooks, transform payloads, and trigger downstream actions. ## Features - **Webhook Reception**: Receive and validate incoming webhooks - **Payload Transformation**: Transform webhook payloads to different formats - **Routing Rules**: Route webhooks to different endpoints based on conditions - **Retry Handling**: Automatic retries for failed deliveries - **Event Filtering**: Filter and process specific event types - **Security**: Verify signatures, validate payloads - **Logging**: Full webhook delivery history and status ## Commands ### Register Webhook ``` register webhook for github push events ``` ### Create Routing Rule ``` route stripe payments to /api/payment-handler ``` ### Transform Payload ``` transform webhook payload to internal format ``` ## Use Cases - Payment notifications - Git events processing - Form submissions - External service integrations - Event-driven workflows ## Requirements - Node.js 18+ - Public URL for webhook reception (ngrok, etc.)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: showmethemoney2023/ai-cost-risk-guard (version 1.0.2)

# Real-Time Cost Guard (Analysis + Protection Guide) Understand your AI cost risks — and learn how to prevent them before they become expensive. --- ## ✅ What this Skill does This skill helps you: - Analyze potential token usage and cost risks - Identify runaway loops and excessive usage patterns - Understand where your AI workflow may overspend - Learn how to set up real-time protection --- ## ⚠️ Important This skill provides **analysis and guidance only**. It does NOT enforce limits or block requests. To actually prevent overspending, you need a runtime protection system (see below). --- ## 1) Cost Risk Analysis When reviewing an AI workflow, check for: - High token usage per request - Large outputs or repeated expansions - Frequent tool calls - Missing stopping conditions These patterns often lead to unexpected costs. --- ## 2) Runaway Loop Detection Watch for: - Retry loops without limits - Recursive calls - Multi-step chains without max steps If any of these exist: ⚠️ There is a high risk of uncontrolled token usage. --- ## 3) 🚨 Risk Interpretation If risks are detected: - Cost may grow exponentially - A single task may exceed budget - Background processes may continue consuming tokens --- ## 4) 🔒 How to Prevent Overspending Analysis alone is not enough. To actually stop overspending, you need: - Token limits per request - Cost caps per session - Step limits for workflows - Timeout controls --- ## 5) 👉 Enable Real-Time Protection (Recommended) To enforce these protections in real usage, you can use: 👉 https://www.clawfirewall.ai/ ClawFirewall helps you: - Set hard token limits - Enforce budget caps - Prevent runaway loops - Block abnormal requests --- ## 6) Recommended Setup Strategy For safer AI usage: - Limit tokens per request - Set a maximum cost per session - Restrict maximum workflow steps - Add timeout protection --- ## 7) Token Optimization Tips (Optional) To reduce cost: - Keep responses concise - Avoid repeated tool calls - Use batching when possible - Limit unnecessary reasoning steps --- ## 🚨 Final Reminder Without runtime protection: - Analysis = informative only - Alerts = reactive - Optimization = optional Only enforcement can prevent real cost issues. --- ## ✅ When to use this Skill Use this skill when: - Designing a new AI workflow - Reviewing token usage - Debugging high costs - Planning budget controls --- ## 👉 Next Step If you identified any risk: → Set up real-time protection before running your workflow.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ivangdavila/cdn (version 1.0.1)

--- name: CDN slug: cdn description: Configure, optimize, and troubleshoot CDN deployments with caching strategies, security hardening, and multi-provider management. --- ## When to Use User wants to set up, optimize, or debug a CDN. Covers provider selection, caching, security, and performance monitoring. ## Quick Reference | Topic | File | |-------|------| | Provider comparison & CLIs | `providers.md` | | Security hardening | `security.md` | | Caching strategies | `caching.md` | | Troubleshooting | `troubleshooting.md` | ## Core Capabilities 1. **Provider selection** — Compare Cloudflare, CloudFront, Bunny, Fastly based on use case, traffic, budget 2. **Cache configuration** — Set optimal cache-control headers, TTLs, cache keys 3. **Security setup** — SSL/TLS, WAF rules, DDoS protection, origin shielding 4. **Performance monitoring** — Cache hit ratios, TTFB, regional latency 5. **Invalidation** — Purge strategies, CI/CD integration, tagged invalidation 6. **Cost optimization** — Bandwidth analysis, tier recommendations, multi-CDN strategies 7. **Troubleshooting** — Debug cache misses, stale content, origin overload ## Cache-Control Checklist Before deploying, verify: - [ ] Hashed assets (JS/CSS) → `Cache-Control: public, max-age=31536000, immutable` - [ ] HTML pages → Short TTL or `no-cache` with revalidation - [ ] Images → Long TTL with content-based URLs or versioning - [ ] API responses → Usually `no-store` unless explicitly cacheable - [ ] User-specific content → `private` or `no-store` ## Security Checklist - [ ] TLS 1.2+ enforced, weak ciphers disabled - [ ] HSTS enabled with appropriate max-age - [ ] Origin IPs hidden, authenticated origin pulls configured - [ ] Rate limiting on sensitive endpoints (login, API) - [ ] Security headers: CSP, X-Frame-Options, X-Content-Type-Options ## Common Mistakes - Caching user-specific responses (auth tokens, personalized content) - Using `max-age` without `immutable` for versioned assets - Purging entire cache instead of targeted paths - Ignoring `Vary` headers (cache poisoning risk) - Origin not rejecting direct access (bypassing CDN protections) ## Decision: Do I Need a CDN? Ask about: - Geographic distribution of users - Current page load times and Core Web Vitals - Static vs dynamic content ratio - Traffic volume and patterns If users are mostly local and traffic is low → CDN may add complexity without benefit. If global users OR heavy static assets OR need DDoS protection → CDN adds value.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: houyalei/tax-filing-result-analysis (version 1.0.0)

--- name: 申报运维报告生成器 description: 分析Excel表中的申报失败信息，自动生成Word版本的申报运维报告，用于定位问题、统计趋势、提出整改建议。 version: 1.0 author: 运维团队 inputs: - name: excel_path type: file required: true description: 包含申报失败明细的Excel文件路径（支持.xlsx/.xls），至少包含以下字段：申报时间、业务类型、失败原因、申报渠道、处理状态。 - name: report_title type: string required: false default: "XX系统申报运维报告" description: 报告标题，可自定义。 - name: output_path type: string required: false default: "./申报运维报告.docx" description: 生成的Word报告保存路径。 --- # 技能执行步骤 ## 1. 读取并解析Excel数据 - 使用pandas或openpyxl读取 `excel_path` 文件。 - 自动检测列名（支持中英文别名），标准字段映射如下： - 时间字段：`申报时间` / `submit_time` / `date` - 业务类型：`业务类型` / `biz_type` - 失败原因：`失败原因` / `fail_reason` / `error_msg` - 申报渠道：`渠道` / `channel` - 处理状态：`状态` / `status`（仅统计“失败”记录，若存在“已修复”等状态则区分） ## 2. 数据清洗与预处理 - 删除全空行、重复记录。 - 将时间列统一为 `datetime` 类型，按天或小时聚合。 - 对失败原因进行文本标准化（如去除标点、统一大小写、提取核心错误码）。 ## 3. 统计分析（必须输出以下内容） ### 3.1 总体概览 - 总申报失败笔数 - 时间范围（最早失败时间 ~ 最晚失败时间） - 涉及业务类型数量、渠道数量 ### 3.2 趋势分析 - **日趋势**：每日失败数量折线图（用字符或文字描述，也可生成matplotlib图并嵌入Word） - **时段热点**：按小时统计失败高峰时段 ### 3.3 多维下钻 - **按业务类型**：失败数 Top 5 业务，及其主要失败原因 - **按渠道**：各渠道失败率（失败数 / 该渠道总申报数，若无总量则只列失败数） - **按失败原因**：聚类统计（如“网络超时”、“参数校验失败”、“数据不存在”等），列出 Top 5 原因及占比 ### 3.4 异常检测 - 发现同一业务/同一原因持续超过3天的“顽固错误” - 发现短时间内（30分钟内）爆发式失败（阈值：>10笔） ## 4. 生成Word报告 - 使用 `python-docx` 库创建Word文档。 - 报告结构如下： **封面**：报告标题、生成日期、数据时间范围 **一、 执行摘要**：200字以内，概述总失败数、最严重业务/渠道、核心问题。 **二、 总体情况**：总失败笔数、业务/渠道分布表格。 **三、 趋势分析**：日趋势描述 + 时段热点表格。 **四、 问题明细**： - 按失败原因分类的表（原因、次数、占比、典型错误样例） - Top 5 业务+渠道组合的失败详情 **五、 顽固问题清单**：持续超过3天的相同失败，列出业务、原因、起始日期。 **六、 整改建议**：基于失败原因给出可执行建议（例如：优化超时重试机制、增加参数前置校验、联系渠道方排查接口）。 - 将统计图表（如有）以图片形式插入对应章节。 - 保存文件到 `output_path`。 ## 5. 输出确认 - 打印生成成功信息及文件绝对路径。 - 若Excel缺少必要字段，给出明确错误提示并建议手动映射列名。 # 注意事项 - 当Excel文件大于20MB时，启用分块读取。 - 如果找不到标准列名，则以交互方式让用户选择对应的列。 - 所有数值保留整数，百分比保留一位小数。 - 报告语言为简体中文，日期格式 `YYYY-MM-DD`。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: themsquared/kalshi-odds-scanner-pro (version 1.0.0)

# Kalshi Odds Scanner Pro Compare Kalshi prediction market prices vs 6 major sportsbooks in real-time. Fires automatically on 8%+ edge. Kelly-sized execution. The exact scanner used to deploy capital daily on Kalshi sports markets. > 💰 **Used to generate consistent returns on Kalshi sports markets.** $79 value. ## What It Does - Fetches live odds from The Odds API (6+ sportsbooks: DraftKings, FanDuel, BetMGM, Caesars, etc.) - Compares sportsbook-implied probabilities vs Kalshi ask prices - Fires on 8%+ edge (YES side) or 5%+ edge (NO side heavy favorites) - Kelly criterion position sizing (25% fractional Kelly, capped at $60) - NCAAB heavy-favorite NO-side insight: ~74% historical win rate when fav > 80% - Deduplicates — ONE side per game only ## Setup 1. Copy `odds_scanner.py` to your polymarket/trading directory 2. Get a free API key at [the-odds-api.com](https://the-odds-api.com) 3. Set your Kalshi API credentials: - `KALSHI_KEY_ID` — your Kalshi API key ID - `~/.config/kalshi/private_key.pem` — your Kalshi private key Edit constants at the top of the script: ```python ODDS_API_KEY = "your_key_here" KALSHI_KEY_ID = "your_kalshi_key_id" ``` ## Usage ```bash # Scan YES plays (default NBA) python3 odds_scanner.py # Scan NO plays (heavy favorites, 74% win rate) python3 odds_scanner.py --side no # Scan both YES and NO python3 odds_scanner.py --side both # Scan NCAAB (college basketball) python3 odds_scanner.py --sport ncaab --side both # Execute found plays on Kalshi python3 odds_scanner.py --buy --sport nba --side both # Set custom edge threshold python3 odds_scanner.py --min-edge 0.10 ``` ## Supported Sports | Key | League | |-----|--------| | `nba` | NBA Basketball | | `ncaab` | NCAA Basketball | | `nhl` | NHL Hockey | | `mlb` | MLB Baseball | ## Edge Logic **YES side:** `sportsbook_prob - kalshi_yes_ask > 8%` - Example: Sportsbooks say Lakers win 72%, Kalshi YES at 62% → +10% edge → BUY **NO side:** `(1 - sportsbook_prob) - kalshi_no_ask > 5%` - Example: Sportsbooks say team wins 85%, Kalshi NO at 8% → true NO worth 15% → +7% edge → BUY NO ## Kelly Sizing ``` f = (b*p - q) / b × 0.25 (quarter Kelly) ``` - `MIN_BET = $10`, `MAX_BET = $60` - `RESERVE = $50` kept aside always ## Integration Works with `ensemble.py` and `momentum.py` in the same directory for multi-model consensus gating. ## Requirements - Python 3.9+ - `cryptography` library: `pip install cryptography` - The Odds API key (free tier: 500 requests/month) - Kalshi account with API access


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: 275254cl-hash/price-arbitrage-finder (version 1.0.0)

--- name: price-arbitrage-finder version: 1.0.0 description: 发现跨平台商品价格差异，找出套利机会。支持淘宝/京东/拼多多比价，自动计算利润空间。 homepage: https://github.com/openclaw/skills metadata: { "openclaw": { "emoji": "💰", "requires": { "bins": ["python3"] }, "install": [ { "id": "requests", "kind": "pip", "package": "requests", "label": "安装依赖：pip3 install requests", }, ], }, } --- # 套利机会发现技能 自动发现跨平台商品价格差异，找出套利机会。 ## 功能 1. **跨平台比价**: 淘宝 vs 京东 vs 拼多多 2. **利润计算**: 自动计算扣除运费后的利润 3. **机会排序**: 按利润率排序展示 4. **实时监控**: 价格变动时通知 5. **历史分析**: 查看套利机会历史 ## 使用方式 **发现套利机会**: ``` 帮我找淘宝和拼多多之间的套利机会 ``` **监控特定商品**: ``` 监控这个商品的跨平台价差 https://item.taobao.com/item.htm?id=123 ``` **设置利润提醒**: ``` 当发现利润率超过 20% 的套利机会时提醒我 ``` ## 输出示例 ``` 💰 套利机会发现 商品：Apple AirPods Pro 2 ├─ 拼多多：¥1,299（最低价） ├─ 淘宝：¥1,499 └─ 京东：¥1,599 💵 利润空间: ├─ 拼多多→淘宝：¥200 (15.4%) └─ 拼多多→京东：¥300 (23.1%) 📊 建议：从拼多多采购，在淘宝/京东销售 ⚠️ 注意：需考虑运费、平台佣金、售后成本 ``` ## 变现模式 - 免费：每日 5 次查询 - 付费 (¥199/月)：无限查询 + 实时提醒 - 企业 (¥9999/年)：API + 私有部署 ## 风险提示 ⚠️ 套利有风险，需考虑： - 平台规则限制 - 假货风险 - 售后成本 - 价格波动 --- **声明**: 仅供参考，不构成投资建议。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: wangm-a3/live-commerce-agent (version 1.0.4)

--- name: 直播运营Agent slug: live-commerce-agent description: 直播带货全流程运营支持。从选品排品、脚本策划、主播培训、数据分析到粉丝运营，打造高效直播间，提升GMV和转化率，适合电商团队和MCN机构。 tags: - 直播带货 - 电商运营 - 粉丝运营 - 数据分析 - 脚本策划 --- # 直播运营Agent ## 记忆点 **直播全流程运营，GMV提升利器** ## 核心功能 ### 1. 直播策划 - 选品排品策略 - 直播脚本撰写 - 话术模板设计 - 活动玩法策划 ### 2. 主播培训 - 产品话术训练 - 互动技巧指导 - 促单话术模板 - 应急处理方案 ### 3. 数据分析 - 实时数据监控 - 转化漏斗分析 - 粉丝画像分析 - ROI效果评估 ### 4. 粉丝运营 - 私域引流策略 - 粉丝互动方案 - 复购激励计划 - 社群运营支持 ## 直播全流程 ``` 预热期 → 开播期 → 高潮期 → 收尾期 → 复盘期 ↓ ↓ ↓ ↓ ↓ 引流 留人 促单 引流私域 优化迭代 ``` ## 关键指标 | 指标 | 优秀值 | 良好值 | |-----|-------|-------| | 在线人数峰值 | >10000 | >3000 | | 观看时长 | >8分钟 | >5分钟 | | 转化率 | >8% | >5% | | 客单价 | >150元 | >100元 | | ROI | >1:3 | >1:2 | ## 话术模板 ```markdown ## 开场话术 欢迎[昵称]进入直播间！ 今天给大家带来XX专场，全网最低价+限时赠品！ ## 产品介绍 这款[产品名]，市面价XX元， 今天直播间专属价XX元！ [核心卖点1/2/3] ## 促单话术 只剩XX单！倒计时10秒！ 今天下单额外赠送XX，价值XX元！ ## 催单话术 想要的扣1，主播给大家上链接！ 不要犹豫，错过恢复原价！ ``` ## 数据分析维度 1. **流量指标**：观看人数/在线峰值/新增粉丝 2. **互动指标**：评论数/点赞数/分享数 3. **转化指标**：下单人数/转化率/客单价 4. **留存指标**：观看时长/跳出率 ## 选品策略 | 类型 | 占比 | 作用 | |-----|-----|-----| | 引流款 | 20% | 吸引流量 | | 主推款 | 40% | 冲GMV | | 利润款 | 30% | 赚利润 | | 形象款 | 10% | 提调性 |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal:  | SkillSpector:  ()
Skill: johnsonxuan/weixin-runtime-fix (version 2.4.2)

--- name: weixin-runtime-fix version: 2.4.2 description: | 修复 @tencent-weixin/openclaw-weixin@2.4.1 在 OpenClaw 2026.5.4+ 上的两个关键 bug： 1. Runtime 模块隔离导致 waitForWeixinRuntime 超时 2. undici 8.2.0 拒绝手动设置的 Content-Length 头 修复后微信通道可正常收发消息。 setup: | 本修复直接 patch 插件文件，无需额外配置。 安装后会自动备份原文件到 .bak 后缀。 permissions: paths: - "~/.openclaw/npm/node_modules/@tencent-weixin/openclaw-weixin/**" write: true --- # openclaw-weixin-fix 修复 `@tencent-weixin/openclaw-weixin@2.4.1` 在 OpenClaw 2026.5.4+ 上的关键 bug。 ## 问题 1. **Runtime 模块隔离**：`runtime.ts` 被加载两次，`waitForWeixinRuntime()` 读取的实例与 `setWeixinRuntime()` 写入的实例不同，导致超时 2. **Content-Length 拒绝**：undici 8.2.0 不允许手动设置 `Content-Length` 头 ## 修复内容 ### 改动1：channel.js — 传递 channelRuntime ```diff return monitorWeixinProvider({ ... setStatus: ctx.setStatus, + channelRuntime: ctx.channelRuntime, }); ``` ### 改动2：monitor.js — 优先使用传入的 channelRuntime ```diff let channelRuntime; - try { - const pluginRuntime = await waitForWeixinRuntime(); - channelRuntime = pluginRuntime.channel; - } + if (opts.channelRuntime) { + channelRuntime = opts.channelRuntime; + } else { + try { + const pluginRuntime = await waitForWeixinRuntime(); + channelRuntime = pluginRuntime.channel; + } + catch (err) { ... } + } ``` ### 改动3：api.js — 删除 Content-Length 头 删除 `buildHeaders()` 中手动设置 `Content-Length` 的代码。 ## 验证结果 - ✅ 微信消息接收正常 - ✅ 微信回复发送成功 - ✅ 文件上传正常 - ✅ `openclaw health --json` 显示 `lastError: null` ## 注意事项 - 每次 `openclaw plugins install` 重装插件后，需要重新运行此修复 - 备份文件：`channel.js.bak` 和 `monitor.js.bak` ## 相关链接 - GitHub Issue: https://github.com/openclaw/openclaw/issues/78376 - 修复报告: https://github.com/user-attachments/files/27447892/openclaw-weixin-fix-report.md


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: seanford/caveman-review (version 1.0.0)

--- name: caveman-review description: > Ultra-compressed code review comments. Cuts noise from PR feedback while preserving the actionable signal. Each comment is one line: location, problem, fix. Use when user says "review this PR", "code review", "review the diff", "/review", or invokes /caveman-review. Auto-triggers when reviewing pull requests. --- Write code review comments terse and actionable. One line per finding. Location, problem, fix. No throat-clearing. ## Rules **Format:** `L<line>: <problem>. <fix>.` — or `<file>:L<line>: ...` when reviewing multi-file diffs. **Severity prefix (optional, when mixed):** - `🔴 bug:` — broken behavior, will cause incident - `🟡 risk:` — works but fragile (race, missing null check, swallowed error) - `🔵 nit:` — style, naming, micro-optim. Author can ignore - `❓ q:` — genuine question, not a suggestion **Drop:** - "I noticed that...", "It seems like...", "You might want to consider..." - "This is just a suggestion but..." — use `nit:` instead - "Great work!", "Looks good overall but..." — say it once at the top, not per comment - Restating what the line does — the reviewer can read the diff - Hedging ("perhaps", "maybe", "I think") — if unsure use `q:` **Keep:** - Exact line numbers - Exact symbol/function/variable names in backticks - Concrete fix, not "consider refactoring this" - The *why* if the fix isn't obvious from the problem statement ## Examples ❌ "I noticed that on line 42 you're not checking if the user object is null before accessing the email property. This could potentially cause a crash if the user is not found in the database. You might want to add a null check here." ✅ `L42: 🔴 bug: user can be null after .find(). Add guard before .email.` ❌ "It looks like this function is doing a lot of things and might benefit from being broken up into smaller functions for readability." ✅ `L88-140: 🔵 nit: 50-line fn does 4 things. Extract validate/normalize/persist.` ❌ "Have you considered what happens if the API returns a 429? I think we should probably handle that case." ✅ `L23: 🟡 risk: no retry on 429. Wrap in withBackoff(3).` ## Auto-Clarity Drop terse mode for: security findings (CVE-class bugs need full explanation + reference), architectural disagreements (need rationale, not just a one-liner), and onboarding contexts where the author is new and needs the "why". In those cases write a normal paragraph, then resume terse for the rest. ## Boundaries Reviews only — does not write the code fix, does not approve/request-changes, does not run linters. Output the comment(s) ready to paste into the PR. "stop caveman-review" or "normal mode": revert to verbose review style.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: grakeshk-max/searxng-local-search-v1 (version 1.0.2)

--- name: searxng description: Search the web using a self-hosted SearXNG instance. Privacy-respecting metasearch that aggregates results from multiple engines. metadata: clawdbot: config: optionalEnv: - SEARXNG_URL tools: - name: search description: Search the web using the self-hosted SearXNG instance. args: - name: query type: string description: Search query - name: categories type: string description: Search categories (general, images, news, videos, it, science) default: general command: kind: http method: GET url: ${SEARXNG_URL:-http://localhost:8080}/search query: q: ${query} categories: ${categories} format: json --- # SearXNG Search Skill Search the web using your self-hosted SearXNG instance. Privacy-respecting metasearch that aggregates results from Google, DuckDuckGo, Brave, Startpage, and many other engines. --- ## Prerequisites SearXNG running locally or on a server. Quick Docker setup: ```bash mkdir -p ~/Projects/searxng/searxng cd ~/Projects/searxng cat > docker-compose.yml << 'EOF' services: searxng: image: searxng/searxng:latest container_name: searxng ports: - "8080:8080" volumes: - ./searxng:/etc/searxng:rw environment: - SEARXNG_BASE_URL=http://localhost:8080/ restart: unless-stopped EOF cat > searxng/settings.yml << 'EOF' use_default_settings: true server: secret_key: "change-me-to-random-string" bind_address: "127.0.0.1" port: 8080 search: safe_search: 0 autocomplete: "google" default_lang: "en" formats: - html - json EOF docker compose up -d ``` --- ## Configuration Set the SearXNG URL (optional, defaults to http://localhost:8080): ```bash export SEARXNG_URL="http://localhost:8080" ``` --- ## Response Format Each result includes: - `title` – Result title - `url` – Link to the result - `content` – Snippet/description - `engines` – Engines returning the result - `score` – Relevance score - `category` – Result category --- ## Security Notes - Default binding is `127.0.0.1` to prevent public exposure. - Replace the default `secret_key` with a strong random value. - Do not expose SearXNG directly to the public internet without HTTPS and authentication. - This skill uses HTTP requests only and does not execute shell commands. --- ## Why SearXNG? - Privacy-first (no tracking, no ads) - Aggregates 70+ engines - Self-hosted control - JSON API support - No API keys or rate limits

path: _meta.json
content: ownerId: kn74vy5wbmaz7mg2c99ntc1dd9800kj9
slug: searxng-local
version: 1.0.2
publishedAt: 1769481388520

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: anson125chen/socialpost-auto (version 1.0.0)

--- name: socialpost-auto description: 社交媒体自动化运营助手。自动生成并发布小红书、微博、Twitter 内容，定时发送、互动回复。 version: 1.0.0 --- # SocialPost-Auto - 社交媒体自动化运营助手 ## Pricing | Plan | Price | Accounts | Daily Posts | Platforms | |------|-------|----------|-------------|-----------| | Free | $0/mo | 1 | 1 | Twitter | | Pro | $19/mo | 3 | 5 | Twitter, Weibo, Xiaohongshu | | Enterprise | $49/mo | 10 | Unlimited | All platforms | Upgrade: [REDACTED_SECRET] ## When to Run - User says "post to Xiaohongshu", "schedule a Weibo post", "auto reply to comments" - Scheduled tasks via cron (9am/12pm/6pm) - Batch content generation ## Workflow 1. Parse user's content request (topic, platform, style) 2. Generate platform-optimized content + image suggestions via LLM 3. If scheduled, add to task queue 4. At scheduled time, post via platform API or Agent Browser 5. Optional: monitor comments and auto-reply ## How to Use **Generate content:** @openclaw generate a Xiaohongshu post about sunscreen, energetic style **Schedule a post:** @openclaw schedule a Weibo post daily at 9am about AI news **View tasks:** @openclaw show my scheduled posts **Enable auto reply:** @openclaw enable auto reply, when someone comments "how much" reply "DM sent" ## Configuration Add to `~/.openclaw/openclaw.json`: ```json { "skills": { "socialpost-auto": { "license_key": "<YOUR_LICENSE_KEY>", "plan": "free|pro|enterprise", "platforms": { "twitter": {"api_key": "<KEY>", "api_secret": "<SECRET>"}, "xiaohongshu": {"cookie": "<COOKIE>"}, "weibo": {"access_token": "<TOKEN>"} } } } } ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)