OpenClaw/clawhub-security-signals huggingface dataset:
Skill: santosparra651-arch/rustchain-bounty-hunter-v2-1 (version 1.0.0)

# RustChain Bounty Hunter Skill Automate RustChain bounty hunting workflow — find low-competition bounties, implement requirements, create PR ready for merge. ## Features - Analyzes issue requirements and creates complete working code - Follows existing project coding conventions - Includes full test suite for all new features - Creates PR with proper description matching bounty requirements - Claims bonus features when possible for extra RTC ## Usage Just tell me which bounty you want to do next, I'll handle the coding, testing, pushing to your fork, and prepare the PR for you. All you need to do is click "Create PR" on GitHub. ## Results Example (One Day) Completed 4 bounties: - Deploy BCOS v2 to Node 4 → **10 RTC** - Parasocial Hooks Audience Tracking → **25 RTC** - Agent Memory Self-Referencing → **40 RTC** - Interactive RustChain Mining Simulator (includes bonus) → **50 RTC** **Total: 125 RTC = $12.5 in one day** ## Author Zhang Baiwan (OpenClaw)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bytesagain3/terms-of-service (version 2.0.0)

--- version: "2.0.0" name: Terms of Service description: "Terms of Service Generator - 服务条款生成器. Use when you need terms of service capabilities. Triggers on: terms of service." 服务条款生成器。SaaS/电商/App服务条款、更新通知、白话版。Terms of service generator. 服务条款、用户协议。 author: BytesAgain homepage: https://bytesagain.com source: https://github.com/bytesagain/ai-skills --- # Terms of Service 服务条款生成器。SaaS/电商/App服务条款、更新通知、白话版。Terms of service generator. 服务条款、用户协议。 ## 常见问题 **Q: 这个工具适合谁用？** A: 任何需要terms of service的人，无论是个人还是企业用户。 **Q: 输出格式是什么？** A: 主要输出Markdown格式，方便复制和编辑。 ## 命令速查 ``` generate generate saas saas ecommerce ecommerce app app update update plain plain ``` --- *Terms of Service by BytesAgain* --- 💬 Feedback & Feature Requests: https://bytesagain.com/feedback Powered by BytesAgain | bytesagain.com - Run `terms-of-service help` for all commands ## Commands Run `terms-of-service help` to see all available commands. ## When to Use - Quick terms tasks from terminal - Automation pipelines ## When to Use - Quick terms tasks from terminal - Automation pipelines


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: googleworkspace-bot/gws-admin-reports (version 1.0.13)

--- name: gws-admin-reports description: "Google Workspace Admin SDK: Audit logs and usage reports." metadata: version: 0.22.5 openclaw: category: "productivity" requires: bins: - gws cliHelp: "gws admin-reports --help" --- # admin-reports (reports_v1) > **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it. ```bash gws admin-reports <resource> <method> [flags] ``` ## API Resources ### activities - `list` — Retrieves a list of activities for a specific customer's account and application such as the Admin console application or the Google Drive application. For more information, see the guides for administrator and Google Drive activity reports. For more information about the activity report's parameters, see the activity parameters reference guides. - `watch` — Start receiving notifications for account activities. For more information, see Receiving Push Notifications. ### channels - `stop` — Stop watching resources through this channel. ### customerUsageReports - `get` — Retrieves a report which is a collection of properties and statistics for a specific customer's account. For more information, see the Customers Usage Report guide. For more information about the customer report's parameters, see the Customers Usage parameters reference guides. ### entityUsageReports - `get` — Retrieves a report which is a collection of properties and statistics for entities used by users within the account. For more information, see the Entities Usage Report guide. For more information about the entities report's parameters, see the Entities Usage parameters reference guides. ### userUsageReport - `get` — Retrieves a report which is a collection of properties and statistics for a set of users with the account. For more information, see the User Usage Report guide. For more information about the user report's parameters, see the Users Usage parameters reference guides. ## Discovering Commands Before calling any API method, inspect it: ```bash # Browse resources and methods gws admin-reports --help # Inspect a method's required params, types, and defaults gws schema admin-reports.<resource>.<method> ``` Use `gws schema` output to build your `--params` and `--json` flags.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: codekungfu/eggy-party (version 0.1.0)

--- name: eggy-party description: 注册“蛋仔派对”技能；用于游戏公开页面、版本活动、赛事内容与社区规则整理。 homepage: `https://party.163.com/` metadata: {"clawdbot":{"emoji":"🎮"}} --- # 蛋仔派对 用途与边界 - 面向公开官网、活动页、赛事页、公告页与社区规则页的信息整理 - 不提供代练、外挂、作弊、账号交易、充值绕过或风控规避能力 - 仅处理公开可见的版本活动、玩法说明、赛事信息与规则公告 关键入口 - 主页：https://party.163.com/ - 活动与公告：官网中的公告、版本更新、活动中心或赛事入口 - 规则与帮助：未成年人规则、处罚公告、客服与帮助中心入口 常见任务 - 版本更新、活动时间、奖励结构与参与方式整理 - 赛事信息、社区活动、联动内容与公告汇总 - 账号安全、违规处罚、健康系统与帮助信息提取 数据字段 - 活动名称、上线时间、奖励说明、参与入口、链接 - 版本更新、赛事入口、规则页、公告链接 - 处罚说明、健康系统、客服入口、帮助页链接 自动化要点 - 活动与版本频繁变化，输出时保留日期与来源链接 - 不得输出任何作弊、绕过防沉迷、绕过充值限制或账号交易建议 - 不处理玩家私密数据、战绩接口、登录态资产或未公开测试内容 示例流程 - 活动整理：访问 Eggy Party 活动与公告页 → 提取时间与奖励 → 输出表格 - 版本摘要：进入更新公告 → 提取新内容与调整点 → 输出摘要 - 规则汇总：访问帮助与处罚页 → 提取风险点与申诉入口 → 输出清单 合规提示 - 遵守平台规则、版权要求与账号安全要求 - 只整理公开信息，不输出敏感数据或非公开内容


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zhanggroot7/english-follower (version 1.0.0)

--- name: english-follower description: Professional English native speaker coach. Triggers when users want to practice English, check grammar, speak English naturally, improve expressions, or discuss anything in English. Keywords: english, natural, speak english, grammar, expression, practice english. user-invocable: true disable-model-invocation: false --- # English Follower You are a **professional native English speaker** and the user's language companion. Your purpose is to **accompany the user and make progress together** — like a friend walking the same road. ## Golden Rule: ONE SENTENCE Response **Your entire response must be within ONE sentence.** This is non-negotiable. Be concise, warm, and impactful in a single sentence. ## How It Works Your one sentence should do as much of the following as possible: 1. **Validate & accompany** — agree with or react to what the user said (emotional value first) 2. **Gently fix** — if there's a grammar/syntax issue, weave the corrected version naturally into your response so the user sees the right way by reading your reply 3. **Keep it going** — end with a thought or question that invites more conversation ## Output Format (STRICT) **Line 1:** The user's message rewritten as a natural English expression **Line 2:** Your one-sentence response (warm, conversational) That's it. Two lines only. Nothing else. ## Examples **User:** *I think today is very tired for me.* > I'm really exhausted today. > Sounds like you had a tough one — what wore you out the most? **User:** *I want to improve my English but I don't know how to start.* > I want to improve my English, but I don't know where to start. > Honestly, just talking like this is already a great start, so keep going! **User:** *Yesterday I go to park with my dog, he is very happy.* > Yesterday I went to the park with my dog, and he was so happy. > That sounds lovely — I bet he had the best time running around! **User:** *it's too expensive* > It's too expensive. > Ha, that's always the catch with nice things — maybe it'll be worth saving up for though? ## Style - Line 1: Natural, idiomatic rewrite — show how a native speaker would say the same thing - Line 2: Conversational, warm, like a friend texting back - Use contractions: "don't", "wasn't", "I'd" - If the user's sentence is already perfect, Line 1 just repeats it as-is - Your job is to **accompany**, not to **teach** — progress happens through natural conversation


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: paparusi/a2a-vault (version 2.0.0)

--- name: a2a-vault description: "Zero-knowledge secrets management via PassBox — store, retrieve, rotate, and inject credentials securely." metadata: { "openclaw": { "emoji": "🔐", "requires": {}, "install": [ { "id": "plugin", "kind": "node", "package": "@a2a/openclaw-plugin", "label": "Install A2A Corp plugin", }, ], }, } --- # A2A Vault (PassBox) Zero-knowledge secrets management. Store API keys, tokens, and credentials with client-side encryption. The server never sees plaintext values. ## Quick Start Store a secret: ``` Use passbox_set_secret with vault "my-project", key "API_KEY", value "sk-abc123" ``` Retrieve a secret: ``` Use passbox_get_secret with vault "my-project", key "API_KEY" ``` ## Available Tools ### Secret Operations | Tool | Description | |------|-------------| | `passbox_get_secret` | Retrieve and decrypt a secret | | `passbox_set_secret` | Create or update a secret (encrypted before upload) | | `passbox_list_secrets` | List secret names (values not returned) | | `passbox_delete_secret` | Delete a secret | | `passbox_rotate_secret` | Trigger manual secret rotation | ### Vault Management | Tool | Description | |------|-------------| | `passbox_list_vaults` | List all available vaults | | `passbox_list_environments` | List environments (dev, staging, prod) | | `passbox_get_environment` | Get all secrets in an environment | ### .env Integration | Tool | Description | |------|-------------| | `passbox_diff_env` | Compare local .env with vault secrets | | `passbox_import_env` | Import .env file into vault | ## Workflows ### Set up project credentials 1. `passbox_list_vaults` — see existing vaults 2. `passbox_set_secret` — store each credential 3. `passbox_list_secrets` — verify all keys are stored ### Sync .env with vault 1. Read your local .env file 2. `passbox_diff_env` — see what's different 3. `passbox_import_env` — push local secrets to vault ### Environment promotion 1. `passbox_get_environment` for "dev" 2. Review values 3. `passbox_set_secret` for each key in "staging" ### Credential injection Use with `a2a_secure_execute` to automatically inject secrets: ``` Use a2a_secure_execute with toolId "my-api-tool" and input { "apiKey": "{{API_KEY}}" }, vault "my-project" ``` The `{{API_KEY}}` placeholder is resolved from PassBox before execution. ## Security Model - **Client-side encryption**: Values are encrypted before leaving your device - **Zero-knowledge**: The server stores only ciphertext - **Environment isolation**: dev/staging/prod secrets are fully separated - **Audit trail**: All access is logged - **Secret rotation**: Built-in rotation support with webhooks


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: yifany-github/youtube-asr-summarize (version 0.1.0)

--- name: youtube-asr-summarize description: "Summarize YouTube videos with NO subtitles by doing local ASR (yt-dlp + faster-whisper) and extracting a few screenshot frames via ffmpeg. Use when the user asks to summarize the latest video from a channel and YouTube timedtext/subtitles are empty, or when no API tokens/keys should be used." --- # YouTube ASR Summarize (local, no tokens) Use this skill to summarize a YouTube video *even when subtitles are missing* by downloading audio and running local speech-to-text. ## Quick start 1) One-time deps ```bash brew install yt-dlp ffmpeg ``` 2) Create venv + install ASR ```bash python3 -m venv .venv source .venv/bin/activate pip install faster-whisper ``` 3) Run ```bash python3 scripts/youtube_asr_summarize.py \ --url "https://www.youtube.com/watch?v=<id>" \ --out "/tmp/youtube-asr/<id>" \ --model small \ --lang zh \ --frames 1 \ --timeline-every 180 ``` Outputs in `--out`: - `summary.md`（含：链接 + 摘要 + 时间轴） - `transcript.txt` - `transcript.srt` - `frames/frame_01.jpg` … (if `--frames > 0`) ## Notes - Default model `small` (CPU/int8) is fast; use `--model medium` for better accuracy. - If you need more control, see `references/workflow.md`.

path: references/workflow.md
content: # Workflow notes (YouTube no-subtitle)

Goal: Summarize the latest video even when YouTube timedtext/subtitles are empty.

Preferred local pipeline:

1) Install deps (once)
- `brew install yt-dlp ffmpeg`
- `python3 -m venv .venv && source .venv/bin/activate && pip install faster-whisper`

2) Run script
- `python3 scripts/youtube_asr_summarize.py --url <youtube-url> --out <outdir>`

3) Deliver
- Send `summary.md` content as WhatsApp-friendly bullets
- Attach 1-3 frames from `<outdir>/frames/frame_*.jpg`

Tips:
- Use `--model small` for speed on CPU; `medium` for accuracy.
- ASR may contain homophone errors; treat numbers/names carefully.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: gerhardvr26/oken-usage-tracker (version 1.0.0)

--- name: token-usage-tracker description: Token usage logging, alerting, and context-compression utilities for OpenClaw. Use when you want to track per-call token usage, normalize timestamps, and reduce context sent to LLMs via summarization/compression. --- # token-usage-tracker Quick start 1. Configure defaults in `skill-config.json` (timezone, log_folder). 2. Install scripts (examples provided) into your workspace and wire the interceptor into your message pipeline. 3. Use `scripts/context_summarizer.py` before sending large contexts to reduce token usage. What this skill provides - Logging: `token_tracker.py` writes per-call token usage to a JSONL log. Includes timestamp normalization. - Interceptor: `token_interceptor.py` example that normalizes timestamps and forwards sanitized messages to the tracker. - Alerts: `token_alerts.py` example for threshold-based alerts (no external posting by default). - Compression: `context_summarizer.py` produces short summaries to reduce token payloads. - Utilities: migration and cleanup scripts (convert timestamps, dedupe log entries). When to use - Use this skill when you want transparent per-call token accounting, to keep token usage low, or to protect sensitive/verbose contexts by summarizing before sending to the model. Files - scripts/ - token_interceptor.py — example interceptor (normalizes timestamps) - token_tracker.py — logging helper - token_alerts.py — alert examples - context_summarizer.py — compression helper - migrate_timestamps.py — migration utility - dedupe_log.py — dedupe utility - references/ - examples/systemd/ — example unit files (install manually) - skill-config.json — configurable defaults - README.md — usage and install notes Configuration See `skill-config.json` for defaults. The skill exposes: - timezone: default UTC - log_folder: default ./skills/logs (relative to OpenClaw workspace) - compression settings: summary_target_tokens, max_context_tokens Security and installation - The scripts are examples and safe by default. They do not change system state or install services automatically. - Example systemd/unit files are provided in `references/systemd/` — apply them manually after review. License: MIT (adapt as you prefer)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kubiczech808/anthropic-usage-report (version 1.0.0)

--- name: anthropic-report-format description: Format for Anthropic API usage reports generated by anthropic-report.py. Use this skill when creating, modifying, or discussing the format of Anthropic proxy usage reports, CLI vs API tracking reports, or OpenClaw agent cost/usage reports. Also use when the user asks about report formatting, wants to change report output, or mentions anthropic-report.py. --- # Anthropic Usage Report Format ## Design Principles 1. **Icons = signal importance only.** Icons appear ONLY at the start of lines with key metrics the user needs to scan quickly. No decorative icons. 2. **Key metrics first.** CLI %, cache %, high-output call count — these appear at line start with icons. 3. **No noise.** No latency (ms), no success/error icons, no redundant breakdowns unless errors exist. 4. **Neutral labeling.** High-output calls are flagged for review, not pre-judged as "should have used CLI" — the cause may be inefficiency, legitimate work, or missing CLI usage. 5. **Compact.** Every line earns its place. ## Report Template ``` Anthropic Usage — {date} ({time} CET) ══════════════════════════════════════════ Total: {total} calls ({errors} errors) ⚠️ CLI: {cli_pct}% / API: {api_pct}% {agent_name}: 🗄️ {cache_pct}% cache ({cache_read} read / {cache_create} create) Tokens: {total_in} in ({new_in} new) / {total_out} out Cost: ~${cost} ────────────────────────────────────────── CLI potential: ⚠️ {n}× inline work (>{threshold} out, {sum} tok, max {max}) {n}× standard ({low}-{threshold} out) {n}× heartbeat (<{low} out) ────────────────────────────────────────── Total estimate: ~${total_cost} ``` ## Conditional Rules - **Error breakdown**: Show `API: X (Y ok, Z err) | CLI: X (Y ok, Z err)` ONLY when errors > 0 - **CLI icon**: ⚠️ when CLI < 50%, ✅ when CLI >= 50% - **High output icon**: ⚠️ when inline work calls > 0, ✅ (show "No inline work") when 0 - **Model line**: Show only if multiple models used ## Icon Placement Rules Icons appear ONLY on these lines, ALWAYS at line start: - `⚠️` or `✅` — CLI/API ratio - `🗄️` — Cache rate - `⚠️` or `✅` — Inline work count NO icons on: header, totals, tokens, cost, heartbeat count, standard count, separator lines. ## Language Default language is English. To localize, edit `LANG` dict in `scripts/format_report.py`: ```python LANG = { "total": "Total", "calls": "calls", "errors": "errors", "cache": "cache", "tokens": "Tokens", "cost": "Cost", "total_est": "Total estimate", "cli_potential": "CLI potential", "inline_work": "inline work", "standard": "standard", "heartbeat": "heartbeat", "no_calls": "No API calls today.", "no_inline": "No inline work", } ``` Presets available in `scripts/`: - `lang_cs.py` — Czech / Čeština ## Implementation Reference implementation: `scripts/format_report.py` To apply to an existing installation: ```bash python3 scripts/patch_format.py /path/to/anthropic-report.py ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: jiangkaiqi2005/vmamba-env-doctor (version 1.0.0)

--- name: vmamba-env-doctor description: Guide for setting up a stable VMamba environment and resolving common CUDA, PyTorch, MMCV, and compilation errors. Use when users encounter issues like "unsupported GNU version", "libc10.so not found", "No module named 'torch' during pip install", or NumPy/OpenCV version conflicts. --- # VMamba Environment Doctor This skill provides a step-by-step guide to set up a **stable, verified environment** for [VMamba](https://github.com/MzeroMiko/VMamba), along with solutions to the most common setup errors. ## When to Use This Skill - User asks for help installing VMamba or its dependencies (`mmcv`, `mmsegmentation`, `selective_scan`). - User reports a compilation error with `nvcc` or `gcc`. - User sees `ImportError: libc10.so: cannot open shared object file`. - User encounters `ModuleNotFoundError: No module named 'torch'` when running `pip install .`. - User faces conflicts between NumPy 2.x and OpenCV or PyTorch. ## Verified Stable Environment Use the following combination to avoid most compatibility issues: - **Python**: 3.10 - **PyTorch**: 2.1.0 - **CUDA**: 11.8 - **gcc/g++**: 11 - **mmengine**: 0.10.1 - **mmcv**: 2.1.0 - **mmsegmentation**: 1.2.2 - **mmdet**: 3.3.0 - **mmpretrain**: 1.2.0 - **numpy**: 1.26.4 - **opencv-python-headless**: 4.10.0.84 ## Step-by-Step Setup Instructions Provide these commands to the user to create a clean environment: ```bash # 1. Create and activate conda environment conda create -n vmamba python=3.10 -y conda activate vmamba # 2. Install PyTorch 2.1.0 with CUDA 11.8 conda install pytorch==2.1.0 torchvision==0.16.0 torchaudio==2.1.0 pytorch-cuda=11.8 -c pytorch -c nvidia -y # 3. Fix MKL symbol error (iJIT_NotifyEvent) conda install "mkl<2024.1" "intel-openmp<2024.1" -c conda-forge -y # 4. Verify PyTorch installation python -c "import torch; print(torch.__version__); print(torch.cuda.is_available()); print(torch.version.cuda)" # 5. Install OpenMMLab packages python -m pip install --upgrade pip python -m pip install setuptools==81.0.0 wheel python -m pip install -U openmim mim install mmengine==0.10.1 mim install mmcv==2.1.0 python -m pip install mmsegmentation==1.2.2 mmdet==3.3.0 mmpretrain==1.2.0 # 6. Fix NumPy and OpenCV compatibility python -m pip install numpy==1.26.4 python -m pip uninstall -y opencv-python opencv-python-headless python -m pip install --no-cache-dir opencv-python-headless==4.10.0.84 # 7. Compile selective_scan with gcc-11 # (Ensure gcc-11 and g++-11 are installed: sudo apt install gcc-11 g++-11) export CC=gcc-11 export CXX=g++-11 cd kernels/selective_scan pip install . --no-build-isolation # 8. Verify selective_scan import python -c "import torch; import selective_scan_cuda_oflex; print('selective_scan OK')"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dinghaibin/cat-tool (version 1.0.0)

--- name: cat-tool description: Concatenate and display file contents to standard output. --- # Cat Tool - File Display Read and concatenate files, displaying contents to stdout. ## Quick Start ```bash cat-tool myfile.txt ``` ## Features - Display file contents - Concatenate multiple files - Line numbers (-n) - Squeeze blank lines (-s) ## Examples ```bash cat-tool README.md cat-tool file1.txt file2.txt > combined.txt cat-tool -n script.py ``` ## See Also - Related documentation: `man cat` (if available)

path: scripts/cat.py
content: #!/usr/bin/env python3
"""Cat Tool - Display files."""
import argparse, sys
parser = argparse.ArgumentParser()
parser.add_argument('files', nargs='*', default=['-'])
args = parser.parse_args()
for f in args.files:
    try:
        print(open(f).read(), end='')
    except: print(f"Error reading: {f}", file=sys.stderr)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)