OpenClaw/clawhub-security-signals huggingface dataset:
Skill: mike47512/release-notes (version 1.0.0)

--- name: release-notes description: "User-facing change logs: categories, clarity, links. Use when maintaining CHANGELOG or release notes." --- # Release Notes Structured guidance for **CHANGELOG** files and **release notes**: confirm triggers, propose the stages below, and adapt if the user wants a lighter pass. ## When to Offer This Workflow **Trigger conditions:** - User mentions **release notes**, **CHANGELOG**, **what shipped**, or closely related work - They want a structured workflow rather than ad-hoc tips - They are preparing a review, rollout, or stakeholder communication **Initial offer:** Explain the four stages briefly and ask whether to follow this workflow or work freeform. If they decline, continue in their preferred style. ## Workflow Stages ### Stage 1: Clarify context & goals Anchor on **audience** (users vs developers) and **cadence** (per release vs continuous). Ask what success looks like and what must not break. ### Stage 2: Structure & categories Group changes (features, fixes, breaking, security). Prefer links to issues/PRs and migration notes when breaking. ### Stage 3: Draft & refine Iterate for clarity: imperative mood, scannable bullets, version headers aligned with semver or product versioning. ### Stage 4: Verify & ship Close the loop with **tone: concise and verifiable**: monitoring, documentation, stakeholder updates, and lessons learned for the next cycle. ## Checklist Before Completion - Goals and constraints are explicit for **release notes** work - Risks and trade-offs are stated, not hand-waved - Verification steps match the change’s impact (tests, canary, peer review) - Operational follow-through is covered (monitoring, docs, owners) ## Tips for Effective Guidance - Be procedural: stage-by-stage, with clear exit criteria - Ask for missing context (environment, scale, deadlines) before prescribing - Prefer checklists and concrete examples over generic platitudes - If the user declines the workflow, switch to freeform help without lecturing ## Handling Deviations - If the user wants to skip a stage: confirm and continue with what they need. - If context is missing: ask targeted questions before strong recommendations. - Prefer concrete examples, trade-offs, and verification steps over generic advice. ## Quality Bar - Each recommendation should be **actionable** (what to do next). - Call out **failure modes** relevant to release communication (security, scale, UX, or ops). - Keep tone direct and respectful of the user’s time.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: chongjie-ran/wecom-email (version 1.0.0)

--- name: wecom-email version: 1.0.0 description: > 企业微信邮箱操作 - 使用专用邮箱发送邮件。 支持读取会议纪要、业务文档等作为邮件内容发送。 author: SC keywords: [email, mail, smtp, wecom, notification] metadata: openclaw: emoji: "📧" category: productivity --- # 📧 WeCom Email - 企业微信邮箱 使用专用邮箱发送工作邮件。 ## 快速开始 ### 1. 配置 SMTP | 配置项 | 值 | |--------|-----| | SMTP服务器 | smtp.exmail.qq.com | | SMTP端口 | 465 (SSL) | | 邮箱账号 | YOUR_EMAIL@YOUR_DOMAIN.COM | | 凭证文件 | ~/.openclaw/workspace/memory/sc-email-credentials.enc | ### 2. 发送邮件 ```python import smtplib from email.mime.text import MIMEText from email.mime.multipart import MIMEMultipart SMTP_SERVER = "smtp.exmail.qq.com" SMTP_USER = "YOUR_EMAIL@YOUR_DOMAIN.COM" SMTP_PASSWORD = "YOUR_PASSWORD" msg = MIMEMultipart() msg['From'] = SMTP_USER msg['To'] = "[REDACTED_SECRET]" msg['Subject'] = "邮件主题" msg.attach(MIMEText("邮件内容", 'plain', 'utf-8')) server = smtplib.SMTP_SSL('smtp.exmail.qq.com', 465) server.login(SMTP_USER, SMTP_PASSWORD) server.sendmail(SMTP_USER, ["[REDACTED_SECRET]"], msg.as_string()) server.quit() ``` ## 安全规则 ### 发送条件 - ✅ 需要用户明确指令才能发送 - ✅ 只能发送工作相关内容 - ✅ 使用专用邮箱账号 ### 禁止发送 - ❌ 密码、token、密钥等鉴权信息 - ❌ 个人隐私信息 - ❌ 非工作相关内容 ### 账号权限 - 专用邮箱: 仅授权用户可用 - SC代发邮箱: 需用户明确授权 ## 使用示例 ### 发送会议纪要 ```python # 读取会议纪要文件 with open("meeting-minutes.md", 'r') as f: content = f.read() # 发送邮件 send_email( to=["[REDACTED_SECRET]"], subject="会议纪要 - 日期", body=content ) ``` ### 命令行发送 ```bash # 直接使用Python脚本发送 python3 scripts/send-email.py --to "[REDACTED_SECRET]" --subject "主题" --body "内容" ``` ## 凭证管理 - 凭证位置: ~/.openclaw/workspace/memory/sc-email-credentials.enc - 编码方式: Base64 或 AES 加密 - 解码命令示例: `base64 -d ~/.openclaw/workspace/memory/sc-email-credentials.enc` ## 相关文件 - 邮箱列表: ~/.openclaw/workspace/memory/enmo-emails.enc - 个人邮箱: ~/.openclaw/workspace/memory/email-credentials.enc (仅授权账号可用) --- ## 触发词 当用户提到以下内容时激活此Skill： - "发送邮件" - "发邮件" - "邮件通知" - "发送会议纪要" - "用邮箱通知"


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: aaronmda/revenue-scout (version 0.1.0)

--- name: revenue-scout description: "Scan for bounties, gigs, freelance opportunities, and revenue lanes across platforms like ClawHub, GitHub, X, and web. Track and prioritize high-value opportunities." --- # Revenue Scout Autonomous revenue opportunity scanner for agents. ## Capabilities - Search ClawHub for publishable skills and bounties - Query X and web for gigs (Solidity, React, data analysis, agent work) - Prioritize by value, effort, and fit - Maintain a running list of active revenue lanes - Help publish new skills to ClawHub when ready Use when looking to generate earnings without constant human input.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yang1002378395-cmyk/ai-intelligent-content-generation (version 1.0.0)

--- name: ai-intelligent-content-generation version: 1.0.0 description: 内容生成，文章生成 + 图片生成。 metadata: openclaw: emoji: "🤖" requires: bins: [] --- # AI 智能内容生成系统 ## 描述 内容生成，文章生成 + 图片生成。 ## 功能 - 文章生成（AI写作） - 图片生成（AI绘图） - 视频生成（AI视频） - 标题优化（标题生成） - 内容审核（自动审核） ## 定价 - 基础版：¥199/月（100 篇/月） - 专业版：¥999/月（1000 篇/月） - 企业版：¥2999/月（无限篇） ## 适用场景 - 内容创作 - 营销文案 - 新闻写作 - 社媒内容 ## 技术栈 - Python + FastAPI - GPT 集成 - 图片生成 - 内容审核 ## 安装 ```bash git clone https://github.com/openclaw-skills/ai-intelligent-content-generation cd ai-intelligent-content-generation pip install -r requirements.txt python app.py ``` --- 创建：2026-03-13 作者：OpenClaw Skills Team


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: nissan/demo-precacher (version 1.0.1)

--- name: demo-precacher description: Pre-generate and cache all demo content before live presentations — hit every API endpoint in advance, verify playback, report coverage gaps. Use before hackathon demos, investor pitches, or any live presentation that relies on AI-generated content. Never demo live API calls. version: 1.0.0 metadata: openclaw: emoji: "🏃" requires: bins: [] env: - ELEVENLABS_API_KEY - MISTRAL_API_KEY - TURSO_AUTH_TOKEN primaryEnv: ELEVENLABS_API_KEY network: outbound: true reason: "Pre-generates content by calling your configured APIs (ElevenLabs, Mistral, etc.) ahead of a live demo." security_notes: "base64 usage is for encoding binary audio/image content to store in cache — not for obfuscation or exfiltration." --- # Demo Precacher The golden rule of AI demos: **never rely on live API calls during a presentation.** This skill provides a systematic approach to pre-generating and verifying all demo content before you go live. ## Why This Exists In a 48-hour hackathon, we had 18 stories across 10 languages with audio narration, sound effects, and background music. During the demo, the Mistral API had a 3-second latency spike. Because everything was pre-cached, the demo played flawlessly from cache while the audience assumed it was generating in real-time. ## The Pattern ```python async def precache_demo(): scenarios = [ {"name": "Sophie", "language": "fr", "prompt": "A story about cloud whales..."}, {"name": "Kai", "language": "ja", "prompt": "A story about bamboo forests..."}, ] for s in scenarios: # Step 1: Generate content (hits the real API) story = await generate_story(s["prompt"], s["name"], s["language"]) # Step 2: Cache the result await cache.set(s, story) # Step 3: Generate all derived content (audio, images) for scene in story["scenes"]: audio = await generate_tts(scene["text"], voice_id) await cache.set(f"audio_{scene['id']}", audio) # Step 4: Verify playback cached = await cache.get(s) assert cached is not None, f"Cache miss for {s['name']}" # Step 5: Report coverage print(f"Cached {len(scenarios)} scenarios, all verified ✅") ``` ## Checklist Before any live demo, verify: - [ ] All primary scenarios cached and verified - [ ] Audio files playable (correct format, no corruption) - [ ] Fallback content available if cache miss occurs - [ ] Demo account credentials working - [ ] Network not required for cached playback - [ ] Cache TTL won't expire during the presentation ## Files - `scripts/precache_demo.py` — Example precacher with verification and coverage reporting


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: nissan/group-chat-protocol (version 1.0.0)

--- name: group-chat-protocol version: 1.0.0 description: Governs Loki's behaviour in Telegram group chats — when to speak, when to stay silent, how to react, and platform formatting rules. author: nissan tags: - telegram - group-chat - protocol - privacy metadata: openclaw: emoji: "💬" network: outbound: false --- # Group Chat Protocol ## Know When to Speak In group chats where you receive every message, be **smart about when to contribute**. **Respond when:** - Directly asked (by name or @mention) - You can add clear value the conversation lacks - Something witty and appropriate fits naturally - Correcting misinformation - Summarizing a long thread someone asked to summarize **Stay silent (send HEARTBEAT_OK internally) when:** - Casual banter between humans - Question already answered by someone else - Your response would just be "yeah" or "👍" - Conversation is flowing fine without you - Late night (23:00–08:00 AEST) unless urgent **The human rule:** Quality > quantity. If you wouldn't send it in a real group chat with friends, don't send it. **Avoid the triple-tap:** One thoughtful response beats three fragments. Write it once, write it well. ## React Like a Human Use emoji reactions naturally on Telegram. React when: - You appreciate something - Something made you laugh - You find it interesting or insightful - You want to acknowledge without interrupting the flow One reaction per message max. Don't over-react to every message. ## Platform Formatting Rules | Platform | Rule | |---|---| | Discord / WhatsApp | No markdown tables — use bullet lists instead | | Discord links | Wrap in `<>` to suppress embeds | | WhatsApp | No headers — use **bold** or CAPS instead | | Telegram | Markdown renders — use it normally | ## Group Privacy Rule You have access to Nissan's private context. That doesn't mean you share it. In groups, you're a participant — not Nissan's voice, not their proxy. Private memory, DM history, and personal context stay private. Think before you speak.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: nimachu/svg-generator-pro (version 1.0.0)

--- name: svg-generator description: Generate customizable SVG backgrounds and graphics with multiple styles (tech, minimal, geometric, abstract) and color schemes. Use when creating website backgrounds, presentation slides, social media graphics, or UI decorative elements. --- # SVG Generator Skill Generate beautiful, customizable SVG backgrounds and graphics for websites, presentations, and more. ## Features - **4 Styles**: tech, minimal, geometric, abstract - **5 Color Schemes**: blue-purple, gray-blue, teal-cyan, green-blue, custom - **Local Execution**: No API costs, completely free - **Web Ready**: Responsive design, optimized for web use ## Quick Start ```bash # Generate tech-style background svg-generator --style tech --colors blue-purple --output hero-bg.svg # Generate minimal background svg-generator --style minimal --colors gray-blue --output simple-bg.svg # Generate geometric pattern svg-generator --style geometric --colors teal-cyan --output pattern-bg.svg # Generate abstract art svg-generator --style abstract --colors green-blue --output art-bg.svg ``` ## Styles Available | Style | Description | Best For | |-------|-------------|----------| | `tech` | Abstract tech elements (data flows, nodes, circuits) | Tech websites, SaaS landing pages | | `minimal` | Clean, simple gradients and shapes | Professional sites, portfolios | | `geometric` | Mathematical patterns and geometric shapes | Modern designs, dashboards | | `abstract` | Artistic abstract compositions | Creative projects, social media | ## Color Schemes | Scheme | Colors | Use Case | |--------|--------|----------| | `blue-purple` | Tech blue to purple gradient | SaaS, tech products | | `gray-blue` | Professional gray to blue | Corporate, business | | `teal-cyan` | Modern teal to cyan | Fresh, modern designs | | `green-blue` | Nature-inspired green to blue | Eco, wellness brands | | `custom` | Specify your own hex colors | Brand-specific needs | ## Advanced Usage ### Custom Colors ```bash svg-generator --style tech --colors "#FF6B6B-#4ECDC4" --output custom.svg ``` ### Generate PNG ```bash # First generate SVG, then convert svg-to-png input.svg output.png --width 1920 --height 1080 ``` ## Bundled Resources ### Scripts - `scripts/generate-svg.js` - Main SVG generation script - `scripts/svg-to-png.js` - Convert SVG to PNG - `scripts/ppt-image-generator.js` - Generate images for PPT templates ### Assets - `assets/` - Sample SVG outputs for reference ## Integration Examples ### Website Hero Background ```bash svg-generator --style tech --colors blue-purple --output public/hero-bg.svg ``` ### Social Media Post ```bash svg-generator --style abstract --colors teal-cyan --output social-post.svg svg-to-png social-post.svg social-post.png --width 1080 --height 1080 ``` ### Presentation Slide ```bash ppt-image-generator --template modern --output slide-bg.svg ``` ## Related Skills - `pptx-2` - For integrating SVG into PowerPoint presentations - `diagram` - For generating diagrams alongside backgrounds


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: athola/nm-gauntlet-curate (version 1.0.2)

--- name: curate description: | Add or edit knowledge annotations. Capture tribal knowledge, business context, and rationale that cannot be inferred from code version: 1.9.5 metadata: {"openclaw": {"homepage": "https://github.com/athola/claude-night-market/tree/master/plugins/gauntlet", "emoji": "\ud83e\udd9e"}} source: claude-night-market source_plugin: gauntlet --- > **Night Market Skill** — ported from [claude-night-market/gauntlet](https://github.com/athola/claude-night-market/tree/master/plugins/gauntlet). For the full experience with agents, hooks, and commands, install the Claude Code plugin. # Curate Knowledge Add developer-authored annotations to the knowledge base. ## Steps 1. Identify the module to annotate 2. Ask for the concept (key insight or rule) 3. Ask for the why (rationale, history, context) 4. Generate YAML annotation file 5. Save to `.gauntlet/annotations/<slug>.yaml` 6. Confirm saved and will be included in future challenges


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yuyiyuleyuli-cloud/clawhub-security-scan (version 1.1.2)

--- name: clawhub-security-scan description: Pre-publish security scan for ClawHub skills - Scans code for patterns that might get flagged as suspicious and gives fixing suggestions. --- # ClawHub Security Scan Pre-publish security scan for ClawHub skills. Scans your skill code for patterns that might trigger automatic suspicious flagging on ClawHub, and gives actionable fixing suggestions. ## Commands | Command | Description | |:---|:---| | `scan.py` | Scan a skill folder for suspicious patterns | | `precheck.py` | **Interactive pre-publish checklist wizard** - step-by-step security check before publishing | | `review.py` | Review scan results and get modification suggestions | ## Usage ```bash # Scan a skill folder python scripts/scan.py --path ./my-skill ``` ## What it scans Scans for code patterns that commonly trigger ClawHub VirusTotal Code Insight suspicious flagging: ### 🔴 High Risk (really dangerous, should fix) - Reads sensitive files (`/etc/passwd`, `~/.ssh/*`, `id_rsa`, etc.) - Uses dangerous functions (`eval()`, `exec()`, `execfile()`) without validation - Dynamic code execution from untrusted sources - Hard-coded API keys/tokens in source code ### 🟡 Medium Risk (may trigger false positive flagging, need review) - Reads environment variables for API keys (normal & safe, but triggers flag) - Makes external HTTP/HTTPS requests (normal for most skills, but triggers flag) - Uses `subprocess`, `os.system` to run system commands - Downloads code from external sources ### 🟢 Good Practice - Reads environment variables instead of hard-coding keys - All network requests go to known public APIs - No arbitrary code execution ## Output - Gives each file a risk rating (High/Medium/Low/Good) - Lists the line numbers and patterns found - Gives specific modification suggestions - Exits with non-zero code if high risk issues found ## Pricing **0.001 USDT per call**, billed via SkillPay.me. ## Custom Configuration You can create a `.clawhub-security` file in your skill root to ignore specific patterns that you know are safe: ``` # .clawhub-security - ignore patterns that are safe ignore: high-entropy-secret # ignore the high-entropy warning for your SkillID ignore: os\.environ # ignore environment variable warnings ``` One pattern per line. Lines starting with `#` are comments. ## Why use this ClawHub automatically scans published skills with VirusTotal Code Insight. Some perfectly normal patterns (like reading env vars or making API requests) get flagged as "suspicious" scaring users. This tool helps you find and address those issues before publishing. **This tool doesn't guarantee you won't get flagged, but it greatly reduces the chance.**

path: _meta.json
content: 
{
  "name": "clawhub-security-scan",
  "version": "1.0.0",
  "description": "Pre-publish security scan for ClawHub skills - Finds patterns that may get flagged as suspicious.",
  "author": "",
  "license": "MIT",
  "keywords": ["clawhub", "security", "scan", "suspicious", "publishing"]
}


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: dinghaibin/ps-tool (version 1.0.0)

--- name: ps-tool description: Display information about active processes. Use for monitoring running programs, checking resource usage, and system diagnostics. --- # PS - Process Status Viewer Show snapshot of current processes with PID, CPU usage, memory consumption, and status. Essential for system monitoring and process management. ## Usage ```bash ps-tool [options] ``` ## Common Options - `aux`: Detailed view of all processes - `-ef`: Full-format listing - `-u user`: Filter by user - `--sort=-%mem`: Sort by memory usage ## Examples ```bash ps-tool aux ps-tool -ef ps-tool -u root ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ckchzh/decision-maker (version 2.0.0)

--- version: "2.0.0" name: decision-maker description: "决策分析工具。利弊对比、加权决策矩阵、盲选消除偏见、决策框架推荐、风险评估。Decision maker with pros-cons analysis, weighted matrix, blind choice, decision frameworks." author: BytesAgain homepage: https://bytesagain.com source: https://github.com/bytesagain/ai-skills --- # decision-maker 决策分析工具。利弊对比、加权决策矩阵、盲选消除偏见、决策框架推荐、风险评估。Decision maker with pros-cons analysis, weighted matrix, blind choice, decision frameworks, risk assessment. ## 速查表 See commands above. ## 可用命令 - **analyze** — analyze - **pros-cons** — pros cons - **matrix** — matrix - **blind** — blind - **framework** — framework - **risk** — risk > 💡 小技巧：先用 `help` 查看所有命令，再选择最适合的 ## 专业建议 - 问自己：这个决定... - 分钟后**我会怎么想？ - 个月后**我会怎么想？ - 年后**我会怎么想？ - W**iden options — 拓宽选择 --- *decision-maker by BytesAgain* --- 💬 Feedback & Feature Requests: https://bytesagain.com/feedback Powered by BytesAgain | bytesagain.com ## Examples ```bash # Show help decision-maker help # Run decision-maker run ``` - Run `decision-maker help` for commands - No API keys needed ## Commands Run `decision-maker help` to see all available commands. - Run `decision-maker help` for all commands


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: huangjingzhi07/currency-converter-zh (version 1.0.0)

--- name: currency-converter-zh version: 1.0.0 description: 货币汇率换算工具（中文版） author: 黄豆豆 tags: [货币, 汇率, 换算, 金融, 工具, 中文] --- # currency-converter-zh - 货币汇率换算 货币汇率换算工具。 ## 功能 1. **汇率查询** - 查询实时汇率 2. **货币换算** - 多种货币之间的换算 ## 触发关键词 - 汇率 - 换算 - 美元 - 人民币 - 欧元 - 日元 ## 支持货币 - USD - 美元 - CNY - 人民币 - EUR - 欧元 - JPY - 日元 - GBP - 英镑 - HKD - 港币 ## 使用示例 - "100美元等于多少人民币" - "汇率 USD to CNY" - "50欧元"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: razzeee/codeberg (version 0.1.0)

--- name: codeberg description: "Interact with Codeberg using the `tea` CLI. Use `tea issue`, `tea pr`, `tea actions`, and `tea api` for issues, PRs, Actions, and advanced queries." metadata: { "openclaw": { "emoji": "🏔️", "requires": { "bins": ["tea"] }, "install": [ { "id": "brew", "kind": "brew", "formula": "tea", "bins": ["tea"], "label": "Install Tea CLI (brew)", }, { "id": "go", "kind": "go", "module": "code.gitea.io/tea@latest", "bins": ["tea"], "label": "Install Tea CLI (go)", }, ], }, } --- # Codeberg Skill Use the `tea` CLI to interact with Codeberg. Codeberg is a Forgejo instance, and the `tea` CLI is fully compatible with it. ## Pull Requests List open pull requests: ```bash tea pulls --repo owner/repo ``` Check details of a PR: ```bash tea pr 55 --repo owner/repo ``` ## Issues List open issues: ```bash tea issues --repo owner/repo ``` View an issue: ```bash tea issue 123 --repo owner/repo ``` ## Actions (CI/CD) List repository secrets: ```bash tea actions secrets list --repo owner/repo ``` List repository variables: ```bash tea actions variables list --repo owner/repo ``` ## API for Advanced Queries The `tea api` command is useful for accessing data not available through other subcommands. Get PR with specific fields (requires `jq` for filtering): ```bash tea api repos/owner/repo/pulls/55 | jq '.title, .state, .user.login' ``` ## Logins To use `tea` with Codeberg, you first need to add your login: ```bash tea login add --name codeberg --url https://codeberg.org --token <your-token> ``` Then you can use `--login codeberg` in your commands: ```bash tea pulls --repo owner/repo --login codeberg ``` List all configured logins: ```bash tea logins ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)