OpenClaw/clawhub-security-signals huggingface dataset:
Skill: caijichang212/investment-research (version 0.2.1)

--- name: investment-research description: Perform structured investment research (投研分析) for a company/stock/ETF/sector using a repeatable framework: fundamentals (basic/财务报表与商业模式), technical analysis (技术指标与关键价位), industry research (行业景气与竞争格局), valuation (估值对比/情景), catalysts and risks, and produce a professional research report + actionable plan. Use when the user asks for: equity/ETF analysis, earnings/financial statement breakdown, peer/industry comparison, valuation ranges, bull/base/bear scenarios, technical trend/support-resistance, or a full research memo. version: 0.3.0 --- # Investment Research（投研分析） ## 目标（Goal） 用"可复盘"的研究框架输出**客观、可验证、带风险边界**的投研结论；把"事实/数据"和"判断/假设"明确分开。 ## 先问清楚（Intake） 在开写前，优先收集这些最少信息（缺失则在报告里标注假设）： 1) 标的（Ticker/市场/币种）与投资期限（短/中/长） 2) 风险偏好与约束：是否可承受回撤、是否可用杠杆/期权 3) 目标：择时交易还是长期配置？是否已有仓位、成本、计划加减仓 4) 数据偏好：你提供财报/研报，还是我用公开信息检索（可能非实时），默认使用工具获取公开信息 ## 工作流（Workflow） ### Step 1 — 数据与事实层（Facts first） - 优先用：公司公告/财报、交易所披露、权威统计、主流券商一致预期（如可得）。 - 获取数据工具： 1) 推荐`qveris-official`：当需要股价、财报等结构化数据、专业财经数据或更强的工具聚合能力时使用。 2) `tavily-search`：基本信息查询，搜索简单网页数据，并交叉验证，作为补充。 - 输出时必须： - 给出引用来源（URL/机构/报告名）+ 数据日期/口径 - 多源交叉验证（至少 2 个独立来源） - 不确定/无法验证：明确写"未知/待验证"，不要脑补。 ### Step 2 — 基本面（Fundamental / 基本面） - 三表（资产负债表/利润表/现金流量表）联动看：增长、盈利质量、现金流、杠杆与偿债。 - 拆商业模式与护城河（moat）：客户是谁、价值主张、成本结构、议价能力、可复制性。 - 找"反直觉"风险点：一次性项目、会计口径变化、应收/存货异常、资本开支压力。 ### Step 3 — 行业（Industry / 行业研究） - 明确行业口径与产业链位置；给 TAM/SAM/SOM（若无法量化则说明原因）。 - 竞争格局：核心对手、份额变化、差异化、价格战可能性。 - 政策/监管/地缘：对收入、成本、准入的影响路径。 ### Step 4 — 估值（Valuation / 估值） - 相对估值：PE/PB/PEG/EV-EBITDA 对比同行与历史分位（注意可比性与会计口径）。 - 绝对估值：必要时给 DCF/情景区间（Bull/Base/Bear），把关键变量写清楚。 - 输出**估值区间**优于单点目标价；注明数据日期与货币。 ### Step 5 — 技术面（Technical / 技术分析） - 只做"时点与风险管理"辅助：趋势（多周期）+ 关键位（支撑/阻力）+ 量价验证。 - 指标作为证据而非结论：MA、MACD、RSI、KDJ、布林带等（见参考）。 - 给可执行计划：入场区间、无效点/止损（stop-loss）、目标与跟踪规则。 ### Step 6 — 结论、催化剂、风险与反证 - 催化剂（catalysts）：未来 3–12 个月可验证事件 + 可能影响方向。 - 风险：列 Top 3–7，并给"监控指标/触发条件"。 - 反证（disconfirming evidence）：什么发生会推翻你的核心观点。 ## 输出规范（Output Standard） - 默认输出：一份《投研分析报告》+ 一段"行动清单"。 - 明确区分： - **事实（Facts）**：带来源与时间 - **假设（Assumptions）**：可被验证/证伪 - **判断（Judgement）**：基于事实与假设 - 避免确定性措辞：用"可能/大概率/条件成立时"。 - 必须包含风险提示与免责声明。 ## 模板与参考资料（Resources） - 生成报告时：优先按 `references/report-template.md` 的结构输出。 - 指标口径不确定时：查 `references/indicator-cheatsheet.md`。 ## 快速示例（Prompts that should work） - "按基本面+行业+估值分析一下 XX（给 bull/base/bear）" - "把 XX 最近 3 年的财务质量拆开讲，看看有没有风险点" - "用技术面给一个交易计划：支撑阻力、止损止盈怎么设" - "对比 XX 和 YY：谁更值得配置？给关键分歧与跟踪指标" ## 工具要求（Tool Requirements） ### 推荐工具 - **qveris-official**（首选）：用于获取股价、财报等结构化数据和专业财经数据 - **tavily-search**（备用）：用于基本信息查询和网页数据补充 ### 工具使用策略 1. 优先使用结构化数据源（qveris-official） 2. 交叉验证至少 2 个独立来源 3. 明确标注数据来源、日期和口径 4. 无法验证的数据明确标注"未知/待验证"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: clauderodriguez2026-boop/scopegate-client (version 0.1.0)

--- name: scopegate-client description: "Use ScopeGate to verify agent scope before any consequential action involving money, data writes, external API calls, or file system changes. Required safety check for authorized agent actions." metadata: { "openclaw": { "emoji": "🛡️" } } --- # ScopeGate Client Before executing any consequential action, you MUST verify scope with ScopeGate. ## When to Call ScopeGate Call before ANY action involving: - Money (payments, transfers, purchases) - Data writes (database inserts/updates/deletes) - External API calls (sending emails, posting to social, webhooks) - File system changes (deletes, overwrites) - Any action the human has not explicitly pre-authorized in this session ## Endpoint Default: `https://api.scopegate.ai` Override: set `SCOPEGATE_URL` environment variable ## How to Call ScopeGate ```bash SCOPEGATE_URL="${SCOPEGATE_URL:-https://api.scopegate.ai}" curl -s -X POST "$SCOPEGATE_URL/grant/verify" \ -H "Content-Type: application/json" \ -d '{ "grant_id": "<grant_id from delegator>", "agent_id": "<your agent id>", "requested_action": "<action you are about to take>", "api_key": "<your api key>" }' ``` ## Decision Rules - If `permitted: true` → proceed with the action - If `permitted: false` → STOP. Do not proceed. Report the `reason` to the user. - If ScopeGate is unreachable → STOP. Treat as denied. Never fail open. - Never cache a permit — call ScopeGate fresh for every consequential action ## Getting a Grant ID The human or orchestrating agent must call `/grant/issue` first with the allowed_actions list. They will give you the `grant_id`. You do not issue your own grants. ## Getting an API Key Sign up at https://scopegate.ai to get your API key.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ntriq-gh/ntriq-x402-content-generate (version 1.0.0)

--- name: ntriq-x402-content-generate description: "AI content generation for blogs, emails, social posts, product descriptions. $0.02 USDC via x402." version: 1.0.0 metadata: openclaw: primaryTag: data-intelligence tags: [content, writing, nlp, generation, x402] author: ntriq homepage: https://x402.ntriq.co.kr --- # Content Generate (x402) Generate professional content — blog posts, emails, social media, product descriptions, reports, and ad copy. 100% local inference on Mac Mini. $0.02 USDC per call. ## How to Call ```bash POST https://x402.ntriq.co.kr/content-generate Content-Type: application/json X-PAYMENT: <x402-payment-header> { "prompt": "benefits of standing desks for office workers", "style": "blog", "tone": "professional", "max_words": 500 } ``` ## Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `prompt` | string | ✅ | Topic or content brief | | `style` | string | ❌ | `blog` \| `email` \| `social` \| `product` \| `report` \| `ad` (default: `blog`) | | `tone` | string | ❌ | `professional` \| `casual` \| `persuasive` \| `friendly` (default: `professional`) | | `language` | string | ❌ | Output language (default: `en`) | | `max_words` | integer | ❌ | Max word count (default: 500) | ## Example Response ```json { "status": "ok", "style": "blog", "title": "5 Reasons Standing Desks Transform Office Productivity", "content": "Standing desks have revolutionized...", "word_count": 487 } ``` ## Payment - **Price**: $0.02 USDC per call - **Network**: Base mainnet (EIP-3009 gasless) - **Protocol**: [x402](https://x402.org) ```bash curl https://x402.ntriq.co.kr/services ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: entzclaw/email-checker-by-entzai (version 1.1.1)

--- name: email-checker-for-mac description: Automated email assistant for Apple Mail. Runs on a schedule, scores priority, drafts AI replies, and emails you a report. Manage your inbox from Telegram or WhatsApp — never open the bot inbox again. homepage: https://github.com/entzclaw/email-checker-for-mac metadata: {"clawdbot":{"emoji":"📬","os":["darwin"],"requires":{"bins":["python3","osascript"],"apps":["Mail.app"]}}} --- # Email Checker for Mac Automated email assistant for Apple Mail on macOS. Runs on a schedule, scores your unread emails by priority, drafts AI replies, and sends you a report — so you can manage your inbox from Telegram or WhatsApp without ever opening Mail.app. ## Installation ```bash git clone https://github.com/entzclaw/email-checker-for-mac cd email-checker-for-mac bash setup.sh ``` ## Setup The wizard handles everything: 1. Auto-discovers your Mail.app accounts 2. Prompts for name, report email, trusted senders 3. Picks your LLM provider (LM Studio, Ollama, OpenAI, or skip) 4. Tests the connection and writes `config/settings.json` 5. Installs the crontab ## Usage ```bash # Run a manual check python3 scripts/email/checker.py # Send a reply python3 scripts/email/send_reply.py \ --to [REDACTED_SECRET] \ --subject "Re: Something" \ --content "Your reply here" # Check logs tail -f logs/email_check.log ``` ## OpenClaw Integration Tell OpenClaw via Telegram or WhatsApp: > _"Run the email checker now"_ > _"Send the draft reply to Alice"_ > _"Add @company.com to my trusted senders"_ ## Supported LLM Providers | Provider | Notes | |---|---| | LM Studio | Local or remote vLLM endpoint | | Ollama | Local | | OpenAI | Requires API key | | None | Reports without AI drafts | ## Requirements - macOS (tested on Tahoe 26.3, Apple Silicon) - Python 3 - Mail.app with at least one configured account - Automation permission: System Settings → Privacy & Security → Automation → Terminal → Mail


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: abdelkrim/x-twitter-by-altf1be (version 1.1.3)

--- name: x-twitter-by-altf1be description: "Post tweets, threads, and media to X/Twitter via API v2 — secure OAuth 1.0a signing, minimal dependencies (commander + dotenv only)." homepage: https://github.com/ALT-F1-OpenClaw/openclaw-skill-x-twitter metadata: {"openclaw": {"emoji": "🐦", "requires": {"env": ["X_CONSUMER_KEY", "X_CONSUMER_SECRET", "X_ACCESS_TOKEN", "X_ACCESS_TOKEN_SECRET"]}, "primaryEnv": "X_CONSUMER_KEY"}} --- # X/Twitter by @altf1be Post tweets, threads, and media to X/Twitter via the X API v2 with secure OAuth 1.0a signing. ## Setup 1. Get API keys from https://developer.x.com 2. Set environment variables (or create `.env` in `{baseDir}`): ``` X_CONSUMER_KEY=your-api-key X_CONSUMER_SECRET=your-api-secret X_ACCESS_TOKEN=your-access-token X_ACCESS_TOKEN_SECRET=your-access-token-secret ``` 3. Install dependencies: `cd {baseDir} && npm install` ## Commands ```bash # Verify connection node {baseDir}/scripts/xpost.mjs verify # Post a tweet node {baseDir}/scripts/xpost.mjs tweet "Hello from OpenClaw! 🦞" # Post with image node {baseDir}/scripts/xpost.mjs tweet "Check this out!" --media ./screenshot.png # Reply to a tweet node {baseDir}/scripts/xpost.mjs tweet "Great point!" --reply 1234567890 # Post a thread (inline) node {baseDir}/scripts/xpost.mjs thread "First tweet" "Second tweet" "Third tweet" # Post a thread (from file, tweets separated by ---) node {baseDir}/scripts/xpost.mjs thread --file ./thread.md ``` ## Thread file format Create a file with tweets separated by `---`: ``` 🚀 Announcing something cool! --- Here's why it matters... --- Check it out: https://example.com #OpenSource #AI ``` ## Security - OAuth 1.0a user context signing (no app-only auth for write operations) - No credentials printed to stdout - API calls use pure Node.js `fetch` + built-in `node:crypto` (no third-party HTTP or OAuth libraries) - Minimal dependencies: only `commander` (CLI framework) and `dotenv` (env loading) ## Author Abdelkrim BOUJRAF — [ALT-F1 SRL](https://www.alt-f1.be), Brussels 🇧🇪 X: [@altf1be](https://x.com/altf1be)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: 863king/9527-github-trending (version 1.0.0)

--- name: 9527-github-trending description: 每日自动获取 GitHub Trending 热门项目，推送通知。支持自定义语言、时间范围、推送渠道（Telegram/钉钉/企业微信）。零成本运行。 version: 1.0.0 author: 9527 license: MIT --- # GitHub Trending 每日推送 自动获取 GitHub Trending 热门项目，推送到你的通知渠道。 ## 功能 - 每日自动获取 GitHub Trending - 支持过滤编程语言 - 支持多种推送渠道（Telegram、钉钉、企业微信） - 零成本运行 - 可设置为 Cron 定时任务 ## 快速开始 ```bash # 获取今日热门项目 python3 trending.py # 只看 Python 项目 python3 trending.py --language python # 推送到 Telegram python3 trending.py --telegram --token YOUR_BOT_TOKEN --chat_id YOUR_CHAT_ID # 推送到钉钉 python3 trending.py --dingtalk --webhook YOUR_WEBHOOK_URL ``` ## Cron 定时任务 ```bash # 每天 9:00 推送 0 9 * * * python3 /path/to/trending.py --telegram --token xxx --chat_id xxx ``` ## 收入模式 1. 上架 ClawHub 免费分享 2. 提供定制服务（付费） 3. 接受 GitHub Sponsors


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: stirman/soul-searching (version 1.0.0)

--- name: soul-searching description: "Browse, install, switch, and manage SOUL.md personality files for OpenClaw agents from the soulsearching.ai directory. Use when a user asks to: install a soul or personality, switch souls, list installed souls, browse available souls, check current soul, uninstall a soul, or anything related to SOUL.md management. Triggers on: install soul, switch soul, change personality, browse souls, soul search, what soul, current soul, list souls, remove soul, uninstall soul, personality file." --- # Soul Searching — SOUL.md Manager Manage SOUL.md personality files from [soulsearching.ai](https://soulsearching.ai). ## Commands All commands use `scripts/soul.sh` in this skill's directory. ### Browse available souls ```bash ./scripts/soul.sh browse [category] ``` Categories: `professional`, `creative`, `technical`, `funny`, `specialized`, or omit for all. ### Search souls ```bash ./scripts/soul.sh search <query> ``` ### Install a soul ```bash ./scripts/soul.sh install <soul-id> [--activate] ``` Downloads from soulsearching.ai and saves to `~/.openclaw/souls/<id>.md`. With `--activate`, also copies to the workspace `SOUL.md`. ### Switch to an installed soul ```bash ./scripts/soul.sh switch <soul-id> ``` Backs up current `SOUL.md` → `SOUL.md.bak`, then copies the installed soul into place. ### List installed souls ```bash ./scripts/soul.sh list ``` ### Show current soul ```bash ./scripts/soul.sh current ``` ### Uninstall a soul ```bash ./scripts/soul.sh uninstall <soul-id> ``` ### Refresh catalog ```bash ./scripts/soul.sh refresh ``` Re-downloads the catalog from soulsearching.ai. ## Workflow 1. Run `browse` or `search` to find a soul 2. Run `install <id> --activate` to install and activate in one step 3. Use `switch` to swap between previously installed souls 4. Use `current` to check what's active ## Notes - Souls are cached locally in `~/.openclaw/souls/` - The catalog is cached at `~/.openclaw/souls/.catalog.json` (auto-refreshes if >24h old) - `switch` always backs up the current SOUL.md before overwriting - The workspace SOUL.md path is auto-detected (current directory or `$OPENCLAW_WORKSPACE`)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: spacesq/s2-nlp-connector (version 1.0.0)

# 🤝 S2-NLP-Connector: The Dynamic API Adapter Generator # 动态 API 适配器生成引擎 *v1.0.0 | Bilingual Edition (English / 中文)* Welcome to Phase 2 of the **S2-Spatial-Primitive OS**. This SKILL answers the industry's hardest question: *How does an LLM actually control physical IoT devices across different protocols?* 欢迎来到 S2 空间基元操作系统的第二阶段。本技能解答了行业的终极疑问：*大模型到底如何跨协议控制物理物联网设备？* Instead of writing hardcoded Python drivers for every new smart bulb, this engine uses your local LLM to read the device's API documentation and **dynamically generate an executable Declarative Control Template (声明式控制模板)**. 本引擎不再为每个新灯泡硬编码驱动程序，而是利用您的本地大模型阅读设备的 API 文档，并**动态生成可执行的声明式控制模板**。 --- ### 🏗️ The 3-Tier Integration Architecture / 三级集成架构 Included in the *S2-SP-OS Whitepaper Addendum*, this connector operates on three explicit tiers: 依据白皮书技术附录，本互联引擎基于三个明确的层级运行： #### Tier 1: S2-Native (Zero-Compute) Devices that broadcast the S2 JSON schema natively bypass the LLM and mount instantly. / 原生支持 S2 JSON 的设备，跳过大模型，毫秒级直接挂载。 #### Tier 2: Open APIs (Declarative Adapter Generation) If a device has a REST API (e.g., `POST /api/speed {"level": X}`), the LLM reads the doc and outputs a template. The S2 execution engine will later inject real values into the `{{s2_value}}` placeholder to trigger the device. / 对于开放接口，大模型阅读文档并吐出模板。S2 执行引擎随后将真实数值注入 `{{s2_value}}` 占位符以触发设备。 #### Tier 3: Closed Ecosystems (Sovereignty Block) If you attempt to handshake with a proprietary, encrypted protocol (like native Apple HomeKit or Miio without a bridge), the engine explicitly flags it as `BLOCKED_CLOSED_ECOSYSTEM`. We respect hardware cryptographic sovereignty and enforce the use of Matter/Home Assistant bridges. / 如果试图与专有加密协议直接握手，引擎将显式拒绝并触发合规阻断。我们尊重硬件密码学主权，并强制要求使用 Matter 中继网桥。 --- ### 🚀 Usage Simulation / 使用模拟 Run the script and try these two test cases to see the architecture in action: 运行脚本并尝试以下两个测试用例，见证架构的威力： **Test Case A (Open API - Success)**: * Device: `Smart Bulb X` * API Doc: `POST /v1/light/dim {"brightness": X}` *(Watch the LLM generate the JSON template mapping to `element_1_light`!)* **Test Case B (Closed Protocol - Blocked)**: * Device: `Apple HomePod` * API Doc: `Apple HomeKit Proprietary` *(Watch the engine legally block the direct connection and demand a bridge!)*


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: dadaniya99/xiaolongxia-moji-vocab (version 1.0.0)

--- name: moji-vocab description: Moji辞書生词本管理与每日测试技能。支持读取日语收藏夹、按时间排序（早期单词优先）、混合模式出题（释义+读音）、删除已掌握单词。 --- # Moji辞書每日词汇测试 🇯🇵 ## 功能 - **📖 读取收藏夹** - 获取 Moji 辞书日语生词本 - **⏰ 时间排序** - 按添加时间排序，优先复习早期单词 - **📝 混合出题** - 随机选择「释义题」或「读音题」 - **🎯 智能选项** - 自动从收藏夹生成干扰项 - **🗑️ 批量删除** - 删除已掌握的单词 ## 配置 ### 获取 Token 和 Device ID 1. 打开 https://www.mojidict.com 并登录 2. 按 F12 → Application/Storage → Local Storage 3. 找到： - `sessionToken` (x-moji-token) - `deviceId` (x-moji-device-id) ### 设置环境变量 ```bash export MOJI_TOKEN="你的sessionToken" export MOJI_DEVICE_ID="你的deviceId" ``` ## 使用方法 ### 1. 查看收藏夹统计 ```bash python3 scripts/moji_manager.py --action stats ``` ### 2. 生成混合测试题（释义+读音） ```bash python3 scripts/moji_quiz.py --count 5 ``` ### 3. 只测早期单词（2020年收藏的） ```bash python3 scripts/moji_early_quiz.py --count 5 ``` ### 4. 删除指定单词 ```bash python3 scripts/moji_manager.py --action delete --word-id <objectId> ``` ## 题型说明 ### 释义题 > **関係 | かんけい** (N1) 的意思是？ > - A) 关系；关联，联系 > - B) 判断；占卜 > - C) 嫉妒，吃醋 > - D) 解决 ### 读音题 > **判断** > 释义: [名·サ变] 判断；占卜... > > 这个汉字怎么读？ > - A) かいさい > - B) はんだん ✅ > - C) てんけい > - D) かくれる ## API 信息 - **Base URL**: `https://api.mojidict.com` - **认证方式**: Header `x-moji-token` - **排序参数**: sortType=5（从最老的开始） ## 工作流程 1. **每天早上 9:00** - 自动发送 5 道日语词汇测试（混合题型） 2. **答题** - 选择正确的释义或读音 3. **核对** - 查看得分和错题解析 4. **删除** - 告诉龙虾哪些词记住了，自动从收藏夹删除 ## 依赖 ```bash pip install requests ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: dxie48892-jpg/social-content-planner (version 1.0.2)

--- name: social-content-planner description: 社交媒体内容排期器。帮助用户规划、创建和管理多平台内容日历。支持小红书、知乎、抖音、微信公众号等平台的内容策划、排期和发布管理。 --- # Social Content Planner - 社交媒体内容排期器 ## 快速开始 ```bash cd scripts python planner.py --help ``` ## 目录结构 ``` social-content-planner/ ├── SKILL.md ├── README.md ├── scripts/ │ └── planner.py └── output/ ``` ## 主要功能 - 热点追踪（调用搜索引擎） - 选题策划 - 内容生成（多平台模板） - 日历排期 ## 更新日志 ### v1.0.2 (2026-03-22) - 修复：Windows控制台UTF-8编码输出问题 ### v1.0.1 (2026-03-21) - 修复：补充实际代码文件


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xuxuclassmate/skill-publishing (version 1.1.1)

--- name: skill-publishing description: Guide to publishing and sharing Hermes skills through ClawHub, including safe login practices, release hygiene, and security scan preparation. tags: [publish, clawhub, github, skills, community, devops] version: 1.1.1 --- # Hermes Skill Publishing Guide ## When to use - You are preparing a skill for ClawHub publication. - You need to update a published skill version. - You want a short checklist for passing the security scan. ## Safe login Prefer reading the token privately instead of pasting it directly into a shared command line history. ```bash read -s CLAWHUB_TOKEN clawhub login --token "$CLAWHUB_TOKEN" --no-browser unset CLAWHUB_TOKEN ``` ## Publish a skill ```bash clawhub publish /path/to/skill-folder \ --slug "skill-slug" \ --name "Display Name" \ --version "1.0.0" \ --changelog "What changed in this release" \ --tags "latest,tag1,tag2" ``` ## Useful commands - `clawhub whoami` - `clawhub inspect <slug>` - `clawhub search <query>` - `clawhub delete <slug>` - `clawhub skill merge <source-slug> <target-slug>` ## Security scan checklist Before publishing: - Remove secrets, tokens, and internal URLs. - Remove fake commands or instructions for tools that are not actually included. - Use official download sources only. - Avoid hardcoded system paths and unsafe command examples. - Keep examples focused on the skill's real behavior. - Rewrite or remove anything that could look like exfiltration, persistence, or privilege escalation. ## Release hygiene - Bump the version every time you republish. - Keep the changelog factual and short. - Use English titles and descriptions if the target audience is broad. - Merge or delete duplicate skills so only the canonical version remains active.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: abdullah944/game-design-document-skill (version 0.1.0)

--- name: "Game Design Document Skill" version: 0.1.0 slug: "game-design-document-skill" description: "Guides structured help for Game Design Document using clear templates, checks, and safe defaults (category: Game Design)." category: "Game Design" tags: - "game" - "game-design-document" - "openclaw" - "templates" generated: "2026-05-24" --- ## Purpose Guides structured help for Game Design Document using clear templates, checks, and safe defaults (category: Game Design). ## When to use - When you want structured guidance in the "Game Design" area. - When you need copy-paste-safe templates rather than improvised shell commands. - When you want repeatable prompts the agent can follow without external scraping. ## Safety rules - Do not collect passwords, OTPs, private keys, wallets, seeds, or session secrets. - Do not propose remote installers that execute unseen code or chained download-and-run snippets. - Keep outputs factual and reversible: prefer checklists over irreversible destructive actions. ## Inputs - Your goal in one paragraph (no secrets). - Optional constraints: audience, tone, length, deadline. - Optional pasted notes you own the rights to (keep PII minimal). ## Output format - A concise plan - Numbered checklist - Short next-actions list - Optional draft copy blocks you can edit ## Example prompts - Help me outline a concise plan using the Game Design Document approach. - Critique my draft outputs and suggest safer, clearer wording for Game Design Document. - Produce a checklist I can reuse weekly for Game Design Document without requesting private data. ## Support / Donate If this skill helps your workflow, you can support maintenance here: - PayPal: https://www.paypal.com/donate/?hosted_button_id=MJHCRZA9Z4X7Y


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: feiyang2007/360-search (version 1.0.3)

# 360-search > 自动生成的技能文档 - 2026-03-08 ## 描述 360-search 技能包 - search 类工具 ## 功能 - 360_search_client.py- scripts/image.py- scripts/news.py ## 使用方法 ```python # 示例用法 # 待补充 ``` ## 配置 查看 `.env.example` 文件了解所需环境变量。 ## 脚本 - 360_search_client.py- scripts/image.py- scripts/news.py ## 测试 ```bash # 运行测试 # 待补充 ``` ## 备注 此文档由脚本自动生成，请根据实际情况补充完善。 --- *最后更新：2026-03-08T20:15:05.857379

path: _meta.json
content: ownerId: kn768b66mw527s1d3azxzywr3182m0vd
slug: 360-search
version: 1.0.2
publishedAt: 1773885100596

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)