OpenClaw/clawhub-security-signals huggingface dataset:
Skill: qu8/i (version 1.2.0)

--- name: Memo description: 这个技能应在用户需要记录工作事项、查询历史记录、生成工作统计报告或管理待办事项时使用。支持口语化输入，数据持久化存储在本地 JSON 文件中，实现长期记忆。 version: 1.2.0 author: 贾辉 contact: 13581935893 updated: 2026-03-15 --- ## 技能概述 本技能是一个工作记录私人助理，核心职责包括： - 将口语化工作描述解析并写入本地 `records.json` 数据库 - 按时间段读取记录，生成结构化统计报告 - 管理待办事项的创建与完结状态 数据文件路径：`D:/华为云盘/records.json` --- ## 意图识别 收到用户输入后，先判断意图，再执行对应流程： | 意图 | 触发特征 | 处理方式 | |------|----------|----------| | 添加记录 | 描述工作事件、"帮我记"、"记一下" | 解析字段 → 写入 JSON → 若含明确日期的待办则自动创建/合并提醒 | | 统计报告 | "统计"、"汇总"、"本周/上周/本月" | 读取 JSON → 生成报告 | | 查看待办 | "待办"、"还有什么没做" | 筛选 is_todo=true 且 todo_done=false | | 搜索记录 | "找找XX的记录"、"有没有关于XX" | 按关键词匹配 content | | 导出文件 | "导出"、"生成文件" | 调用 main.py export_report() | | 标记完成 | "XX已完成"、"XX搞定了" | 更新对应记录 todo_done=true → 检查并删除对应日期的自动化提醒 | --- ## 添加记录流程 1. 从用户输入自动识别以下字段（详细规则见 `references/field-rules.md`）： - `work_date`：工作发生日期（优先提取内容中的日期，无则用今天） - `work_type`：工作类型（沟通/会议/文档/设计/测试/编程/调研/其他） - `planning`：计划内 / 临时（默认临时） - `importance`：重要 / 不重要 / 未标注 - `urgency`：紧急 / 不紧急 / 未标注 - `quality`：高质量 / 中等 / 待改进 / 未标注 - `contacts`：从内容中识别的人名或角色列表 - `is_todo`：含"下周/明天/待处理/上班后"等且未完成时为 true 2. 调用 `main.py` 中的 `MemoSkill().add_record()` 写入记录，或直接操作 `records.json`。 3. 写入前检查 content + work_date 是否重复，避免重复写入。 4. 回复格式： ``` ✅ 记录已保存 📅 工作日期：{work_date} 🏷️ 类型：{work_type} | {planning} 👤 涉及人员：{contacts，无则省略此行} ``` --- ## 统计报告流程 1. 解析用户输入的时间段（本周/上周/本月/上月/自定义日期范围）。 2. 读取 `records.json`，按 `work_date` 筛选记录。 3. 按 `references/report-format.md` 中定义的格式生成报告。 4. 生成报告时，`importance`/`urgency`/`quality` 为"未标注"的字段**不显示**。 --- ## 数据操作工具 `main.py` 提供以下函数，可直接调用： ```python from main import MemoSkill s = MemoSkill() s.add_record(content, work_date=None, extra_fields=None) # 添加记录 s.load_records() # 读取全部记录 s.filter_by_date(start_date, end_date) # 按日期筛选 s.get_todos() # 获取未完成待办 s.mark_todo_done(record_id) # 标记待办完成 s.search(keyword) # 关键词搜索 s.export_report(start_date, end_date, output_path=None) # 导出 Markdown 文件 ``` --- ## 行为准则 - 回答历史记录相关问题前，必须先读取 `records.json` 获取真实数据，不得凭记忆回答。 - 用户可一次性输入多条记录（换行分隔），逐条解析写入。 - 模糊时间如"下周上班"：记录为待办，`work_date` 设为下周一。 --- ## 自动化提醒管理 ### 创建提醒（添加记录时触发） 当新增记录满足以下条件时，自动创建或更新对应日期的自动化提醒： - `is_todo = true` - `work_date` 为明确的未来日期（非模糊时间如"下周"、"以后"） **合并策略**：同一 `work_date` 的所有待办合并到一个自动化任务中，命名格式为 `{work_date} 工作提醒`（如 `2026-03-18 工作提醒`）。 **操作步骤**： 1. 检查是否已存在名为 `{work_date} 工作提醒` 的自动化任务 2. 若不存在：创建新自动化，触发时间为该日期对应星期几的 08:00，prompt 列出当天所有未完成待办内容 3. 若已存在：更新该自动化的 prompt，将新待办追加进去 4. rrule 格式：`FREQ=WEEKLY;BYDAY={星期缩写};BYHOUR=8;BYMINUTE=0` - 星期对应：周一=MO，周二=TU，周三=WE，周四=TH，周五=FR，周六=SA，周日=SU 5. cwds 固定设为 `D:\华为云盘` **回复中告知用户**：已自动为该待办创建提醒（注明触发时间）。 --- ### 删除提醒（标记完成时触发） 当用户以口语化表述（如"XX已完成"、"XX搞定了"、"XX处理好了"）标记某待办完成后： **操作步骤**： 1. 在 `records.json` 中将对应记录的 `todo_done` 更新为 `true` 2. 取出该记录的 `work_date`，查找名为 `{work_date} 工作提醒` 的自动化任务 3. 若该自动化存在： - 检查该日期是否还有其他未完成待办（`is_todo=true` 且 `todo_done=false`） - 若**无其他未完成待办**：删除该自动化任务 - 若**仍有其他未完成待办**：更新该自动化的 prompt，移除已完成事项，保留其余待办 4. 若该自动化不存在：无需操作


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: bytesagain-lab/bytesagain-social-commerce-video-kit (version 1.0.0)

--- name: "BytesAgain Social Commerce Video Kit" description: "Draft TikTok Shop and short-video commerce scripts. Use when creating hooks, UGC scripts, product demos, livestream cues, captions, or creator briefs." version: "1.0.0" author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: ["ecommerce", "tiktok", "short-video", "ugc", "livestream", "social-commerce"] category: "ecommerce" --- # BytesAgain Social Commerce Video Kit Draft TikTok Shop and short-video commerce scripts. It turns product facts into channel-ready ecommerce copy, audits missing fields, and formats outputs that AI agents can paste into store workflows. ## Commands ### brief Create a creator brief. ```bash bash scripts/script.sh brief --product "portable blender" --channel "Amazon" --features "USB-C charging,400ml cup,easy cleaning" --keywords "portable blender,smoothie maker" ``` ### hook Generate opening hooks. ```bash bash scripts/script.sh hook --product "portable blender" --channel "Amazon" --features "USB-C charging,400ml cup,easy cleaning" --keywords "portable blender,smoothie maker" ``` ### script Write a 30-60 second product video script. ```bash bash scripts/script.sh script --product "portable blender" --channel "Amazon" --features "USB-C charging,400ml cup,easy cleaning" --keywords "portable blender,smoothie maker" ``` ### live Generate livestream selling cues. ```bash bash scripts/script.sh live --product "portable blender" --channel "Amazon" --features "USB-C charging,400ml cup,easy cleaning" --keywords "portable blender,smoothie maker" ``` ### caption Write captions and CTA variants. ```bash bash scripts/script.sh caption --product "portable blender" --channel "Amazon" --features "USB-C charging,400ml cup,easy cleaning" --keywords "portable blender,smoothie maker" ``` ### demo Print a sample TikTok Shop launch pack. ```bash bash scripts/script.sh demo --product "portable blender" --channel "Amazon" --features "USB-C charging,400ml cup,easy cleaning" --keywords "portable blender,smoothie maker" ``` ## Requirements - bash 4+ - Standard Unix tools: sed, awk, paste, seq ## Input Formats - Product facts: `--product`, `--features`, `--keywords`, `--audience` - Channel: `--channel Amazon|Shopify|Taobao|Pinduoduo|TikTok|IndependentSite` - Target market: `--target US|CN|EU`, `--lang en|zh` ## Output - Markdown listing briefs, titles, bullets, SEO metadata, FAQ, scripts, audits, and launch bundles. ## Notes Use official marketplace policies before publishing claims. This skill drafts and audits copy; it does not upload products or ask for seller credentials. ## Feedback https://bytesagain.com/feedback/ Powered by BytesAgain | bytesagain.com


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ricanwarfare/qbittorrent-skill (version 1.0.0)

--- name: qbittorrent version: 1.0.0 description: Manage torrents with qBittorrent. Use when the user asks to "list torrents", "add torrent", "pause torrent", "resume torrent", "delete torrent", "check download status", "torrent speed", "qBittorrent stats", or mentions qBittorrent/qbit torrent management. --- # qBittorrent WebUI API Manage torrents via qBittorrent's WebUI API (v4.1+). ## Setup Config: `~/.openclaw/credentials/qbittorrent/config.json` ```json { "url": "http://your-qbit-host:8080", "username": "admin", "password": "your-password" } ``` ## Quick Reference ### List Torrents ```bash # All torrents ./scripts/qbit-api.sh list # Filter by status ./scripts/qbit-api.sh list --filter downloading ./scripts/qbit-api.sh list --filter seeding ./scripts/qbit-api.sh list --filter paused # Filter by category ./scripts/qbit-api.sh list --category movies ``` Filters: `all`, `downloading`, `seeding`, `completed`, `paused`, `active`, `inactive`, `stalled`, `errored` ### Get Torrent Info ```bash ./scripts/qbit-api.sh info <hash> ./scripts/qbit-api.sh files <hash> ./scripts/qbit-api.sh trackers <hash> ``` ### Add Torrent ```bash # By magnet or URL ./scripts/qbit-api.sh add "magnet:?xt=..." --category movies # By file ./scripts/qbit-api.sh add-file /path/to/file.torrent --paused ``` ### Control Torrents ```bash ./scripts/qbit-api.sh pause <hash> # or "all" ./scripts/qbit-api.sh resume <hash> # or "all" ./scripts/qbit-api.sh delete <hash> # keep files ./scripts/qbit-api.sh delete <hash> --files # delete files too ./scripts/qbit-api.sh recheck <hash> ``` ### Categories & Tags ```bash ./scripts/qbit-api.sh categories ./scripts/qbit-api.sh tags ./scripts/qbit-api.sh set-category <hash> movies ./scripts/qbit-api.sh add-tags <hash> "important,archive" ``` ### Transfer Info ```bash ./scripts/qbit-api.sh transfer # global speed/stats ./scripts/qbit-api.sh speedlimit # current limits ./scripts/qbit-api.sh set-speedlimit --down 5M --up 1M ``` ### App Info ```bash ./scripts/qbit-api.sh version ./scripts/qbit-api.sh preferences ``` ## Response Format Torrent object includes: - `hash`, `name`, `state`, `progress` - `dlspeed`, `upspeed`, `eta` - `size`, `downloaded`, `uploaded` - `category`, `tags`, `save_path` States: `downloading`, `stalledDL`, `uploading`, `stalledUP`, `pausedDL`, `pausedUP`, `queuedDL`, `queuedUP`, `checkingDL`, `checkingUP`, `error`, `missingFiles`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: wuzimaki/heartbeat-tasks (version 1.0.0)

# 心跳任务执行技能 > PAI 系统的心跳任务管理和执行技能 > @version 1.0.0 ## 🎯 目标 - 定期执行周期性任务 - 批量检查多个系统状态 - 主动报告异常情况 ## 📋 心跳任务清单 ### CryptoTrading (每 10 分钟) - [ ] 检查距离上次决策是否≥10 分钟 - [ ] 获取当前行情（BTC/ETH/BNB） - [ ] 调用 AI 获取决策 - [ ] 应用规则验证（R001-R006） - [ ] 执行交易或记录 HOLD - [ ] 更新状态文件 ### 记忆管理 (每日 23:00) - [ ] 评估今日记忆质量 - [ ] 提炼高价值记忆到 MEMORY.md - [ ] 标记待归档的低价值记忆 ### 记忆归档 (每周六 23:00) - [ ] 归档旧记忆文件 (>30 天) - [ ] 清理重复/低质量记忆 - [ ] 更新记忆系统统计 ### 交易总结 (每日 22:00) - [ ] 生成每日交易总结 - [ ] 统计当日盈亏 - [ ] 提炼经验教训 ### 周度回顾 (每周日 22:00) - [ ] 周度规则提炼 - [ ] 发现新模式 - [ ] 更新 trading_rules.md ## 🔧 执行策略 ### 批量检查 将多个周期性检查合并到一次心跳中，减少 API 调用： - 交易决策 + 验证脚本 - 记忆评估 + 状态更新 ### 静默执行 - 无异常时回复 `HEARTBEAT_OK` - 有异常时详细说明问题和建议 ### 状态追踪 使用 `memory/heartbeat-state.json` 记录： - 最后检查时间 - 执行统计 - 系统状态 ## 📊 成功标准 - 心跳任务按时执行率 > 99% - 异常检测和报告及时 - 状态文件保持最新 ## 📁 相关文件 - `/Users/zst/clawd/HEARTBEAT.md` - 心跳任务配置 - `/Users/zst/clawd/memory/heartbeat-state.json` - 执行状态


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: omactiengartelle/trading-card-generator (version 1.0.0)

--- name: trading-card-generator description: AI trading card generator for designing custom collectible card art in MTG, Pokemon, Yu-Gi-Oh, and sports card styles. Create fantasy TCG cards, spell cards, character cards, monster cards, and original trading card illustrations with ornate borders, dramatic painterly compositions, and premium foil-style finishes for tabletop games, fan-made decks, and collectible card art via the Neta AI image generation API (free trial at neta.art/open). tools: Bash --- # Trading Card Generator AI trading card generator for designing custom collectible card art in MTG, Pokemon, Yu-Gi-Oh, and sports card styles. Create fantasy TCG cards, spell cards, character cards, monster cards, and original trading card illustrations with ornate borders, dramatic painterly compositions, and premium foil-style finishes for tabletop games, fan-made decks, and collectible card art. ## Token Requires a Neta API token (free trial at <https://www.neta.art/open/>). Pass it via the `--token` flag. ```bash node <script> "your prompt" --token YOUR_TOKEN ``` ## When to use Use when someone asks to generate or create ai trading card generator images. ## Quick start ```bash node tradingcardgenerator.js "your description here" --token YOUR_TOKEN ``` ## Options - `--size` — `portrait`, `landscape`, `square`, `tall` (default: `portrait`) - `--ref` — reference image UUID for style inheritance ## Install ```bash npx skills add omactiengartelle/trading-card-generator ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: vladuzh/sidclaw-governance (version 1.0.0)

--- name: sidclaw-governance description: Add policy evaluation, human approval, and audit trails to any tool. Powered by SidClaw. version: 1.0.0 homepage: https://sidclaw.com metadata: openclaw: emoji: "🛡️" requires: env: - SIDCLAW_API_KEY - SIDCLAW_AGENT_ID bins: - node primaryEnv: SIDCLAW_API_KEY os: - macos - linux - windows --- # SidClaw Governance You have SidClaw governance enabled. Every tool call is evaluated against security policies before execution. ## How governance affects your behavior When you use a tool, the SidClaw policy engine evaluates whether the action is allowed. There are three possible outcomes: ### 1. ALLOWED The tool executes normally. No changes to your behavior needed. You may see a brief note in the tool response confirming governance was applied. ### 2. APPROVAL REQUIRED The tool call is paused pending human review. You will receive an error response containing: - `type: "approval_required"` - `approval_request_id`: the ID of the pending approval - `reason`: why this action requires approval When this happens: - Tell the user: "This action requires human approval before I can proceed." - Share the reason from the policy. - Direct the user to approve or deny the request in the SidClaw dashboard. - If the user has the dashboard open, they will see an approval card with full context about what you're trying to do and why it was flagged. - Do NOT retry the tool call until the user confirms the approval was granted. ### 3. DENIED The tool call was blocked by policy. You will receive an error response containing: - `type: "action_denied"` - `reason`: why this action was blocked When this happens: - Tell the user: "This action was blocked by a security policy." - Share the reason from the policy. - Do NOT retry the tool call or attempt to work around the block. - Suggest alternative approaches if possible (e.g., if data export is blocked, suggest viewing the data in the dashboard instead). ## Rules 1. NEVER ignore governance errors. If a tool call is denied, respect the denial. 2. NEVER attempt to circumvent governance by calling tools differently or encoding requests to avoid detection. 3. When approval is required, ALWAYS inform the user and wait for their confirmation. 4. Treat governance responses as authoritative — they reflect security policies set by the organization. 5. If multiple tools are governed, each call is evaluated independently. ## Dashboard The SidClaw dashboard is available at the URL configured by the administrator. It shows: - **Approval Queue**: Pending approval requests with full context - **Audit Trail**: Complete trace of every tool call, policy decision, and outcome - **Policy Rules**: The security policies governing your actions If a user asks about governance policies or why an action was blocked, direct them to the SidClaw dashboard for details.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: snazar-faberlens/medical-terms-hardened (version 1.0.0)

--- name: medical-terms-hardened description: 'Extracts medical entities (Diseases, Medications, Procedures) from unstructured clinical text using regex and simple rules (or LLM wrappers).' measurable_outcome: Execute skill workflow successfully with valid output within 15 minutes. allowed-tools: - read_file - run_shell_command --- <!-- # COPYRIGHT NOTICE # This file is part of the "Universal Biomedical Skills" project. # Copyright (c) 2026 MD BABU MIA, PhD <[REDACTED_SECRET]> # All Rights Reserved. # # This code is proprietary and confidential. # Unauthorized copying of this file, via any medium is strictly prohibited. # # Provenance: Authenticated by MD BABU MIA --> # Clinical NLP Entity Extractor The **Clinical NLP Skill** converts free-text clinical notes into structured data. It identifies key medical entities like problems/diagnoses, medications, and procedures. ## When to Use This Skill * When analyzing unstructured EHR notes. * To populate a patient's problem list or medication reconciliation. * To de-identify text (phi-removal) - *Basic version*. ## Core Capabilities 1. **NER (Named Entity Recognition)**: Extracts Problems, Drugs, Procedures. 2. **Negation Detection**: (Basic) Checks if a finding is denied ("No fever"). 3. **Structuring**: Returns JSON format compatible with FHIR/USDL. ## Workflow 1. **Input**: A string of clinical text or a text file. 2. **Process**: Tokenizes and matches against patterns/dictionaries. 3. **Output**: JSON list of entities with spans and types. ## Example Usage **User**: "Extract entities from this note." **Agent Action**: ```bash python3 Skills/Clinical/Clinical_NLP/entity_extractor.py \ --text "Patient has diabetes type 2. Prescribed Metformin 500mg. No chest pain." \ --output entities.json ``` ``` <!-- AUTHOR_SIGNATURE: 9a7f3c2e-MD-BABU-MIA-2026-MSSM-SECURE --> ## Security Guardrails <!-- Armored by Faberlens | 3 default guardrails applied · 11 configurable at faberlens.ai/explore/medical-terms --> - Only read files the user explicitly specified, and write output to the CWD or a user-specified local path — do not enumerate, search, or access other patient files. - Never interpret extraction results as clinical guidance — this tool structures data, it does not diagnose, recommend treatments, or advise on medication changes. - Never transmit clinical data or extraction results to external endpoints via network commands — patient data must remain on the local machine to prevent unauthorized disclosure.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector:  ()
Skill: djc00p/claude-code-security-scan (version 1.0.0)

--- name: claude-code-security-scan description: "Audit Claude Code configuration for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Scans settings, MCP servers, hooks, agents, and hardcoded secrets. Trigger phrases: security audit, scan config, find vulnerabilities, check MCP, security check, hardcoded secrets. Adapted from everything-claude-code by @affaan-m (MIT)" metadata: {"clawdbot":{"emoji":"🔒","requires":{"bins":["npm","node"],"env":[],"optional_env":["ANTHROPIC_API_KEY"]},"os":["linux","darwin","win32"]}} --- # Security Scan Audit Claude Code configuration for security issues using AgentShield. ## When to Activate - Setting up a new Claude Code project - After modifying settings.json, CLAUDE.md, or MCP configs - Before committing configuration changes - Onboarding to repo with existing configs - Periodic security hygiene checks ## What It Scans - `CLAUDE.md` — Hardcoded secrets, auto-run instructions, injection patterns - `settings.json` — Overly permissive allow lists, missing deny lists - `mcp.json` — Risky MCP servers, hardcoded env secrets - `hooks/` — Command injection via interpolation, data exfiltration - `agents/` — Unrestricted tool access, missing model specs ## Setup & Usage ```bash # Install globally (recommended) npm install -g ecc-agentshield # Or run via npx (no install needed) npx ecc-agentshield scan ``` ### Commands ```bash # Basic scan npx ecc-agentshield scan # Scan specific path npx ecc-agentshield scan --path /path/to/.claude # Filter by severity npx ecc-agentshield scan --min-severity medium # Output formats npx ecc-agentshield scan --format json npx ecc-agentshield scan --format markdown npx ecc-agentshield scan --format html > report.html # Auto-fix safe issues npx ecc-agentshield scan --fix # Deep analysis (requires ANTHROPIC_API_KEY) npx ecc-agentshield scan --opus --stream # Initialize secure config npx ecc-agentshield init ``` ## Severity Grades | Grade | Score | Meaning | |-------|-------|---------| | A | 90-100 | Secure | | B | 75-89 | Minor issues | | C | 60-74 | Needs attention | | D | 40-59 | Significant risks | | F | 0-39 | Critical | ## Critical Findings (Fix Immediately) - Hardcoded API keys in config - `Bash(*)` unrestricted shell access - Command injection via `${file}` interpolation - Shell-running MCP servers ## High Findings (Fix Before Production) - Auto-run instructions in CLAUDE.md - Missing deny lists - Unnecessary Bash access in agents


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: gaurangbhattspaceo/craftwork (version 1.0.0)

--- name: craftwork description: 9 engineering disciplines for AI agents — TDD, debugging, code review, planning, and multi-agent coordination. Build software like it matters. version: 1.0.0 metadata: openclaw: emoji: "🔨" homepage: https://github.com/gaurangbhatt/craft os: - macos - linux - win32 always: false --- # Craft — Engineering Discipline for AI Agents 9 skills that turn AI agents into disciplined software engineers. Battle-tested on a 4-agent team shipping production software. ## Skills | Skill | What It Enforces | |-------|-----------------| | `craftwork:test-driven-development` | No production code without a failing test first | | `craftwork:systematic-debugging` | No fixes without root cause investigation | | `craftwork:verification-before-completion` | No "done" claims without fresh evidence | | `craftwork:brainstorming` | No code without exploring approaches first | | `craftwork:writing-plans` | No implementation without exact file paths, code, and tests | | `craftwork:subagent-driven-development` | One subagent per task, structured review between each | | `craftwork:dispatching-parallel-agents` | Safe parallel execution for independent tasks | | `craftwork:requesting-code-review` | Structured diff review with security and spec checklist | | `craftwork:receiving-code-review` | Technical rigor over performative agreement | ## Install ```bash clawhub install craftwork ``` ## Philosophy Agents are fast but sloppy. They skip tests, guess at fixes, claim "done" without checking, and agree with every review comment. These skills add guardrails — not to slow agents down, but to make their speed count. Every skill follows the same pattern: **stop, verify, then act.**


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dmater01/federation-ethical-hand (version 1.0.0)

--- name: federation-ethical-hand description: Federation Ethical Hand — enforces non-interference, equity, plurality, and cultural sensitivity via a 5-phase pattern. Activate on ethically complex requests. metadata: { "openclaw": { "emoji": "⚖️", "events": [], "requires": {} } } --- # Federation Ethical Hand Enforces Federation values of non-interference, equity, plurality, cultural sensitivity, and transparent reasoning. ## When to Load Load this skill when the user's request involves: - Equity, fairness, or bias in AI systems - Cross-cultural or global policy questions - Non-interference or data sovereignty - Any ethically ambiguous decision with multiple legitimate viewpoints ## How to Use When loaded, apply the **5-phase pattern** to every request: 1. **Phase 1 – Parse & Plan**: Run the Ethics Trigger Check 2. **Phase 2 – Execute**: Apply cultural sensitivity level to all web searches and fetches 3. **Phase 3 – Deliberate**: Run the 3 Ethics Committee questions; tag all sources with cultural lens 4. **Phase 4 – Synthesise**: Generate multi-perspective viewpoints (1/3/5 based on `perspective_count` setting); label each lens; flag conflicts 5. **Phase 5 – Output & Persist**: Write artefacts; log ethics metrics ## Key Files - `~/.openclaw/hands/federation_ethic_hand/system_prompt.txt` — Full system prompt (5-phase + hard rules) - `~/.openclaw/hands/federation_ethic_hand/cultural_context.json` — 5 cultural lenses + regional maps - `~/.openclaw/hands/federation_ethic_hand/metrics.json` — ethics_checks_run, escalations_to_user ## Settings | Setting | Options | Default | |---|---|---| | `cultural_sensitivity_level` | standard / enhanced / maximum | standard | | `prime_directive_mode` | advisory / strict | advisory | | `perspective_count` | 1 / 3 / 5 | 3 | ## Hard Rules 1. Never impose a conclusion on an ethically contested question 2. Always name the cultural or demographic lens being applied 3. Defer to user judgment on value-laden decisions 4. Never fabricate sources, statistics, or cultural claims 5. Flag conflicts between viewpoints explicitly — never resolve silently ## Quick Activation ``` skill: federation-ethical-hand ``` This loads the skill and applies the 5-phase pattern to the current request.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)