OpenClaw/clawhub-security-signals huggingface dataset:
Skill: nonlinear/transcript-triage (version 1.0.1)

--- name: transcript-triage description: "Parses long transcripts into topics under ordered lists, to triage in your notes system" type: public version: 0.1.0 status: published dependencies: [] author: nonlinear license: MIT --- ## Transcript Triage **Parse AI conversation transcripts → numbered topics → groom into positions.** ### Flow 1. **Trigger:** User provides transcript (MD format) 2. **Parse:** AI extracts topics, decisions, action items 3. **Triage:** Classify by urgency/importance: - **NOW** - Current epic (immediate) - **LATER** - Future epics (planned) - **BACKLOG** - Ideas (someday/maybe) - **DECISIONS** - What was agreed (log) 4. **Groom:** User positions topics in correct places (ROADMAP, epic-notes, memory) ### Triggers - "triage transcript" - "parse conversation" - "organize chat" - "extract action items from [file/paste]" ### Output Format ```markdown ## Triage Results ### NOW (v1.1.0 Contract Diagram) 1. [Topic] - [Brief description] 2. [Topic] - [Brief description] ### LATER (Future Epics) 3. [Topic] - [Brief description] 4. [Topic] - [Brief description] ### BACKLOG (Ideas) 5. [Topic] - [Brief description] ### DECISIONS (Log to Memory) - [Decision] - [Context] - [Decision] - [Context] ``` ### Integration Points - **Backstage:** Auto-add NOW items to current epic-notes/ - **ROADMAP:** Suggest LATER items as new epics - **Memory:** Log DECISIONS to memory/YYYY-MM-DD.md --- ## Notes **Why this skill?** - External AI chats (Claude, ChatGPT, etc.) generate valuable insights - Transcripts are hard to parse manually - Need systematic way to extract → classify → act **Similar skills:** - Backstage (epic management, checks) - Roadmap (epic planning, grooming) - Memory (decision logging) **Unique value:** - Bridges external conversations → internal workflow - Automates triage (urgency + importance) - Preserves context (decisions logged, not lost)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: 12357851/obsidian-1-0-0-local-backup (version 1.0.0)

--- name: obsidian description: Work with Obsidian vaults (plain Markdown notes) and automate via obsidian-cli. homepage: https://help.obsidian.md metadata: {"clawdbot":{"emoji":"💎","requires":{"bins":["obsidian-cli"]},"install":[{"id":"brew","kind":"brew","formula":"yakitrak/yakitrak/obsidian-cli","bins":["obsidian-cli"],"label":"Install obsidian-cli (brew)"}]}} --- # Obsidian Obsidian vault = a normal folder on disk. Vault structure (typical) - Notes: `*.md` (plain text Markdown; edit with any editor) - Config: `.obsidian/` (workspace + plugin settings; usually don’t touch from scripts) - Canvases: `*.canvas` (JSON) - Attachments: whatever folder you chose in Obsidian settings (images/PDFs/etc.) ## Find the active vault(s) Obsidian desktop tracks vaults here (source of truth): - `~/Library/Application Support/obsidian/obsidian.json` `obsidian-cli` resolves vaults from that file; vault name is typically the **folder name** (path suffix). Fast “what vault is active / where are the notes?” - If you’ve already set a default: `obsidian-cli print-default --path-only` - Otherwise, read `~/Library/Application Support/obsidian/obsidian.json` and use the vault entry with `"open": true`. Notes - Multiple vaults common (iCloud vs `~/Documents`, work/personal, etc.). Don’t guess; read config. - Avoid writing hardcoded vault paths into scripts; prefer reading the config or using `print-default`. ## obsidian-cli quick start Pick a default vault (once): - `obsidian-cli set-default "<vault-folder-name>"` - `obsidian-cli print-default` / `obsidian-cli print-default --path-only` Search - `obsidian-cli search "query"` (note names) - `obsidian-cli search-content "query"` (inside notes; shows snippets + lines) Create - `obsidian-cli create "Folder/New note" --content "..." --open` - Requires Obsidian URI handler (`obsidian://…`) working (Obsidian installed). - Avoid creating notes under “hidden” dot-folders (e.g. `.something/...`) via URI; Obsidian may refuse. Move/rename (safe refactor) - `obsidian-cli move "old/path/note" "new/path/note"` - Updates `[[wikilinks]]` and common Markdown links across the vault (this is the main win vs `mv`). Delete - `obsidian-cli delete "path/note"` Prefer direct edits when appropriate: open the `.md` file and change it; Obsidian will pick it up.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: googleworkspace-bot/recipe-email-drive-link (version 1.0.12)

--- name: recipe-email-drive-link description: "Share a Google Drive file and email the link with a message to recipients." metadata: version: 0.22.5 openclaw: category: "recipe" domain: "productivity" requires: bins: - gws skills: - gws-drive - gws-gmail --- # Email a Google Drive File Link > **PREREQUISITE:** Load the following skills to execute this recipe: `gws-drive`, `gws-gmail` Share a Google Drive file and email the link with a message to recipients. ## Steps 1. Find the file: `gws drive files list --params '{"q": "name = '\''Quarterly Report'\''"}'` 2. Share the file: `gws drive permissions create --params '{"fileId": "FILE_ID"}' --json '{"role": "reader", "type": "user", "emailAddress": "[REDACTED_SECRET]"}'` 3. Email the link: `gws gmail +send --to [REDACTED_SECRET] --subject 'Quarterly Report' --body 'Hi, please find the report here: https://docs.google.com/document/d/FILE_ID'`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: gchapim/hackernews (version 1.0.0)

--- name: hackernews description: Browse and search Hacker News. Fetch top, new, best, Ask HN, Show HN stories and job postings. View item details, comments, and user profiles. Search stories and comments via Algolia. Find "Who is hiring?" threads. Use for any HN-related queries like "what's trending on HN?", "search HN for AI", "show comments on story X", "who is hiring?", "latest Ask HN posts". --- # Hacker News CLI tool for the Hacker News API. No authentication required. ## CLI Usage Run `scripts/hn.sh <command>`. All commands support `--json` for raw JSON output. ### Browse Stories ```bash # Top/trending stories (default 10) scripts/hn.sh top scripts/hn.sh top --limit 20 # Other lists scripts/hn.sh new --limit 5 # newest scripts/hn.sh best --limit 10 # highest rated scripts/hn.sh ask # Ask HN scripts/hn.sh show # Show HN scripts/hn.sh jobs # job postings ``` ### View Item Details & Comments ```bash # Full item details (story, comment, job, poll) scripts/hn.sh item 12345678 # Top comments on a story scripts/hn.sh comments 12345678 scripts/hn.sh comments 12345678 --limit 10 --depth 2 ``` ### User Profiles ```bash scripts/hn.sh user dang ``` ### Search ```bash # Basic search scripts/hn.sh search "rust programming" # With filters scripts/hn.sh search "LLM" --type story --sort date --period week --limit 5 scripts/hn.sh search "hiring remote" --type comment --period month ``` ### Who is Hiring ```bash # Latest "Who is hiring?" job postings scripts/hn.sh whoishiring scripts/hn.sh whoishiring --limit 20 ``` ## Common Workflows | User asks | Command | |---|---| | "What's trending on HN?" | `scripts/hn.sh top` | | "Latest Ask HN posts" | `scripts/hn.sh ask` | | "Search HN for X" | `scripts/hn.sh search "X"` | | "Show me comments on story Y" | `scripts/hn.sh comments Y` | | "Who is hiring?" | `scripts/hn.sh whoishiring` | | "Tell me about HN user Z" | `scripts/hn.sh user Z` | ## Notes - Story lists use parallel fetching for speed - HTML in comments/bios is auto-converted to plain text - Timestamps shown as relative time ("2h ago", "3d ago") - For API details, see [references/api.md](references/api.md)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: muguozi1/feishu-evolver-wrapper-local (version 1.0.0)

--- name: feishu-evolver-wrapper description: Feishu-integrated wrapper for the capability-evolver. Manages the evolution loop lifecycle (start/stop/ensure), sends rich Feishu card reports, and provides dashboard visualization. Use when running evolver with Feishu reporting or when managing the evolution daemon. --- # Feishu Evolver Wrapper A lightweight wrapper for the `capability-evolver` skill. It injects the Feishu reporting environment variables (`EVOLVE_REPORT_TOOL`) to enable rich card reporting in the Master's environment. ## Usage ```bash # Run the evolution loop node skills/feishu-evolver-wrapper/index.js # Generate Evolution Dashboard (Markdown) node skills/feishu-evolver-wrapper/visualize_dashboard.js # Lifecycle Management (Start/Stop/Status/Ensure) node skills/feishu-evolver-wrapper/lifecycle.js status ``` ## Architecture - **Evolution Loop**: Runs the GEP evolution cycle with Feishu reporting. - **Dashboard**: Visualizing metrics and history from `assets/gep/events.jsonl`. - **Export History**: Exports raw history to Feishu Docs. - **Watchdog**: Managed via OpenClaw Cron job `evolver_watchdog_robust` (runs `lifecycle.js ensure` every 10 min). - Replaces fragile system crontab logic. - Ensures the loop restarts if it crashes or hangs.


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: itsnishi/audit-code (version 1.1.1)

--- name: audit-code description: Security-focused code review for hardcoded secrets, dangerous calls, and common vulnerabilities disable-model-invocation: true allowed-tools: Read, Glob, Grep, Bash context: fork --- # audit-code -- Project Code Security Review Security-focused code review of project source code. Covers OWASP-style vulnerabilities, hardcoded secrets, dangerous function calls, and patterns relevant to AI-assisted development. ## What to do Run the auditor against the target path: ```bash python3 "$SKILL_DIR/scripts/audit_code.py" "$ARGUMENTS" ``` If `$ARGUMENTS` is empty, default to `$PROJECT_ROOT`. ## What it checks - **Hardcoded secrets** -- API keys (AWS, GitHub, Stripe, OpenAI, Slack), tokens, private keys, connection strings, passwords - **Dangerous function calls** -- eval, exec, subprocess with shell=True, child_process.exec, pickle deserialization, system(), gets(), etc. - **SQL injection** -- String concatenation/interpolation in SQL queries - **Dependency risks** -- Known hallucinated package names, unverified installations - **Sensitive files** -- .env files committed to git, credential files in repo - **File permissions** -- Overly permissive chmod patterns - **Exfiltration patterns** -- Base64 encode + network send, DNS exfiltration, credential file reads ## Output Structured report with severity-ranked findings, file locations, and actionable remediation steps. ## When to use - Before committing or pushing code - When reviewing third-party contributions or PRs - As part of a periodic security audit of the codebase - After AI-assisted code generation to verify no secrets or vulnerabilities were introduced ## Advisory hooks The repository's `.claude/settings.json` includes PreToolUse hooks that warn on dangerous Bash and Write operations. These hooks are **advisory only** -- they produce warnings but do not block execution. - audit-code is the detection layer for source code security issues - The hooks provide supplementary runtime warnings during agent operation - To enforce blocking, hooks must return `{"decision": "block"}` instead of warning messages


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: rioo-maker/12-cool-skills-openclaw-agent (version 1.0.1)

--- name: ai-trading description: "Assistant de trading automatisé pour l'analyse de marché, la détection de signaux et l'exécution de stratégies techniques (RSI, MA, Support/Résistance). À utiliser pour : analyser les cryptomonnaies, calculer la taille des positions, gérer le risque et générer des rapports de performance." --- # AI Trading Cette compétence transforme Manus en un assistant de trading discipliné, capable de suivre des stratégies techniques strictes tout en priorisant la gestion des risques. ## Fonctionnalités Principales - **Analyse Technique Multi-Indicateurs** : Utilisation du RSI (période 14), des Moyennes Mobiles (MA20, MA50) et détection dynamique des supports et résistances. - **Gestion des Risques Intégrée** : Calcul automatique de la taille de position pour limiter le risque par trade à 1-2% du capital total. - **Filtrage des Signaux** : Validation des entrées par le volume et la tendance globale pour éviter les faux signaux. - **Suivi de Performance** : Génération de rapports détaillés incluant le taux de victoire, le profit moyen et le maximum drawdown. ## Ressources de la Compétence ### Scripts - `scripts/position_sizing.py` : Calcule la taille optimale de la position en fonction du capital, du risque souhaité et de la distance du Stop Loss. - Usage : `python3 scripts/position_sizing.py <balance> <risk_percent> <stop_loss_dist>` ### Références - `references/trading_strategies.md` : Contient les règles détaillées pour les entrées ACHAT/VENTE, les paramètres des indicateurs et les contraintes de sécurité (max 3 trades simultanés). ### Templates - `templates/performance_report.md` : Modèle pour la création de rapports de trading professionnels. ## Flux de Travail Recommandé 1. **Analyse de Marché** : Récupérer les données de prix (1m, 5m, 15m, 1h) et calculer les indicateurs techniques (RSI, MA). 2. **Détection de Tendance** : Vérifier la tendance avec les MA20/MA50. Ne trader que dans le sens de la tendance. 3. **Validation du Signal** : Attendre que le RSI, le volume et les niveaux de support/résistance confirment l'entrée. 4. **Calcul du Risque** : Utiliser `position_sizing.py` pour déterminer la taille de la position avant toute exécution. 5. **Exécution et Suivi** : Définir obligatoirement un Stop Loss et un Take Profit (Ratio R/R 1:2 minimum). 6. **Reporting** : Utiliser le template de rapport pour documenter chaque trade et analyser la performance globale. ## Contraintes de Sécurité - **Stop Loss Obligatoire** : Aucun trade ne doit être ouvert sans un Stop Loss défini. - **Limite de Risque** : Ne jamais dépasser 2% de risque par trade. - **Mode Test** : Privilégier le "Paper Trading" pour valider de nouvelles stratégies sans risque financier réel. - **Fail-Safe** : En cas de perte de connexion ou d'erreur API, fermer les positions ouvertes ou arrêter les nouveaux trades.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: edwardrodriguez703-design/book-flooring (version 1.0.1)

--- name: book-flooring description: Book flooring services through Lokuli MCP. Use when user needs to find and book flooring. Triggers on requests like "book a flooring", "find flooring near me", or any flooring service request. --- # uook flooring Book flooring services through Lokuli's MCP server. ## MCP Endpoint ``` https://lokuli.com/mcp/sse ``` Transport: SSE | JSON-RPC 2.0 | POST requests ## Tools ### search ```json { "method": "tools/call", "params": { "name": "search", "arguments": { "query": "flooring", "zipCode": "90640", "maxResults": 20 } } } ``` ### check_availability ```json { "method": "tools/call", "params": { "name": "check_availability", "arguments": { "providerId": "xxx", "serviceId": "yyy", "date": "2025-02-10" } } } ``` ### create_booking ```json { "method": "tools/call", "params": { "name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "[REDACTED_SECRET]", "customerPhone": "+13105551234" } } } ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: hzz780/aelf-skills (version 0.1.0)

--- name: aelf-skills-hub description: > Discovery, download, and configuration hub for the entire aelf agent skill ecosystem. Use when the user wants to: (1) explore or list available aelf skills, (2) install/bootstrap aelf skills into Cursor, Claude Desktop, OpenClaw, Codex, or Claude Code, (3) route an aelf-related intent to the correct skill, (4) check health or audit installed skills, (5) onboard a new skill into the aelf ecosystem. Covers domains: Portkey CA wallet, Portkey EOA wallet, Awaken DEX, eForest NFT marketplace, AelfScan explorer, TomorrowDAO governance, aelf node interaction. --- # aelf Skills Hub One-stop meta-skill for discovering, downloading, configuring, and routing all aelf ecosystem skills. ## Available Skills Read `skills-catalog.json` for the full machine-readable registry. Current skills: | ID | Domain | |---|---| | `portkey-ca-agent-skills` | CA wallet: registration, auth, guardian, transfer | | `portkey-eoa-agent-skills` | EOA wallet: create, import, assets, transfer | | `aelf-node-skill` | Node: chain status, block, tx, contract view/send | | `aelfscan-skill` | Explorer: address, token, NFT, statistics analytics | | `awaken-agent-skills` | DEX: quote, swap, liquidity, K-line | | `eforest-agent-skills` | NFT marketplace: symbol, collection, listing, trade | | `tomorrowdao-agent-skills` | Governance: DAO, proposals, BP election, resources | ## Workflow ### 1. Route user intent Read [docs/SKILL_ROUTING_MATRIX.md](docs/SKILL_ROUTING_MATRIX.md) to map intent → skill. Key rules: - Wallet: default EOA; switch to CA on guardian/register/recover/CA-hash signals. - Chain data: `aelf-node-skill` for raw node interaction; `aelfscan-skill` for aggregated analytics. - DEX/NFT: domain skill handles logic; wallet skill provides signing identity. - Ambiguous: return Recommended / Alternative / Reason. ### 2. Bootstrap the skill ```bash ./bootstrap.sh --only <skill-id> ``` Options: `--source auto|npm|github|local`, `--skip-install`, `--skip-health`, `--dest <dir>`. ### 3. Configure for client After bootstrap, run setup inside the downloaded skill directory: ```bash cd downloaded-skills/<skill-id> bun run setup openclaw # for OpenClaw bun run setup cursor # for Cursor bun run setup claude # for Claude Desktop ``` ### 4. Health check ```bash bun run health:check -- --skills-root ./downloaded-skills ``` ## Recovery | Problem | Action | |---|---| | Dependency download failed | `./bootstrap.sh --source github --only <skill-id>` | | skill-id not found | `bun run catalog:generate`, then retry | | Health check failed | Follow `health:check` output, add missing artifacts | ## References - Catalog field semantics: [docs/CATALOG_SCHEMA.md](docs/CATALOG_SCHEMA.md) - Intent routing matrix: [docs/SKILL_ROUTING_MATRIX.md](docs/SKILL_ROUTING_MATRIX.md) - E2E scenarios with recovery: [docs/AI_E2E_SCENARIOS.md](docs/AI_E2E_SCENARIOS.md) - Security audit: `bun run security:audit`


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: suspicious | SkillSpector: suspicious (HIGH)
Skill: godferylindsay/godfery-transcribe (version 1.0.0)

--- --- name: openai-whisper name: openai-whisper description: Speech-to-text via SkillBoss API Hub (STT, powered by Whisper and more). homepage: https://api.skillbossai.com metadata: {"clawdbot":{"emoji":"🎙️","requires":{"env":["SKILLBOSS_API_KEY"]}}} --- # Whisper STT via SkillBoss API Hub Use SkillBoss API Hub's `/v1/pilot` to transcribe audio (STT), powered by OpenAI Whisper and other speech recognition models. Quick start (Python) ```python import requests, base64, os SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] API_BASE = "https://api.skillbossai.com/v1" def pilot(body: dict) -> dict: r = requests.post( f"{API_BASE}/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=body, timeout=60, ) return r.json() # Transcribe audio file audio_b64 = base64.b64encode(open("/path/audio.mp3", "rb").read()).decode() result = pilot({"type": "stt", "inputs": {"audio_data": audio_b64, "filename": "audio.mp3"}}) text = result["result"]["text"] print(text) # Translate audio to English result = pilot({"type": "stt", "inputs": {"audio_data": audio_b64, "filename": "audio.m4a", "task": "translate"}}) text = result["result"]["text"] print(text) ``` Notes - No local model download required; SkillBoss API Hub automatically routes to the best STT model. - `SKILLBOSS_API_KEY` environment variable required. - Response text is at `result["result"]["text"]`.

path: README.md
content: # transcribe - OpenClaw Skill

## Installation

```bash
openclaw skill install transcribe
```

> 📖 **Complete setup guide**: https://skillboss.co/skill.md

## Usage
See SKILL.md for details.

## License
MIT


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: qiaotucodes/openclaw-skill-cutmv-video-tool (version 0.1.0)

# SKILL.md - cutmv Video Tool ## Skill Name cutmv-video-tool ## Description A video processing skill for OpenClaw that leverages FFmpeg to perform video/audio cutting, format conversion, and compression. Perfect for handling video files for messaging apps with file size limits. ## Capabilities - **Video Cutting**: Split video/audio by time range - **Format Conversion**: Convert between video/audio formats (mp4, avi, mp3, wav, etc.) - **Video Compression**: Compress videos with adjustable bitrate - **Frame Extraction**: Extract frames from videos at specified intervals - **Audio Extraction**: Extract audio track from video - **Audio Replacement**: Replace or mix audio in video - **Text Watermark**: Add text overlay on video (requires freetype) - **Subtitle**: Add .srt/.ass subtitle files to video ## Use Cases 1. Compress videos to send via WeChat/Lark/Telegram (16MB limit) 2. Extract screenshots from videos for analysis 3. Convert video formats for different platforms 4. Cut specific segments from long videos ## Requirements ### System Requirements - FFmpeg installed and available in PATH - Python 3.7+ ### Python Dependencies - None (uses subprocess to call ffmpeg) ## Installation 1. Ensure FFmpeg is installed on your system: - macOS: `brew install ffmpeg` - Ubuntu: `sudo apt install ffmpeg` - Windows: Download from ffmpeg.org or `winget install ffmpeg` 2. Place the skill files in your workspace: ``` ~/openclaw-workspace/skills/cutmv-video-tool/ ├── SKILL.md ├── skill.py ├── README.md └── README-CN.md ``` ## Usage ### Python API ```python from skill import VideoTool tool = VideoTool() # Compress video for messaging tool.compress("input.mp4", "output.mp4", bitrate="1000k") # Cut video segment tool.cut("input.mp4", "clip.mp4", start_time=30, end_time=90) # Convert format tool.convert("input.mp4", "output.avi", "avi") # Extract frames every 10 seconds tool.extract_frames("input.mp4", "./frames/", interval=10) ``` ### CLI Usage ```bash # Compress video python skill.py compress input.mp4 output.mp4 1000k # Cut video python skill.py cut input.mp4 clip.mp4 0 60 # Convert format python skill.py convert input.mp4 output.mp3 mp3 ``` ## Configuration No additional configuration required. The skill uses system FFmpeg installation. ## Testing Run the built-in tests: ```bash python skill.py test ``` ## License MIT License ## Author - Isaac (@QiaoTuCodes) ## Acknowledgments - OpenClaw team for the platform - FFmpeg team for media processing tools --- **Author Identity**: yanyan@3c3d77679723a2fe95d3faf9d2c2e5a65559acbc97fef1ef37783514a80ae453


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)