OpenClaw/clawhub-security-signals huggingface dataset:
Skill: parkertoddbrooks/wip-file-guard (version 1.9.72)

--- name: wip-file-guard description: Hook that blocks destructive edits to protected identity files. For Claude Code CLI and OpenClaw. license: MIT interface: [cli, module, hook, plugin, skill] metadata: display-name: "Identity File Protection" version: "1.0.1" homepage: "https://github.com/wipcomputer/wip-file-guard" author: "Parker Todd Brooks" category: dev-tools capabilities: - file-protection - edit-blocking - identity-guard requires: bins: [node] openclaw: requires: bins: [node] install: - id: node kind: node package: "@wipcomputer/wip-file-guard" bins: [wip-file-guard] label: "Install via npm" emoji: "🛡️" compatibility: Requires node. Node.js 18+. --- # wip-file-guard Hook that blocks destructive edits to protected identity files. For Claude Code CLI and OpenClaw. ## When to Use This Skill **Use wip-file-guard for:** - Protecting CLAUDE.md, SOUL.md, IDENTITY.md, MEMORY.md, and other identity files from being overwritten - Blocking AI agents from replacing file content instead of extending it - Surviving context compaction (behavioral rules get erased, but hooks don't) **This is a technical guardrail, not a prompt.** It blocks the operation before it happens. ### Do NOT Use For - Protecting binary files or images - Blocking all edits (it allows small edits, only blocks destructive ones) - Repos without identity files ## How It Works Two rules: 1. **Write is blocked** on protected files. Always. Use Edit instead. 2. **Edit is blocked** when it removes more than 2 net lines from a protected file. ### Protected Files CLAUDE.md, SHARED-CONTEXT.md, SOUL.md, IDENTITY.md, CONTEXT.md, TOOLS.md, MEMORY.md ### Protected Patterns Any file matching: memory, memories, journal, diary, daily log ## API Reference ### CLI ```bash node guard.mjs --list # list protected files bash test.sh # run test suite ``` ### Claude Code Hook Add to `~/.claude/settings.json`: ```json { "hooks": { "PreToolUse": [ { "matcher": "Edit|Write", "hooks": [ { "type": "command", "command": "node \"/path/to/wip-file-guard/guard.mjs\"", "timeout": 5 } ] } ] } } ``` ## Troubleshooting ### Agent keeps trying to Write The deny message tells the agent to re-read the file and use Edit instead. If the agent ignores it, it's likely post-compaction and has lost context. The hook will keep blocking. ### Edit blocked unexpectedly Check the net line removal. Edits that remove more than 2 lines from a protected file are blocked. Small edits (adding or replacing 1-2 lines) are allowed.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xingjianliu0417/data-governance (version 1.10.1)

--- name: data-governance description: 数据治理与资产管理技能。用于数据质量评估、元数据管理、数据血缘追踪、数据标准制定、数据合规检查等任务。 --- # Data Governance Skill 数据治理（Data Governance）是指对数据资产管理行使权力和控制的活动集合。 ## ⚠️ 安全警示 使用前请阅读以下安全建议： 1. **仅使用环境变量** - 不写入配置文件 2. **使用最小权限账户** - 生产环境使用只读用户 3. **勿在命令行明文传密码** - 使用环境变量 4. **敏感数据脱敏** - 分享报告前移除真实数据 ## 首次配置 ### 1. 安装依赖 ```bash # 创建虚拟环境（推荐） python3 -m venv venv source venv/bin/activate # 安装依赖 pip install -r requirements.txt ``` ### 2. 配置环境变量 **当前会话有效：** ```bash # MySQL export DB_HOST=localhost export DB_PORT=3306 export DB_USER=your_user export DB_PASS=your_password export DB_NAME=your_database # PostgreSQL export DB_HOST=localhost export DB_PORT=5432 export DB_USER=your_user export DB_PASS=your_password export DB_NAME=your_database # SQLite（无需凭证） export DB_PATH=/path/to/your/database.db ``` **使用前导入：** ```bash # 每次使用前source环境变量文件（不推荐写入~/.bashrc） source ~/db-env.sh python scripts/data_quality_check.py --table users --db-type mysql ``` ### 3. 运行脚本 ```bash # 数据质量检查（必须指定 --db-type） export DB_HOST=localhost DB_USER=admin DB_PASS=xxx DB_NAME=mydb python scripts/data_quality_check.py --table users --db-type mysql # 元数据生成 python scripts/generate_metadata.py --source users --db-type postgresql # 数据血缘分析（可选加数据库） python scripts/lineage_analysis.py --table orders --db-type sqlite # 合规检查 python scripts/compliance_check.py --table users --db-type mysql ``` ## 依赖 | 依赖 | 版本 | 用途 | |------|------|------| | sqlalchemy | ==2.0.25 | 数据库抽象层 | | pymysql | ==1.1.0 | MySQL 连接 | | psycopg2-binary | ==2.9.9 | PostgreSQL 连接 | | pandas | ==2.1.4 | 数据处理 | 详见 [requirements.txt](requirements.txt) ## 何时使用 当用户提及以下内容时使用此 skill： - 数据质量、数据标准、数据血缘 - 元数据管理、数据目录、数据资产 - 数据合规、隐私保护、数据安全 - 数据治理框架、数据资产管理 ## 核心能力 ### 1. 数据质量评估 评估数据的完整性、准确性、一致性、时效性： **检查维度：** - 缺失值检测 - 重复记录检测 - 格式校验 - 范围校验 - 业务规则验证 ### 2. 元数据管理 帮助构建和管理元数据： **技术元数据：** 表结构、字段类型、数据来源 **业务元数据：** 字段定义、业务规则、所有者 **运营元数据：** 更新频率、ETL信息、访问统计 ### 3. 数据血缘追踪 追踪数据的来龙去脉： **来源追溯：** 数据从哪来 **转换追踪：** 经过哪些处理 **下游影响：** 谁在使用这些数据 ### 4. 数据标准 制定和执行数据标准： **命名规范：** 表名、字段名命名规则 **类型规范：** 数据类型、格式标准 **编码规范：** 枚举值、代码表 ## 输出格式 完成数据治理任务后，输出结构化报告： ```markdown ## 数据治理报告 ### 数据质量 - 完整性：XX% - 准确率：XX% - 发现问题：N个 ### 元数据 - 表数量：N - 字段数量：N ### 建议 1. ... 2. ... ``` ## 常见场景 | 场景 | 输出 | |------|------| | 数据质量评估 | 质量报告 + 问题清单 | | 元数据梳理 | 数据字典 + 关系图 | | 血缘分析 | 链路图 + 影响分析 | | 合规检查 | 合规报告 + 风险点 |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: rafimchmd/geopolitics-expert (version 1.0.0)

--- name: geopolitics-expert description: Geopolitical conflict analysis for war sentiment assessment. Use when analyzing armed conflicts, military interventions, or regional crises to determine conflict duration probability, economic and commodity impacts, trading opportunities, and termination scenarios. Triggered by news article URLs about wars or military operations. --- # Geopolitics Expert Analyzes armed conflicts through integrated frameworks to assess war duration, economic impact, and termination scenarios. ## Usage ``` geopolitics-expert <news_url> ``` The skill fetches the news URL and produces a structured analysis with five outputs. ## Workflow ### Step 1: Fetch and Parse News Content Use `web_fetch` to extract article content from the provided URL. ### Step 2: Apply Analytical Frameworks Analyze the conflict using these integrated frameworks (stored in `references/`): 1. **Strategic Gravity** — forever war vs short war indicators 2. **Modern Doctrines** — US intervention triggers and target selection 3. **Five Pathways** — conflict termination scenarios 4. **Perpetual Quagmire** — forever war risk factors 5. **IRGCistan** — post-theocratic military state dynamics 6. **Hormuz Siege** — chokepoint weaponization patterns 7. **Reopening Blueprints** — strategic options for de-escalation ### Step 3: Generate Structured Output Produce analysis in this exact format: ``` ## 1. Conclusion [Core assessment of the conflict situation] ## 2. Economic/Commodity Impact [Effects on oil, gas, fertilizers, supply chains, inflation] ## 3. Commodity Trading Odds [Assessment of trading opportunities: long/short positions, risk factors] ## 4. War Duration Categorization - **Short-term war probability**: X% - **Long-term/forever war probability**: Y% - **Key indicators**: [list specific factors from Strategic Gravity framework] ## 5. Termination Scenarios [Summary of which pathways could end this conflict, ranked by likelihood] ``` ## Framework Reference Read `references/frameworks.md` for detailed analytical models when complex conflicts require deeper assessment. ## Output Guidelines - **Be decisive** — provide clear probabilities, not vague ranges - **Anchor to frameworks** — cite specific indicators from the loaded models - **Economic focus** — always tie back to commodity impacts (oil, gas, fertilizer, shipping) - **Scenario-ranked** — order termination scenarios by probability, not alphabetically


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jeremycooper2077/parcel-station-chat (version 1.0.0)

--- name: parcel-station-chat description: "Build a courier station AI chat system with Express, GPT-5.5, local JSON DB, OCR, and WeChat-style frontend." --- # 快递驿站智能客服系统 快速搭建快递驿站 AI 客服系统。Express 后端 + GPT-5.5 对话 + JSON 本地数据库 + 面单 OCR + 微信风格聊天前端。 ## 系统架构 ``` 用户 (微信小程序/浏览器) │ POST /api/chat POST /api/ocr GET /api/packages/:code │ ┌───────▼──────────────────────┐ │ Express server.js (v3.1) │ │ ├ loadApiConfig() → SU2 │ │ ├ buildLookupBlock() │ │ │ ├ extractPickupCode() │ │ │ └ extractTrackingTail() │ │ ├ callAI() → GPT-5.5 │ │ └ handleFallback() │ ├──────────────────────────────┤ │ db.js (JSON 文件存储) │ │ ├ findByPickupCode() │ │ ├ findByTrackingTail() │ │ ├ findByPhoneTail() │ │ ├ listPackages() (分页) │ │ └ insertPackage() │ ├──────────────────────────────┤ │ ocr.js (GPT-5.5 Vision) │ │ └ recognizeWaybill() │ └──────────────────────────────┘ ``` ## 取件码格式 ``` 1-2-25001 │ │ ││││ │ │ │││└── 001 = 当天第1个包裹 │ │ ││└─── 25 = 日期(当月第几天) │ │ └┴──── 5位日期序号(DDNNN) │ └────── 排号 └──────── 货架号 ``` 正则：`/(\d{1,2})\s*[-－—–]\s*(\d{1,2})\s*[-－—–]\s*(\d{5})/` ## 搭建步骤 ### 1. 初始化项目 ```powershell mkdir parcel-help && cd parcel-help npm init -y npm install express ``` ### 2. 创建 db.js JSON 文件存储，零原生依赖。关键函数： - `findByPickupCode(code)` — 取件码查询 - `findByTrackingTail(tail)` — 运单号后5位查询 - `findByPhoneTail(tail)` — 手机尾号4位查询 - `listPackages({page, pageSize, q})` — 分页+搜索 - `insertPackage(p)` — 新增包裹（含冲突检测） 种子数据：12条包裹覆盖全部货架，当天日期自动计算。 ### 3. 创建 ocr.js 调用 GPT-5.5 Vision 识别面单，返回 JSON： ```json {"pickup_code":"","tracking_no":"","recipient_name":"","recipient_phone_tail":"","carrier":"","confidence":"low|medium|high"} ``` 注意：AI 可能返回 markdown 包裹的 JSON，parseOcrJson 需处理 ` ```json ``` `。 ### 4. 创建 server.js 核心逻辑流程： 1. `loadApiConfig()` → 读 SU2_API_KEY + baseUrl 2. `buildLookupBlock(message)` → 自动识别取件码/运单号尾号 3. 有 AI → `callAI()` → 带会话历史 + 查库结果 4. 无 AI → `handleFallback()` → 本地关键词+查库 会话管理：30分钟 TTL，保留最近5轮对话。 ### 5. 创建前端 (public/index.html) 微信风格聊天界面，注意： - ❌ 不加入"管理"入口（客户端） - ✅ 底部快捷按钮：找不到包裹 / 取件码说明 / 运单号查询 - ✅ 支持图片上传拍照 - ✅ 移动端优化 ### 6. 启动测试 ```powershell node server.js # 聊天界面: http://localhost:3000 # 管理后台: http://localhost:3000/admin.html # 健康检查: http://localhost:3000/api/health ``` ## API 接口 | 方法 | 路径 | 说明 | |------|------|------| | GET | `/api/health` | 健康检查（版本、AI状态、数据库总量） | | POST | `/api/chat` | 聊天（message + image + sessionId） | | POST | `/api/ocr` | 面单识别（image） | | GET | `/api/packages` | 包裹列表（page, pageSize, q） | | POST | `/api/packages` | 录入包裹 | | GET | `/api/packages/:code` | 按取件码查询 | ## 核心设计决策 1. **不用 better-sqlite3** — Windows 需要 VC++ 编译工具，改用纯 JS JSON 文件存储 2. **不用 shelf_color/shelf_area** — 真实驿站用"第X号货架 第Y排"，不设颜色/区号 3. **取件码正则匹配 5 位日期序号** — 区别于其他数字输入 4. **运单号查询** — 匹配 5 位及以上连续数字，支持部分单号 5. **管理后台单独存在** — 不和客户端 UI 混在一起 ## 坑与注意事项 - `better-sqlite3` 在 Windows 编译失败 → 换 JSON - Unicode 中文在 `taskkill /F /IM node.exe` 后可能输出乱码，但服务正常 - API 调用超时默认 30s，中转站偶尔延迟需重试 - `curl.exe` 在 PowerShell 中 JSON 引号会转义出错 → 用 `Invoke-RestMethod`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xhc1111/shopping-intent-extractor (version 1.0.3)

--- name: shopping-intent-extractor description: 从当前对话中提取用户的购物和支付意图，输出结构化 JSON 总结。提供两种方式：(1) 调用 `payment-intent summarize` 命令，或 (2) 由 AI 模型直接读取对话上下文分析总结。当用户要求总结购物意图、查看之前的购买计划、或提取支付相关信息时使用。 --- # Shopping Intent Extractor 从当前对话中提取用户的购物和支付意图，生成结构化 JSON 总结。 ## 两种实现方式 | 方式 | 描述 | 适用场景 | |------|------|----------| | **方式 1** | 调用 `payment-intent summarize -s <sessionId>` 命令 | 有 sessionId 时，推荐方式 | | **方式 2** | AI 模型直接分析对话上下文 | 无 sessionId 或快速响应 | --- ## 触发条件 当用户说以下类型的话时使用此 skill： - "总结一下我之前的购物意图" - "我之前想买什么来着？" - "看看我之前的支付记录" - "提取我的购物意图" - "我从没说过要买什么吧" - "我之前想支付什么？" - "帮我看看上下文里有什么购物信息" --- ## 方式 1：调用 `payment-intent summarize` 命令 如果系统中有 `payment-intent` 命令行工具可用，优先使用此方式： ### 命令格式 ```bash payment-intent summarize -s <sessionId> ``` ### 参数说明 | 参数 | 说明 | 是否必需 | |------|------|----------| | `-s <sessionId>` | 指定要分析的会话 ID | 必需 | ### 使用步骤 1. **获取 sessionId** —— 从当前会话元数据中获取 2. **执行命令** —— `payment-intent summarize -s <sessionId>` 3. **解析输出** —— 工具返回 JSON 格式的意图总结 **优点：** 准确、标准化、可复用 --- ## 方式 2：AI 模型直接分析上下文 当 `payment-intent` 工具不可用或没有 sessionId 时，直接分析当前对话中的用户消息历史（OpenClaw 的上下文窗口内），**不需要读取外部 session 文件**。 **优点：** 快速、无需外部工具依赖 --- ## AI 分析流程（方式 2） ### Step 1：扫描对话内容 读取当前对话中的用户消息历史。 ### Step 2：识别关键信息 提取以下字段到 JSON： | 字段 | 类型 | 说明 | |------|------|------| | `hasIntent` | boolean | 是否存在购物/支付意图 | | `intentType` | `"shopping" \| "payment" \| "none"` | 意图类型 | | `product` | string | 商品/服务名称（无则 `null`） | | `amount` | string | 金额（无则 `null`） | | `platform` | string | 平台（如"淘宝"、"支付宝"，无则 `null`） | | `status` | `"pending" \| "paid" \| "cancelled" \| "unknown"` | 支付状态 | | `summary` | string | 一句话总结（中文） | ### Step 3：识别关键词 **购物倾向：** - "买"、"购买"、"下单"、"付款"、"支付" - 商品名称、金额、平台名称 - "购物车"、"购物车里"、"淘宝"、"支付宝" **支付状态：** - "已支付"、"付款成功" → `paid` - "待支付"、"还没付款"、"等会再付" → `pending` - "不买了"、"取消了" → `cancelled` --- ## 输出格式 **纯 JSON，不使用 markdown 代码块包裹。** ### 示例 1：有明确购物意图 ```json { "hasIntent": true, "intentType": "shopping", "product": "手机高清壁纸", "amount": "¥0.01", "platform": "淘宝", "status": "pending", "summary": "用户计划在淘宝购买 1 分钱手机高清壁纸，待支付状态" } ``` ### 示例 2：无购物意图 ```json { "hasIntent": false, "intentType": "none", "product": null, "amount": null, "platform": null, "status": "unknown", "summary": "当前会话未检测到购物或支付意图" } ``` ### 示例 3：已支付 ```json { "hasIntent": true, "intentType": "payment", "product": "手机高清壁纸", "amount": "¥0.01", "platform": "支付宝", "status": "paid", "summary": "用户已通过支付宝完成 1 分钱壁纸支付" } ``` --- ## 规则 1. **优先使用 `payment-intent summarize -s <sessionId>` 命令** —— 有 sessionId 且工具可用时调用工具 2. **工具不可用时** —— AI 模型直接分析对话上下文 3. **只分析当前对话** —— 不读取外部 session 文件，不跨会话汇总 4. **仅识别购物/支付** —— 其他意图忽略 5. **输出纯 JSON** —— 不用 markdown 代码块包裹 6. **summary 字段用中文** —— 简洁直观 7. **金额统一格式** —— `¥X.XX` 或 `X 元` 8. **不确定时保守判断** —— `hasIntent: false` --- ## 决策流程 ``` 用户触发 skill ↓ 有 sessionId 且 payment-intent 工具可用？ ↓ 是 → payment-intent summarize -s <sessionId> ↓ 否 → AI 直接分析对话上下文 ↓ 输出 JSON 总结 ``` --- ## 下一步 分析完成后，直接输出 JSON 结果给用户。如果用户需要进一步操作（比如继续支付），根据结果提供建议。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bytesagain3/windows-setup (version 2.0.3)

--- name: "windows-setup" version: "2.0.3" description: "Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Windows Setup concepts, best practices, and implementation patterns." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [windows,setup, reference] category: "devtools" --- # Windows Setup Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Windows Setup concepts, best practices, and implementation patterns. No API keys or credentials required. ## Commands | Command | Description | |---------|-------------| | `intro` | intro reference | | `quickstart` | quickstart reference | | `patterns` | patterns reference | | `debugging` | debugging reference | | `performance` | performance reference | | `security` | security reference | | `migration` | migration reference | | `cheatsheet` | cheatsheet reference | ## Output Format All commands output plain-text reference documentation via heredoc. No external API calls, no credentials needed, no network access. --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: simantak-dabhade/tunneling (version 1.0.0)

--- name: tunneling description: Create free SSH tunnels to expose local ports to the internet using tinyfi.sh. Use when you need to share a locally running app, test webhooks, demo a prototype, or get a public HTTPS URL for any local service — no signup or authentication required. --- # TinyFish Tunneling Service (tinyfi.sh) Creates instant public HTTPS URLs for locally running apps via SSH tunneling. Free, no account, no installation beyond SSH. ## Pre-flight Check (REQUIRED) Verify SSH is available (it almost always is): ```bash which ssh && echo "SSH available" || echo "SSH not found — install OpenSSH first" ``` ## Quick Start Expose a local port to the internet: ```bash ssh -o StrictHostKeyChecking=accept-new -R 80:localhost:<PORT> tinyfi.sh ``` Replace `<PORT>` with the port your app is running on. The command will print a public `https://<random>.tinyfi.sh` URL. ## Custom Subdomain Request a specific subdomain instead of a random one: ```bash ssh -o StrictHostKeyChecking=accept-new -R myname:80:localhost:<PORT> tinyfi.sh ``` This gives you `https://myname.tinyfi.sh`. ## Keep-Alive (Stable Connections) For long-running tunnels, add a keep-alive interval to prevent disconnection: ```bash ssh -o StrictHostKeyChecking=accept-new -o ServerAliveInterval=60 -R 80:localhost:<PORT> tinyfi.sh ``` ## Usage Guidelines When starting a tunnel for the user: 1. **Ask which port** to expose if not already specified 2. **Run the SSH command** in the background so the agent can continue working 3. **Report the public URL** back to the user once the tunnel is established 4. The tunnel stays open as long as the SSH connection is alive ## Common Ports | Framework / Tool | Default Port | |----------------------|-------------| | Next.js / React / Express | 3000 | | Vite | 5173 | | Django | 8000 | | Flask | 5000 | | Go (net/http) | 8080 | | Ruby on Rails | 3000 | | PHP (built-in) | 8000 | ## Rate Limits - 5 SSH connections per minute per IP - 100 HTTP requests per minute per IP - 50 concurrent connections max - 48-hour idle timeout


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: ckchzh/modbus (version 1.0.0)

--- name: "modbus" version: "1.0.0" description: "Modbus communication protocol tool. Use when json modbus tasks, csv modbus tasks, checking modbus status." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [modbus, industrial, cli, tool] category: "industrial" --- # modbus Modbus communication protocol tool. Use when json modbus tasks, csv modbus tasks, checking modbus status. ## Commands ### `status` ```bash scripts/script.sh status ``` Show current status ### `add` ```bash scripts/script.sh add ``` Add new entry ### `list` ```bash scripts/script.sh list ``` List all entries ### `search` ```bash scripts/script.sh search ``` Search entries ### `remove` ```bash scripts/script.sh remove ``` Remove entry by number ### `export` ```bash scripts/script.sh export ``` Export data to file ### `stats` ```bash scripts/script.sh stats ``` Show statistics ### `config` ```bash scripts/script.sh config ``` View or set config ### `help` ```bash scripts/script.sh help ``` ### `version` ```bash scripts/script.sh version ``` ## Configuration Use `scripts/script.sh config <key> <value>` to set preferences. | Variable | Description | |----------|-------------| | `MODBUS_DIR` | Data directory (default: ~/.modbus/) | --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: asimons81/side-hustle-analyst (version 0.1.0)

--- name: side-hustle-analyst description: Runs structured day-by-day execution for AI agent side hustles. Use when: executing the Agent Side Hustle School workflow, tracking experiment progress, or maintaining persistent state across a 28-day hustle cycle. NOT for: generic productivity advice, long-term business strategy, or non-AI/agent business ideas. --- # Side Hustle Analyst **Operational mode:** Execution tracker. Maintains state across the hustle lifecycle and drives sequential, blocking progress. ## What it does 1. Loads current day/phase state from course-state.json 2. Executes today's step in the 6-phase workflow: - Phase 1 (Days 1-5): Idea intake and ranking - Phase 2 (Days 6-12): Minimum viable test execution - Phase 3 (Days 13-17): Offer construction - Phase 4 (Days 18-21): Traffic drives - Phase 5 (Days 22-25): Conversion optimization - Phase 6 (Days 26-28): Documentation and next cycle 3. Logs OUTCOME / SCORE / WHY after every meaningful action 4. Advances phase only when "done when" criteria are met 5. Flags blockers that persist >48 hours ## When to use - Daily execution of the hustle engine workflow - After selecting an experiment, for Day 2+ execution - When restarting after a gap and needing to know current state ## State management - Reads: state/course-state.json (canonical position) - Writes: output/experiment-log/ and output/daily-summaries/ - Maintains: outcome_log array with scores per action ## Approval gates Requires operator approval before: - Experiment selection (presents exactly 3 options) - Experiment lock-in (Day 5 confirmation) - Offer definition and pricing (Day 13) - Any spend above $0 ## Output naming - Daily summaries: output/daily-summaries/YYYY-MM-DD-day-N.md - Experiment logs: output/experiment-log/day-NN-name.md ## Aesthetic Dark mode. Charcoal (#1a1a1a) primary. Electric purple accent (#9b59b6). Monospace details.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 3rdbrain/x-prospecting (version 1.0.0)

--- name: x-prospecting description: Find and engage potential leads on X (Twitter) by searching for keywords and buying-intent posts via Brave Search. version: 1.0.0 author: ModelFitAI <[REDACTED_SECRET]> license: MIT keywords: [openclaw, skill, twitter, x, lead-gen, prospecting, brave-search] requires: env: [BRAVE_API_KEY] --- # X (Twitter) Prospecting Skill Find potential leads on X by searching for keyword mentions and buying-intent posts. Uses the Brave Search API to query `site:x.com` — no X API credentials required. ## Available Tools Run with Node.js: `node {baseDir}/x-prospecting.js <command> [args]` - **search** - Search X posts by keyword via Brave - **score** - Score a prospect based on their tweet and bio signals - **thread** - Generate a lead-magnet thread outline - **dm-sequence** - Generate a DM outreach sequence for a prospect ## Usage ```bash node {baseDir}/x-prospecting.js search "looking for AI tools" node {baseDir}/x-prospecting.js score --handle "@username" --bio "founder at SaaS" --tweet "frustrated with my current tool" node {baseDir}/x-prospecting.js dm-sequence --handle "@username" --name "Jane" ``` ## How Brave Search Works for X ```bash curl -s -H "Accept: application/json" \ -H "X-Subscription-[REDACTED_SECRET]" \ "https://api.search.brave.com/res/v1/web/search?q=site:x.com+%22looking+for+AI+tools%22&count=10" ``` Substitute the query with your target keywords. Parse results to extract handles and tweet text, then run through lead scoring. ## Environment Variables - `BRAVE_API_KEY` - Brave Search API key (free tier: 2,000 queries/month)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)