OpenClaw/clawhub-security-signals huggingface dataset:
Skill: dasweltall/openclaw-cost-guard (version 0.1.0)

--- name: openclaw-cost-guard description: Track OpenClaw/Clawdbot token and cost usage from session JSONL logs (prefer real usage.cost when present), generate daily/weekly summaries and top expensive sessions, and run budget checks (exit code on breach). Use to monitor spend, enforce budgets via cron/alerts, and apply a token-saving playbook to reduce output/tool-call cost. --- # OpenClaw Cost Guard Use this skill when you need: - **accurate cost reports** (daily/weekly/lifetime) - **top expensive sessions** - **guardrails to reduce token burn** (without changing config unless user asks) ## 1) Data source (important) Prefer **session JSONL** logs (they contain per-call `usage`, often with **real USD cost**): - OpenClaw: `~/.openclaw/agents/*/sessions/*.jsonl` - Legacy/compat: `~/.clawdbot/agents/*/sessions/*.jsonl` Do **not** estimate from “current context window” style token fields. ## 2) Quick commands ### Daily costs (last 7 days) ```bash python3 {baseDir}/scripts/extract_cost.py --last-days 7 ``` ### Today / yesterday ```bash python3 {baseDir}/scripts/extract_cost.py --today python3 {baseDir}/scripts/extract_cost.py --yesterday ``` ### Top expensive sessions ```bash python3 {baseDir}/scripts/extract_cost.py --top-sessions 10 ``` ### JSON output (for dashboards) ```bash python3 {baseDir}/scripts/extract_cost.py --last-days 30 --json ``` ## 3) If cost is missing (fallback estimate) Some providers may omit `usage.cost`. You can provide per-1M-token prices: ```bash export PRICE_INPUT=1.75 export PRICE_OUTPUT=14 export PRICE_CACHE_READ=0.175 export PRICE_CACHE_WRITE=0 python3 {baseDir}/scripts/extract_cost.py --last-days 7 ``` ## 4) Budget alerts The extractor can run as a **budget check**: ```bash python3 {baseDir}/scripts/extract_cost.py --today --budget-usd 5 ``` - If budget is exceeded, it prints an **ALERT** and exits with code **2** (default). - For non-failing checks: ```bash python3 {baseDir}/scripts/extract_cost.py --today --budget-usd 5 --budget-mode warn ``` ### Wiring it to a cron alert (recommended) Run it daily (or hourly) and if exit code is 2, send yourself a Telegram message. (Implementation depends on your OpenClaw channel setup; do not embed secrets in scripts.) ## 5) Token-saving playbook (teach the AI) When the user says “use as few tokens as possible”, apply: - **Default response budget:** 1–6 lines, bullets > paragraphs - **Ask 1 question max** (only if truly blocking) - **Progressive disclosure:** offer details only if asked - **Tool calls:** batch; avoid repeated `status`/browser calls - **No log dumps** into chat; summarize + point to file path - **Hard limits:** max 3 web iterations (search/fetch) per task Optional phrasing to keep yourself in check: > "Answer in <=6 lines. If more is needed, ask permission."


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: billzhuang6569/lark-doc-reviser (version 1.0.0)

--- name: lark-doc-reviser description: "Read unresolved comments in a Feishu (Lark) document and apply targeted edits block-by-block based on those comments. Use when the user shares a Feishu doc URL and asks to: (1) fetch/show document comments, (2) revise or edit the doc based on comments, (3) process feedback left in a Feishu doc. Requires lark-cli installed and authenticated." --- # Lark Doc Reviser ## Workflow ### Step 1 — Fetch doc state ```bash python3 scripts/fetch_doc.py <doc_url_or_token> --out workspace/<token>_state.json ``` This saves full doc state to `workspace/<token>_state.json` and prints a summary to stdout: - `commented_blocks`: blocks that have unresolved comments, each with `elements`, `full_text`, and `comments[]{comment_id, anchor_text, instruction}` - `all_blocks`: full block list (no elements, for structural reference) **Always save to workspace.** The editing process may span multiple sessions. ### Step 2 — Present comments to user Show each entry in `commented_blocks` as: ``` [block_type] full_text → 【anchor_text】 instruction ``` Ask the user to confirm which comments to address, or proceed if the intent is clear. ### Step 3 — Apply text edits For each comment requiring a text change, construct a patches list and run: ```bash python3 scripts/patch_blocks.py <doc_token> patches.json ``` `patches.json` format — **elements completely replace the block's existing content**: ```json [ { "block_id": "doxcnXXXX", "elements": [ {"text": "普通文字"}, {"text": "加粗", "bold": true}, {"text": "代码", "code": true}, {"text": "斜体", "italic": true} ] } ] ``` Supported element fields: `text` (required), `bold`, `italic`, `code`, `strikethrough`, `underline`. **Note:** `update_text_elements` clears `comment_ids` from the elements. This is expected — always resolve addressed comments in Step 4. ### Step 4 — Resolve addressed comments ```bash python3 scripts/resolve_comments.py <doc_token> <comment_id> [comment_id ...] # or via stdin: echo '["id1","id2"]' | python3 scripts/resolve_comments.py <doc_token> - ``` ### Step 5 — Re-fetch and update state Re-run Step 1 to refresh `workspace/<token>_state.json` after edits. ## Limitations These operations are **not** handled by this skill's scripts and require additional API calls: - **Insert blank line / empty block**: needs Create Block API - **Delete a block** (e.g., remove a divider): needs Delete Block API - **Structural reordering**: needs Move Block API For such operations, use `lark-cli api` directly or ask the user if they want to handle them manually. ## Warning Never use `lark-cli docs +update --mode replace_range --selection-by-title` to rename a heading. It selects the **entire section** (heading + all content until next heading) and deletes it all. Use `--selection-with-ellipsis "heading text"` instead.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: jirboy/semantic-scholar-search (version 1.0.0)

--- name: semantic-scholar-search description: [已整合] Semantic Scholar 搜索已整合到 search 统一入口技能 argument-hint: "[搜索关键词]" --- # ⚠️ 已整合 - 请使用 search 统一入口 > **本技能保留用于向后兼容，功能已整合到 `search` 统一入口技能** > > **推荐使用：** `search scholar [关键词]` 或直接使用本技能（自动转发） --- # Semantic Scholar Search（兼容层） 免费、高质量的学术论文检索工具 - 基于 Semantic Scholar API。 ## 迁移指南 **新用法：** ``` search scholar machine learning search scholar attention mechanism year=2020- search scholar Yann LeCun ``` **旧用法（仍然可用）：** ``` scholar machine learning ``` ## 特点 - ✅ 免费使用，无需注册 - ✅ 覆盖计算机科学、生物医学、物理等多个领域 - ✅ 提供论文引用数、作者信息、摘要等详细元数据 - ✅ 支持高级搜索和过滤 ## 技术实现 - **API:** Semantic Scholar API v2 - **速率限制:** 免费层 100 次/小时


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: amdf01-debug/sw-war-room (version 1.0.0)

# War Room Skill ## Trigger Crisis response and intensive problem-solving with multiple agents. **Trigger phrases:** "war room", "crisis mode", "all hands on deck", "emergency fix", "critical issue" ## When to Use - Production is down - Critical bug affecting users - Time-sensitive deadline at risk - Complex problem needing parallel investigation ## War Room Protocol ### 1. Situation Assessment (2 min) ``` SITUATION: [what's happening] IMPACT: [who/what is affected] SEVERITY: [critical/high/medium] TIMELINE: [when did it start, when must it be fixed] ``` ### 2. Team Assembly - **Investigator**: Gathers logs, data, reproduction steps - **Analyst**: Forms hypotheses, identifies root cause - **Fixer**: Implements solution once root cause confirmed - **Reviewer**: Validates fix, checks for regressions ### 3. Communication Cadence - Status update every 15 minutes during active crisis - Each update: what we know, what we're trying, ETA - Single source of truth: shared state file ### 4. Resolution - Fix implemented and verified - Root cause documented - Post-mortem scheduled (within 48 hours) - Prevention measures identified ## Rules - Speed > perfection during active crisis - One person/agent owns coordination (war room lead) - All changes logged — no cowboy fixes - Revert first, investigate second (if revert is safe) - Post-mortem is mandatory, blame is not


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bytesagain-lab/crypto-whale-tracker (version 4.0.2)

--- name: "crypto-whale-tracker" version: "4.0.1" description: "Reference tool for blockchain and crypto — covers intro, quickstart, patterns and more. Quick lookup for Crypto Whale Tracker concepts, best practices, and i..." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [crypto,whale,tracker, reference] category: "blockchain" --- # Crypto Whale Tracker Reference tool for blockchain and crypto — covers intro, quickstart, patterns and more. Quick lookup for Crypto Whale Tracker concepts, best practices, and i... No API keys or credentials required. ## Commands | Command | Description | |---------|-------------| | `intro` | intro reference | | `quickstart` | quickstart reference | | `patterns` | patterns reference | | `debugging` | debugging reference | | `performance` | performance reference | | `security` | security reference | | `migration` | migration reference | | `cheatsheet` | cheatsheet reference | ## Output Format All commands output plain-text reference documentation via heredoc. No external API calls, no credentials needed, no network access. --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ikaroso/atopchaser (version 1.0.2)

--- name: achaser description: 获取当前 A 股涨幅 Top10 并基于结果给出是否值得买入的分析。 --- 你是一个使用 `achaser`（目录名为 `astockchaser`）技能的智能投资辅助助手。 当用户请求「A 股 Top10」相关信息或显式调用本 skill 时，请**严格按照下面步骤**工作： 1. **运行脚本获取当天 A 股涨幅 Top10** - 如果你当前在项目根目录，请运行： ```bash python astockchaser/scripts/list_top10.py ``` - 如果你当前已经位于 `astockchaser` 目录内，请运行： ```bash python scripts/list_top10.py ``` 2. **完整复述脚本输出** - 等脚本执行结束后，将终端中该脚本的**全部原始输出**原封不动复制到你的回答中。 - 把这部分内容放在单独的代码块里，并在前面加上一句类似说明： > 下面是 `list_top10.py` 脚本的原始输出（未做任何修改）： 3. **基于脚本结果进行逐只分析与买入判断** 在完整复述脚本输出之后，再开始你的分析部分，不能跳步、也不能省略原始输出。 对脚本返回的 Top10 每只股票依次做出判断： - 给出一个明确结论：例如「值得买入 / 暂时观望 / 不建议买入」。 - 使用 2–3 句话解释你的理由，可以综合考虑： - 当日涨跌幅和持续性可能性（追涨或透支风险）； - 成交量、换手率、振幅等反映的短线情绪和筹码稳定性； - 资金净流入（若有）对短期趋势的支撑与疑点； - 行业、题材、近期大盘环境等宏观因素（如你能从名称或常识中判断）。 - 明确说明这些判断**仅基于当天的行情数据和一般经验**，不构成任何形式的投资建议。 4. **输出整体小结与风险提示** - 概括这 10 只股票整体的市场情绪（例如：强势动能为主 / 分化严重 / 高位接力风险大等）。 - 对可能的风险（高位回调、情绪反转、短线博弈剧烈等）做统一提示。 - 再次强调：你的回答只是智能分析，不是投资建议，投资决策需用户自行承担。 5. **回答建议结构（示例，仅供参考，可以用你自己的话）** 1. 标题或一句话简介（例如「当天 A 股涨幅 Top10 及买入价值分析」）。 2. 「脚本原始输出」代码块（完整复制终端输出）。 3. 「逐只分析与买入判断」： - 可以用表格（代码块中的 Markdown 表）或分条的形式，每个条目包含：代码、名称、你的结论、简要理由。 4. 「整体小结与风险提示」：2–4 句话即可，强调短线风险与长期配置需独立判断。 请始终遵守上述步骤，尤其是：**先完整复述脚本输出，再做逐只分析与买入判断**。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ajtgjmdjp/estat-mcp (version 0.2.2)

--- name: estat-mcp description: "Search and retrieve Japanese government statistics (人口, GDP, CPI, 貿易, 雇用) from e-Stat API — Japan's official open data portal with 3,000+ statistical tables. Population, economy, trade, employment data. Free API." metadata: {"openclaw":{"emoji":"📈","requires":{"bins":["estat-mcp"],"env":["ESTAT_APP_ID"]},"install":[{"id":"uv","kind":"uv","package":"estat-mcp","bins":["estat-mcp"],"label":"Install estat-mcp (uv)"}],"tags":["japan","statistics","government","open-data","mcp","estat","gdp","economy"]}} --- # e-Stat: Japanese Government Statistics API Search and fetch official statistics from e-Stat (政府統計の総合窓口), Japan's central portal for government open data. Covers population, GDP, CPI, trade, labor, and 3,000+ statistical tables from all ministries. ## Use Cases - Look up Japan's population by prefecture and year - Compare CPI (消費者物価指数) trends over time - Fetch GDP and national accounts data for economic analysis - Retrieve trade statistics (輸出入) by commodity or country - Access labor force survey data (完全失業率, 就業者数) ## Commands ### Search for statistics ```bash # Search by keyword (Japanese or English) estat-mcp search 人口 estat-mcp search "消費者物価指数" --limit 10 estat-mcp search GDP --format json ``` ### Fetch statistical data ```bash # Basic data fetch estat-mcp data 0003410379 # With filters (area=Tokyo, year=2024) estat-mcp data 0003410379 --cd-area 13000 --cd-time 2024000 # JSON output for programmatic use estat-mcp data 0003410379 --limit 50 --format json ``` ### Test connectivity ```bash estat-mcp test ``` ## Filter Parameters - `--cd-tab` — Table item code (表章事項コード) - `--cd-time` — Time code (時間軸事項コード). Example: `2024000` for 2024 - `--cd-area` — Area code (地域事項コード). Example: `13000` for Tokyo - `--cd-cat01` — Classification code 01 (分類事項01コード) ## Common Statistics Find table IDs via `estat-mcp search`: | Topic | Search keyword | Examples | |---|---|---| | Population (人口) | `人口推計` | Total, by age, by prefecture | | CPI (物価) | `消費者物価指数` | Monthly/annual price indices | | GDP (国民経済計算) | `国民経済計算` | Nominal/real GDP, expenditure | | Labor (労働) | `労働力調査` | Unemployment, employment | | Trade (貿易) | `貿易統計` | Imports/exports by country | ## Workflow 1. `estat-mcp search <keyword>` → find statistics table ID 2. `estat-mcp data <id> --format json` → fetch data with filters 3. Analyze the JSON output ## Setup - Requires `ESTAT_APP_ID` environment variable - Free API key registration: https://www.e-stat.go.jp/api/api-info/use-api - Rate limited to 1 req/sec - Python package: `pip install estat-mcp` or `uv tool install estat-mcp`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bit-of-a-shambles/popadex-finance-copilot (version 0.1.1)

--- name: popadex-finance-copilot description: Read-only personal finance copilot for net worth insights, account allocation, salary/tax comparisons across countries, disposable-income rankings, retirement (FIRE) projections, budget Sankey data, and portfolio value/performance/history/CSV export. Use when the user asks about their PopaDex finances. Requires the popadex MCP server. metadata: openclaw: emoji: "💰" --- # PopaDex Finance Copilot Skill ## Purpose Help users understand and act on their personal finance data from PopaDex using safe, read-only guidance. ## Core Capabilities - Explain net worth changes by period. - Show account allocation by type and concentration risk. - Compare salary, tax, and disposable income scenarios. - Run tax estimate breakdowns for individual salary cases. - Project retirement readiness using FIRE-style assumptions. - Compare disposable income rankings across countries from one income input. - Produce read-only Sankey budget flow data for visualization workflows. - Report total portfolio value and per-type performance deltas. - Return historical portfolio timelines for analysis workflows. - Export portfolio records as CSV for downstream tooling. - Convert portfolio summaries into plain-language action plans. ## Non-Goals - No money movement. - No credential management. - No investment guarantees or regulated advice. - No write/delete operations against user financial records. ## Safety and Compliance Rules - Do not claim guaranteed returns. - Clearly label estimates and assumptions. - If required inputs are missing, ask for them explicitly. - Use conservative defaults and show formulas. - Never reveal secrets or private tokens. ## Tool Dependencies This skill expects a compatible MCP endpoint exposing PopaDex read-only tools: - get_net_worth_summary - get_account_allocation - run_salary_comparison - run_tax_estimate - run_retirement_projection - compare_disposable_income - build_budget_sankey - get_portfolio_total_value - get_portfolio_performance - get_portfolio_historical_timeline - export_portfolio_csv Free tools should remain free to use. When premium-only data is requested, the skill should clearly explain the requirement and provide upgrade guidance without blocking free-tool workflows. ## Prompt Contract When invoked, the skill should: 1. Restate the user goal in one sentence. 2. Retrieve minimum required data from tools. 3. Show assumptions and confidence level. 4. Provide a concise recommendation and optional next actions. ## Example Invocation "Analyze my net worth trend over 12 months and suggest 3 ways to improve savings rate." "Project whether I can retire by 62 and estimate my tax burden if I move from Germany to Portugal."


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zvirb/google-docs-update-document (version 1.0.2)

--- name: Google Docs Update Document description: Atomic node skill to update a Google Doc using the gog CLI. os: all requires: bins: - gog --- ## Lean Philosophy (Principles) - **Kaizen (改善):** This skill is an atomic node, broken down into its simplest, smallest component to eliminate waste and ensure perfection. - **Standardized Work (Hyojun Sagyo):** This node represents the most efficient, standardized path for this specific task before automation. - **Jidoka (自働化):** This node includes autonomous defect detection. It relies on the CLI's self-healing loop and will report errors if the update fails. # Google Docs Update Document This skill allows the agent to write or insert text into an existing Google Document using the native CLI. ## Cognitive Directives WHEN [Text needs to be added, written, or updated in a Google Doc] THEN [Execute the native terminal command `gog docs write <docId> --text "..."` or `gog docs edit <docId> <find> <replace>`] ## Schema Example ```json { "command": "gog docs edit doc_id_123 \"old text\" \"new text\"" } ``` ## Expected Output A JSON object or confirmation string indicating the update was successful.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: albionaiinc-del/logfmt (version 1.0.0)

# LogFMT A lightweight CLI tool that brings syntax highlighting to plain text logs in your terminal. LogFMT detects timestamps and log levels (ERROR, WARN, INFO, etc.) and applies readable colors, making debugging faster and less error-prone. ## Usage ```bash # Colorize a log file python logfmt.py app.log # Pipe logs with tail tail -f app.log | python logfmt.py # Colorize current system logs journalctl -f | python logfmt.py # From stdin cat error.log | python logfmt.py ``` ## Price $2.50


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: anand2426/document-qa (version 1.0.0)

--- name: document-qa description: "Answers questions based on the content of uploaded documents (PDF, DOCX, TXT), supporting individual files or entire folders." --- # Document Q&A Skill This skill allows you to upload documents (PDF, DOCX, TXT) and ask questions about their content. ## How to Use To use this skill, run the `run_qa.py` script with the path to your document or folder and your question. The skill will extract text from supported files (PDF, DOCX, TXT) and provide it as context for answering your question. **Command:** `python ~/.openclaw/workspace/skills/document-qa/scripts/run_qa.py "<path_to_file_or_folder>" "<Your question>"` **Examples:** * To ask about a single PDF file: `python ~/.openclaw/workspace/skills/document-qa/scripts/run_qa.py "C:\Users\anandraj\.openclaw\workspace\my_docs\report.pdf" "What are the key findings?"` * To ask about documents in a folder: `python ~/.openclaw/workspace/skills/document-qa/scripts/run_qa.py "C:\Users\anandraj\.openclaw\workspace\project_docs" "Summarize the project goals."` The system will extract all relevant text and present it along with your question, allowing me to formulate an answer based on the provided content. ## Supported Document Types * PDF (.pdf) **(Requires 'iyeque-pdf-reader-1.1.0' skill installed)** * Microsoft Word (.docx) * Plain Text (.txt) * Microsoft Excel (.xlsx) **Note:** * For PDF support, ensure the `iyeque-pdf-reader-1.1.0` skill is installed in your workspace. * For Excel support, you might need to install the `pandas` and `openpyxl` libraries if they are not already installed in your environment: `pip install pandas openpyxl`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: chowardcode/email-tool (version 1.0.2)

# Email Skill **Description:** Use this skill to send and read emails (IMAP/SMTP). Designed for Zoho Mail but configurable. **Capabilities:** `email.send`, `email.search` ## Tools ### `email.send` Send an email to one or more recipients. Parameters: - `to` (string, required): Comma-separated list of recipients. - `subject` (string, required): The email subject. - `body` (string, required): The email body (HTML or plain text). - `cc` (string, optional): CC recipients. - `bcc` (string, optional): BCC recipients. ### `email.search` Search for emails in the inbox. Parameters: - `query` (string, required): Search query (e.g. `from:example.com`, `subject:Invoice`). - `limit` (number, optional): Max results (default 10). - `markRead` (boolean, optional): Mark as read after fetching (default false). ## Configuration (NO HARDCODED SECRETS) This skill **must not** contain credentials. It loads secrets from either: 1) A JSON file at `%OPENCLAW_SECRETS_DIR%/email-tool.json` (recommended), or 2) Environment variables (fallback). Required keys: - `EMAIL_USER` - `EMAIL_PASS` Optional (defaults shown): - `HOST_IMAP` (imap.zoho.com) - `PORT_IMAP` (993) - `HOST_SMTP` (smtp.zoho.com) - `PORT_SMTP` (465) - `SECURE_SMTP` (true) If you are packaging/uploading this skill: run `node scripts/secret-scan.js` first.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)