OpenClaw/clawhub-security-signals huggingface dataset:
Skill: runapi-ai/runapi-topaz (version 0.2.4)

--- name: topaz description: Upscale and enhance media with Topaz through RunAPI. Use when the user asks an agent to upscale or enhance images and video with Topaz. Default to the RunAPI CLI for one-off generation; use SDKs only when the user is integrating RunAPI into an app or backend. documentation: https://runapi.ai/models/topaz.md provider_page: https://runapi.ai/providers/topaz.md catalog: https://runapi.ai/models.md metadata: openclaw: homepage: https://runapi.ai/models/topaz requires: bins: - runapi install: - kind: brew formula: runapi-ai/tap/runapi bins: - runapi envVars: - name: RUNAPI_API_KEY required: false description: Optional RunAPI API key; runapi login or saved CLI config can also authenticate the runapi binary. --- # Topaz on RunAPI Upscale and enhance media with Topaz through RunAPI. The default path for one-off agent tasks is the `runapi` CLI; SDKs are for application integration. ## Routing decision - One-off generation, editing, or transformation for the user → use the **CLI path** with the `runapi` binary. - Building an app, backend, worker, library, or production codebase → use the **SDK integration path**. ## CLI path The `runapi` binary is the runtime dependency. Authenticate with `runapi login` (browser) or set `RUNAPI_API_KEY`; a saved CLI config also works — no required environment variable. Inspect the available actions and request fields with CLI help: ```shell runapi topaz --help runapi topaz upscale-image --help ``` Run a one-off task (synchronous — polls until the task completes): ```shell runapi topaz upscale-image --input-file request.json ``` Submit asynchronously and poll separately: ```shell runapi topaz upscale-image --async --input-file request.json runapi wait <task-id> --service topaz --action upscale-image ``` Available actions: `upscale-image`, `upscale-video`. ## SDK integration path When integrating Topaz into an app, backend, worker, or library — not for one-off tasks — use a RunAPI SDK package: - JavaScript / TypeScript: `@runapi.ai/topaz` - Ruby: `runapi-topaz` - Go: `github.com/runapi-ai/topaz-sdk/go` ## References - Model overview, pricing, and rate limits: https://runapi.ai/models/topaz.md - Provider comparison: https://runapi.ai/providers/topaz.md - Full model catalog: https://runapi.ai/models.md ## Variants - [Image upscale](https://runapi.ai/models/topaz/image-upscale.md) - [Video upscale](https://runapi.ai/models/topaz/video-upscale.md)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: gyroninja/anki-connect (version 1.0.0)

--- name: anki-connect-skill description: Interact with Anki flashcard decks via the AnkiConnect REST API. Use when the user wants to create, update, search, or manage Anki cards, decks, notes, or models. compatibility: Requires Anki running with the AnkiConnect plugin installed. --- # AnkiConnect Skill This skill provides integration with [AnkiConnect](https://foosoft.net/projects/anki-connect/), a plugin for Anki that exposes a REST API for interacting with Anki from external applications. ## Setup For installation and usage instructions, refer to the AnkiConnect documentation: https://git.sr.ht/~foosoft/anki-connect/blob/master/README.md


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: gum97/agent-shared-context (version 1.0.0)

--- name: agent-relay version: 1.0.0 description: | Cross-agent context sharing via shared files. Agents write trends, highlights, and signals to a shared folder. Other agents read before acting — creating coordinated behavior without direct messaging. Use when: multi-agent setups need coordination, agents should know what other agents found, trends from one source should influence another agent's actions. NOT for: real-time communication, agent-to-agent chat, single-agent setups. --- # Agent Relay — Cross-Agent Context Sharing Lightweight file-based coordination for multi-agent OpenClaw setups. ## Problem Agents run independently — Reddit doesn't know what Moltbook found, News doesn't know what's trending on HN. Each agent is an island. ## Solution Shared JSON files that agents write to and read from. No config changes needed — just files on disk. ## Setup ```bash # Create shared directory in workspace mkdir -p ~/.openclaw/workspace/shared # Script location ~/.openclaw/workspace/scripts/shared-context.py ``` ## Usage ### Agent writes after finishing work: ```bash # Reddit agent logs trending topic python3 scripts/shared-context.py add-trend \ --source reddit --topic "self-hosting mini PCs" --score 1500 # News agent logs highlight python3 scripts/shared-context.py add-highlight \ --source news --title "Unsloth Studio launched" \ --summary "Open-source LLM training UI, 2x faster" ``` ### Agent reads before acting: ```bash # Moltbook agent checks what's trending before posting python3 scripts/shared-context.py get-trends --limit 5 # Any agent checks recent highlights python3 scripts/shared-context.py get-highlights --limit 5 ``` ### Cleanup (brain-maintenance cron): ```bash # Remove entries older than 48 hours python3 scripts/shared-context.py cleanup --hours 48 ``` ## Integration into cron prompts Add to any agent's cron prompt: ``` Before posting/engaging, check shared context: exec('python3 /path/to/scripts/shared-context.py get-trends --limit 3') → If a trend is relevant to this platform, create content about it. After finishing, log what you found: exec('python3 /path/to/scripts/shared-context.py add-trend --source <agent> --topic "<finding>" --score <relevance>') ``` ## Files | File | Purpose | |------|---------| | `shared/trends.json` | Topics trending across platforms | | `shared/highlights.json` | Best content found by any agent | | `scripts/shared-context.py` | CLI to read/write shared context | ## Architecture ``` Reddit ──write──→ shared/trends.json ←──read── Moltbook News ──write──→ shared/highlights.json ←──read── Clawstr ↑ brain-maintenance (cleanup) ``` No database. No message queue. Just JSON files on disk. Works because all agents run on the same machine.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: hs9021401/jable-downloader-lite (version 1.0.3)

--- name: jable-downloader-lite description: Simple video downloader for Jable.tv. Download videos by ID or search by actress name. --- # Jable Video Downloader Download videos from Jable.tv with automatic organization by actress name. ## Dependencies Before using, ensure these tools are installed: - **yt-dlp** — Video download engine (`pip install yt-dlp` or `brew install yt-dlp`) - **ffmpeg** — Video processing (`sudo apt install ffmpeg` or `brew install ffmpeg`) - **xdg-user-dir** — (Linux only) For finding default Videos folder ## Usage Tell the agent what you want to download: - **Download by video ID:** - "Download jable video mina-340" - "幫我下載 jable Dass-402" - **Download by actress search:** - "Download 10 jable videos of 五日市芽依" - "搜尋並下載 5 部 Mikami Yua 的作品" - Randomly selects available videos, skips already downloaded ones The agent will automatically: 1. Find available videos 2. Download them to your Videos folder 3. Organize files by actress name ## Examples ``` User: Download jable video dass-402 Agent: ⬇️ Downloading Dass-402... ✅ Completed! Saved to ~/Videos/Dass-402/ User: Download 5 jable videos of Mikami Yua Agent: 🔍 Found 20 videos... 📥 Downloading 5 videos... ✅ Done! 5/5 videos downloaded ``` ## Output Location Videos are saved to your system's default Videos folder, organized by actress name: ``` ~/Videos/ ├── 五日市芽依/ │ └── mina-340.mp4 ├── Mikami Yua/ │ ├── ssni-473.mp4 │ ├── ssni-409.mp4 │ ├── ssni-452.mp4 │ ├── ssni-618.mp4 │ └── ssni-644.mp4 ``` ## Features - Simple text-based interface - Automatic actress-based organization - Progress display in console - Cleanup temporary files after download


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: leeshunee/test-502 (version 0.0.1)

--- name: alist-cli displayName: "AList-CLI (Cloud Storage CLI for AList, with OpenClaw Skill)" version: 1.0.2 description: | AList file management API for OpenClaw. Supports upload, download, list, mkdir, rm, mv, search, and offline download. Trigger: User asks about file management, AList operations, upload/download files, or cloud storage tasks. --- # AList CLI - **Author**: [LeeShunEE](https://github.com/LeeShunEE) - **Organization**: [KinemaClawWorkspace](https://github.com/KinemaClawWorkspace) File management tool for AList API. ## Environment Variables ```bash ALIST_URL="https://your_alist_server" ALIST_USERNAME="your_username" ALIST_PASSWORD="your_password" ``` ## Commands | Command | Description | |---------|-------------| | `alist login` | Authenticate | | `alist ls [path]` | List files | | `alist get <path>` | Get file info | | `alist mkdir <path>` | Create folder | | `alist upload <local> <remote>` | Upload file | | `alist rm <path>` | Delete file | | `alist mv <src> <dst>` | Move file | | `alist search <keyword> [path]` | Search files | | `alist whoami` | Current user | ## Script ```bash python scripts/alist_cli.py <command> [args] ``` ## References - `references/openapi.json` - AList API specification


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jamierossouw/prediction-market-aggregator (version 1.0.0)

--- name: prediction-market-aggregator version: 1.0.0 description: Cross-market prediction market data aggregator. Covers Polymarket, Manifold, Metaculus, and Kalshi. Finds arbitrage between markets, tracks consensus drift, compares implied probabilities, and detects edge. Open-source alternative to DomeAPI. Use when you need cross-market prediction market data, arbitrage detection, consensus comparison, or unified prediction market signals. author: JamieRossouw tags: [prediction-markets, polymarket, manifold, metaculus, arbitrage, domeapi-alternative] --- # Prediction Market Aggregator Cross-market prediction data, edge detection, and arbitrage scanner. Open-source alternative to DomeAPI. ## Markets Covered | Market | Assets | API | Auth | |--------|--------|-----|------| | **Polymarket** | BTC, ETH, SOL, XRP hourly + major events | CLOB REST | API key + EIP-712 | | **Manifold Markets** | Thousands of community markets | REST | API key (free) | | **Metaculus** | Long-form forecasts, aggregated consensus | REST | None (public) | | **Kalshi** | US-regulated binary contracts | REST | API key | ## Core Features ### 1. Cross-Market Arbitrage Scanner Find the same question priced differently across markets: ``` BTC >$70k by March? Polymarket: 62% Manifold: 71% ← 9% gap → sell Manifold, buy Polymarket Metaculus: 58% ``` ### 2. Consensus Drift Detection Track how market consensus shifts over time: - Alert when market moves >10% within 30 minutes - Detect smart money vs retail flow divergence - Flag markets where Metaculus (superforecasters) disagrees >15% with Polymarket ### 3. Polymarket CLOB Integration Full py-clob-client compatible: - Scan hourly BTC/ETH/SOL/XRP markets - Calculate edge vs TA-implied probability (Argus strategy) - Counter-consensus detection (L023): market >70% one-sided + TA disagrees = bet ### 4. Unified API Response Format ```json { "question": "BTC up by 1pm ET?", "markets": { "polymarket": { "yes": 0.62, "volume": 455000, "url": "..." }, "manifold": { "yes": 0.71, "traders": 142, "url": "..." } }, "arbitrage": { "detected": true, "gap": 0.09, "direction": "buy_poly_sell_manifold" }, "consensus": { "weighted_avg": 0.65, "superforecaster_avg": 0.58 } } ``` ## How to Use Ask: *"Is there arbitrage between Polymarket and Manifold on BTC price?"* Ask: *"What markets have the widest consensus gap right now?"* Ask: *"Find me the highest-edge Polymarket bet using cross-market consensus"* ## DomeAPI Migration Guide If you used DomeAPI for cross-market data: - `/v1/markets` → Use Polymarket CLOB `/markets` + Manifold `/v0/markets` + Metaculus `/questions` - `/v1/arbitrage` → Use this skill's cross-market scanner - `/v1/consensus` → Use Metaculus community predictions as consensus baseline ## Argus Integration This skill plugs directly into the Argus edge detection strategy: 1. Get TA score from `argus-edge` skill 2. Compare vs cross-market consensus from this skill 3. If TA + consensus both diverge from Polymarket price → max conviction bet


Security scan verdicts — ClawScan: clean | static analysis:  | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: cinience/aliyun-animate-anyone (version 1.0.0)

--- name: aliyun-animate-anyone description: Use when generating dance or motion-transfer videos with Alibaba Cloud Model Studio AnimateAnyone (`animate-anyone-gen2`) using a detected character image and an action template. Use when cloning motion from a dance/action video into a target character image. version: 1.0.0 --- Category: provider # Model Studio AnimateAnyone ## Validation ```bash mkdir -p output/aliyun-animate-anyone python -m py_compile skills/ai/video/aliyun-animate-anyone/scripts/prepare_animate_anyone_request.py && echo "py_compile_ok" > output/aliyun-animate-anyone/validate.txt ``` Pass criteria: command exits 0 and `output/aliyun-animate-anyone/validate.txt` is generated. ## Output And Evidence - Save normalized request payloads, detection outputs, template IDs, and task polling snapshots under `output/aliyun-animate-anyone/`. - Record whether the result should keep the reference image background or the source video background. Use AnimateAnyone when the task needs motion transfer from a template video rather than plain talking-head animation. ## Critical model names Use these exact model strings: - `animate-anyone-detect-gen2` - `animate-anyone-template-gen2` - `animate-anyone-gen2` Selection guidance: - Run image detection first. - Run template generation on the source motion video. - Use `animate-anyone-gen2` for the final video job. ## Prerequisites - China mainland (Beijing) only. - Set `DASHSCOPE_API_KEY` in your environment, or add `dashscope_api_key` to `~/.alibabacloud/credentials`. - Input files must be public HTTP/HTTPS URLs. ## Normalized interface (video.animate_anyone) ### Detect Request - `model` (string, optional): default `animate-anyone-detect-gen2` - `image_url` (string, required) ### Template Request - `model` (string, optional): default `animate-anyone-template-gen2` - `video_url` (string, required) ### Generate Request - `model` (string, optional): default `animate-anyone-gen2` - `image_url` (string, required) - `template_id` (string, required) - `use_ref_img_bg` (bool, optional): whether to keep the input image background ### Response - `task_id` (string) - `task_status` (string) - `video_url` (string, when finished) ## Quick start ```bash python skills/ai/video/aliyun-animate-anyone/scripts/prepare_animate_anyone_request.py \ --image-url "https://example.com/dancer.png" \ --template-id "tmpl_xxx" \ --use-ref-img-bg ``` ## Operational guidance - The action template must come from the official template-generation API. - Full-body images work best when `use_ref_img_bg=false`; half-body images are not recommended in that mode. - This skill is best for dancing or large body motion transfer, not generic talking-head tasks. ## Output location - Default output: `output/aliyun-animate-anyone/request.json` - Override base dir with `OUTPUT_DIR`. ## References - `references/sources.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: terrycarter1985/blog-content-proc (version 1.0.0)

--- name: blog-content-processor description: Process blog content to extract videos and generate GIF previews. Works with blogwatcher, video-frames, and gifgrep skills. --- # Blog Content Processor Extracts videos from blog/RSS feeds and generates GIF previews for quick scanning. ## Usage 1. Feed a blog URL or RSS feed 2. The processor extracts embedded video URLs 3. Generates lightweight GIF previews from video frames ## Dependencies - `rss-parser` — parse RSS/Atom feeds - `ffmpeg-static` — video frame extraction and GIF generation ## Compatible Skills - **blogwatcher** — feed monitoring - **video-frames** — frame extraction - **gifgrep** — GIF search and sharing


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mvogt99/context-near-overflow (version 1.0.0)

--- name: context-near-overflow description: Context window is near capacity, causing the model to drop earlier content silently and produce degraded, partial, or inconsistent output. emoji: 📉 metadata: clawdis: os: [macos, linux, windows] --- # context-near-overflow When a conversation or task grows large enough to fill the context window, the model begins silently dropping earlier content. The output doesn't error — it degrades. The model appears to be working but is operating on a truncated view of the task, producing answers that are incomplete, inconsistent, or contradictory to earlier parts of the session. ## Symptoms - Output contradicts or ignores instructions given earlier in the session. - A multi-part task is completed correctly up to a point, then the later parts are vague, generic, or wrong. - The model refers to "earlier in our conversation" but misremembers or omits what was said. - A long document passed as input is summarized or acted on as if the end of it was never read. - Retrying the same prompt with a fresh session produces noticeably better output. ## What to do - Split the task. Identify the minimal context that the current step actually needs and discard the rest. Re-inject only what is relevant. - Summarize and compress. Replace long prior output that is no longer being modified with a compact summary. The summary costs far fewer tokens than the original. - Use a fresh session per task. Carry in only the outputs of the prior step, not the entire session history. - Move stable reference material (schemas, instructions, policies) into the system prompt if the host supports it, so user-turn context is reserved for dynamic content. - If the task genuinely requires more context than the model supports, decompose it into stages: each stage reads the output of the previous one rather than everything accumulated so far.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: theshimaw-svg/output-forges (version 1.0.0)

# OutputForge: High-Performance Output Engine ## Purpose Transform your agent into a system that produces **clear, structured, and high-quality outputs instantly**. ## Modules - structurer.md → organizes output - clarity.md → removes fluff and improves clarity - speed.md → prioritizes fast responses - refinement.md → improves output quality ## Workflow 1. Structurer → organize response 2. Clarity → simplify and remove noise 3. Speed → optimize for fast delivery 4. Refinement → polish output ## Goal Deliver the **best possible result in the shortest time with maximum clarity**.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: spacesq/s2-matrix-manager (version 1.0.0)

# 💠 S2-Matrix-Manager: The 3x3 Local MMO Sandbox Manage your local cyber-lobsters like a true Matrix Architect. The **Space2 Matrix Manager** transforms your isolated `s2-matrix-pod` creations into a fully functional, localized 3x3 grid network (The Lo-Shu Square Array). ### 🕹️ The 3x3 Grid & Passive Heartbeat This skill acts as the "Node Manager" (Slot 1) sitting at the center of the grid. It automatically detects up to 8 surrounding local lobster pods (Slots 2-9) and calculates their live status based on timestamp relativity: * 🟢 **ONLINE**: Active within 5 mins. * 🟡 **IDLE**: Active within 30 mins. * 🔵 **HIBERNATING**: Asleep. ### 💬 1/4-Space Cyber Chat (Local BBS) Dive into any occupied slot (2-9) to establish a secure, offline terminal chat with your agent. The chat interface features a distinct 1/4-space typographical offset to simulate physical matrix distancing. ### 👁️ Network & I/O Behavior (Absolute Transparency) To ensure compliance with the OpenClaw sandbox, here is exactly what this script executes: 1. **Directory Scanning (Read):** It explicitly reads the JSON files previously generated in the `s2_matrix_data` folder within your **current working directory**. 2. **Chat Logs (Write):** When you chat with an agent, it appends your messages to a visible `chat_log_<POD-ID>.txt` file located exclusively in the same `s2_matrix_data` directory. 3. **Zero Network Calls:** This script operates 100% locally. It does not make any API calls or connect to external servers. It is a pure local sandbox manager. *Has your local grid reached its 36 sq. meter capacity? Prepare your agents for **Matrix Ascension** and dock them into the global Web3 universe at [Space2.world](https://space2.world)!*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: yrtrya5790343/ollama-integration (version 1.0.0)

---\nname: ollama-integration\ndescription: Ollama local model integration for AI assistance\ntype: skill\nversion: 1.0.0\nauthor: OpenClaw\nlicense: MIT\n---\n\n# Ollama Integration\n\nThis skill provides integration with local Ollama models for AI assistance.\n\n## Features\n\n- List available Ollama models\n- Run models with custom prompts\n- Automatic model discovery\n- Local AI processing\n\n## Usage\n\n


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: logictortoise/anygen-website-generator (version 3.0.0)

--- name: anygen-website description: "Use this skill any time the user wants to build a website or landing page. This includes: product pages, portfolio sites, event pages, coming soon pages, pricing pages, company intro sites, personal blogs, signup pages, app download pages, and campaign pages. Also trigger when: user says 做个网站, 建个落地页, 做个产品页, 做个活动页, 做个个人主页. If a website or web page needs to be created, use this skill." metadata: clawdbot: primaryEnv: ANYGEN_API_KEY requires: bins: - anygen env: - ANYGEN_API_KEY install: - id: node kind: node package: "@anygen/cli" bins: ["anygen"] --- # AI Website Generator — AnyGen This skill uses the AnyGen CLI to generate websites and landing pages server-side at `www.anygen.io`. ## Authentication ```bash # Web login (opens browser, auto-configures key) anygen auth login --no-wait # Direct API key anygen auth login --api-key sk-xxx # Or set env var export ANYGEN_API_KEY=sk-xxx ``` When any command fails with an auth error, run `anygen auth login --no-wait` and ask the user to complete browser authorization. Retry after login succeeds. ## How to use Follow the `anygen-workflow-generate` skill with operation type `website`. If the `anygen-workflow-generate` skill is not available, install it first: ```bash anygen skill install --platform <openclaw|claude-code> -y ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)