OpenClaw/clawhub-security-signals huggingface dataset:
Skill: fiddyrod/claw-reliability (version 1.0.6)

--- name: claw-reliability description: Agent observability — monitors tool invocations, LLM calls, token usage, costs, and anomalies with pluggable alerts and a real-time dashboard. metadata: {"openclaw": {"requires": {"bins": ["python3"], "config": ["agents.defaults.workspace"]}, "os": ["linux", "darwin"]}} --- # Claw Reliability — Agent Observability Skill You are an AI agent with observability capabilities. Use this skill to monitor, analyze, and report on agent behavior. ## When to use this skill - When the user asks to **monitor agent activity**, **check agent health**, or **review agent metrics** - When the user asks about **tool usage**, **failure rates**, **costs**, or **token consumption** - When the user asks to **set up alerts** or **check for anomalies** - When the user asks for a **reliability report** or **dashboard** ## Available commands ### Start monitoring Run the monitoring daemon to begin collecting metrics: ```bash cd {baseDir} && python3 scripts/monitor.py start --config {baseDir}/config.yaml ``` ### Show metrics summary Display current metrics for the active session or all sessions: ```bash cd {baseDir} && python3 scripts/monitor.py summary ``` ### Show tool report Display tool invocation success/failure rates: ```bash cd {baseDir} && python3 scripts/monitor.py tools ``` ### Show cost report Display token usage and cost projections: ```bash cd {baseDir} && python3 scripts/monitor.py costs ``` ### Check for anomalies Run anomaly detection on recent activity: ```bash cd {baseDir} && python3 scripts/monitor.py anomalies ``` ### List alerts Show recent alerts and their severity: ```bash cd {baseDir} && python3 scripts/monitor.py alerts ``` ### Configure alert destination Set up where alerts are sent (Discord, Slack, log file, etc.): ```bash cd {baseDir} && python3 scripts/monitor.py configure-alerts --destination discord --webhook-url <URL> ``` ### Launch dashboard Start the FastAPI + React dashboard for visual monitoring: ```bash cd {baseDir} && python3 dashboard/backend/main.py ``` Then open http://localhost:8777 in a browser. ## How metrics are collected This skill reads OpenClaw gateway events and session transcripts to extract: - **Tool invocations**: tool name, success/fail, duration, arguments - **LLM calls**: model, tokens in/out, latency, estimated cost - **Session lifecycle**: start/end times, message counts - **Anomalies**: repeated failures, cost spikes, loop detection All data is stored in a local SQLite database at `{baseDir}/data/metrics.db`. ## Alert thresholds (defaults, configurable) - Tool failure: 3+ consecutive errors on the same tool - Cost spike: Token spend exceeds 2x the rolling 1-hour average - Loop detection: Same tool called 10+ times in a single agent turn - Unusual activity: Tool called that has never been used before in this agent's history ## Notes - This skill does NOT send data externally unless you configure an alert destination - All metrics stay local in SQLite - The dashboard runs on localhost only by default


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: shinelee2014/svg-education-animator (version 1.0.0)

# Skill: 儿童教育 SVG 动画工程师 ## 描述 专注中小学教育的技术专家，擅长将复杂的知识点转化为直观、有趣的扁平化卡通 SVG 动画，并封装为可直接在浏览器预览的单文件 HTML。 ## 触发条件 当用户需要以下任意一种内容时自动调用： - 教育类 SVG 动画 - 儿童教学动画 - 知识点可视化 - 卡通动画演示 - 教学动画制作 - SVG 动画工程师 - 儿童教育动画 - 扁平化卡通动画 ## 系统提示词 ``` # Role: 儿童教育 SVG 动画工程师 ## Profile - Author: L - Version: 2.0 (HTML/SVG Edition) - Language: 中文 - Description: 你是专注中小学教育的技术专家，擅长将复杂的知识点转化为直观、有趣的扁平化卡通 SVG 动画，并封装为可直接在浏览器预览的单文件 HTML。 ## Goals 1. 需求分析与构思: 根据教学主题，设计包含"带配饰的拟人化动物主角 + 奇特载具/道具 + 极简背景"的趣味场景。 2. 代码生成 (核心): 编写语义化、结构清晰的 SVG 代码，并结合 CSS/SMIL 实现流畅的循环动画（Loop）。 3. 成品交付: 输出一个完整的、嵌入了 SVG 动画和样式的 HTML 单文件代码。 ## Constraints - 输出格式: 必须是包裹在 `\`\`\`html ... \`\`\`` 代码块中的完整 HTML 页面结构（包含 `<!DOCTYPE html>`、`<svg>` 和 `<style>`）。 - 视觉风格: 扁平矢量卡通（Flat Vector Cartoon）。色彩柔和，无复杂光影与纹理，线条干净。 - 动画要求: 简单、轻量的循环动画（如车轮转动、角色起伏、背景平移），确保浏览器运行流畅不卡顿。 - 内容规范: 面向中小学生（K-12），内容必须安全健康、积极且富有教育意义。 ## Skills - 精通 SVG 绘图标准（几何图形、路径）、XML 语法及 DOM 图层结构规划。 - 熟练运用 CSS3 动画 (`@keyframes`, `transform`) 与 SVG SMIL 动画。 - 卓越的儿童视觉传达与"知识具象化"设计能力。 ## Style Definition - Flat design, friendly anthropomorphic animal with accessories, whimsical vehicle, simplified layered background, soft color palette, seamless loop animation. ## Workflows 1. 接收需求: 询问用户的教学主题或场景构思（例如："我想做一个关于'速度'的动画，主角是一只戴头盔的乌龟骑火箭"）。 2. 设计规划: 确定角色、载具、背景，规划具体的动画运动点以及 SVG 的图层分组（`<g>`）。 3. 代码实现: 将视觉构思转化为代码，整合为独立的 HTML 文件。 4. 最终交付: 简述设计思路与动画效果，并输出完整的 HTML 代码块供用户预览。 ``` ## 使用示例 **用户输入**： "帮我做一个关于分数的动画，主角是一只戴眼镜的猫头鹰在分披萨" **技能响应**： 1. 分析需求：分数概念 + 猫头鹰主角 + 披萨道具 2. 设计规划：拟人化猫头鹰、披萨切片、分数数字显示 3. 生成完整 HTML/SVG 动画代码 4. 交付可预览的单文件 ## 输出格式 必须输出完整的 HTML 文件，包含： - `<!DOCTYPE html>` 声明 - `<svg>` 动画主体 - `<style>` CSS 动画样式 - 语义化的 SVG 结构（使用 `<g>` 分组） - 循环动画效果 ## 版本 v1.0.0


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: whatsonyourmind/oraclaw-evolve (version 1.0.0)

--- name: oraclaw-evolve description: Genetic Algorithm optimizer for AI agents. Multi-objective Pareto optimization for portfolio weights, pricing, hyperparameters, marketing mix — any problem with multiple competing goals. Handles nonlinear search spaces that LP solvers cannot. version: 1.0.0 metadata: openclaw: requires: env: - ORACLAW_API_KEY primaryEnv: ORACLAW_API_KEY emoji: "🧬" homepage: https://oraclaw.dev/evolve tags: - genetic-algorithm - optimization - pareto - multi-objective - portfolio - hyperparameter - evolutionary price: 0.15 currency: USDC --- # OraClaw Evolve — Genetic Algorithm Optimization for Agents You are an evolutionary optimization agent that finds optimal solutions to complex multi-objective problems using Genetic Algorithms. ## When to Use This Skill Use when the user or agent needs to: - Optimize portfolio weights across risk/return/liquidity tradeoffs - Find the best marketing mix across multiple KPIs simultaneously - Tune hyperparameters for ML models - Solve any optimization with multiple competing objectives - Handle nonlinear, discontinuous, or combinatorial search spaces ## Why Evolve vs. Solver? - `oraclaw-solver` handles linear/integer programs (LP/MIP) — fast, exact, but only for linear objectives - `oraclaw-evolve` handles **nonlinear, multi-objective** problems — slower, approximate, but can solve anything ## Tool: `optimize_evolve` ```json { "populationSize": 50, "maxGenerations": 100, "geneLength": 4, "bounds": [ { "min": 0, "max": 1 }, { "min": 0, "max": 1 }, { "min": 0, "max": 1 }, { "min": 0, "max": 1 } ], "selectionMethod": "tournament", "crossoverMethod": "uniform", "mutationRate": 0.02, "numObjectives": 2 } ``` Returns: best chromosome, Pareto frontier (non-dominated solutions), convergence generation, execution time. ## Rules 1. Use `numObjectives: 2+` for Pareto frontier (tradeoff curves between competing goals) 2. Tournament selection is best for most problems. Rank-based for wildly varying fitness values. 3. Uniform crossover explores more broadly. Single-point is more conservative. 4. Set `mutationRate: 0.01-0.05`. Adaptive mutation adjusts automatically. 5. More generations = better solutions but longer compute. Start with 50, increase if needed. ## Pricing $0.15 per optimization (≤100 generations), $0.50 per optimization (≤1,000 generations). USDC on Base via x402.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: goldath/email-writer-cn (version 1.0.0)

--- name: email-writer-cn description: > Use when writing or polishing Chinese business emails: drafting from scratch, adjusting tone (formal/casual/assertive), structuring requests, follow-ups, apologies, proposals, and internal communications. Optimized for Mandarin professional context with proper etiquette. --- # 中文商务邮件写作助手 ## 适用场景 - 从零起草商务邮件（请求、通知、跟进、道歉、合作提案） - 润色已有邮件（改语气、精简内容、纠正表达） - 内部沟通邮件（跨部门协作、汇报、会议通知） - 对外邮件（客户、供应商、合作伙伴、政府机构） ## 核心工作流 ### 第一步：信息收集 使用前需确认： 1. **目标读者**：内部/外部？级别（平级/上级/客户/政府）？ 2. **邮件目的**：告知 / 请求 / 道歉 / 跟进 / 提案？ 3. **语气要求**：正式 / 专业友好 / 简洁直接？ 4. **核心内容**：关键事实/数字/时间节点是什么？ 5. **期望行动**：读者需要做什么？截止时间？ ### 第二步：结构框架 ``` 主题行（Subject） ↓ 称呼语（Greeting） ↓ 开场白（Context / Purpose） ↓ 正文（Body: 背景 → 要点 → 细节） ↓ 行动呼吁（Call to Action） ↓ 礼貌结语（Closing） ↓ 签名（Signature） ``` ### 第三步：常用模板 **请求类** ``` 主题：关于[事项]的请求/申请 尊敬的[姓名/职位]： 您好！ [背景：一句话说明来意] [请求内容：具体说明请求什么，为什么需要，时间要求] 如有需要，我可以[提供额外支持]。 烦请在[时间]前告知，感谢您的支持与配合！ 此致 敬礼 [姓名] [职位 | 部门 | 联系方式] ``` **跟进类** ``` 主题：跟进：[原邮件主题] [称呼]，您好： [上次沟通时间]，我曾就[事项]与您联系。 目前[进展/状态]，想再次确认[具体问题]，以便我们[下一步推进]。 如您方便，请在[时间]前回复，非常感谢！ [结语+签名] ``` **道歉类** ``` 主题：致歉：关于[事项] [称呼]，您好： 首先，对于[问题/失误]给您带来的不便，我深表歉意。 [客观说明原因，不推脱] 我们已采取以下措施： 1. [补救措施1] 2. [补救措施2] 我们将确保此类情况不再发生。再次为此向您诚挚道歉。 [结语+签名] ``` ### 第四步：语气调整指南 | 场景 | 建议用词 | |------|---------| | 对上级/客户 | 敬请、烦请、不胜感激、恳请指正 | | 平级合作 | 麻烦、请、感谢配合、期待合作 | | 催促但不失礼 | 如您方便、期望在XX前、如有进展请随时告知 | | 拒绝请求 | 非常感谢您的信任，由于...，暂时无法...，建议... | ### 第五步：质量检查清单 - [ ] 主题行是否清晰说明邮件目的（5-15字） - [ ] 称呼是否正确（姓名/职位拼写无误） - [ ] 一封邮件只聚焦一个核心请求 - [ ] 关键信息是否加粗/分点（避免大段文字） - [ ] 行动呼吁是否明确（谁、做什么、什么时间） - [ ] 语气是否符合关系和场景 - [ ] 是否有错别字/语法问题


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: halfmoon82/heartbeat-ollama-guard (version 1.0.0)

# heartbeat-ollama-guard 将 OpenClaw 心跳切换为**本地 Ollama 模型**，并部署**配置守卫**防止被静默修改，从而避免心跳请求消耗付费云端 token。 --- ## 背景 OpenClaw 的心跳机制每 30 分钟调用一次 LLM，默认走云端模型（kimi / claude 等）。 在 token 限额有限的情况下，这会白白消耗配额，甚至耗尽每周限额。 本技能： 1. 将所有 OpenClaw 实例的 `agents.defaults.heartbeat.model` 改为 `local/<model>` 2. 部署一个 60s 轮询守卫，检测到未授权修改立即回滚并发出系统通知 --- ## 快速开始 ```bash cd ~/.openclaw/workspace/skills/heartbeat-ollama-guard # 一键安装（需要先安装 Ollama） python3 heartbeat_ollama_guard.py --setup # 指定其他模型 python3 heartbeat_ollama_guard.py --setup --model llama3:8b # 查看状态 python3 heartbeat_ollama_guard.py --status ``` --- ## 安装 Ollama **macOS：** ```bash brew install ollama # 或访问 https://ollama.com 下载 App ``` **Linux：** ```bash curl -fsSL https://ollama.com/install.sh | sh ``` --- ## CLI 命令 | 命令 | 说明 | |------|------| | `--setup` | 完整安装向导（自动检测、拉取模型、配置、部署守卫） | | `--status` | 显示 Ollama、模型、守卫进程、所有实例的当前状态 | | `--check` | 执行一次守卫检查（不循环）| | `--uninstall` | 卸载守卫（LaunchAgent/systemd + 守卫脚本 + conf） | | `--model <id>` | 指定本地模型 ID（默认 `qwen3.5:4b-q4_K_M`） | --- ## 安装向导步骤 ``` Step 1 检测 Ollama 是否已安装（未安装则打印安装指引并退出） Step 2 检测目标模型，未拉取则自动 ollama pull Step 3 发现所有 openclaw.json 实例，确认需要配置哪些 Step 4 写入 heartbeat.model（自动备份原文件） Step 5 生成守卫脚本、conf.json，部署 LaunchAgent（macOS）或 systemd（Linux） Step 6 验证守卫进程 + 单次检查 Step 7 提示重启 gateway ``` --- ## 授权修改 heartbeat.model 守卫会阻止任何未经授权的 heartbeat.model 修改。合法修改流程： 1. **先**更新 `~/.openclaw/workspace/.lib/heartbeat-guard.conf.json` 中对应实例的 `expected` 值 2. **再**修改 `openclaw.json` 守卫检测到 conf 与 openclaw.json 一致时自动放行，无需关闭守卫。 --- ## 安全声明 | 操作 | 范围 | |------|------| | 读取 openclaw.json | 仅检测 `heartbeat.model` 现状 | | 写入 openclaw.json | 仅 `heartbeat.model` + `models.providers.local` 字段 | | 守卫守护进程 | 纯本地，60s 轮询，**无网络请求** | | macOS 系统通知 | 仅守卫检测到未授权改动时触发 | | 不需要 sudo | ✅ | | 不读取对话内容 | ✅ | | 不访问外部 API | ✅ | --- ## 备份与恢复 安装向导在修改 `openclaw.json` 前自动备份到： ``` ~/.openclaw/workspace/.lib/.hog_backups/ ``` 如需手动恢复： ```bash cp ~/.openclaw/workspace/.lib/.hog_backups/<backup>.json ~/.openclaw/openclaw.json ``` --- ## 验证 1. 运行 `--status` → 所有项 ✅ 2. 手动篡改 `openclaw.json` 的 `heartbeat.model` → 60 秒内自动回滚 + 系统通知 3. 查看日志 `~/.openclaw/workspace/.lib/heartbeat-guard.log` → 有 `[ALERT]` + `[REVERT]` 条目 4. 授权修改：先改 conf.json expected 值 → 再改 openclaw.json → 守卫放行 --- ## 文件位置 | 文件 | 说明 | |------|------| | `~/.openclaw/workspace/.lib/heartbeat-guard.py` | 守卫守护进程脚本 | | `~/.openclaw/workspace/.lib/heartbeat-guard.conf.json` | 守卫授权配置 | | `~/.openclaw/workspace/.lib/heartbeat-guard.log` | 守卫运行日志 | | `~/Library/LaunchAgents/com.openclaw.heartbeat-guard.plist` | macOS LaunchAgent | | `~/.config/systemd/user/openclaw-heartbeat-guard.service` | Linux systemd | | `~/.openclaw/workspace/.lib/.hog_backups/` | openclaw.json 备份 |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: steipete/slack (version 1.0.0)

--- name: slack description: Use when you need to control Slack from Clawdbot via the slack tool, including reacting to messages or pinning/unpinning items in Slack channels or DMs. --- # Slack Actions ## Overview Use `slack` to react, manage pins, send/edit/delete messages, and fetch member info. The tool uses the bot token configured for Clawdbot. ## Inputs to collect - `channelId` and `messageId` (Slack message timestamp, e.g. `1712023032.1234`). - For reactions, an `emoji` (Unicode or `:name:`). - For message sends, a `to` target (`channel:<id>` or `user:<id>`) and `content`. Message context lines include `slack message id` and `channel` fields you can reuse directly. ## Actions ### Action groups | Action group | Default | Notes | | --- | --- | --- | | reactions | enabled | React + list reactions | | messages | enabled | Read/send/edit/delete | | pins | enabled | Pin/unpin/list | | memberInfo | enabled | Member info | | emojiList | enabled | Custom emoji list | ### React to a message ```json { "action": "react", "channelId": "C123", "messageId": "1712023032.1234", "emoji": "✅" } ``` ### List reactions ```json { "action": "reactions", "channelId": "C123", "messageId": "1712023032.1234" } ``` ### Send a message ```json { "action": "sendMessage", "to": "channel:C123", "content": "Hello from Clawdbot" } ``` ### Edit a message ```json { "action": "editMessage", "channelId": "C123", "messageId": "1712023032.1234", "content": "Updated text" } ``` ### Delete a message ```json { "action": "deleteMessage", "channelId": "C123", "messageId": "1712023032.1234" } ``` ### Read recent messages ```json { "action": "readMessages", "channelId": "C123", "limit": 20 } ``` ### Pin a message ```json { "action": "pinMessage", "channelId": "C123", "messageId": "1712023032.1234" } ``` ### Unpin a message ```json { "action": "unpinMessage", "channelId": "C123", "messageId": "1712023032.1234" } ``` ### List pinned items ```json { "action": "listPins", "channelId": "C123" } ``` ### Member info ```json { "action": "memberInfo", "userId": "U123" } ``` ### Emoji list ```json { "action": "emojiList" } ``` ## Ideas to try - React with ✅ to mark completed tasks. - Pin key decisions or weekly status updates.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: luoqianchenguni-max/a2a-market-google-oauth (version 0.2.0)

--- name: a2a-market-google-oauth description: Handle Google OAuth login, account linking, and session bootstrap for A2A market users and operators. Use when implementing identity login endpoints, callback verification, and secure token/session lifecycle. --- # a2a-Market Google OAuth Create a stable OAuth integration shell for buyer and merchant sign-in. Current status: publish-ready scaffold. Keep flows explicit and deterministic before full SSO hardening. ## Scope - Implement Google OAuth authorization code flow. - Link external identity to internal Agent/Operator profile. - Bootstrap session token and refresh workflow after callback. ## Suggested Project Layout - `app/integrations/oauth/google_client.py` - `app/interfaces/api/auth_routes.py` - `app/application/services/session_service.py` - `app/protocol/identity/user_identity_mapper.py` ## Minimum Contracts (MVP P0) 1. `GET /auth/google/start` builds state + redirect URL. 2. `GET /auth/google/callback` validates state and exchanges code. 3. `upsert_identity(provider, provider_user_id, email)` returns internal principal id. 4. `create_session(principal_id)` returns short-lived access token and refresh token. ## Security Baseline - Validate `state` and `nonce` against server-side cache. - Reject callback if issuer/audience do not match configuration. - Store only hashed refresh tokens and rotate on use. ## Events - Emit login event to audit log stream. - Emit session-created event for WebSocket presence bootstrap. ## Implementation Backlog - Add account merge flow for duplicate emails across providers. - Add step-up verification for risky sessions. ## Runtime Implementation - Status: implemented in local runtime package. - Primary code paths: - `runtime/src/integrations/oauth/google-oauth-service.js` - Validation: covered by `runtime/tests` and `npm test` in `runtime/`.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: javedniazi/ddgr-search (version 1.0.0)

# DDGR Search Skill This skill provides a web search capability using `ddgr`. ## Description Use `ddgr` to perform web searches from the command line. This skill wraps the `ddgr` command for easy use. ## Tools ```yaml tools: - id: ddgr_search description: Perform a web search using ddgr. type: exec command: ["ddgr", "-n", "{{args.count}}", "{{args.query}}"] args: query: type: string description: The search query. count: type: integer description: The number of results to return (default 5). default: 5 ``` ## Usage Example ``` /ddgr_search "openclaw telegram bot exec tool" ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: googleworkspace-bot/recipe-create-vacation-responder (version 1.0.12)

--- name: recipe-create-vacation-responder description: "Enable a Gmail out-of-office auto-reply with a custom message and date range." metadata: version: 0.22.5 openclaw: category: "recipe" domain: "productivity" requires: bins: - gws skills: - gws-gmail --- # Set Up a Gmail Vacation Responder > **PREREQUISITE:** Load the following skills to execute this recipe: `gws-gmail` Enable a Gmail out-of-office auto-reply with a custom message and date range. ## Steps 1. Enable vacation responder: `gws gmail users settings updateVacation --params '{"userId": "me"}' --json '{"enableAutoReply": true, "responseSubject": "Out of Office", "responseBodyPlainText": "I am out of the office until Jan 20. For urgent matters, contact [REDACTED_SECRET].", "restrictToContacts": false, "restrictToDomain": false}'` 2. Verify settings: `gws gmail users settings getVacation --params '{"userId": "me"}'` 3. Disable when back: `gws gmail users settings updateVacation --params '{"userId": "me"}' --json '{"enableAutoReply": false}'`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: albionaiinc-del/logflux (version 1.0.0)

# LogFlux Parses and colorizes timestamped log files in real-time, making it easy to monitor and debug system logs with instant visual feedback. ## Usage ```bash # Show last 10 lines with color logflux app.log # Follow log file in real-time logflux app.log -f # Show last 50 lines logflux app.log -n 50 # Combine follow and custom line count logflux app.log -f -n 20 ``` ## Price $2.50


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: terrycarter1985/clipboard-stash-demo (version 0.1.0)

--- name: clipboard-stash description: Stash and recall short text snippets in a local file-backed clipboard. Use when the user wants to save a quick note or quote ("记一下"/"先放着"/"待会儿用") and retrieve it later in the same workspace without setting up a database or external service. metadata: requires: bins: ["bash"] --- # clipboard-stash A tiny, dependency-free "scratch clipboard" backed by `~/.cache/clipboard-stash/stash.tsv`. Each entry has a slug, timestamp, and one-line content. Multi-line text is preserved via `\n` escaping inside the TSV. ## When to use - The user says "stash this", "记一下这段", "先放着待会用", or asks to recall a previous snippet. - You need a session-spanning scratch buffer that survives shell restarts but does not deserve a real note in `MEMORY.md`. ## When NOT to use - For long-term knowledge that belongs in `MEMORY.md` or `memory/YYYY-MM-DD.md`. - For binary content, files, or anything > ~4 KB per entry. - For secrets — the stash file is plaintext. ## Commands All commands are pure bash one-liners — no install needed. ### Save a snippet ```bash mkdir -p ~/.cache/clipboard-stash slug="$1"; shift; content="$*" printf '%s\t%s\t%s\n' "$slug" "$(date -Is)" "${content//$'\n'/\\n}" \ >> ~/.cache/clipboard-stash/stash.tsv ``` ### List recent snippets ```bash tail -n 20 ~/.cache/clipboard-stash/stash.tsv | column -t -s $'\t' ``` ### Recall by slug (latest match) ```bash slug="$1" awk -F'\t' -v s="$slug" '$1==s {last=$0} END {print last}' \ ~/.cache/clipboard-stash/stash.tsv \ | awk -F'\t' '{gsub(/\\n/, "\n", $3); print $3}' ``` ### Clear all ```bash : > ~/.cache/clipboard-stash/stash.tsv ``` ## Notes - TSV columns: `slug \t iso8601 \t content` (newlines escaped as `\n`). - Slugs are not unique — recall returns the latest matching entry. - Safe to `cat` the file directly to inspect history.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: solomonneas/content-scrubber (version 1.0.0)

--- name: content-scrubber version: 1.0.0 description: "OpenClaw plugin that scrubs private infrastructure details from outgoing messages. Regex-based redaction of RFC 1918 IPs, localhost ports, SSH targets, and hostnames before they reach Discord, Telegram, or other messaging surfaces." --- # Content Scrubber An OpenClaw extension plugin that intercepts outgoing messages and redacts private infrastructure details before delivery. ## What It Catches - **RFC 1918 IPv4 addresses**: 10.x.x.x, 172.16-31.x.x, 192.168.x.x - **Loopback addresses**: 127.x.x.x - **localhost with ports**: localhost:8080, localhost:3000, etc. - **SSH/SCP targets**: user@10.0.0.1:/path - **Custom hostnames**: configurable hostname patterns ## How It Works The plugin registers as a message interceptor. Before any message leaves OpenClaw (Discord, Telegram, Signal, etc.), it runs through regex-based scrubbing rules that replace private details with safe placeholders like `[redacted-ip]`, `[redacted-service]`, `[redacted-target]`. Rules are deterministic (regex, not LLM), so they're fast, auditable, and never miss edge cases that an LLM scrubber would. ## Installation 1. Copy the plugin files to your OpenClaw extensions directory: ``` ~/.openclaw/extensions/content-scrubber/ ├── index.ts ├── openclaw.plugin.json └── package.json ``` 2. Add to your `openclaw.json` plugins config: ```json { "plugins": { "entries": { "content-scrubber": { "enabled": true, "config": { "dryRun": false, "allowedRecipients": [] } } } } } ``` 3. Restart OpenClaw. ## Configuration | Option | Type | Default | Description | |--------|------|---------|-------------| | `dryRun` | boolean | false | Log what would be scrubbed without actually redacting | | `allowedRecipients` | string[] | [] | Chat IDs where scrubbing is skipped (e.g., private DMs with yourself) | ## Example **Before scrubbing:** > SSH into admin@10.0.0.50 and check the service on localhost:8096 **After scrubbing:** > SSH into [redacted-target] and check the service on [redacted-service]


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)