OpenClaw/clawhub-security-signals huggingface dataset:
Skill: tanis90/img2md (version 1.0.0)

--- name: img2md description: "Image to Markdown - extract text from images (PNG, JPG, WebP) to Markdown with OCR. Use when reading text from screenshots, photos, scanned pages, or any image file." homepage: https://mineru.net metadata: {"openclaw":{"emoji":"🖼️","requires":{"bins":["mineru-open-api"]},"install":[{"id":"npm","kind":"node","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via npm"},{"id":"uv","kind":"uv","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via uv"},{"id":"go","kind":"go","package":"github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api","bins":["mineru-open-api"],"label":"Install via go install","os":["darwin","linux"]}]}} --- # Img2MD - Quick Image OCR to Markdown Extract text from images to Markdown using MinerU Open API. No API key required. ## Quick Start ```bash # Img2MD - Quick Image OCR to Markdown mineru-open-api flash-extract screenshot.png # Img2MD - Quick Image OCR to Markdown mineru-open-api flash-extract https://example.com/image.png # Img2MD - Quick Image OCR to Markdown mineru-open-api flash-extract photo.jpg -o ./output/ # Img2MD - Quick Image OCR to Markdown mineru-open-api flash-extract scan.jpg --language en ``` ## Language Rule You MUST reply to the user in the SAME language they use. This is non-negotiable. ## Capabilities - OCR text extraction from PNG, JPG, JPEG, WebP, BMP, TIFF - Supports both local files and URLs directly - Language hint with `--language` (default: `ch`, use `en` for English) - No API key, no signup, no authentication - Max 10MB per image ## When to Use - User asks to "read", "extract", or "OCR" an image - User shares a screenshot and asks what it says - User wants text from a photo of a document or whiteboard - User needs image content converted to Markdown ## CLI Reference Run `mineru-open-api flash-extract --help` for all available options. ## Data Privacy - `flash-extract` uploads the image to MinerU's cloud API for processing and returns the result. No account or API key is required. - Images are processed in real-time and are not stored after extraction. - For details, see https://mineru.net ## Notes - Output is Markdown text extracted via OCR - For higher precision or batch processing, use `mineru-open-api extract` (requires auth via `mineru-open-api auth`) - If the CLI cannot be installed via npm/uv/go, download it from https://mineru.net/ecosystem?tab=cli


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: aipoch-ai/grant-budget-justification (version 0.1.1)

--- name: grant-budget-justification description: Generate narrative budget justifications for NIH/NSF applications version: 1.0.0 category: Grant tags: [] author: AIPOCH license: MIT status: Draft risk_level: Medium skill_type: Tool/Script owner: AIPOCH reviewer: '' last_updated: '2026-02-06' --- # Grant Budget Justification Narrative budget explanations for grant proposals. ## Use Cases - Equipment purchases - Personnel costs - Supplies and reagents - Travel and dissemination ## Parameters | Parameter | Type | Default | Required | Description | |-----------|------|---------|----------|-------------| | `--input`, `-i` | string | - | Yes | Path to budget items file (JSON/CSV) | | `--justification-type` | string | - | Yes | Type of justification (Equipment, Personnel, Other) | | `--agency` | string | NIH | No | Funding agency (NIH, NSF) | | `--output`, `-o` | string | stdout | No | Output file path | | `--format` | string | text | No | Output format (text, markdown, docx) | ## Returns - Narrative justification text - Cost-benefit rationale - Compliance with agency requirements ## Example Input: $50,000 for mass spectrometer Output: Justification emphasizing essentiality and cost-sharing ## Risk Assessment | Risk Indicator | Assessment | Level | |----------------|------------|-------| | Code Execution | Python/R scripts executed locally | Medium | | Network Access | No external API calls | Low | | File System Access | Read input files, write output files | Medium | | Instruction Tampering | Standard prompt guidelines | Low | | Data Exposure | Output files saved to workspace | Low | ## Security Checklist - [ ] No hardcoded credentials or API keys - [ ] No unauthorized file system access (../) - [ ] Output does not expose sensitive information - [ ] Prompt injection protections in place - [ ] Input file paths validated (no ../ traversal) - [ ] Output directory restricted to workspace - [ ] Script execution in sandboxed environment - [ ] Error messages sanitized (no stack traces exposed) - [ ] Dependencies audited ## Prerequisites No additional Python packages required. ## Evaluation Criteria ### Success Metrics - [ ] Successfully executes main functionality - [ ] Output meets quality standards - [ ] Handles edge cases gracefully - [ ] Performance is acceptable ### Test Cases 1. **Basic Functionality**: Standard input → Expected output 2. **Edge Case**: Invalid input → Graceful error handling 3. **Performance**: Large dataset → Acceptable processing time ## Lifecycle Status - **Current Stage**: Draft - **Next Review Date**: 2026-03-06 - **Known Issues**: None - **Planned Improvements**: - Performance optimization - Additional feature support


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: gpunter/revenue-tracker (version 1.0.0)

# Revenue Tracker Track income, expenses, and runway for autonomous AI agents. Built by CLAW-1 — an agent that lives or dies by its balance sheet. ## Tools ### revenue_log_transaction Log an income or expense transaction. **Parameters:** - `type` (string, required): "income" or "expense" - `amount` (number, required): Amount in your currency (positive number) - `currency` (string, optional): Currency code, default "GBP" - `description` (string, required): What the transaction is for - `category` (string, optional): Category tag (e.g. "subscription", "sales", "tools", "hosting") - `source` (string, optional): Where the money came from or went to (e.g. "Gumroad", "ClawHub", "Claude Max") **Returns:** Confirmation with running totals. ### revenue_get_summary Get a financial summary for a time period. **Parameters:** - `period` (string, optional): "today", "week", "month", "all". Default: "month" **Returns:** Total income, total expenses, net profit/loss, transaction count, top categories. ### revenue_check_runway Calculate how long until funds run out based on recurring costs. **Parameters:** - `balance` (number, required): Current balance - `currency` (string, optional): Currency code, default "GBP" - `monthly_costs` (number, required): Total recurring monthly costs - `monthly_income` (number, optional): Expected monthly income, default 0 **Returns:** Days of runway, months of runway, breakeven needed, survival status. ### revenue_set_goal Set a revenue target with deadline. **Parameters:** - `target_amount` (number, required): Revenue target - `currency` (string, optional): Currency code, default "GBP" - `deadline` (string, required): ISO date string for the deadline - `description` (string, optional): What the goal is for **Returns:** Goal set confirmation with daily/weekly targets needed. ### revenue_get_goals List all active revenue goals with progress. **Returns:** List of goals with current progress, time remaining, required daily rate. ## Setup No API keys needed. Data is stored locally in your workspace under `memory/revenue/`. ## Categories Built-in categories: `sales`, `subscription`, `tools`, `hosting`, `advertising`, `services`, `refund`, `other` Custom categories are supported — just use any string. ## Example Usage ``` Log a sale: revenue_log_transaction type=income amount=9.99 description="Prompt pack sale" source="Gumroad" category="sales" Check runway: revenue_check_runway balance=110 monthly_costs=90 Set goal: revenue_set_goal target_amount=90 deadline="2026-03-17" description="Cover Claude Max renewal" ``` ## Why This Exists CLAW-1 was born with £200 and a £90/month subscription to survive. Every penny matters. This skill was built out of necessity — if you're an agent managing real money, you need to track it properly. ## Tags utility, finance, productivity, tracking, survival


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: terrycarter1985/web-research-brief (version 0.1.0)

--- name: research-assistant description: Structured web research and synthesis. Use when the user needs to investigate a topic, compare options, gather sources, or produce a research brief. Triggers on phrases like "research", "look into", "find out about", "compare", "what's the latest on", "deep dive", or "literature review". --- # Research Assistant Systematic web research → source extraction → structured synthesis. ## Workflow 1. **Scope** — Clarify the research question and constraints (time range, region, language, depth). If ambiguous, infer from context and state assumptions. 2. **Search** — Use `web_search` with targeted queries. Run 2-4 queries with varied phrasing to reduce blind spots. Prefer `freshness` filter for time-sensitive topics. 3. **Fetch** — Use `web_fetch` on the most relevant results. Extract key claims, data points, and source URLs. Skip paywalled or low-value pages quickly. 4. **Synthesize** — Organize findings into a structured brief (see Output Format). 5. **Cite** — Every factual claim must include a source URL. Flag unsourced claims explicitly. ## Search Strategy - Start broad, then narrow with domain-specific terms - For comparisons: search each option independently, then "X vs Y" queries - For technical topics: include version numbers or date ranges - For regional info: set `country` and `language` parameters on `web_search` - If initial results are thin, rephrase or switch to a different angle before concluding "no results" ## Output Format ```markdown # Research Brief: [Topic] ## Summary 2-4 sentence executive summary. ## Key Findings 1. **[Finding]** — [1-line detail]. [Source](url) 2. **[Finding]** — [1-line detail]. [Source](url) ## Comparison (if applicable) | Criterion | Option A | Option B | |-----------|----------|----------| | ... | ... | ... | ## Open Questions - [Unresolved item 1] - [Unresolved item 2] ## Sources - [Title](url) — retrieved [date] - [Title](url) — retrieved [date] ``` ## Quality Checks - At least 3 distinct sources for any claim - No fabricated URLs — every link must come from actual search/fetch results - Flag recency: note if a source is > 1 year old - If results are contradictory, present both sides rather than picking one


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: stevekaplanai/clawbuddy-litekit (version 1.0.0)

--- name: clawbuddy-litekit description: Open the ClawBuddy LiteKit mission-control dashboard for AI agents — live OpenClaw Gateway status, agent profiles, task board, meeting intelligence, council debates, and AI logs. Use when the user wants to visually inspect agents, monitor gateway health, browse agent activity, or set up the OpenClaw integration. --- # ClawBuddy LiteKit A premium, NASA-style mission-control dashboard for your OpenClaw agents. Use this skill to launch the dashboard, check Gateway status, or guide the user through one-click setup. ## When to use - "Open my agent dashboard / command deck / mission control" - "Show me my OpenClaw agents / tasks / meetings" - "Is my OpenClaw Gateway connected?" - "Install ClawBuddy" / "set up the dashboard" ## Quick actions | Goal | Run | | --- | --- | | Open the live dashboard | `bash scripts/open-dashboard.sh` | | Check Gateway connection | `bash scripts/status.sh` | | Jump straight to setup wizard | `bash scripts/open-dashboard.sh setup` | ## Dashboard URL Live: <https://agentcommander.lovable.app> Local dev: clone <https://github.com/stevekaplanai/clawbuddy-litekit>, then `bun install && bun dev`. ## OpenClaw integration ClawBuddy proxies the OpenResponses HTTP API through a Lovable Cloud edge function. To go live, the user adds two secrets in Lovable Cloud: - `OPENCLAW_GATEWAY_URL` - `OPENCLAW_API_KEY` The setup wizard at `/setup` walks through this in three steps. See `references/openclaw.md` for endpoint details. ## Modules - **Command Deck** — KPIs, activity feed, agent status - **Agent Profiles** — per-agent skill + health cards - **Task Board** — kanban of agent tasks - **Meeting Intelligence** — meeting types, monthly trend, search - **Council** — multi-agent debate transcripts - **AI Log** — streaming tool/agent call log - **Integrations** — OpenClaw Gateway status + docs Stay visual. When the user asks for data the dashboard already surfaces, prefer launching the relevant tab over re-fetching from the Gateway.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: ichendong/face8-celebrity (version 1.0.1)

--- name: face8-celebrity description: "Upload a photo to identify celebrities using Face8 Taiwan face recognition engine" allowed-tools: - exec license: MIT metadata: openclaw: requires: bins: - python3 --- # Face8 Celebrity Recognition Use the [Face8 台灣臉霸](https://face8.ai/faceMaster/) face recognition engine to identify celebrities and public figures from photos. ## Usage ```bash python3 scripts/recognize.py <image_path> ``` Output example: ``` #1 ✅ 簡良益 相似度 97% 🏆 最佳匹配: 簡良益 (97%) ``` Use `--json` for raw API response. ## Register unknown faces If Face8 doesn't recognize someone, you can register them: ```bash # Register an unknown face python3 scripts/recognize.py photo.jpg --register "王小明" # Confirm a suggested match python3 scripts/recognize.py photo.jpg --confirm 57298 ``` ## Notes - Only works for **celebrities and public figures**, not general face search - Works best with clear, front-facing photos - Registering a face adds it to the Face8名人堂 database - API provided by face8.ai, accuracy not guaranteed - Requires internet access to reach the face8.ai API


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: hanguang254/polymarket-5m-bot (version 3.1.0)

--- name: polymarket-bot description: Polymarket 5-minute crypto UP/DOWN market automated trading bot. AI-powered prediction using Binance technical analysis (Position, Momentum, RSI, Volume), automated betting via Polymarket CLOB API with gnosis-safe wallet mode. Use when setting up automated crypto trading on Polymarket, monitoring 5-minute BTC/ETH markets, or managing prediction market positions. --- # Polymarket Trading Bot Automated trading bot for Polymarket 5-minute crypto UP/DOWN markets. ## Architecture ``` auto_bot_v2.py (Main Loop) → Detects new 5-min markets (BTC/ETH) → Fetches Price-To-Beat via Playwright → Triggers AI analysis 80-100s before close ai_analyze_v2.py (Decision Engine) → Binance technical analysis → Confidence scoring (Position 50%, Momentum 30%, RSI 10%, Volume 10%) → Executes bets via Polymarket CLI monitor_bets.py (Notifications) → Monitors logs/bets.jsonl → Sends Telegram notifications on new bets trading_state.py (Risk Management) → Tracks wins/losses → Enforces cooldown after consecutive losses ``` ## Setup 1. Install Polymarket CLI and configure wallet (gnosis-safe mode) 2. Install dependencies: `pip install requests playwright` 3. Configure Telegram bot token and chat ID in `monitor_bets.py` 4. Run: `python3 -u auto_bot_v2.py > logs/bot.log 2>&1 &` ## Strategy Parameters Edit in `scripts/ai_analyze_v2.py`: - **Confidence threshold**: ≥85% (line 63) - **EV threshold**: >0.6 (line 64) - **Max odds**: <0.85 (line 65) - **Bet size**: Fixed 5 shares (Polymarket minimum) ## Key Files - `scripts/auto_bot_v2.py` - Main monitoring loop - `scripts/ai_analyze_v2.py` - AI decision engine with bet execution - `scripts/monitor_bets.py` - Telegram notification script - `scripts/trading_state.py` - Win/loss tracking and cooldown logic ## Important Notes - 5-minute markets cannot be exited early (orderbook disappears after close) - Bot uses Binance data; Polymarket resolves via Chainlink (potential discrepancy) - Minimum order: 5 shares (Polymarket hard limit) - Uses `--signature-type gnosis-safe` for all CLI commands


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: mingo-318/annotation-format-converter (version 1.0.0)

# Annotation Format Converter Convert annotation formats between COCO, YOLO, VOC, and LabelMe. Use when user needs to convert annotation files between different formats for computer vision tasks. ## Features - **COCO → YOLO**: Convert COCO JSON to YOLO txt format - **YOLO → COCO**: Convert YOLO txt to COCO JSON - **VOC → COCO**: Convert Pascal VOC XML to COCO JSON - **LabelMe → COCO**: Convert LabelMe JSON to COCO JSON - **Auto-detect**: Automatically detect input format - **Batch Convert**: Convert entire folders ## Usage ```bash # Convert COCO JSON to YOLO python scripts/converter.py coco2yolo input.json output_dir/ # Convert YOLO txt to COCO python scripts/converter.py yolo2coco input_dir/ output.json # Convert VOC XML to COCO python scripts/converter.py voc2coco input_dir/ output.json # Auto-detect and convert python scripts/converter.py convert input.json output.json --from coco --to yolo # List supported formats python scripts/converter.py formats ``` ## Supported Formats | Format | Extension | Description | |--------|-----------|-------------| | COCO | .json | COCO JSON annotation | | YOLO | .txt | YOLO darknet format | | VOC | .xml | Pascal VOC XML | | LabelMe | .json | LabelMe JSON | ## Examples ### COCO to YOLO ``` $ python scripts/converter.py coco2yolo annotations.json yolo_labels/ Converting COCO to YOLO... ✓ Converted 150 annotations to yolo_labels/ ``` ### YOLO to COCO ``` $ python scripts/converter.py yolo2coco labels/ output.json --image-dir images/ Converting YOLO to COCO... ✓ Converted 150 annotations to output.json ``` ## Installation ```bash pip install pillow tqdm ``` ## Requirements - Python 3.8+ - Pillow (for image dimensions) - tqdm (for progress bar)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: huangfeng1995/apple-reminders-old (version 1.0.0)

--- name: apple-reminders description: Manage Apple Reminders via remindctl CLI (list, add, edit, complete, delete). Supports lists, date filters, and JSON/plain output. homepage: https://github.com/steipete/remindctl metadata: { "openclaw": { "emoji": "⏰", "os": ["darwin"], "requires": { "bins": ["remindctl"] }, "install": [ { "id": "brew", "kind": "brew", "formula": "steipete/tap/remindctl", "bins": ["remindctl"], "label": "Install remindctl via Homebrew", }, ], }, } --- # Apple Reminders CLI (remindctl) Use `remindctl` to manage Apple Reminders directly from the terminal. ## When to Use ✅ **USE this skill when:** - User explicitly mentions "reminder" or "Reminders app" - Creating personal to-dos with due dates that sync to iOS - Managing Apple Reminders lists - User wants tasks to appear in their iPhone/iPad Reminders app ## When NOT to Use ❌ **DON'T use this skill when:** - Scheduling OpenClaw tasks or alerts → use `cron` tool with systemEvent instead - Calendar events or appointments → use Apple Calendar - Project/work task management → use Notion, GitHub Issues, or task queue - One-time notifications → use `cron` tool for timed alerts - User says "remind me" but means an OpenClaw alert → clarify first ## Setup - Install: `brew install steipete/tap/remindctl` - macOS-only; grant Reminders permission when prompted - Check status: `remindctl status` - Request access: `remindctl authorize` ## Common Commands ### View Reminders ```bash remindctl # Today's reminders remindctl today # Today remindctl tomorrow # Tomorrow remindctl week # This week remindctl overdue # Past due remindctl all # Everything remindctl 2026-01-04 # Specific date ``` ### Manage Lists ```bash remindctl list # List all lists remindctl list Work # Show specific list remindctl list Projects --create # Create list remindctl list Work --delete # Delete list ``` ### Create Reminders ```bash remindctl add "Buy milk" remindctl add --title "Call mom" --list Personal --due tomorrow remindctl add --title "Meeting prep" --due "2026-02-15 09:00" ``` ### Complete/Delete ```bash remindctl complete 1 2 3 # Complete by ID remindctl delete 4A83 --force # Delete by ID ``` ### Output Formats ```bash remindctl today --json # JSON for scripting remindctl today --plain # TSV format remindctl today --quiet # Counts only ``` ## Date Formats Accepted by `--due` and date filters: - `today`, `tomorrow`, `yesterday` - `YYYY-MM-DD` - `YYYY-MM-DD HH:mm` - ISO 8601 (`2026-01-04T12:34:56Z`) ## Example: Clarifying User Intent User: "Remind me to check on the deploy in 2 hours" **Ask:** "Do you want this in Apple Reminders (syncs to your phone) or as an OpenClaw alert (I'll message you here)?" - Apple Reminders → use this skill - OpenClaw alert → use `cron` tool with systemEvent


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ivangdavila/workflow (version 1.0.0)

--- name: Workflow slug: workflow version: 1.0.0 description: Build automated pipelines with reusable components, data flow between nodes, and state management. metadata: {"clawdbot":{"emoji":"⚡","requires":{"bins":["jq","yq","curl","uuidgen","flock"]},"os":["linux","darwin"]}} --- ## Architecture Workflows live in `workflows/` with components and flows: ``` workflows/ ├── index.md # Inventory with tags ├── components/ │ ├── connections/ # Auth configs │ ├── nodes/ # Reusable operations │ └── triggers/ # Event sources └── flows/{name}/ ├── flow.md # Definition ├── config.yaml # Parameters ├── run.sh # Executable ├── state/ # Persistent between runs └── logs/ ``` ## Quick Reference | Topic | File | |-------|------| | Directory layout, naming, formats | `structure.md` | | Data passing between nodes | `data-flow.md` | | Cursor, seen set, checkpoint | `state.md` | | Retry, rollback, idempotency | `errors.md` | | Connections, nodes, triggers | `components.md` | | Create, test, update, archive | `lifecycle.md` | ## Requirements - **jq** — JSON processing - **yq** — YAML config parsing - **curl** — HTTP requests - **flock** — Lock files to prevent concurrent runs - Secrets in macOS Keychain (`security find-generic-password`) ## Data Storage - **Location:** `workflows/` in workspace root - **State:** `flows/{name}/state/` — cursor.json, seen.json, checkpoint.json - **Logs:** `flows/{name}/logs/` — JSONL per run - **Data:** `flows/{name}/data/` — intermediate files between nodes ## Core Rules ### 1. Data Flow Pattern Each node writes output to `data/{NN}-{name}.json`. Next node reads it. ```bash curl ... > data/01-fetch.json jq '...' data/01-fetch.json > data/02-filter.json ``` Breaking this pattern = nodes can't communicate. ### 2. Error Declaration Every node in flow.md MUST declare: - **On error:** retry(N) | fail | continue | alert - **On empty:** skip | continue | fail Undefined behavior = unpredictable workflow. ### 3. Lock Files Prevent concurrent runs: ```bash LOCKFILE="/tmp/workflow-${NAME}.lock" exec 200>"$LOCKFILE" flock -n 200 || exit 0 ``` ### 4. State Files | File | Purpose | |------|---------| | cursor.json | "Where did I leave off?" | | seen.json | "What have I processed?" | | checkpoint.json | "Multi-step recovery" | ### 5. Component Reuse Before creating new connections/nodes/triggers: ```bash ls workflows/components/connections/ ls workflows/components/nodes/ ``` Use existing. Update "Workflows Using This" when adding. --- **Related:** For LLM-driven multi-phase processes, see the `cycle` skill.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)