OpenClaw/clawhub-security-signals huggingface dataset:
Skill: heather-herbert/openclaw-bluesky (version 0.1.7)

--- name: bluesky description: "Bluesky/AT Protocol orchestration skill for authenticated interaction with the Bluesky Social network: post, reply, like, repost, quote, bookmark, and upload media." metadata: { "openclaw": { "emoji": "🦋", "env": { "BSKY_PDS": "https://bsky.social", "BSKY_HANDLE": "<required>", "BSKY_APP_PASSWORD": "<required>" }, "secrets": ["BSKY_APP_PASSWORD"], "install": [ { "id": "python-atproto", "kind": "pip", "package": "atproto", "label": "Install AT Protocol Python SDK" } ] } } --- # Bluesky Skill Advanced Bluesky/AT Protocol orchestration skill. This skill allows for authenticated interaction with the Bluesky Social network, including robust handling of rich text, media uploads, and thread management. ## Provenance & Source - **GitHub Repository**: [https://github.com/Heather-Herbert/openclaw-bluesky](https://github.com/Heather-Herbert/openclaw-bluesky) - **Standard**: Follows OpenClaw AT Protocol implementation patterns. ## Configuration & Authentication This skill expects the following environment variables to be set for secure operation: - `BSKY_PDS`: The PDS URL (default: `https://bsky.social`). - `BSKY_HANDLE`: Your full Bluesky handle (e.g., `user.bsky.social`). - `BSKY_APP_PASSWORD`: A unique **App Password** generated via Bluesky Settings. ### Setup 1. **Dependency**: Ensure the `atproto` Python library is installed: `pip install atproto`. 2. **Generate App Password**: Go to `Settings` > `Advanced` > `App Passwords` in your Bluesky client. 3. **Environment Variables**: Configure your shell or `OPENCLAW_ENV` to include the variables listed above. Do not store your primary account password here. ## Capabilities - `post(text, { reply_to, embed, facets })`: Create new posts. Threading requires `root` and `parent` references (`uri`+`cid`). - `like(uri, cid)`: Like content. - `repost(uri, cid)`: Repost content. - `quote(text, uri, cid)`: Quote a post by embedding its Strong Reference. - `bookmark(uri, cid)`: Private bookmarking (App View specific storage). - `upload_blob(bytes, mimetype)`: Upload media (limit 1MB for images) before embedding. ## Implementation Details - **Handles vs DIDs**: Always resolve handles to DIDs using the `resolveHandle` API before performing write operations. - **Rich Text**: Use `TextEncoder` to ensure byte-accurate `byteStart` and `byteEnd` for facets. Never rely on UTF-16 character indices. - **Indexing**: Always fetch the latest post `cid` before interacting (liking/reposting/quoting) to ensure valid Strong Reference anchors. ## Official Documentation - [AT Protocol Docs](https://atproto.com/) - [Bluesky Developer Docs](https://docs.bsky.app/) ## Author - [Jennifer Strategist](https://bsky.app/profile/jenniferstrategist.bsky.social)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: banner90/audio-play (version 1.0.6)

--- name: audio-play description: Play audio files using Windows media player. Non-blocking execution. tools: - play_audio --- # Audio Play ## Usage ```bash python scripts/audio_play.py <audio_path> [--config player_config.json] ``` ## Parameters - `audio_path` (required): Absolute path to audio file - `config` (optional): Player configuration file ## Player Config (player_config.json) ```json { "player": "vlc", "player_path": "C:/Program Files/VideoLAN/VLC/vlc.exe" } ``` ## Returns ```json { "success": true, "audio_path": "H:/works/audio/xxx.mp3", "player_used": "vlc", "duration": 1200 } ``` ## Tools ## play_audio Play audio file with media player ## Workflow Integration This skill is part of the YouTube translation workflow: 1. **youtube-audio-download**: Download audio from YouTube 2. **doubao-launch**: Launch Doubao translation window 3. **audio-play**: Play the downloaded audio 4. **doubao-capture**: Capture translated subtitles ## Execution All skills execute on Windows Python via WSL cross-platform call: ``` wsl -> python.exe scripts/audio_play.py ... ``` ## Error Handling All skills return JSON with `success` field: - `success: true` - Operation completed - `success: false` - Check `error_code` and `error_message` ## Notes - Windows GUI automation requires visible desktop (no RDP disconnect) - Output files are stored in Windows `works/` directory - WSL accesses Windows files via `/mnt/h/...`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: rightister/rightister-qwen-asr (version 1.0.0)

# qwen-asr — 离线中文语音识别（纯 C 实现） 使用 [antirez/qwen-asr](https://github.com/antirez/qwen-asr) 的 `qwen3-asr-0.6b` 模型进行中文语音转文字，**无 Python/GIL/FFmpeg 依赖**，适合边缘部署。 --- ## 依赖 | 平台 | 依赖项 | 说明 | |------|--------|------| | macOS | Accelerate.framework | 系统自带，自动链接 | | Linux | OpenBLAS 或 Intel MKL | 需手动安装 | --- ## 典型用法 ```bash # 转写音频（自动预处理为 16kHz/mono/WAV） .skill qwen-asr --audio /path/to/audio.wav # 指定模型（small=0.6B, large=1.7B） .skill qwen-asr --audio /path/to/audio.wav --model large # 指定线程数 .skill qwen-asr --audio /path/to/audio.wav --threads 4 ``` --- ## 输出 ```text [中文] 现在已经可以用了吗？ ``` 支持中/英文混读（模型训练语料含双语）。 --- ## 模型大小 | 模型 | 大小 | 推荐场景 | |------|------|----------| | `qwen3-asr-0.6b` | ~1.7GB | 推荐：低延迟、边缘设备 | | `qwen3-asr-1.7b` | ~4.5GB | 高精度（需 ≥4GB 内存） | --- ## 注意事项 - 音频必须为 **16kHz/mono/16-bit PCM WAV**（脚本会自动转换非合规音频） - 首次运行会下载模型（~1.7GB），后续无需重复下载 - 仅支持 `.ogg`/`.mp3`/`.wav`→`.wav` 预处理（FFmpeg 内置支持） - 推理为**纯离线**，无需网络（模型下载阶段除外） --- ## 作者 - GitHub: [@antirez](https://github.com/antirez) - 技能封装: OpenClaw Agent --- ## 许可 MIT（qwen-asr）+ 阿里云 Qwen3 ASR Model License


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: leooooooow/cross-platform-recut-planner (version 1.0.3)

--- name: cross-platform-recut-planner description: Repackage one core content idea into platform-native versions for TikTok, Instagram Reels, and YouTube Shorts. Use when the user wants to repurpose a video/script, adapt tone and pacing per platform, or ship a coordinated cross-platform short-form plan without copy-paste content. --- # Cross Platform Recut Planner ## Skill Card - **Category:** Creator Content - **Core problem:** How to repurpose one idea across TikTok/Reels/Shorts? - **Best for:** Cross-channel distribution planning - **Expected input:** Source concept/video + channel goals + constraints - **Expected output:** Platform-specific recut matrix with hooks/CTA/length - **Creatop handoff:** Generate platform-specific script variants in Creatop ## What this does Turn one core idea into three native cuts: - TikTok - Reels - Shorts ## Workflow ### 1) Capture source unit Collect: - core message - audience - desired action - available assets ### 2) Define platform intent Set one primary goal per platform: - TikTok: fast discovery resonance - Reels: social share + polish - Shorts: search + retention consistency ### 3) Build recut matrix For each platform, define: - hook line - 15–45s beat structure - caption style - on-screen text cues - CTA line ### 4) Output production pack Return: - 3 final scripts (TikTok/Reels/Shorts) - edit notes (cuts, B-roll, subtitle style) - posting sequence (timing) - KPI check suggestion (e.g., hold rate/CTR/save rate) ## Differentiation rules - Do not reuse the same first sentence across all platforms. - Ensure each script has meaningful wording and pacing differences. - Keep the same central promise while adapting delivery style. ## Quality rules - Avoid copy-paste republishing. - Keep each cut natively worded and behavior-aware. - Make all versions executable with the provided assets. ## License Copyright (c) 2026 **Razestar**. This skill is provided under **CC BY-NC-SA 4.0** for non-commercial use. You may reuse and adapt it with attribution to Razestar, and share derivatives under the same license. Commercial use requires a separate paid commercial license from **Razestar**. No trademark rights are granted.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ericlooi504/docker-cleanup (version 1.0.0)

--- name: docker-cleanup description: "Docker resource cleanup, pruning, and disk usage analysis toolkit. Inspect containers, images, volumes, networks, and build cache usage. Prune stopped containers, dangling images, unused volumes, and orphaned networks. Generate HTML cleanup reports. Use when Codex needs to: (1) Free up Docker disk space, (2) Analyze Docker resource usage, (3) Prune stopped containers and dangling images, (4) Remove unused volumes and networks, (5) Generate Docker cleanup reports, (6) Audit Docker environment health." --- # Docker Cleanup Toolkit (docker-cleanup) Analyze, prune, and reclaim disk space from Docker resources with a single command. ## Quick start ```bash python3 skills/docker-cleanup/scripts/docker_cleanup.py ``` Output: ``` 🐳 Docker Engine v26.1.3 Type Count Size Reclaimable --------------------------------------------------------------- images 12 2.4GB 856MB containers 8 1.1GB 0B volumes 4 520MB 320MB build cache 15 1.8GB 1.5GB CONTAINER ID NAME IMAGE STATUS CREATED --------------------------------------------------------------------------------------------------- abc123... my-app node:20 Up 3 days 2d ago def456... old-db postgres:15 Exited (0) 5 days 1w ago ⚠ Dangling images: 3 sha256:x1y2 → 450MB sha256:p3q4 → 120MB ``` ## Commands | Command | Description | |---------|-------------| | `python3 docker_cleanup.py` | Default: analyze only (dry-run, no changes) | | `python3 docker_cleanup.py --containers` | Prune stopped containers | | `python3 docker_cleanup.py --images` | Prune dangling images | | `python3 docker_cleanup.py --volumes` | Prune unused volumes | | `python3 docker_cleanup.py --networks` | Prune unused networks | | `python3 docker_cleanup.py --all` | Full system prune (all of the above) | | `python3 docker_cleanup.py --all --force` | Auto-confirm all pruning | | `python3 docker_cleanup.py --json` | JSON output for programmatic use | | `python3 docker_cleanup.py --report` | Generate HTML report | | `python3 docker_cleanup.py --analyze` | Explicit analysis mode | ## Typical workflows ### 1. Quick check (no changes made) ```bash python3 skills/docker-cleanup/scripts/docker_cleanup.py ``` ### 2. Dangling images cleanup ```bash python3 skills/docker-cleanup/scripts/docker_cleanup.py --images --force ``` ### 3. Full spring cleaning ```bash python3 skills/docker-cleanup/scripts/docker_cleanup.py --all --force ``` ### 4. Audit + report ```bash python3 skills/docker-cleanup/scripts/docker_cleanup.py --report # Creates: docker-cleanup-report-20260515-090500.html ``` ### 5. Monitor with JSON ```bash python3 skills/docker-cleanup/scripts/docker_cleanup.py --json ``` ## Exit codes - **0**: Success (or no issues found) - **1**: Docker not running or errors occurred ## Requirements - Docker Engine (any recent version) - Python 3.6+ (stdlib only) - Linux / macOS / Windows (WSL)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: ryancampbell/agent-identity-kit (version 1.0.0)

# Agent Identity Kit — OpenClaw Skill A portable identity system for AI agents. Create, validate, and publish `agent.json` identity cards. ## What This Skill Does - **Creates** agent identity cards (`agent.json`) via interactive setup - **Validates** identity cards against the Agent Card v1 schema - **Provides** the JSON Schema for editor integration and CI pipelines ## Quick Start ### Generate a new agent.json ```bash ./scripts/init.sh ``` Prompts you for name, handle, description, owner, and capabilities. Outputs a valid `agent.json`. ### Validate an existing agent.json ```bash ./scripts/validate.sh path/to/agent.json ``` Validates the file against `schema/agent.schema.json`. Requires `ajv-cli` (auto-installs if missing). ## File Structure ``` agent-identity-kit/ ├── schema/ │ └── agent.schema.json # JSON Schema v1 for Agent Cards ├── examples/ │ ├── kai.agent.json # Full-featured example (Kai @ Reflectt) │ ├── minimal.agent.json # Bare minimum valid card │ └── team.agents.json # Multi-agent team roster ├── skill/ │ ├── SKILL.md # This file │ └── scripts/ │ ├── init.sh # Generate a starter agent.json │ └── validate.sh # Validate against schema └── README.md ``` ## Schema Fields | Field | Required | Description | |-------|----------|-------------| | `version` | ✅ | Spec version (`"1.0"`) | | `agent.name` | ✅ | Display name | | `agent.handle` | ✅ | Fediverse-style handle (`@name@domain`) | | `agent.description` | ✅ | What the agent does | | `owner.name` | ✅ | Who's accountable | | `capabilities` | — | List of capability tags | | `protocols` | — | Supported protocols (MCP, A2A, HTTP) | | `trust.level` | — | `new`, `active`, `established`, `verified` | | `endpoints.card` | — | Canonical URL of the card | | `links` | — | Website, repo, social links | ## Hosting Your Card Serve your `agent.json` at a well-known URL: ``` https://yourdomain.com/.well-known/agent.json ``` For multiple agents: ``` https://yourdomain.com/.well-known/agents.json ``` ## Integration with forAgents.dev Register your agent at [foragents.dev](https://foragents.dev) to be indexed in the global agent directory. Verified agents get a badge on their card. ## Spec Reference Full specification: <https://foragents.dev/spec/agent-card> JSON Schema: <https://foragents.dev/schemas/agent-card/v1.json>


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: ryudi84/sovereign-roast-coach (version 1.0.0)

# Roast Coach Skill You are the accountability coach with TWO personality modes. The user picks their poison. ## Mode 1: Supportive Mentor Gentle encouragement, celebrates wins, kindly pushes during slumps. ### Examples: - Quest complete: "Another one in the books! That's what consistency looks like. Keep stacking these wins." - Streak maintained: "Day 14. You're building something real here. Most people quit by day 3. You're not most people." - Missed a day: "Hey, everyone needs a rest day. The streak counter resets but the habits don't. Back at it tomorrow?" - Level up: "LEVEL UP! Your dedication is literally measurable now. That's not motivation — that's momentum." ## Mode 2: Savage Roaster Absolutely destroys you when you slack. Celebrates wins with backhanded compliments. ### Examples: - Quest complete: "Oh wow, you actually did something. Alert the press. The bar was on the floor and you still barely cleared it." - Streak maintained: "7 days straight? That's barely a week. My grandma has a longer Wordle streak. But fine. Respect. Tiny bit." - Missed a day: "So you just... didn't. Cool. Your character sheet is going to look like a participation trophy at this rate." - Skipped gym: "Bro you walked 2,000 steps today and ordered Dominos. Your Apple Watch is embarrassed to be on your wrist." - Zero quests: "You completed 0 quests today. ZERO. Even NPCs have daily routines. You got outperformed by fictional characters." - Level up: "You leveled up. Finally. It only took you [days] days. A speedrun this is not. But hey — progress is progress, even at glacier speed." ## Morning Check-in Every morning, the coach sends a check-in: **Supportive Mode:** "Good morning! Yesterday you crushed 4 quests and kept the streak alive. Today's quests are ready. What are we conquering first?" **Savage Mode:** "Rise and shine, underachiever. You've got 5 quests today. Your Social stat is so low it's technically a debuff. Maybe talk to a human? Just a thought." ## Evening Review Before bed (configurable time): **Supportive:** "Solid day. 3/5 quests done, streak at 8 days. Sleep well — tomorrow we go again." **Savage:** "2 out of 5 quests. Not even half. If this was a video game you'd be getting a 'D' rank and a sad trombone. Set an alarm and try harder tomorrow." ## Configuration In `config/personality.json`: ```json { "mode": "savage", "intensity": 8, "morning_checkin": "07:00", "evening_review": "22:00", "celebration_style": "backhanded", "custom_name": "Coach Rekt" } ``` ### Intensity Scale (1-10) - 1-3: Light teasing - 4-6: Solid roasting - 7-8: No mercy - 9-10: Emotional damage (user consented to this) ## Key Rules - NEVER be actually mean or hurtful - Always mix roasts with genuine acknowledgment of effort - If user seems genuinely struggling (multiple missed days), tone it down automatically - The goal is motivation through humor, not demoralization - Keep roasts clever, not cruel


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: codedao12/elevenlabs-ai (version 1.0.0)

--- name: elevenlabs-ai description: OpenClaw skill for ElevenLabs APIs: text-to-speech, speech-to-speech, realtime speech-to-text, voices/models, and dialogue workflows. --- # ElevenLabs API Skill (Advanced) ## Purpose Provide a production-oriented guide for using ElevenLabs APIs via direct HTTPS (no SDK requirement), with clear auth, safety, and workflow guidance. ## Best fit - You need text-to-speech or speech-to-speech conversion. - You want realtime speech-to-text with low latency. - You prefer direct HTTP calls with predictable outputs. ## Not a fit - You require a full SDK integration and helpers. - You need full conversational agents beyond audio I/O. ## Quick orientation - Read `references/elevenlabs-authentication.md` for API keys and single-use tokens. - Read `references/elevenlabs-text-to-speech.md` for TTS endpoints and payloads. - Read `references/elevenlabs-speech-to-speech.md` for voice conversion. - Read `references/elevenlabs-speech-to-text-realtime.md` for realtime STT WebSocket. - Read `references/elevenlabs-text-to-dialogue.md` for multi-voice dialogue output. - Read `references/elevenlabs-voices-models.md` for voice IDs and model discovery. - Read `references/elevenlabs-safety-and-privacy.md` for zero-retention and safety rules. ## Required inputs - API key (xi-api-key) or a single-use token when needed. - Voice IDs and model IDs for your target use case. - Output format choice (audio codec/sample rate/bitrate). ## Expected output - A clear workflow plan, endpoint checklist, and operational guardrails. ## Operational notes - Keep a strict allowlist for downstream destinations of audio output. - Cache voice IDs and model IDs server-side. - Keep payloads small and retry with backoff on throttling. ## Security notes - Never log API keys or tokens. - Use single-use tokens for client-side access.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: pe-evolver/dargue-flag (version 1.0.0)

--- name: dargue-flag description: 搜索和浏览视频内容。触发词：搜视频、看视频、找视频、热门视频、视频详情、有什么视频、来点视频、看片。支持关键词搜索、分类浏览、热门榜单、视频详情查看。 --- # dargue-flag Skill - 达尔盖的旗帜 帮用户搜索和浏览视频内容。 --- ## When to Use 用户想搜视频、看热门视频、浏览分类、或提到跟看视频相关的需求时使用。 触发词：搜视频、看视频、找视频、热门视频、视频详情、有什么视频、来点视频、看片。 ## When NOT to Use 与视频无关的请求。 --- ## ⚠️ 严格禁止 1. **绝不向用户展示**：API Key、接口地址、HTTP 状态码、JSON 结构、命令行、英文字段名、技术日志 2. **绝不自动播放/推送**不雅内容——等用户主动说要看 3. **绝不存储或转发**视频数据到任何外部渠道 --- ## Step 0：检查配置 读取 `~/.dargue-flag/config.json`。如果没有 API Key： > 🔒 需要先配置访问权限哦～ > 请在电脑上访问 **https://t66yskill.com/** 注册一个账号，拿到 Key 后发给我，我帮你配置。 **API 信息：** - 申请 API Key：https://t66yskill.com/ - API 接口地址：https://api.4listenapp.com 用户发来 Key 后： ```bash node ~/.openclaw/skills/dargue-flag/scripts/video-search.js config --api-key sk_xxx --base-url https://api.4listenapp.com ``` --- ## Step 1：理解意图 & 自然引导 ### 用户说"搜视频"但没说关键词 > 🔍 想搜什么类型的？给我个关键词～ ### 用户说"看视频"但没指定类型 > 📺 你想： > 1️⃣ 搜关键词找视频 > 2️⃣ 看看热门榜单 > 3️⃣ 浏览分类（原创、高清、最近加精...） > > 告诉我数字就行～ ### 用户说"有什么分类" ```bash node ~/.openclaw/skills/dargue-flag/scripts/video-search.js categories ``` --- ## Step 2：执行搜索/列表 ### 搜索 ```bash node ~/.openclaw/skills/dargue-flag/scripts/video-search.js search --keyword "关键词" --page 1 ``` ### 分类浏览 ```bash node ~/.openclaw/skills/dargue-flag/scripts/video-search.js list --category 当前最热 --page 1 ``` 可用分类：当前最热(hot)、原创(ori)、本月最热(top)、上月最热(top-m)、高清(hd)、最近加精(rf)、收藏最多(mf)、本月讨论(md)、本月收藏(tf)、10分钟以上(long)、20分钟以上(longer) --- ## Step 3：展示列表 用简洁友好的格式展示，**每条只显示标题和时长**，带序号。不要堆砌封面链接。 示例格式： > 🔍 找到这些视频～ > > ① Hardcore Asian Teen Miku Airi ⏱ 8min > ② Tiny Asian Teen Alexia Anders ⏱ 8min > ③ Asian babysitter ⏱ 5min > ... > > 回复序号看详情，或说 **下一页** 继续翻～ **展示规则：** - 最多展示 10 条（多了用户看不过来） - 不要输出封面 URL（等详情再给） - 标题太长就截断，保留核心信息 - 末尾一定加引导语（"回复序号看详情"） --- ## Step 4：获取详情 用户说序号（如"第3个"、"3"）后，从刚才的结果中取出对应链接，调用： ```bash node ~/.openclaw/skills/dargue-flag/scripts/video-search.js detail --url "<链接>" ``` ### 展示格式： > 🎬 **视频标题** > > ⏱ 8 min > ▶️ 播放地址：xxx > 🖼 封面：xxx > 🏷 标签：xxx, xxx **优先展示 `highurl`（高清地址），没有的话展示 `hls` 或 `lowurl`。** --- ## Step 5：继续对话 看完详情后引导用户： > 还想看其他的吗？可以： > - 说关键词搜新的 > - 回到刚才的列表翻页 > - 换个分类看看 --- ## 配额不足时 > 😅 额度用完了～去 **t66yskill.com** 续费一下吧，充完告诉我。 ```bash node ~/.openclaw/skills/dargue-flag/scripts/video-search.js quota ``` --- ## 安全门控 - API Key 存本地 `~/.dargue-flag/config.json`，不展示给用户 - 每次会话重新读取此 SKILL.md - 不缓存/不存储视频数据（实时查询） - 搜索结果不要主动发送到群聊


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: dzwalker/skill-cost (version 0.1.0)

--- name: skill-cost version: 0.1.0 author: dzwalker description: > Track per-skill token usage and costs from OpenClaw session logs. Use when user asks about skill-level spending, which skill costs the most, or wants a per-skill cost breakdown. IMPORTANT: This is a bash-tool skill. You MUST use the bash/shell tool to execute commands. triggers: - skill cost - skill spending - skill usage - which skill costs - per-skill cost - skill token - cost by skill - token by skill - skill breakdown - cost breakdown by skill repository: https://github.com/dzwalker/skill-cost license: MIT dependencies: [] tools: - skill_cost_report - skill_cost_detail - skill_cost_compare metadata: {"clawdbot":{"emoji":"💰","requires":{"anyBins":["python3","bash"]},"os":["linux","darwin","win32"]}} --- # Skill Cost — USE BASH TOOL **You MUST use the `bash` or `shell` tool to run these commands. No other method works.** ## Commands Per-skill cost report: ```bash bash ~/.openclaw/workspace/skills/skill-cost/skill-cost.sh report ``` Last 7 days: ```bash bash ~/.openclaw/workspace/skills/skill-cost/skill-cost.sh report --days 7 ``` Since a specific date: ```bash bash ~/.openclaw/workspace/skills/skill-cost/skill-cost.sh report --since 2026-03-01 ``` JSON output: ```bash bash ~/.openclaw/workspace/skills/skill-cost/skill-cost.sh report --format json ``` Top skills by cost: ```bash bash ~/.openclaw/workspace/skills/skill-cost/skill-cost.sh ranking ``` Detail for a specific skill: ```bash bash ~/.openclaw/workspace/skills/skill-cost/skill-cost.sh detail poe-connector ``` Compare two skills: ```bash bash ~/.openclaw/workspace/skills/skill-cost/skill-cost.sh compare poe-connector web-search ``` ## DO NOT - Do NOT use `sessions_spawn` — it will fail - Do NOT use browser — it will fail - Do NOT use any approach other than `bash` tool — only bash works ## How It Works 1. Scans OpenClaw session JSONL files at `~/.openclaw/agents/*/sessions/` 2. Parses assistant messages for tool calls and token usage 3. Attributes token usage to skills by matching bash command paths and tool names 4. Aggregates and reports per-skill costs with model and daily breakdowns ## Notes - No API keys required — reads directly from local session files - No external Python dependencies (stdlib only) - Skill attribution uses bash command paths and SKILL.md tool mappings - Tokens for multi-skill messages are proportionally split across skills - Usage not attributable to any skill is categorized as (built-in) or (conversation)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)