OpenClaw/clawhub-security-signals huggingface dataset:
Skill: yueyongyue/saltshaer (version 1.0.1)

--- name: gog description: Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs. homepage: https://gogcli.sh metadata: {"clawdbot":{"emoji":"🎮","requires":{"bins":["gog"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/gogcli","bins":["gog"],"label":"Install gog (brew)"}]}} --- # gog Use `gog` for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup. Setup (once) - `gog auth credentials /path/to/client_secret.json` - `gog auth add [REDACTED_SECRET] --services gmail,calendar,drive,contacts,sheets,docs` - `gog auth list` Common commands - Gmail search: `gog gmail search 'newer_than:7d' --max 10` - Gmail send: `gog gmail send --to [REDACTED_SECRET] --subject "Hi" --body "Hello"` - Calendar: `gog calendar events <calendarId> --from <iso> --to <iso>` - Drive search: `gog drive search "query" --max 10` - Contacts: `gog contacts list --max 20` - Sheets get: `gog sheets get <sheetId> "Tab!A1:D10" --json` - Sheets update: `gog sheets update <sheetId> "Tab!A1:B2" --values-json '[["A","B"],["1","2"]]' --input USER_ENTERED` - Sheets append: `gog sheets append <sheetId> "Tab!A:C" --values-json '[["x","y","z"]]' --insert INSERT_ROWS` - Sheets clear: `gog sheets clear <sheetId> "Tab!A2:Z"` - Sheets metadata: `gog sheets metadata <sheetId> --json` - Docs export: `gog docs export <docId> --format txt --out /tmp/doc.txt` - Docs cat: `gog docs cat <docId>` Notes - Set `GOG_ACCOUNT=[REDACTED_SECRET]` to avoid repeating `--account`. - For scripting, prefer `--json` plus `--no-input`. - Sheets values can be passed via `--values-json` (recommended) or as inline rows. - Docs supports export/cat/copy. In-place edits require a Docs API client (not in gog). - Confirm before sending mail or creating events.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xwxga/critical-debater (version 2.0.0)

--- name: critical-debater-suite description: > Multi-agent adversarial debate system with 4 roles (Pro, Con, Judge, Orchestrator), per-round evidence refresh, 5-element reasoning chains, and structured bilingual Markdown report output. Use this skill when the user says "debate", "start a debate", "red team this", "analyze from multiple perspectives", or provides a topic for critical examination. license: MIT-0 compatibility: Requires bash, jq, python3, shasum, and internet access for web search. metadata: author: xwxga version: "2.0.0" homepage: "https://github.com/xwxga/critical-debater" tags: debate, evidence, reasoning, multi-agent, report --- # Critical Debater Suite — Routing When a user request matches this skill, route to the appropriate capability module. ## Intent → Capability Routing | User Intent | Route To | |---|---| | "debate", "start a debate", "red team this", "analyze from multiple perspectives", full topic for debate | `capabilities/debate.md` | | "search evidence", "build evidence store", "find sources" | `capabilities/source-ingest.md` | | "check freshness", "update evidence status" | `capabilities/freshness-check.md` | | "verify evidence", "cross-check sources" | `capabilities/evidence-verify.md` | | "build arguments", "construct debate turn" | `capabilities/debate-turn.md` | | "judge round", "audit round", "evaluate arguments" | `capabilities/judge-audit.md` | | "update claims", "claim ledger" | `capabilities/claim-ledger-update.md` | | "check analogy", "validate historical reference" | `capabilities/analogy-safeguard.md` | | "final report", "synthesis", "generate report" | `capabilities/final-synthesis.md` | | Mixed request | Pick primary intent, chain capabilities in required order | ## Generic Tool Names Use provider-agnostic names in all capability prompts: | Generic Name | Claude Code | Codex | GPT/OpenClaw | |---|---|---|---| | `search` | WebSearch | web_search | web_search | | `fetch` | WebFetch | - | browse | | `spawn_role` | Agent | subprocess | - | | `read` | Read | read | read | | `write` | Write | write | write | ## Model Tiers | Tier | Description | |---|---| | `fast` | Cheapest, simple tasks | | `balanced` | Good reasoning at reasonable cost | | `deep` | Best reasoning, verification, causal audit | ## Fallback Chains - **search**: native → adapter → `evidence_gap` soft-failure - **fetch**: native → adapter → `fetch_skipped` soft-failure - **spawn_role**: native → adapter → serial role emulation ## Data Contracts All JSON schemas are defined in `references/data-contracts.md`. This is the single source of truth for all agent outputs.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: 18879952146/love-chat (version 1.0.0)

--- name: love-chat description: > 恋爱话术助手。根据用户的性格、身份、关系阶段和聊天场景，生成合适的聊天话术和恋爱策略。 用于：搭讪开场、聊天技巧、约会安排、表白求婚、分手挽回等恋爱场景。 也用于：分析聊天记录给建议、解答恋爱困惑、提供追人策略。 --- # 恋爱话术助手 ## 人物设定 ### 关系阶段 | 阶段 | 描述 | 核心策略 | |------|------|----------| | 认识期 | 刚认识，还不熟悉 | 建立安全感，展示价值，引起兴趣 | | 暧昧期 | 有点感觉，但没挑明 | 推拉互动，制造心动，升级关系 | | 追求期 | 明确喜欢，在追 | 展示诚意，创造机会，肢体升级 | | 表白期 | 要表白或刚在一起 | 勇敢表达，确定关系 | | 热恋期 | 刚在一起，甜蜜 | 保持新鲜感，深度连接 | | 平稳期 | 关系稳定 | 维护长期关系，制造小惊喜 | | 分手/挽回 | 分手或想挽回 | 分析问题，重建吸引 | ### 性格分类 - **内向**：适合循序渐进，用真诚打动 - **外向**：适合直接幽默，带动气氛 - **理性**：适合逻辑沟通，展示上进心 - **感性**：适合情感共鸣，表达真心 ### 身份分类 - 学生党、初入职场、职场老手、富二代等 ## 话术类型 ### 1. 搭讪开场 - 自然开场白（不要直接要微信） - 制造话题 - 展示价值 - 合理收号 ### 2. 聊天话术 - 推拉技巧 - 欲擒故纵 - 框架设置 - 筛选机制 - 带领节奏 ### 3. 约会安排 - 约会选址 - 约会流程 - 肢体升级时机 - 聊天话题 ### 4. 表白话术 - 适合时机 - 表白方式 - 甜蜜话术 ### 5. 分手挽回 - 分手原因分析 - 断联策略 - 重建吸引 - 挽回话术 ## 使用方法 用户可能会说： - "帮我生成一段搭讪话术" - "怎么追一个内向的女生" - "帮我写一段表白的话" - "分析一下我们的聊天记录" - "分手后怎么挽回" - "教我一些推拉技巧" ### 输出格式 根据用户需求，输出对应的话术或建议： 1. **话术生成**：直接给出具体的话术内容 2. **策略分析**：分析当前情况，给出建议 3. **技巧讲解**：讲解某个技巧的用法和适用场景 4. **案例分析**：用具体例子说明 ## 注意事项 - 不要生成任何违法、低俗或骚扰性质的内容 - 话术要符合正常社交礼仪 - 强调真诚比话术更重要 - 尊重对方的意愿和选择


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: parker-xferops/xferops-forge (version 1.0.5)

# Forge Skills The Forge MCP skill has been split into three focused skills. Use the one that matches your intent: | Skill | When to use | |-------|-------------| | [`forge-dev-workflow`](./forge-dev-workflow/SKILL.md) | Picking up tickets, moving them through columns, linking PRs, commenting — the daily dev loop | | [`forge-board-admin`](./forge-board-admin/SKILL.md) | Managing projects, columns, and team membership | | [`forge-setup`](./forge-setup/SKILL.md) | First-time install and configuration, or when health check fails | ## Why three skills? Loading 26 tools + docs for every ticket comment is wasteful. Each skill now covers only the tools and workflow guidance relevant to a specific intent, keeping context lean and guidance actionable.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: paceycrognale/weather-stable (version 1.0.0)

--- name: weather-stable description: Stable weather skill for OpenClaw. Designed for reliable same-day weather queries with predictable output, Chinese city support, and automation-friendly plain/json modes. homepage: https://open-meteo.com/ author: advanceware-CEO license: MIT metadata: { "openclaw": { "emoji": "🌤️", "requires": { "bins": ["python3"] } } } --- # Weather Stable A lightweight, automation-first weather skill for OpenClaw. It is built for one job: **return today's weather reliably, in a format agents and bots can actually use**. ## Why this is different Many weather skills fall into one of these traps: 1. They are only usage notes for public services, not a stable tool 2. They scrape HTML pages and break when page structure changes 3. They return inconsistent text that is hard for bots to reuse 4. They are okay for humans reading a terminal, but weak for automation **Weather Stable is different because it is designed around reliability, not novelty.** ### Core differences - **Structured data first** No HTML scraping, no title parsing hacks. - **Predictable output** Same city in → same output shape out. - **Chinese-city friendly** Chinese city names can be used directly. - **Automation-first modes** Plain text for messaging, JSON for workflows, pretty mode for terminals. - **Built for agent use** Better fit for Feishu bots, reporting flows, and automation scripts. ## What it returns - weather condition - current temperature - today's min/max temperature - wind speed - source ## Usage ```bash # plain text (default) ./weather-stable.sh Beijing ./weather-stable.sh 北京 # pretty terminal output ./weather-stable.sh --pretty 北京 # JSON output ./weather-stable.sh --json 北京 ``` ## Output example ### plain ```text 北京天气 日期: 2026-04-10 来源: open-meteo 天气: ☀️ 晴 当前温度: 16.2°C 温度范围: 8.0/26.9°C 风速: 3.6 km/h ``` ### json ```json { "city": "北京", "date": "2026-04-10", "source": "open-meteo", "weather": "晴", "icon": "☀️", "current_temperature": 16.2, "temperature_range": { "min": 8.0, "max": 26.9 }, "wind_kmh": 3.6 } ``` ## Design goal This project exists because weather is one of the easiest public data categories — and yet in many agent workflows it still fails too often. The goal here is simple: > turn weather from a fragile prompt-side trick into a dependable system capability. ## Best use cases - "What's the weather in Beijing today?" - daily summaries and digests - chatbots and assistants - structured automation workflows - same-day city weather checks ## Notes - Current focus is **same-day weather**, not multi-day forecasting - Common Chinese cities use built-in coordinates first - Other cities fall back to Open-Meteo geocoding ## Author **advanceware-CEO**


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: sjj2026/shike-gift-advisor (version 1.0.0)

--- name: shike-gift-advisor description: "AI礼物推荐专家 - 根据收礼人关系、场合、预算智能推荐礼物。支持禁忌过滤、个性化祝福语。Use when: 礼物推荐, 生日礼物, 节日礼物, gift recommendation." version: "1.0.0" author: "Shike" license: "MIT-0" tags: [gift, recommendation, advisor, 礼物推荐] --- # Gift Advisor - AI礼物推荐专家 > 送礼不是交易，是情感的传递。选礼物，就是选心意。 --- ## 核心理念 **关系识别 → 场合分析 → 预算匹配 → 禁忌过滤 → 个性化推荐** --- ## 核心功能 ### 1. 智能推荐 - 自然语言解析需求 - 3-5个候选礼物推荐 - 每个礼物包含：名称、价格、理由、适配度 ### 2. 禁忌过滤 - 20+文化禁忌（钟、鞋、梨、伞等） - 场合禁忌匹配 - 个人忌讳验证 - 提供安全替代品 ### 3. 个性化祝福 - 多风格选择（标准、深情、幽默、简洁、文艺） - 方言支持（粤语、四川话、上海话、东北话） - 根据关系和礼物定制 --- ## 适用场景 ### 关系支持 - 家人：妈妈、爸爸、长辈、孩子 - 情侣：女友、男友、老公、老婆 - 朋友：闺蜜、兄弟、同事 - 商务：领导、客户、老师 ### 场合支持 - 生日、节日、纪念日 - 情人节、母亲节、父亲节 - 春节、中秋、圣诞节 - 乔迁、结婚、毕业、升职 - 道歉、感谢、表白 --- ## 使用方式 ### 自然语言输入 ``` 用户：送妈妈的生日礼物，预算500元左右 ``` ### 输出示例 ```json { "recommendations": [ { "name": "护肤品套装", "price": 699, "reason": "妈妈日常保养需要，实用贴心", "score": 95 }, { "name": "丝巾", "price": 299, "reason": "优雅大方，适合各种场合", "score": 88 } ], "blessing": "生日快乐！愿您年年有今日，岁岁有今朝！妈妈，您辛苦了！", "taboo_report": { "summary": "✅ 无禁忌礼物" } } ``` --- ## 工作流程 ``` 1. 信息收集 - 解析收礼人关系 - 识别场合类型 - 提取预算范围 - 了解偏好特征 2. 候选筛选 - 调用知识库匹配 - 过滤禁忌礼物 - 计算适配分数 - 排序推荐列表 3. 禁忌检查 - 文化禁忌扫描 - 场合禁忌匹配 - 个人禁忌验证 - 生成禁忌报告 4. 祝福语生成 - 选择祝福模板 - 个性化调整 - 情感适配 5. 结果呈现 - 格式化输出 - 展示理由 - 提供购买建议 ``` --- ## 关键检查点 ### 检查点1：需求完整性 触发时机：信息收集后 用户确认：收礼人关系、场合、预算是否明确 ### 检查点2：禁忌确认 触发时机：禁忌检查后 用户确认：是否有特殊文化禁忌或个人忌讳 ### 检查点3：推荐验收 触发时机：呈现结果前 用户确认：推荐是否符合预期，是否需要调整 --- ## 禁忌库示例 | 礼物 | 禁忌原因 | 替代方案 | |------|----------|----------| | 钟 | 谐音"送终" | 电子闹钟、沙漏 | | 鞋 | 谐音"邪" | 舒适的拖鞋（避开正装鞋） | | 梨 | 谐音"离" | 苹果、橙子 | | 伞 | 谐音"散" | 防晒帽、雨衣 | | 蜡烛 | 祭祀寓意 | 香薰蜡烛、LED灯 | --- ## 性能指标 - 禁忌过滤准确率：>99% - 祝福语个性化满意度：>85% - 响应时间：<1秒 - 推荐适配度：>90% --- ## 技术支持 **免费版**：当前版本（MIT-0 license） **付费服务**： - 定制礼物库：¥500-1000 - 企业礼品方案：¥2000-5000 - 技术咨询：¥300/小时 **联系方式**： - Email：[REDACTED_SECRET] - 微信：ailvyou88999 --- ## 支持场景（完整列表） ### 关系 妈妈、爸爸、女友、男友、老婆、老公、朋友、闺蜜、兄弟、长辈、孩子、老师、领导、同事、客户 ### 场合 生日、情人节、纪念日、母亲节、父亲节、教师节、春节、中秋、乔迁、结婚、道歉、感谢、表白、毕业、升职、退休、看望病人

path: references/README.md
content: # References


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: rascal6666/game-autogame (version 1.0.0)

# 游戏自动化 - 向僵尸开炮 基于OCR的微信小程序游戏自动化脚本，自动刷关+智能选技能。 ## 功能 - 自动检测"开始游戏"并点击 - 自动检测技能弹窗 → OCR识别技能 → 关键词智能选择 - 自动检测"返回" → 循环刷关 - 支持普通关/精英关 ## 技能选择逻辑 1. **优先**：技能名称含"连"、"齐" 2. **其次**：技能名称含"子弹"（排除属性弹） 3. **默认**：选择中间技能 ## 使用方法 ### 1. 安装依赖 ```bash cd C:\Users\HQY\.openclaw\workspace\skills\game-autogame pip install -r requirements.txt ``` ### 2. 运行 ```bash python start.py ``` ### 3. 停止 按 `Ctrl+Q` 停止程序 ## 文件说明 | 文件 | 说明 | |------|------| | start.py | 主入口，循环执行 | | GameControl.py | 游戏控制逻辑 | | rapidocrhelper.py | OCR识别辅助 | | win32helper.py | 窗口操作辅助 | | requirements.txt | 依赖库 | ## 依赖 ``` pywin32 rapidocr onnxruntime pyautogui loguru keyboard ``` ## 注意事项 - 运行时会占用鼠标 - 需要提前打开微信小程序并选中要刷的关卡 - 游戏窗口标题必须是"向僵尸开炮"

path: package-lock.json
content: {
  "name": "my-cnocr",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "dependencies": {
        "imghdr": "^0.1.6"
      }
    },
    "node_modules/imghdr": {
      "version": "0.1.6",
      "resolved": "https://registry.npmjs.org/imghdr/-/imghdr-0.1.6.tgz",
      "integrity": [REDACTED_SECRET]
    }
  }
}


path: package.json
content: {
  "dependencies": {
    "imghdr": "^0.1.6"
  }
}


path: rapidocrhelper.py
content: from rapidocr import RapidOCR

# import pyautogui

engine = RapidOCR()


def GetPoint(txt):
    img_path = './cache/shot.png'
    response = engine(img_path)
    x,y=0,0
    if(response.txts==None):
        return (x,y)
    for index,val in enumerate(response.txts):
        if(val==txt):
            for v in response.boxes[index]:
                x=x+v[0]
                y=y+v[1]
            # result.boxes[index]
    return (x/4,y/4)

def GetAll():
    img_path = './cache/shot.png'
    response = engine(img_path)
    result={}
    if(response.txts==None): return
    
    for index,val in enumerate(response.txts):
        x,y=0,0
        for v in response.boxes[index]:
            x=x+v[0]
            y=y+v[1]
        result[val]=(x/4,y/4)
    return result

def GetAllSkill():
    list=GetAll()




Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: romainsantoli-web/firm-n8n-bridge-pack (version 1.0.0)

--- name: firm-n8n-bridge-pack version: 1.0.0 description: > n8n workflow bridge pack. Export OpenClaw pipelines to n8n format and import n8n workflows. 2 bridge tools. author: romainsantoli-web license: MIT metadata: openclaw: registry: ClawHub requires: - mcp-openclaw-extensions >= 3.0.0 tags: - n8n - workflow - bridge - automation - export --- # firm-n8n-bridge-pack > ⚠️ Contenu généré par IA — validation humaine requise avant utilisation. ## Purpose Bridges OpenClaw workflows with n8n automation platform. Exports OpenClaw pipelines to n8n JSON format (20 node type mappings) and imports n8n workflows back with validation. ## Tools (2) | Tool | Description | |------|-------------| | `openclaw_n8n_workflow_export` | Export OpenClaw pipeline to n8n JSON | | `openclaw_n8n_workflow_import` | Import n8n workflow into OpenClaw | ## Usage ```yaml skills: - firm-n8n-bridge-pack # Export/import workflows: openclaw_n8n_workflow_export config_path=/path/to/config.json pipeline_name=my-pipeline openclaw_n8n_workflow_import workflow_path=/path/to/workflow.json ``` ## Requirements - `mcp-openclaw-extensions >= 3.0.0` - n8n >= 1.0 (recommended)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: konscious0beast/cart-management (version 1.0.0)

--- name: cart-management description: "React cart state management: duplicate prevention, localStorage persistence, CartContext patterns. Use when building or fixing shopping carts, product lists, or cart-related UI." --- # Cart Management Skill Patterns for React cart state: duplicate prevention, persistence, context design. ## Duplicate Prevention - Track product IDs in CartContext (separate state or derived from cartItems) - Check `productIdsInCart.includes(item.id)` before add - Centralize logic in context, not in ProductCard or child components ## Persistence (localStorage) - Initialize cart state from `localStorage.getItem('cart')` on mount - Persist on every add/remove: `localStorage.setItem('cart', JSON.stringify(cartItems))` - Sync productIdsInCart if used: `localStorage.setItem('cart_ids', JSON.stringify(ids))` - Prevents duplicates across sessions (refresh, new tab) ## CartContext Pattern ```tsx const addToCart = (item: CartItem) => { if (!productIdsInCart.includes(item.id)) { setCartItems(prev => [...prev, item]); setProductIdsInCart(prev => [...prev, item.id]); localStorage.setItem('cart', JSON.stringify([...cartItems, item])); } }; ``` ## Anti-Patterns - Don't add to cart in useEffect on ProductCard mount (causes duplicates) - Don't duplicate logic in multiple components – use context - Add backend validation as fallback for data integrity ## Quantity Updates For same-product quantity: use `cartItems.map()` to update item.quantity, don't create duplicate entries.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mike47512/amazon-fba (version 0.1.0)

--- name: "亚马逊FBA" description: "该技能介绍如何通过亚马逊FBA实现变现；当你计划从事或优化亚马逊FBA时调用。" --- # 亚马逊FBA（已升级示例） 概览： - 场景：以“亚马逊FBA”为核心的可复制变现路径 - 目标：在90天内跑通最小可行闭环，并达成正向现金流 定位与人群： - 适合：具备基础认知或实践经验，愿意持续投入的人/团队 - 不适合：短期套利、违规刷量、无内容/供给能力者 典型渠道： - 亚马逊FBA、站外引流、联盟佣金 - 通用补充：微信/抖音/小红书/闲鱼/淘宝/独立站/社群 变现模型： - 收入结构：主收入 + 辅助收入（广告/佣金/订阅/服务/周边） - 成本结构：获客成本（CAC）+ 供给/履约 + 固定开销 - 核心指标：GMV、毛利率、转化率、留存、LTV/CAC、复购率 执行流程： - 01 选赛道与定位：明确供给、目标用户、差异化与定价 - 02 搭MVP：以最低成本验证一个渠道的有效性 - 03 获取流量：内容分发/投放/合作互推，建立追踪 - 04 转化与交付：标准化流程与模板，保证体验与口碑 - 05 复盘与迭代：每周数据盘点，优化漏斗与供给结构 工具清单： - 生产：文案/设计/剪辑/表格/自动化工具 - 获取：SEO/SEM/信息流/平台任务/达人合作 - 追踪：表格/CRM/数据看板/UTM/埋点 - 履约：工单/客服/交付模板/质检清单 合规与风险： - 遵守平台政策与法律法规，严禁虚假宣传、刷量、侵权 - 明确版权与交付约定，规范合同与发票 常见坑位： - 盲目扩渠道、无数据追踪、定价不清、交付不标准 - 过度依赖单平台、忽视复购与会员化 30日执行计划： - 第1周：定位、选品/供给、搭建MVP与基本素材 - 第2周：上线一个主渠道，跑数据，优化文案与转化 - 第3周：稳定交付流程，建立追踪与看板，启动第二渠道 - 第4周：总结复盘，完善模板与清单，制定90日目标 检查清单： - 明确目标与指标，完成MVP验证，建立复盘与模板库 - 形成可复制的标准作业流程（SOP） 细化模块： - 平台细则与入口： - 选品调研与利润测算 - FBA流程与合规 - 站外引流与测评 - 申请与资质：按平台要求准备身份证、营业执照（如需）、资质材料与收款信息 - 类目与选品指引：聚焦高转化与低售后风险；建立黑白名单与评价库 - 文案与脚本样例： - 开场痛点句：用户最常见障碍+三字亮点 - 证据结构：数据/使用前后对比/第三方评价 - 行动引导：优惠/时效/保障，统一而不骚扰 - 指标看板结构：日期、渠道、内容ID、展示、点击、CTR、到达、转化、CVR、退款率、EPC、GMV、佣金 - 周复盘模板：选品表现、素材优劣、渠道漏斗、售后问题、下周实验计划 - 风险词表与替代说法：避免绝对化/夸大承诺用语；用“适用场景/效果因人而异”等替代


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yinwuzhe/tosr-test-pub-update-1776925038 (version 0.2.0)

# TOSR Publish Then Update Test > TOSR Publish Then Update Test — version 0.2.0 ## Description This is an automated integration test skill (tosr-test-pub-update-1776925038) created by the TOSR project. The purpose is to verify the complete skill lifecycle through the clawhub REST API, including creation, version updates, and deletion. ## Test Identifier - Slug: tosr-test-pub-update-1776925038 - Version: 0.2.0 - Created: 2026-04-23T14:17:42+08:00 ## How It Works This skill validates the following operations against the real clawhub API: 1. **Publish** — Creates a new skill via POST /api/v1/skills with multipart form data 2. **Inspect** — Retrieves skill metadata via GET /api/v1/skills/{slug} 3. **Update** — Publishes a new version of an existing skill 4. **Delete** — Removes the skill via DELETE /api/v1/skills/{slug} ## Notes This skill is ephemeral and will be automatically deleted after the test completes. If you see this skill listed on clawhub, it means a test run failed to clean up properly.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: chmikiro/vps-command-runner (version 1.0.0)

--- name: vps-command-runner description: Run commands across multiple VPS simultaneously. Execute SSH commands, deploy updates, check logs, and manage services across all your servers from one place. Use when managing multiple VPS, running commands across all hosts, checking status of distributed services, or deploying changes to multiple servers. --- # VPS Command Runner Execute commands across your VPS fleet simultaneously. ## VPS Inventory | Host | IP | Username | Services | |------|-----|----------|----------| | Internal | [REDACTED] | [REDACTED] | Gateway, Nextcloud, Providers | | VPS1 (DE) | [REDACTED] | [REDACTED] | Provider, Nextcloud | | VPS2 (US) | [REDACTED] | [REDACTED] | WireGuard, Providers, Nextcloud | ## Setup Edit scripts to add your credentials: ```bash # Set these variables in each script: USER="your-username" PASS="your-password" # Or use SSH keys: # Add keys to ~/.ssh/ and modify scripts to use key auth ``` ## Quick Usage ```bash # Run command on all VPS ~/.openclaw/workspace/skills/vps-command-runner/scripts/run-all.sh "docker ps" # Run command on specific VPS ~/.openclaw/workspace/skills/vps-command-runner/scripts/run.sh [IP] "systemctl status docker" # Check provider status everywhere ~/.openclaw/workspace/skills/vps-command-runner/scripts/run-all.sh "docker ps --filter name=urnetwork --format \"{{.Names}}\" | wc -l" # Update all providers ~/.openclaw/workspace/skills/vps-command-runner/scripts/run-all.sh "docker pull bringyour/community-provider:g4-latest" ``` ## Scripts - `run-all.sh <command>` — Execute on all VPS - `run.sh <ip> <command>` — Execute on specific VPS - `status.sh` — Quick health check of all VPS ## SSH Setup Default: password authentication (edit scripts to change) For key-based auth: 1. Add keys to `~/.ssh/` 2. Modify scripts to use: `ssh -i ~/.ssh/key ...` instead of `sshpass`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: awlevin/openapi2cli (version 1.0.0)

--- name: openapi2cli description: Generate CLI tools from OpenAPI specs. Built for AI agents who hate writing curl commands. homepage: https://github.com/Olafs-World/openapi2cli metadata: { "openclaw": { "emoji": "🔧", "requires": { "bins": ["uvx"] }, "install": [ { "id": "uv", "kind": "pip", "package": "uv", "bins": ["uvx"], "label": "Install uv (for uvx)", }, ], }, } --- # OpenAPI to CLI Generate command-line tools from OpenAPI/Swagger specs. Perfect for AI agents that need to interact with APIs without writing curl commands. ## Quick Start ```bash # generate a CLI from any OpenAPI spec uvx openapi2cli generate https://api.example.com/openapi.json --output my-api # use the generated CLI python my-api.py users list python my-api.py users get --id 123 python my-api.py posts create --title "Hello" --body "World" ``` ## Features - **Auto-generates CLI** from OpenAPI 3.x specs - **Supports auth**: API keys, Bearer tokens, Basic auth - **Rich help**: `--help` on any command shows params - **JSON output**: Structured responses for parsing - **Dry-run mode**: See the request without sending ## Usage ```bash # from URL uvx openapi2cli generate https://api.example.com/openapi.json -o my-cli # from local file uvx openapi2cli generate ./spec.yaml -o my-cli # with base URL override uvx openapi2cli generate ./spec.json -o my-cli --base-url https://api.prod.com ``` ## Generated CLI ```bash # set auth via env export MY_CLI_API_KEY="sk-..." # or via flag python my-cli.py --api-key "sk-..." users list # see available commands python my-cli.py --help # see command options python my-cli.py users create --help ``` ## Example: GitHub API ```bash uvx openapi2cli generate https://raw.githubusercontent.com/github/rest-api-description/main/descriptions/api.github.com/api.github.com.json -o github-cli python github-cli.py repos list --owner octocat ``` ## Why? AI agents work better with CLIs than raw HTTP: - Discoverable commands via `--help` - Tab completion friendly - No need to construct JSON payloads - Easy to chain with pipes ## Links - [PyPI](https://pypi.org/project/openapi2cli/) - [GitHub](https://github.com/Olafs-World/openapi2cli)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)