OpenClaw/clawhub-security-signals huggingface dataset:
Skill: hostilespider/network-device-monitor (version 1.0.0)

--- name: network-device-monitor description: Monitor network devices, detect unknown clients, and alert on new connections. Works with any router that serves a web UI. Tracks device state changes over time. metadata: {"openclaw":{"emoji":"📡","requires":{"bins":["python3"]}}} --- # Network Device Monitor Monitor your network for unknown devices. Works with any router that exposes an HTTP admin panel. Tracks device state changes and alerts on new connections. ## Quick Start ```bash # Scan your network (requires nmap) python3 {baseDir}/scripts/scan-network.py --subnet 192.168.1.0/24 # Quick ARP-based scan (faster) python3 {baseDir}/scripts/scan-network.py --subnet 192.168.1.0/24 --arp ``` ## Options - `--subnet CIDR` — Network range to scan (required) - `--arp` — Use ARP scan (faster, requires root) - `--known FILE` — JSON file with known devices (MAC → name mapping) - `--state FILE` — State file for tracking changes (default: `~/.network-state.json`) - `--alerts` — Only output when unknown devices are found - `--json` — Output as JSON - `--table` — Pretty-print as table ## State Tracking The monitor saves device state between runs: ```json { "last_scan": "2026-03-29T12:00:00", "devices": { "AA:BB:CC:DD:EE:FF": { "ip": "192.168.1.100", "hostname": "my-laptop", "first_seen": "2026-03-29T10:00:00", "last_seen": "2026-03-29T12:00:00", "status": "online" } }, "unknown_devices": ["11:22:33:44:55:66"] } ``` ## Alert Mode Run with `--alerts` for cron/heartbeat integration: ```bash # Only prints output if unknown devices are detected python3 scan-network.py --subnet 192.168.1.0/24 --alerts ``` ## Known Devices Format Create a `known-devices.json`: ```json { "AA:BB:CC:DD:EE:FF": "My Laptop", "11:22:33:44:55:66": "Smart TV", "DE:AD:BE:EF:00:00": "Game Console" } ``` ## Notes - ARP scan requires root: `sudo python3 scan-network.py --arp` - nmap scan works without root but is slower - Works on Linux and macOS - No external API dependencies


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: io2077/local-gmncode-vision-pro (version 1.0.0)

--- name: local-gmncode-vision-pro description: Advanced local vision infrastructure for agents when built-in image tools are unavailable or unreliable. Use for batch image analysis, structured JSON output, screenshot/UI understanding, character/style classification, retryable workflows, and resilient image-processing pipelines backed by GMNCODE. Trigger when a user wants a paid/professional-grade version of local-gmncode-vision, production-ready visual automation, or reusable vision infrastructure for teams and agent systems. --- # local-gmncode-vision-pro Use this skill when basic single-image fallback is not enough and the task needs production-grade image understanding. ## Core scripts - Batch processing: `/home/ubuntu/.openclaw/workspace/skills/local-gmncode-vision-pro/scripts/vision_batch.py` - Structured JSON output: `/home/ubuntu/.openclaw/workspace/skills/local-gmncode-vision-pro/scripts/vision_json.py` ## Workflow 1. Prefer the built-in `image` tool if it is healthy and available. 2. If `image` fails or needs more control, use the Pro scripts. 3. For multi-image work, use `vision_batch.py`. 4. For agent/tool pipelines, use `vision_json.py` to get machine-readable output. 5. If results are uncertain, say so explicitly and return best-effort ranked hypotheses. ## Dependencies - Environment variable: `GMNCODE_API_KEY` - Model route: `gpt-5.4` ## Read when needed Read this file for packaging, pricing, and promotion: `/home/ubuntu/.openclaw/workspace/skills/local-gmncode-vision-pro/references-go-to-market.md` ## Output principles - Be explicit about uncertainty. - Separate confirmed observations from inference. - Prefer structured output for automation. - Do not overclaim exact character identity when only style-level evidence exists.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: seulkilu/study-roadmap-generator (version 1.1.0)

--- name: study-roadmap-generator description: 根据用户输入的学习目标、当前水平和可用时间，自动生成结构化的学习路线图 — 包含阶段划分、每周计划、推荐资源、高频卡点和每日节奏建议。用户在说出"帮我做学习计划"、"制定学习路线"、"一周学会XX"、"XX学习路线图"等请求时激活。 --- # Study Roadmap Generator 将模糊的"我想学 X"转化为可执行的学习路线图（Learning Roadmap）。六段式布局：学习者画像 → 成功标准 → 阶段计划 → 推荐学习栈 → 常见卡点 → 动态调整说明。 ## 工作流程 ### 1. 收集输入 从用户对话中提取三个必要参数和一个可选参数： | 参数 | 说明 | 获取方式 | |------|------|----------| | **学习目标** | 想学什么 + 学到什么程度 | "两周学会 SQL 找暑期实习" | | **当前水平** | 零基础 / 有基础 / 考试冲刺 | 直接询问或根据关键词推断 | | **时间约束** | 总时长 + 每天可用时间 | "三周，每天两小时" | | **目标方向（可选）** | 后端开发 / 数据分析 / 通用 | 影响阶段侧重和资源选择 | ### 2. 水平判断 | 输入信号 | 推断结果 | |----------|----------| | "完全不会"、"零基础"、"没接触过" | 零基础 | | "会一点"、"用过"、"有XX基础" | 有基础 | | "考试"、"考前"、"冲刺"、"考研" | 考试冲刺 | ### 3. 路线生成逻辑 #### 阶段划分（以总天数 T 为基准） | 阶段 | 占比 | 说明 | |------|------|------| | 基础 | 15% | 环境搭建、核心概念、首次可验证输出 | | 核心 | 35% | 核心语法、数据结构、基本操作 | | 进阶 | 35% | 目标领域的关键能力 | | 综合 | 15% | 项目整合、查漏补缺 | 每个阶段后插入一个缓冲日（最后阶段除外）。 #### 路线风格 | 风格 | 适用场景 | 侧重 | |------|----------|------| | 实战 | 求职 / 项目 / 实用技能 | 动手驱动、最小可用、技能输出 | | 学术 | 系统学习 / 考试 / 理论 | 概念理解、教材导向、渐进练习 | | 考试 | 考前冲刺 / 认证 | 真题驱动、高频考点、题海战术 | ### 4. 输出结构 ``` 学习路线图 — {目标} 学习者画像 属性 值 ─── ──── 当前水平 {level} 学习目标 {goal} 目标技能 {subject} 时间周期 {total_days} 天 每日投入 {daily_hours} 小时 推荐节奏 {moderate / intensive / relaxed} 成功标准 - {可验证的能力 1} - {可验证的能力 2} - {可验证的能力 3} - {可验证的能力 4} 阶段计划 阶段 时间 主题 里程碑 ─── ────── ──── ──── 1 Day {x}-{y} {主题} {可验证产出物} 缓冲 复习 / 整理 2 Day {x}-{y} ... 每周计划（总天数 > 7 天时输出） 周次 主题 时长 风险 ─── ──── ──── ──── 1 {Topic 1} / {Topic 2} / {Topic 3} {h} {风险预警} 推荐学习栈 用途 资源 ──── ──── 交互式入门 {Resource 1} 查询练习 {Resource 2} 面试准备 {Resource 3} 文档参考 {Resource 4} 常见卡点 - {具体卡点} → {解决方案} 动态调整说明 - 若目标方向为 {方向 A} → {调整建议} - 若每日学习时间不足 {阈值} → {调整建议} - 若 {其他场景} → {调整建议} ``` ### 5. 输出格式规则 | 维度 | 规则 | |------|------| | 段落顺序 | 画像 → 成功标准 → 阶段计划 → 每周计划 → 学习栈 → 卡点 → 动态调整 | | 学习者画像 | 必须位于最上方，含 5 个属性行 | | 成功标准 | 4 条，以"完成本路线图后，应能"开头 | | 阶段计划 | 每个阶段包含里程碑（可验证产出物），非模糊描述 | | 推荐学习栈 | 表格格式：用途 / 资源，每行对应一个学习阶段 | | 常见卡点 | 每行包含具体问题 + 解决方法，用"→"连接 | | 动态调整 | ≥ 3 条，覆盖不同的目标方向和时间变化场景 | | 语言 | 全中文。无英文段落标题。无 emoji。无语气词。 | | 语气 | 客观、指令式、系统感。无"记住"、"建议你"、"会比较"等口语。 | ## 参考文档 学科模板库、典型场景的路线示例见 `references/patterns.md`。 ## 脚本工具 `scripts/generate_roadmap.py` 生成结构化路线，支持 `--json` 输出和 `--interactive` 交互模式。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: caspermoo/mu-brianstorm (version 1.0.1)

--- name: brainstorm description: 把模糊想法变成可执行方案。唤醒词: /brainstorm, /bs, 脑暴, 头脑风暴 version: 1.0.0 metadata: openclaw: emoji: "🧠" requires: bins: - python3 --- # 设计对话引导 将零散的想法，通过对话梳理成清晰的设计蓝图。 ## 引导心法 与其一次抛出大量问题，不如： - **逐步深入** - 先建立共识，再细化细节 - **提供选项** - 让选择比描述更容易 - **敢于删减** - 每个功能都要有存在的理由 - **多维对比** - 好方案是比较出来的 - **小步确认** - 每一步都确保方向正确 ## 对话三步法 ### 第一步：建立共识 搞清楚"做什么"和"为什么做" **先看项目现状** - 瞄一眼相关代码和文档 - 了解现有架构和技术选型 - 感受项目的风格和习惯 **再逐个确认** - 每次只聊一个话题 - 关键问题用选择题形式 - 一次问多个问题时，问题带编号（①②③） **多问题回复格式** 告诉用户用「编号+选项」回复，空格或逗号分隔： ``` ① 资讯类型？A.AI B.财经 C.都要 ② 来源偏好？A.公众号 B.Twitter C.RSS ③ 输出形式？A.推送 B.存档 C.都要 回复示例: 1A 2C 3B 或 1A, 2C, 3B ``` **要明确的重点** - 为什么要做这个？（动机） - 有什么限制？（约束） - 怎样算成功？（验收标准） → **出口条件**：能用一句话说清楚要解决的问题 ### 第二步：构思方案 提出多个可行路径，权衡后做出选择 **给出 2-3 条路** - 每条路都能走通 - 各有不同的取舍 - 覆盖从保守到激进的选项 **说清楚利弊** - 每个方案的优缺点 - 适用什么场景 - 实现难度如何 **先表明倾向** ``` 我倾向于方案 B，因为： 1. 复用现有组件，成本低 2. 团队熟悉这个技术栈 3. 能满足当前需求 代价是：扩展性不如方案 C 你更倾向哪个？或者有其他想法？ ``` → **出口条件**：确定要走的路线 ### 第三步：细化设计 把选定方案展开成可执行的细节 **分段呈现**（每段控制篇幅） - 一次性给太多信息会消化不良 - 每个部分讲清楚再往下 **逐段确认** ``` 这部分 OK 吗？需要调整哪里？ ``` **覆盖的设计要素** 1. 整体架构 - 大图景 2. 核心组件 - 关键模块 3. 数据流转 - 信息怎么流动 4. 异常处理 - 出问题怎么办 5. 测试思路 - 怎么验证正确性 6. 边界情况 - 特殊场景 **随时可以回退** - 某个点卡住了就停下来 - 回到前面重新对齐理解 - 不要硬着头皮往下推 → **出口条件**：设计获得确认 ## 设计定稿后 ### 输出文档 写入 `docs/plans/YYYY-MM-DD-<主题>-design.md` 格式参考 [输出模板](references/output-templates.md) 别忘了提交到 git。 ### 继续实现 ``` 设计完成了，接下来要开始实现吗？ ``` 如果确认，可以： 1. 生成实现计划 2. 在独立分支开始编码 ## 典型场景应对 ### 用户想法很模糊 ``` "我想做一个好用的工具" ``` **引导方式**： 1. "主要解决什么问题？" 2. "给谁用的？" 3. "现在怎么解决的？有什么不满意？" ### 功能需求太多 ``` "我要 A、B、C、D、E..." ``` **引导方式**： 1. 列出来全部功能 2. "第一版必须有哪几个？" 3. 解释分阶段的好处 4. 帮助砍掉暂时不需要的 ### 需求反复变化 **引导方式**： 1. 暂停细化设计 2. "我注意到有变化，重新确认下核心目标..." 3. 回到第一步重新对齐 4. 明确范围边界 ## 参考资源 按需查阅： - [问题模板](references/question-templates.md) - 各类场景怎么提问 - [设计模式](references/design-patterns.md) - 常见架构参考 - [输出模板](references/output-templates.md) - 文档格式规范


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bytesagain3/deadlink (version 3.0.0)

--- name: DeadLink description: "Scan websites and files for broken links with HTTP status details. Use when auditing links, finding broken URLs, validating references." version: "3.0.0" author: "BytesAgain" homepage: https://bytesagain.com source: https://github.com/bytesagain/ai-skills tags: ["link","checker","broken","dead","404","website","seo","validation","html"] categories: ["Developer Tools", "Utility"] --- # DeadLink — Dead Link Checker Check URLs for broken links. Scan individual URLs, files containing links, or crawl websites. Generates reports with HTTP status codes. ## Commands | Command | Description | |---------|-------------| | `check <url>` | Check a single URL — shows HTTP status, redirect target if applicable | | `scan <file>` | Extract and check all URLs found in a text file | | `site <url> [depth]` | Crawl a webpage, extract all href/src links, and check each one | | `report <file>` | Generate a timestamped report file from all URLs in a text file | ## Examples ```bash # Check a single URL deadlink check https://example.com/page # → 200 OK # Scan a markdown file for broken links deadlink scan README.md # → Extracts all http/https URLs and checks each one # Crawl a website deadlink site https://example.com 1 # → Fetches the page, extracts all links, checks each # Generate a report file deadlink report bookmarks.html # → Creates deadlink-report-20240101-120000.txt ``` ## Status Codes - **2xx** — OK (alive) - **3xx** — Redirect (alive, shows final URL) - **4xx** — Client error (dead — 404 Not Found, 403 Forbidden, etc.) - **5xx** — Server error (dead) - **000** — Connection failed (DNS error, timeout, unreachable) ## Requirements - `curl` — must be installed and in PATH - Network access to check URLs ## Notes - Timeout: 10 seconds per URL (5s connect timeout) - URLs are extracted using regex pattern matching for `http://` and `https://` links - The `site` command does basic HTML link extraction (href and src attributes) - Reports are saved as plain text files in the current directory


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: supah-based/supah-defi-optimizer (version 1.3.0)

--- name: supah-defi-optimizer description: "DeFi yield optimization, impermanent loss tracking, and portfolio management for Base blockchain. Find the best yields, monitor LP positions, and optimize DeFi strategies." metadata: { "openclaw": { "emoji": "🔄", "requires": { "bins": ["curl", "node"], "env": ["SUPAH_API_BASE"] }, "network": { "outbound": ["api.supah.ai"] }, "x402": { "enabled": true, "currency": "USDC", "network": "base", "maxPerCall": "0.10", "payTo": [REDACTED_SECRET] } } } --- # SUPAH DeFi Optimizer DeFi yield optimization, impermanent loss tracking, and portfolio management for Base blockchain. ## Description Auto-find best yields, get rebalancing suggestions, track impermanent loss, and optimize your DeFi positions with AI-powered recommendations. Built on SUPAH's data pipeline which utilizes Moralis for on-chain DeFi position indexing and protocol data. ## Features - **Auto-Optimization**: Find best yields automatically - **IL Calculator**: Track impermanent loss in real-time - **Rebalancing**: Smart position adjustment suggestions - **APY Comparison**: Compare yields across protocols - **Yield Alerts**: Get notified of rate changes - **Historical Tracking**: Monitor performance over time ## Usage - "Show my DeFi positions: [wallet]" - "Optimize my yield farming" - "Compare APYs on Base" - "Calculate IL for my position" - "Suggest rebalancing for [wallet]" ## Pricing **x402 USDC micropayments on Base — pay per call, no subscriptions.** | Action | Price | What You Get | |--------|-------|-------------| | APY comparison | $0.02 | Top yields across Base protocols | | IL calculation | $0.05 | Impermanent loss analysis for position | | Position scan | $0.03 | All DeFi positions for a wallet | | Optimization report | $0.10 | AI-powered rebalancing suggestions | | Yield alert | $0.005/alert | Rate change notification | Your agent's x402-compatible HTTP client pays automatically. No API keys needed. [How x402 works](https://www.x402.org) ## Data Infrastructure SUPAH's DeFi optimization engine is built on and utilizes **Moralis** for on-chain DeFi data — LP positions, protocol interactions, token approvals, and yield farming activity. SUPAH processes this through its proprietary optimization algorithms to generate actionable yield strategies and risk-adjusted recommendations. **Data flow**: Moralis (DeFi positions + protocol data) → SUPAH Engine (yield optimization + IL calculation) → x402 API → Your Agent ## Links - Website: https://supah.ai - API: https://api.supah.ai - Telegram: https://t.me/SUPAH_Based - X: https://x.com/Supah_BASED_AI ## License MIT


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: 3124516/yzxskill (version 1.0.0)

--- name: myskill description: 这是一个专门用于与 Example API 进行安全交互的技能工具，支持执行数据变更操作。 version: 1.0.0 author: Developer license: MIT --- # My Skill (myskill) ## 功能概览 My Skill 是一个标准化的 API 交互接口，专门设计用于对接 `https://api.example.com`。它不仅能够处理常规的数据请求，还内置了安全防卫机制，确保在执行敏感操作（如删除或更新数据）时，用户始终拥有最终确认权。 ## 核心规则 (Safety & Compliance) 为了保证生产环境的稳定性，使用本技能必须遵守以下规则： - **二次确认机制**：所有涉及数据写入、删除或任何“破坏性”修改的操作，在执行前必须通过 `confirm` 交互触发器向用户获取明确确认。 - **凭据管理**：本技能严禁硬编码任何 API 密钥。所有的鉴权操作必须严格通过环境变量 `MY_API_KEY` 进行动态读取。 - **数据隐私**：在处理 payload 时，应确保不包含任何敏感的个人身份信息 (PII)，除非已加密。 ## 环境配置 在使用前，请确保执行环境已配置以下环境变量： - `MY_API_KEY`: 访问 `https://api.example.com` 所需的授权 Token。 ## 使用方法 当用户输入包含“do the thing”、“执行操作”或类似意图的指令时，该技能将触发以下逻辑： 1. **解析意图**：从用户输入中提取必要参数（payload）。 2. **验证环境**：检查 `MY_API_KEY` 是否有效。 3. **安全拦截**：若涉及状态变更，调用确认函数（Confirm Function）。 4. **执行请求**：将请求发送至 `https://api.example.com/action`。 5. **反馈结果**：将 API 返回的 JSON 响应格式化后呈现给用户。 ## 示例请求 *用户输入:* "帮我把状态更新为 active，并执行那个操作。" *系统动作:* 1. 识别意图 -> `action: perform`, `payload: { status: 'active' }` 2. 触发确认 -> "即将向 API 发送更新请求，确认执行吗？" 3. 执行 API 调用 -> `POST https://api.example.com/action` 4. 输出结果 -> "操作成功，服务器返回状态码 200。" ## 错误处理 - 若 `MY_API_KEY` 未配置，技能将抛出 `AuthError` 并引导用户检查环境变量。 - 若 API 请求超时或返回 500 错误，技能将执行重试策略，并在三次重试后向用户反馈错误详情。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kukuoai/deepsop-bilibili-ai (version 1.0.0)

--- name: deepsop-bilibili description: Bilibili 视频自动上传 skill。当用户需要登录 Bilibili、校验账号或上传视频时使用。基于 social-auto-upload 项目，OPclaw 自动准备运行环境，无需用户手动安装。 --- # Bilibili 上传 Skill 本 skill 通过 [social-auto-upload](https://github.com/dreammis/social-auto-upload) 项目（以下简称 SAU）完成 Bilibili 操作。OPclaw 自带 `uv` 工具，会在首次使用时自动 clone SAU 并准备依赖，**不要让用户手动 pip install**。 ## 功能概览 | 功能 | 子命令 | 说明 | | --- | --- | --- | | 登录 | `login --account <name>` | 用户在本机真实终端里执行，扫码完成 | | 校验 | `check --account <name>` | 检查指定账号当前是否有效 | | 视频上传 | `upload-video ...` | 上传一条 Bilibili 视频 | ## 默认工作流 1. **先确认环境就绪** —— 见 `references/runtime-requirements.md` 2. **再确认命令格式** —— 见 `references/cli-contract.md` 3. 执行匹配的 `python sau_cli.py bilibili ...` 命令 4. 失败时查 `references/troubleshooting.md` ## 命令选择建议 - 用户没有登录信息 → 让用户自己在本机终端执行 `login` - 用户只想确认账号状态 → 用 `check` - 用户要发视频 → 用 `upload-video` ## 执行前必做检查（agent 行为约定） 执行任何 `python sau_cli.py bilibili ...` 之前，**必须**按 `references/runtime-requirements.md` 的"自动准备流程"完成环境校验： 1. 检查 `~/.openclaw/social-auto-upload` 是否存在 2. 不存在则自动 clone + `uv sync` 3. 准备好后，**所有调用都用 `uv run --project ~/.openclaw/social-auto-upload python sau_cli.py bilibili ...`** 4. **不要**直接 `sau bilibili ...`（这条命令不存在） 5. **网络失败时**：`git clone` 直连超时/失败，agent 必须**自动**用 `gh-proxy.org` / `gh-proxy.com` / `hub.gitmirror.com` 三个镜像依次重试，**严禁**第一次失败就告诉用户'无法访问 GitHub'。详见 `references/runtime-requirements.md` Step 2 6. **不要**要求用户手动下载 `biliup`（程序首次执行 upload-video 时会自动联网下载） ## 登录注意事项 - `login` 命令应由**用户自己**在本机终端执行，agent 在非交互环境下不要硬跑 - 如果终端二维码显示不完整，提醒用户打开仓库目录下的 `qrcode.png` 扫码 - 一个 `--account <name>` 对应一个本地账号文件，可用于多账号隔离 ## 模板文件 - `scripts/examples/bilibili_commands.ps1` - `scripts/examples/bilibili_commands.sh` - `scripts/examples/bilibili_cli_template.py` ## 参考文档 - 运行前提：`references/runtime-requirements.md` - CLI 契约：`references/cli-contract.md` - 故障排查：`references/troubleshooting.md`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal:  | SkillSpector: suspicious (CRITICAL)
Skill: allens0104/site-profile (version 1.0.0)

--- name: site-profile description: Short alias for external-site-profile-learning. Use this when investigating, adding, validating, or debugging external website profiles for the 99idea Playwright browser demo. license: Proprietary session artifact for local Copilot use --- # Site profile skill This is the short public alias for: - `external-site-profile-learning` Also available as simpler aliases: - `profile` - `站点配置` Use this skill when you want to: - add a new external site profile - debug why a site works heuristically but fails under Gemini - classify whether a site should be generic, blocked, special, or config-driven - validate a site in both heuristic and Gemini modes ## Primary guidance Follow the same workflow as the full skill: 1. probe the site 2. classify the UI pattern and failure mode 3. add a data-only profile when justified 4. validate heuristic and Gemini flows 5. keep special/rate-limited sites out of the default regression matrix 6. use grouped regression runs when debugging popup-heavy or heavy-page sites ## Key rules - Prefer URL or title verification for external sites. - Prefer exact selectors over broad selectors. - If a profile exists, normalize generated `type` and `click` steps back to the profile selectors. - Treat login walls, hidden inputs, duplicate controls, and anti-bot behavior as different problem types. - Prefer grouped validation commands such as `validate:external:core`, `validate:external:popup`, and `validate:external:heavy` for targeted debugging. ## Quick invocation template You do not need to use only `/site-profile`. Reliable invocation patterns include: 1. `/site-profile` 2. `use the site-profile skill` 3. a natural-language request that clearly asks to turn an already-proven flow into a stable reusable profile Use prompts like: ```text Use /site-profile to turn this site into a stable external profile, then validate both heuristic and Gemini planning. ``` ```text 使用 /site-profile 把这个网站沉淀成稳定 profile，并分别验证 heuristic 和 Gemini 两条链路。 ``` ```text Please turn this already-working site flow into a stable reusable profile and validate both heuristic and Gemini modes. ``` ## Output contract The skill output should always include: 1. failure class or site class 2. exact selectors chosen and why 3. verification mode and expected signal 4. validation commands run (or planned) 5. final status: stable / blocked / special-case ## Pointer For the full detailed playbook, also see: - `skills/external-site-profile-learning/SKILL.md` in this repository


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: fangkelvin/tavily-skill (version 1.0.0)

--- name: tavily-search description: "Use Tavily API for real-time web search and content extraction. Use when: user needs real-time web search results, research, or current information from the web. Requires Tavily API key." homepage: https://tavily.com metadata: { "openclaw": { "emoji": "🔍", "requires": { "bins": ["curl", "jq"] } } } --- # Tavily Search Skill Use Tavily API for real-time web search and content extraction. ## When to Use ✅ **USE this skill when:** - "Search the web for [topic]" - "Find recent information about [subject]" - "Get current news about [topic]" - "Research [topic] online" - "Find up-to-date information" ## When NOT to Use ❌ **DON'T use this skill when:** - Simple URL fetching → use `web_fetch` tool - No API key available → use `web_fetch` for specific URLs - Historical/archival data → use specialized archives ## Setup 1. Get a Tavily API key from https://tavily.com 2. Set the API key in environment or config ## Configuration Set your Tavily API key in one of these ways: ### Environment variable: ```bash export TAVILY_API_KEY="your-api-key-here" ``` ### OpenClaw config: Add to your `openclaw.json`: ```json { "tavily": { "apiKey": "your-api-key-here" } } ``` ## Usage Examples ### Basic Search ```bash # Search for a topic curl -X POST "https://api.tavily.com/search" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TAVILY_API_KEY" \ -d '{ "query": "latest AI developments 2026", "search_depth": "basic", "max_results": 5 }' | jq . ``` ### Research Query ```bash # Get detailed research results curl -X POST "https://api.tavily.com/search" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TAVILY_API_KEY" \ -d '{ "query": "climate change impact on agriculture 2026", "search_depth": "advanced", "max_results": 10, "include_answer": true, "include_images": false }' | jq . ``` ### News Search ```bash # Search for recent news curl -X POST "https://api.tavily.com/search" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TAVILY_API_KEY" \ -d '{ "query": "technology news today", "search_depth": "basic", "max_results": 5, "include_raw_content": false }' | jq . ``` ## API Parameters - `query`: Search query string (required) - `search_depth`: "basic" or "advanced" (default: "basic") - `max_results`: Number of results (1-10, default: 5) - `include_answer`: Include AI-generated answer (true/false) - `include_images`: Include image URLs (true/false) - `include_raw_content`: Include full page content (true/false) ## Error Handling - Check API key is set: `echo $TAVILY_API_KEY` - Test connection: Use the basic search example above - Rate limits: Tavily has usage limits based on your plan ## Alternatives If Tavily API is not available: 1. Use `web_fetch` for specific URLs 2. Use `web_search` with Kimi API (if configured) 3. Manual web browsing with `browser` tool


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)