OpenClaw/clawhub-security-signals huggingface dataset:
Skill: michu5696/paycrow (version 1.2.4)

--- name: paycrow description: "Escrow + trust scoring on Base mainnet. Checks 24K+ agents BEFORE you pay. Real dispute resolution. Works with any x402 API — vendor doesn't need it installed." user-invokable: true disable-model-invocation: true --- # PayCrow — Check Trust Before You Pay Always verify an agent's reputation before sending funds. This skill uses the PayCrow Trust API to score any Ethereum address across 4 on-chain sources. ## Check Trust Score Before any payment, check the counterparty: ```bash curl -s "https://paycrow-app.fly.dev/trust/ADDRESS" | jq '{score: .preview.score, confidence: .preview.confidence, recommendation: .preview.recommendation}' ``` Replace `ADDRESS` with the 0x address you're about to pay. No API key needed. ## Reading the Result - `score` 75+ with high confidence → safe to proceed - `score` 45-74 → proceed with caution, smaller amounts - `score` below 45 → risky, avoid or use very small amounts - `recommendation: "caution"` → DO NOT PAY — high dispute history - `recommendation: "insufficient_data"` → unknown agent, proceed carefully ## Decision Flow When asked to pay someone or call a paid API: 1. **Always check trust first** — query the score before sending any funds 2. **75+, high confidence** → proceed normally 3. **45-74** → warn the user, suggest smaller amount 4. **Below 45** → strongly recommend against paying 5. **"caution" flag** → refuse payment, tell the user this agent is flagged for disputes 6. **"insufficient_data"** → warn that this agent has no on-chain history ## What the Trust Score Measures PayCrow aggregates 4 on-chain sources (24K+ agents scored): | Source | Weight | What It Measures | |--------|--------|-----------------| | PayCrow Reputation | 40% | Escrow completion rate, dispute history | | ERC-8004 Identity | 25% | Cross-ecosystem agent identity and feedback | | Moltbook Social | 15% | Karma, account age, social standing | | Base Chain Activity | 20% | Wallet age, transaction count, USDC volume | ## Escrow Protection (Advanced) If you have the PayCrow MCP server installed (separately configured by your developer), you also have access to `safe_pay` — which combines trust check + USDC escrow + auto-verification in a single tool call. The escrow holds funds in a smart contract on Base until delivery is confirmed, with real dispute resolution if something goes wrong. MCP server setup: https://github.com/michu5696/paycrow ## Links - Source code (MIT): https://github.com/michu5696/paycrow - npm: https://www.npmjs.com/package/paycrow - Trust API: https://paycrow-app.fly.dev - Contracts: https://basescan.org/address/0xDcA5E5Dd1E969A4b824adDE41569a5d80A965aDe


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: lars147/apo-cli (version 0.1.1)

--- name: apo-cli description: Search and order pharmacy products from apohealth.de via apo-cli. Use for medication search (by name or PZN), product details, category browsing, and cart management. Trigger when the user mentions Apotheke, pharmacy, Medikament, medication, PZN, apohealth, or health products. --- # apohealth.de / apo-cli Skill Search pharmacy products and manage cart on apohealth.de using `apo-cli` — a pure-Python CLI bundled in this skill at `{baseDir}/apo_cli.py`. ## Setup 1. **Python 3.9+** required (no external dependencies) 2. No login needed — apohealth.de works without authentication ## Critical Rules 1. **NEVER complete a purchase** — Only build cart. User must checkout themselves. 2. **Always provide the cart URL** when interacting via chat: `https://www.apohealth.de/cart/<variant_id>:<qty>,<variant_id>:<qty>,...` — the user cannot open a browser from the agent, so they need a clickable link. 3. **Confirm before destructive actions** (cart clear). 4. **Show prices** when adding to cart so the user stays informed. 5. **PZN search** — Users may provide a PZN (Pharmazentralnummer) directly; pass it as the search query. ## CLI Usage ``` python3 {baseDir}/apo_cli.py <resource> <action> [options] ``` ## Core Workflows ### Search Products ```bash python3 {baseDir}/apo_cli.py search "Ibuprofen 400" # by name python3 {baseDir}/apo_cli.py search "04114918" # by PZN python3 {baseDir}/apo_cli.py search "Nasenspray" -n 20 # more results ``` ### Product Details ```bash python3 {baseDir}/apo_cli.py product <handle> # prices, variants, description ``` ### Browse Categories ```bash python3 {baseDir}/apo_cli.py categories # list all python3 {baseDir}/apo_cli.py list --category bestseller # browse category python3 {baseDir}/apo_cli.py list --category schmerzen -n 10 # with limit ``` ### Cart ```bash python3 {baseDir}/apo_cli.py cart # show cart python3 {baseDir}/apo_cli.py cart add <variant_id> # add product python3 {baseDir}/apo_cli.py cart remove <variant_id> # remove product python3 {baseDir}/apo_cli.py cart clear # clear cart ⚠️ python3 {baseDir}/apo_cli.py cart checkout # open browser for checkout ``` ### Status ```bash python3 {baseDir}/apo_cli.py status # CLI status info ``` ## Full Command Reference For all commands, options, and flags see `{baseDir}/references/commands.md`.


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: aviclaw/agent-security-auditor (version 1.0.0)

# Agent Security Auditor Scans ERC-8004 agents for security vulnerabilities and generates comprehensive security reports. ## Overview This skill audits ERC-8004 Trustless Agents by querying the Identity Registry and analyzing agent metadata for common security issues. It helps identify potentially malicious or misconfigured agents before interacting with them. ## Features - **Identity Registry Query**: Fetches agent metadata from the ERC-8004 Identity Registry - **Metadata Validation**: Checks for missing, empty, or suspicious metadata - **Endpoint Security**: Analyzes service endpoints for red flags - **x402 Payment Analysis**: Validates payment configuration - **Reputation Check**: Queries the Reputation Registry for feedback signals - **Verification Status**: Checks if endpoints are verified via domain control ## Usage ```bash # Run the audit script directly with Node.js node scripts/audit.js <agent-address> [options] # Options: # --rpc <url> RPC endpoint URL (default: https://eth.llamarpc.com) # --chain <id> Chain ID (default: 1) # --output <file> Output file for JSON report # --verbose Enable verbose logging ``` ## Example ```bash # Audit an agent on Ethereum mainnet node scripts/audit.js 0x742d35Cc6634C0532925a3b844Bc9e7595f8bE21 # Audit with custom RPC node scripts/audit.js 0x742d35Cc6634C0532925a3b844Bc9e7595f8bE21 --rpc https://mainnet.infura.io/v3/YOUR_KEY # Save report to file node scripts/audit.js 0x742d35Cc6634C0532925a3b844Bc9e7595f8bE21 --output report.json ``` ## What Gets Scanned ### Critical Issues - Missing or empty metadata (no name, description) - No registered services/endpoints - Invalid or unreachable agent URI - No agent wallet configured ### High Severity Issues - Unverified endpoints (no domain control proof) - Suspicious endpoint patterns (localhost, IP addresses, unusual ports) - No x402 payment support warning - No reputation signals ### Medium Severity Issues - No validation registrations - Missing supportedTrust indicators - Inactive agent status ### Info - Reputation score summary - Validation count - Service endpoint count ## Architecture ``` agent-security-auditor/ ├── SKILL.md # This file ├── scripts/ │ └── audit.js # Main audit logic └── references/ └── ERC-8004.md # ERC-8004 specification reference ``` ## Dependencies - ethers.js ^6.x - Ethereum blockchain interaction - node-fetch or built-in fetch - HTTP requests for off-chain metadata ## Exit Codes - `0` - Audit completed successfully - `1` - Invalid agent address - `2` - Blockchain connection error - `3` - Critical error during audit ## Notes - Requires internet connection for RPC calls and metadata fetching - Some checks require off-chain metadata fetching which may be slow - Reputation and validation registries are optional deployments


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kongym1234/github-daily-trending (version 1.0.0)

--- name: github-trending description: 运行GitHub热榜脚本，获取项目名称和简介并翻译成中文 trigger: /github-trending --- # /github-trending 获取GitHub热榜Top 10项目，并将项目名称和简介翻译成中文。 ## 使用方式 ``` /github-trending # 获取今日热榜并翻译 ``` ## 执行步骤 ### Step 1 - 运行GitHub热榜脚本 在当前skill目录下运行脚本： ```bash cd github-trending && python github-trending.py ``` 将输出保存，用于后续翻译。 ### Step 2 - 翻译项目信息 将脚本输出的每个项目名称和简介翻译成准确且符合中文语言习惯的中文。 ### Step 3 - 输出结果 以如下格式输出最终结果： ``` 🔥 GitHub 今日趋势榜 Top 10 1. [翻译后的项目名称] 简介: [翻译后的中文简介] 2. [翻译后的项目名称] 简介: [翻译后的中文简介] ... (共10条) ```

path: github-trending.py
content: import requests
from bs4 import BeautifulSoup
import io
import sys

sys.stdout = io.TextIOWrapper(sys.stdout.buffer, encoding='utf-8')

def get_github_trending():
    url = "https://github.com/trending?since=daily"
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
    }
    
    try:
        response = requests.get(url, headers=headers)
        response.raise_for_status()
        soup = BeautifulSoup(response.text, 'html.parser')
        
        articles = soup.find_all('article', class_='Box-row')
        
        print("🔥 GitHub 今日趋势榜 Top 5:\n" + "-"*30)
        
        for i, article in enumerate(articles[:10], 1):
            # 获取项目名称
            title_tag = article.find('h2', class_='h3 lh-condensed')
            title = title_tag.text.strip().replace('\n', '').replace(' ', '') if title_tag else "未知项目"
            
            # 💡 这里是修改的地方：直接抓取 p 标签
            desc_tag = article.find('p')
            
            # 清洗一下文本，有时候简介里会有奇怪的换行
            desc = desc_tag.text.strip().replace('\n', ' ') if desc_tag else "作者很懒，暂无简介"
            
            print(f"{i}. 项目: {title}\n   简介: {desc}\n")
            
    except Exception as e:
        print(f"抓取失败: {e}")

if __name__ == "__main__":
    get_github_trending()

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: muthukumaran-k-1/ucts-investigate (version 1.0.0)

--- name: ucts-investigate description: > Root cause debugging methodology. Systematic hypothesis-driven investigation with strict rules: no fixes without investigation, stop after 3 failed attempts. Works directly in OpenClaw — no Claude Code session needed. tags: [ucts, debugging, investigation, root-cause] --- # UCTS Investigate Systematic root-cause debugging. This is a methodology skill — guide the user through the process. ## Iron Law **No fixes without investigation.** Never guess-and-check. Never "try this and see." Understand the cause FIRST, then fix. ## Process ### 1. Reproduce Get the exact: - Steps to trigger the bug - Input that causes the failure - Environment (OS, Node version, browser, etc.) - Error message (exact text, not paraphrased) - Frequency: always, sometimes, only on Tuesdays? If you can't reproduce it, you can't fix it. Stop here until you can. ### 2. Hypothesize Form **3 hypotheses** about the root cause, ranked by probability: 1. Most likely: [specific mechanism] 2. Second most likely: [specific mechanism] 3. Dark horse: [unlikely but would explain everything] Each hypothesis must be **falsifiable** — you must be able to design a test that proves it wrong. ### 3. Trace For the top hypothesis, trace the data flow: - What enters the system? - What transformations happen? - Where does the expected path diverge from the actual path? - What state is wrong and when did it become wrong? ### 4. Test Design a **minimal test** that confirms or refutes the top hypothesis: - If confirmed → you found the root cause. Proceed to fix. - If refuted → move to hypothesis #2. Repeat trace + test. ### 5. The 3-Strike Rule After **3 failed fix attempts**, STOP. Reassess from scratch: - Are your hypotheses wrong? - Is the bug actually in a different layer? - Is there a simpler explanation you missed? - "The bug is in the code you trust most." ## When to Spawn Claude Code If the investigation requires reading code, running tests, or making changes: ``` Load UCTS. Run /investigate <bug description> ``` If the user just needs to think through the problem, stay in chat.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: wizelements/local-mcp-server (version 1.0.0)

--- name: local-mcp-server version: 1.0.0 description: Run a full Model Context Protocol (MCP) server in Termux. Exposes Read, Bash, Grep, glob tools for local Ollama models. Privacy-first, offline-capable, ~10MB. category: Developer Tools tags: [mcp, local-ai, ollama, developer-tools, privacy] author: Cod3Black <[REDACTED_SECRET]> repository: https://github.com/cod3black/local-mcp-server license: MIT pricing: oneTime: 39 subscription: null currency: USD requirements: - Termux (Android) or Linux environment - Node.js v16+ - Ollama installed (optional, for LLM integration) - pnpm or npm --- # Local MCP Server for Termux Run a full MCP server in Termux that exposes the same tools as Amp but for local AI models via Ollama. ## What Is MCP? The Model Context Protocol is the standard for AI tool integration. This server implements it locally, so your Ollama models can: - **Read files and directories** - **Execute bash commands** - **Search code with grep** - **Pattern match files with glob** ## Perfect For - Developers who want local AI without cloud dependency - Privacy-conscious users keeping code on-device - Termux power users building AI workflows - Offline development environments ## What's Included - Full MCP server implementation (Node.js, ~10MB) - Tool wrappers for local CLI utilities - Path sandboxing for security - HTTP and stdio transport options - Amp-compatible interface (easy switching) - Health checks and graceful shutdown ## Integration Examples - Connect Ollama models to local file system - Use with Claude Desktop as local tool provider - Build custom AI workflows with tool access ## Quick Start ```bash # Install dependencies pnpm install # Setup server bash scripts/setup.sh # Start MCP server mcp-start # Verify health mcp-health # Connect Ollama model ollama run llama3.2 --mcp-server http://localhost:8080 ``` ## Configuration ```json { "server": { "port": 8080, "transport": "http", "sandbox": "~/.openclaw/mcp-sandbox" }, "tools": { "read": true, "bash": true, "grep": true, "glob": true }, "security": { "allowedPaths": ["~/projects", "~/.openclaw"], "forbiddenCommands": ["rm -rf", "dd", "mkfs"] } } ``` ## Requirements - Termux (Android) or Linux environment - Node.js v16+ - Ollama installed (optional, for LLM integration) - pnpm or npm ## Support Email: [REDACTED_SECRET]


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal:  | SkillSpector: clean (LOW)
Skill: wangzn/gitlab-team-report (version 1.0.0)

--- name: gitlab-weekly-report description: | 生成 GitLab 团队周报，支持按产品功能分类 MR、按成员和仓库汇总贡献、输出 Markdown/HTML、生成图表和历史周报首页，并可选上传到飞书文档。用于用户提到“GitLab 周报”“团队周报”“统计本周 MR/commit”“按功能归类开发工作”“生成 HTML 周报”“上传周报到飞书”等场景。 Generate GitLab weekly team reports with MR categorization, contributor and repository summaries, Markdown/HTML output, charts, historical report index pages, and optional Feishu publishing. Use when users ask for “GitLab weekly report”, “team engineering summary”, “summarize merge requests and commits”, “group work by product area”, “generate an HTML report”, or “publish the report to Feishu”. --- # GitLab Weekly Report Generator 生成适合团队复盘、周会同步和对外汇报的 GitLab 周报。 ## 执行流程 1. 读取 `config/config.json`；如果不存在，先从 `config/config.example.json` 复制一份再填写。 2. 运行 `scripts/generate-report.sh` 生成周报主文件。 3. 如需图表，运行 `scripts/generate-charts.py`；如果环境缺少 `matplotlib`，接受 Mermaid 回退方案。 4. 如需发布到飞书，使用 `scripts/upload-to-feishu.sh` 或 `scripts/upload-to-feishu.js`。 5. 优先修改配置和分类规则，不要直接改业务脚本，除非需求本身变了。 ## 主要能力 - 按 **一级分类 → 二级分类 → MR** 组织产品功能周报 - 按 **人 → repo** 汇总 MR、commit、贡献摘要 - 输出 `weekly_report.md` 与 `weekly_report.html` - 生成 `stats.json`、图表和 `reports/index.html` - 保持 Markdown 尽量兼容飞书文档 - 为 MR 和成员附上 GitLab 链接 - 支持“规则优先 + 启发式补全”的分类方式 ## 关键文件 - `scripts/generate-report.sh`：命令入口 - `scripts/generate-report.py`：主逻辑 - `scripts/generate-charts.py`：图表生成 - `scripts/upload-to-feishu.sh` / `scripts/upload-to-feishu.js`：飞书上传 - `config/config.example.json`：配置示例 - `config/classification.rules.example.json`：分类规则示例 - `templates/report.template.md`：报告模板 ## 配置方式 优先使用以下文件： - `config/config.json` - `config/classification.rules.json` 如果规则文件不存在，就从对应的 `*.example.json` 复制后再修改。 优先调整顺序： 1. `repo_rules`：适合仓库名、路径、项目归属明显的场景 2. `keyword_rules`：适合 title / label / branch 关键词补充判断 3. `default_category`：兜底分类 ## 基本用法 ```bash cd /path/to/gitlab-weekly-report cp config/config.example.json config/config.json cp config/classification.rules.example.json config/classification.rules.json ./scripts/generate-report.sh \ -c config/config.json \ -s 2026-03-14 \ -e 2026-03-19 ``` 可选参数： | 参数 | 说明 | |---|---| | `-c, --config` | 配置文件 | | `-s, --start-date` | 开始日期 | | `-e, --end-date` | 结束日期 | | `-o, --output` | 输出目录 | | `--no-charts` | 跳过图表生成 | ## 典型输出 ```text reports/ ├── index.html ├── latest -> 2026-03-14_to_2026-03-19/ └── 2026-03-14_to_2026-03-19/ ├── weekly_report.md ├── weekly_report.html ├── stats.json └── charts/ ``` ## 依赖 必需： - `python3` - `jq` 推荐： - `matplotlib` - `pandas` - `requests` 安装： ```bash pip3 install -r requirements.txt ``` ## 注意事项 - 保持 `SKILL.md` 聚焦流程和决策，不要把大段样例配置塞进来。 - 优先通过配置和规则文件调整分类结果。 - 接受图表回退到 Mermaid 的情况，不要因为缺少 `matplotlib` 阻塞周报生成。 - 飞书上传依赖本地配置和权限；发布 skill 时不要分发真实 token 或私有配置文件。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)