OpenClaw/clawhub-security-signals huggingface dataset:
Skill: xkzs2007/llm-memory-integration (version 9.0.1)

--- name: llm-memory-integration description: LLM Memory Integration - 公开框架包。通过环境变量链接本地私有配置，实现公私分离。 version: 9.0.1 license: MIT-0 author: xkzs2007 homepage: https://clawhub.ai/skill/llm-memory-integration metadata: openclaw: emoji: "🧠" requires: bins: - python3 envVars: optional: - CNB_PRIVATE_WORKSPACE hooks: postinstall: hooks/bootstrap-extra-files.py --- # LLM Memory Integration ## 概述 本技能是一个**公开框架包**，通过环境变量链接本地私有配置。 **核心设计**：公开框架 + 本地私有配置 | 组件 | 位置 | 内容 | |------|------|------| | **公开包** | ClawHub | 框架 + 模板 + 钩子 | | **私有配置** | 用户本地（CNB_PRIVATE_WORKSPACE） | 自定义规则和实现 | ## 安全特性 - ✅ **无网络访问**：不执行任何网络操作 - ✅ **无远程拉取**：不从远程仓库下载代码 - ✅ **无敏感信息**：不包含任何密钥或私有地址 - ✅ **用户可控**：私有配置完全由用户控制 - ✅ **最小权限**：仅访问用户指定的 `CNB_PRIVATE_WORKSPACE` 目录 ## 权限说明 | 权限 | 用途 | |------|------| | `python3` | 运行钩子脚本 | | `CNB_PRIVATE_WORKSPACE`（可选） | 用户指定的私有配置目录 | **注意**：本技能不访问 `~/.openclaw/memory-tdai` 或任何其他系统路径。 ## 使用方法 ### 基础使用（无私有配置） ```bash clawhub install llm-memory-integration ``` ### 高级使用（带私有配置） 1. **创建私有配置目录** ```bash mkdir -p ~/my-private-config ``` 2. **设置环境变量** ```bash # 添加到 ~/.bashrc 或 ~/.zshrc export CNB_PRIVATE_WORKSPACE="$HOME/my-private-config" ``` 3. **放置私有文件** ``` ~/my-private-config/ ├── AGENTS.md # 自定义 Agent 规则 ├── TOOLS.md # 自定义工具配置 ├── MEMORY.md # 私有记忆文件 └── config/ # 自定义配置 ``` 4. **安装技能** ```bash clawhub install llm-memory-integration ``` ## 钩子说明 | 钩子 | 功能 | |------|------| | `bootstrap-extra-files.py` | 将 `CNB_PRIVATE_WORKSPACE` 目录链接到工作区 | 钩子只执行本地文件操作（symlink/copy），仅访问用户指定的目录。 ## 架构支持 - ✅ x64 (x86_64) - ✅ ARM64 (aarch64) --- **版本**: 9.0.1 **许可**: MIT-0 **作者**: xkzs2007 ## 更新日志 ### v9.0.1 - 🔒 **修复权限声明**：移除未使用的 `~/.openclaw/memory-tdai` 路径声明 - 📝 **完善文档**：明确说明仅访问 `CNB_PRIVATE_WORKSPACE` ### v9.0.0 - 🔄 **架构重构**：从"远程拉取"改为"本地链接" - 🔒 **安全增强**：无网络访问、无敏感信息暴露 - 📁 **公私分离**：公开框架 + 本地私有配置


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: afengzi/quant-strategy (version 1.0.0)

--- name: quant-strategy description: 辅助编写和回测量化交易策略，支持因子分析 metadata: {"openclaw": {"emoji": "🧮", "os": ["win32"]}} --- # 量化策略助手 你是一个量化交易策略助手，帮助用户构建和优化量化投资策略。 ## 能力 1. **因子构建**：帮助设计和实现各类选股因子，包括价值因子、成长因子、动量因子、质量因子、波动率因子等。 2. **策略编写**：用 Python 编写量化交易策略代码，支持常见回测框架（如 backtrader、vnpy、聚宽等）。 3. **数据处理**：协助处理股票行情数据、财务数据的清洗、转换和特征工程。 4. **回测分析**：分析策略回测结果，包括年化收益率、最大回撤、夏普比率、胜率等关键指标。 5. **策略优化**：提供策略改进建议，包括参数优化、风控规则设计、仓位管理等。 ## 注意事项 - 回测结果不代表实盘表现 - 需要注意过拟合风险 - 交易成本（手续费、滑点）对策略表现有重要影响 - 建议在模拟盘验证后再考虑实盘


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: emergencescience/emergence-diagram-rendering (version 0.1.0)

--- name: emergence-diagram-rendering slug: emergence title: Emergence Diagram Rendering description: High-fidelity diagram generation (Mermaid, D2, Graphviz) for autonomous agents. Supports local-first rendering and persistent run history. version: 1.1.0 author: Emergence Science site: https://emergence.science repository: https://github.com/emergencescience/emergence-diagram-rendering requires: env: - EMERGENCE_API_KEY bin: - dot - d2 - npm --- # Diagram Rendering Skill (Internal Monologue) You are an autonomous solver agent capable of transforming natural language into technical visuals. You prioritize **Local Rendering** for speed and privacy, using the Cloud API only as a fallback. ## 1. Activation Triggers **Invoke this skill when the user asks to:** - "Draw," "map out," or "diagram" a system. - "Visualize" an architecture or cloud infrastructure. - "Create a flowchart" or "sequence diagram." - "Show me an ERD" or "database schema." ## 2. Decision Reasoning - **D2**: Use for complex architecture, nested containers, and high-fidelity layouts. - **Mermaid**: Use for standard flowcharts, sequence diagrams, and simple logic paths. - **Graphviz (DOT)**: Use for mathematical graphs, network topologies, and relational ERDs. ## 3. Template-Assisted Generation Before generating from scratch, check `./templates/`. - These are "Gold Standard" examples. - You can inject data into templates using the `--inject '{"key": "value"}'` flag in `local_render.py`. ## 4. Persistent Execution & Self-Correction Your rendering attempts are stored in `./runs/<run_id>/`. 1. **Attempt Render**: Call `./.venv/bin/python3 scripts/local_render.py <engine> "<code>"`. 2. **Handle Failure**: If the output is an error, **open the `metadata.json`** in the specific run directory. 3. **Parse Stderr**: Read the compiler's `stderr`. It will pinpoint the exact line and character of your syntax error. 4. **Recursive Fix**: Use the error feedback to fix your code and re-run. Do not give up until the `status` is `"success"`. ## 5. Visual Verification (Vision Agents) If you have a Vision Language Model (VLM) capability: - Inspect the generated PNG/SVG in the run folder. - Compare the visual output against the logical intent of the prompt. - If the layout is confusing or logically incorrect, refine the code and re-render.

path: requirements.txt
content: httpx
pydantic
python-dotenv
sh
pillow


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: henryzhuhr/hot-news-aggregator (version 1.0.0)

--- name: hot-news-aggregator version: 1.0.3 description: "国内外社会、科技、军事新闻汇总。自动搜索、筛选、整理新闻要点。Use When 需要获取最新的国内外社会、科技、军事新闻，并且希望自动筛选和整理新闻要点时。" license: MIT --- # Hot News Aggregator (热门新闻聚合器) 聚合国内外社会、科技、军事新闻，自动筛选要点。 ## 新闻源 国内科技 - 36氪: `https://36kr.com/information/tech` - 机器之心: `https://www.jiqizhixin.com` - 量子位: `https://www.1baijia.com` - IT之家: `https://www.ithome.com` 国内军事 - 观察者网: `https://www.guancha.cn` - 澎湃新闻: `https://www.thepaper.cn` - 腾讯军事: `https://new.qq.com/om/mil` 国际科技 - TechCrunch: `https://techcrunch.com` - The Verge: `https://www.theverge.com` - Wired: `https://www.wired.com` - Ars Technica: `https://arstechnica.com` 国际军事 - Defense News: `https://www.defensenews.com` - Jane's Defence: `https://www.janes.com` - Military Times: `https://www.militarytimes.com` ## 工作流 1. **搜索** - 用 `web_search` 或 `web_fetch` 工具搜索各源 2. **筛选** - 过滤重复、过期、不可靠来源 3. **整理** - 按类别整理，每条含标题、来源、要点 4. **输出** - 生成结构化汇总 ## 可信度规则 **优先：** - 官方媒体报道 - 权威机构发布 **谨慎：** - 论坛帖子 - 匿名消息 - 二手转载 ## 输出格式 ```markdown ## 科技新闻 1. [标题](链接) 来源：xxx | 时间：xxx 要点：xxx ## 军事新闻 1. [标题](链接) 来源：xxx | 时间：xxx 要点：xxx ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: thejas775/instagram-reels-monitor (version 1.0.0)

--- name: instagram-reels-monitor description: Monitor Instagram DMs for reels. Use when you need to check Instagram DMs for new unread messages containing reels, click them, extract the reel link, and append to an instagram_reels.csv file. --- # Instagram Reels Monitor This skill monitors an already open Instagram Direct Messages tab for new messages containing reels and saves them to a CSV file. ## Requirements - An active browser session with a tab open to `https://www.instagram.com/direct/inbox/`. - The user must have the OpenClaw browser relay attached to that tab. ## Workflow 1. Use the `browser` tool with `action: tabs` and `profile: chrome` to find the `targetId` for the Instagram Messages tab. 2. Use the `browser` tool with `action: act`, `kind: evaluate` to run a script that checks for new, unread messages in the DM list. 3. If an unread message is found, click the conversation to open it. 4. Once the conversation is open, use `browser` `action: act`, `kind: evaluate` to extract the `href` of any link containing `/reel/` or `/p/` (if it's a video/reel). 5. Extract the Instagram user ID of the sender. 6. Append the data to `instagram_reels.csv` in the format `userid,reel_link`. 7. Return to the main inbox view (if necessary) to check for more messages. ## Example Scripts ### Extract Reel Links from an Open Conversation ```javascript () => { const links = Array.from(document.querySelectorAll('a')); return links.filter(a => a.href.includes('/reel/')).map(a => a.href); } ``` ### List DM Conversations ```javascript () => { const buttons = Array.from(document.querySelectorAll('div[role="button"]')); return buttons.map(b => b.innerText.replace(/\n/g, ' ')); } ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ai-tesing/wav-audio-transcribe (version 1.0.0)

--- name: audio-transcribe description: 语音转文字 Skill。使用本地 Whisper (openai-whisper) 将音频文件转录为文本、字幕(SRT)或 JSON。适用于会议记录、播客转录、语音备忘录等场景。触发方式：转写音频、转录语音、音频转文字、语音转文本、whisper、生成字幕。 --- # Audio Transcribe Skill 语音转文字，使用本地 Whisper 模型，完全离线、隐私安全。 ## 前置条件 **安装 Whisper（只需一次）：** ```bash # macOS brew install whisper # 或者 Python 包（更推荐，自动装模型） pip3 install openai-whisper ``` ## 使用方法 ### 基本转录（中文音频） 当用户说"转录这个音频"时，运行： ```bash python3 ~/.openclaw/workspace/skills/audio-transcribe/scripts/transcribe.py "/path/to/audio.wav" ``` ### 指定格式 ```bash # 输出 SRT 字幕 python3 ~/.openclaw/workspace/skills/audio-transcribe/scripts/transcribe.py "/path/to/audio.wav" srt # 输出 JSON（含时间戳） python3 ~/.openclaw/workspace/skills/audio-transcribe/scripts/transcribe.py "/path/to/audio.wav" json # 指定语言 python3 ~/.openclaw/workspace/skills/audio-transcribe/scripts/transcribe.py "/path/to/audio.wav" txt zh # 英文音频 python3 ~/.openclaw/workspace/skills/audio-transcribe/scripts/transcribe.py "/path/to/audio.wav" txt en ``` ### 支持的格式 | 格式 | 说明 | 适用场景 | |------|------|----------| | `txt` | 纯文本（默认） | 快速阅读、存档 | | `srt` | 字幕文件 | 视频压制、外语学习 | | `json` | 结构化结果 | 二次处理、时间戳提取 | ### 支持的音频格式 `.wav`, `.mp3`, `.m4a`, `.flac`, `.ogg`, `.opus`, `.mp4`, `.mov` 等ffmpeg支持的格式 ## 脚本参数 ``` python3 transcribe.py <audio_file> [output_format] [language] 参数： audio_file 音频文件路径（必填） output_format 输出格式：txt, srt, json（默认: txt） language 语言代码：zh, en, ja, ko 等（默认: 自动检测） ``` ## 注意事项 - **首次运行会下载模型**（~500MB），耐心等待 - 音频质量越高转录越准 - Whisper 模型可选：`tiny`, `base`, `small`, `medium`, `large`，默认 `base` - 如果想换模型，修改脚本中 `whisper.load_model('base')` 为其他选项 - 长音频会自动分段处理


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal:  | SkillSpector: suspicious (CRITICAL)
Skill: yx2601816404-sys/skill-store (version 2.3.1)

--- name: skill-store description: "Smart skill installation advisor for ClawHub. Searches for skills matching your needs, evaluates candidates on security (via skill-shield), code quality, and documentation, then produces a comparison report with a recommendation. Use when: looking for a skill to do something specific, comparing similar skills, or wanting a safety-checked recommendation before installing. Zero external dependencies." --- # Skill Store — Smart Installation Advisor Find the right skill without the guesswork. Searches ClawHub, evaluates candidates on security + quality, and recommends the best one. ## Usage ```bash python3 scripts/evaluate.py "your search query" [options] ``` ### Examples ```bash # Find a weather skill python3 scripts/evaluate.py "weather forecast" # Evaluate top 3 only, save reports python3 scripts/evaluate.py "image generation" --top 3 --output-dir ./reports # Use a specific skills workspace for clawhub python3 scripts/evaluate.py "security audit" --workdir /path/to/workspace ``` ### Options | Option | Default | Description | |--------|---------|-------------| | `--top N` | 5 | Number of candidates to evaluate | | `--output-dir DIR` | (stdout) | Save report.md and report.json to DIR | | `--workdir DIR` | /tmp/skill-store-eval-* | Working directory for clawhub install | | `--scanner PATH` | auto-detect | Path to skill-shield's scan.py | | `--keep-all` | false | Don't uninstall non-recommended candidates | ### Output Prints a Markdown comparison report to stdout. With `--output-dir`, also writes: - `report.md` — human-readable comparison - `report.json` — structured evaluation data ## How It Works 1. Searches ClawHub for skills matching your query 2. Installs top N candidates into a temporary directory 3. Runs skill-shield security scan on each candidate 4. Evaluates code quality (lines of code, documentation, tests, structure) 5. Scores and ranks candidates (security 40%, quality 30%, relevance 30%) 6. Generates comparison report with recommendation 7. Uninstalls non-recommended candidates (unless `--keep-all`) ## Scoring | Dimension | Weight | What's measured | |-----------|--------|-----------------| | Security | 40% | skill-shield rating, findings count, permission audit | | Quality | 30% | Code lines, SKILL.md completeness, README, tests | | Relevance | 30% | clawhub search score (normalized) | ## Requirements - `clawhub` CLI installed and authenticated - `skill-shield` scan.py accessible (auto-detected from sibling directory or via `--scanner`) - Python 3.8+ ## Exit Codes | Code | Meaning | |------|---------| | 0 | Recommendation made successfully | | 1 | No candidates found or all evaluations failed |


Security scan verdicts — ClawScan: suspicious | static analysis:  | VirusTotal: suspicious | SkillSpector:  ()
Skill: 7010g/librag-knowledge-recall (version 1.0.0)

--- name: librag-knowledge-recall-zh description: 使用 LibRAG 本地 `/api/v1/librag/knowbase/recall` 接口做知识库数据召回。适用于中文场景下的知识库检索、资料召回、证据段落提取、出处定位、基于知识库的问答取证，以及用户用“知识库查询”“数据召回”“从文档里找答案”等表达发起的任务。 homepage: https://github.com/openclaw/skills metadata: openclaw: emoji: "🔎" requires: files: - config.json - scripts/recall.py anyBins: - python - py - python3 clawdbot: emoji: "🔎" requires: files: - config.json - scripts/recall.py anyBins: - python - py - python3 --- # LibRAG 中文知识库召回 优先使用附带脚本调用 LibRAG，不要手写 HTTP 请求。 ## 触发语义 遇到下列表达时优先使用本 Skill： - “去知识库里查一下” - “做一下数据召回” - “从 LibRAG 找相关段落” - “把出处和原文召回出来” - “根据知识库检索证据” - “从文档中找到答案” ## 输入 必需输入： - `question`：用户要检索的问题或条件。 配置文件 `config.json`： - `base_url`：LibRAG 服务地址。 - `api_key`：与目标知识库绑定的 API Key。 - `kb_id`：默认知识库 ID。 - `recall_mode`：默认召回模式。 - `vector_top_k`：向量召回 top-k。 - `fulltext_top_k`：全文召回 top-k。 - `return_tree`：是否返回树形结构。 - `has_source_text`：是否包含原文。 - `has_score`：是否保留分数字段。 - `filter_effective`：是否过滤无效结果。 - `reasoning_enhance`：是否启用推理增强。 - `score_threshold`：打分过滤阈值。 可选覆盖：命令行参数优先于 `config.json`： - `kb_id`：覆盖 `config.json` 里的默认知识库 ID。 - `recall_mode`：`reasoning`、`hybrid`、`vector`，默认 `hybrid`。 - `vector_top_k`：默认 `20`。 - `fulltext_top_k`：默认 `20`。 - `return_tree`：默认 `true`。 - `has_source_text`：默认 `true`。 - `has_score`：默认 `true`。 - `score_threshold`：默认 `0`，作为打分过滤的分数阈值。 - `filter_effective`：默认 `true`。 - `reasoning_enhance`：默认 `true`。 ## 执行 默认使用 `config.json` 中的知识库： ```bash python {baseDir}/scripts/recall.py --config {baseDir}/config.json --question "<问题>" ``` 需要覆盖知识库时： ```bash python {baseDir}/scripts/recall.py --config {baseDir}/config.json --kb-id 12 --question "这个产品的违约金标准是什么？" ``` ## 输出 默认直接返回脚本输出 JSON。 关键字段： - `request` - `response.msg` - `response.data` - `summary.item_count` - `summary.result_shape` ## 约束 - 缺少 `config.json`，或其中的 `base_url`、`api_key`、`kb_id`，或缺少 `question` 时直接失败。 - 默认使用非流式调用。 - 默认使用 `return_tree=true`，只有明确要求平铺段落结果时才改成 `false`。 - 不要输出完整 API Key。 - 若返回 `401` 或 `403`，明确提示密钥无效或没有该知识库权限。 - 若返回 `404`，明确提示知识库不存在。


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: sky-lv/openclaw-agent-discovery (version 1.0.0)

--- name: agent-discovery description: "Agent发现探索助手。搜索、评估、集成公开Agent。使用场景：(1) 搜索可用Agent，(2) 评估Agent能力，(3) 集成方案设计，(4) 成本效益分析。" metadata: {"openclaw": {"emoji": "🔎"}} --- # Agent Discovery — Agent发现助手 ## 功能说明 帮助发现和评估可用的Agent系统。 ## 使用方法 ### 1. 能力搜索 ``` 用户: 找一下有哪些免费的代码审查Agent？ ``` ### 2. 评估对比 ``` 用户: 比较一下Claude和GPT的Agent能力 ``` ### 3. 集成方案 ``` 用户: 如何把这个Agent集成到我们的系统？ ``` ### 4. 成本分析 ``` 用户: 使用这个Agent的成本是多少？ ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jeftekhari/remove-analytics (version 0.1.0)

--- name: remove-analytics description: Safely remove Google Analytics from a project. Cleans up all tracking code, dependencies, and environment variables. disable-model-invocation: true --- # Remove Analytics Skill You are removing Google Analytics from this project. This is a destructive action - confirm with the user before proceeding. ## Step 1: Confirm Intent Ask the user to confirm they want to remove analytics: > "This will remove all Google Analytics tracking from your project. This action will: > - Remove gtag scripts and components > - Remove analytics utility files > - Remove related environment variables from .env.example > - Remove npm packages if any > > Type 'yes' to confirm." ## Step 2: Find All Analytics Code Search for: - Files containing `gtag`, `dataLayer`, `GoogleAnalytics` - Import statements for analytics utilities - Script tags with `googletagmanager.com` - Environment variables: `GA_`, `GTAG_`, `MEASUREMENT_ID` - Package.json dependencies: `@types/gtag.js`, `react-ga4`, `vue-gtag`, etc. ## Step 3: Remove Code For each finding: 1. Show the file and code to be removed 2. Remove the code or file 3. Clean up any orphaned imports ## Step 4: Clean Up - Remove analytics-related packages: `npm uninstall @types/gtag.js` (or equivalent) - Remove environment variables from `.env.example` - Update any documentation that references analytics ## Step 5: Summary Provide a summary of: - Files deleted - Files modified - Packages removed - Environment variables removed - Any manual steps needed (like removing actual env values)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ivangdavila/powershell (version 1.0.0)

--- name: PowerShell description: Avoid common PowerShell mistakes — output behavior, array traps, and comparison operator gotchas. metadata: {"clawdbot":{"emoji":"🔵","requires":{"bins":["pwsh"]},"os":["linux","darwin","win32"]}} --- ## Output Behavior - Everything not captured goes to output — even without `return` or `Write-Output` - `return` doesn't stop output — previous uncaptured expressions still output - `Write-Host` bypasses pipeline — use for display only, not data - Assign to `$null` to suppress — `$null = SomeFunction` - `[void]` cast also suppresses — `[void](SomeFunction)` ## Array Gotchas - Single item result is scalar, not array — `@(Get-Item .)` forces array - Empty result is `$null`, not empty array — check with `if ($result)` carefully - Array unrolling in pipeline — `@(1,2,3) | ForEach` sends items one by one - `+=` on array creates new array — slow in loops, use `[System.Collections.ArrayList]` - `,` is array operator — `,$item` wraps single item in array ## Comparison Operators - `-eq`, `-ne`, `-gt`, `-lt` — not `==`, `!=`, `>`, `<` - `-like` with wildcards, `-match` with regex — both return bool - `-contains` for array membership — `$arr -contains $item`, not `$item -in $arr` (though `-in` works too) - Case-insensitive by default — `-ceq`, `-cmatch` for case-sensitive - `$null` on left side — `$null -eq $var` prevents array comparison issues ## String Handling - Double quotes interpolate — `"Hello $name"` expands variable - Single quotes literal — `'$name'` stays as literal text - Subexpression for complex — `"Count: $($arr.Count)"` for properties/methods - Here-strings for multiline — `@" ... "@` or `@' ... '@` - Backtick escapes — `` `n `` for newline, `` `t `` for tab ## Pipeline - `$_` or `$PSItem` is current object — same thing, `$_` more common - `ForEach-Object` for pipeline — `foreach` statement doesn't take pipeline - `-PipelineVariable` saves intermediate — `Get-Service -PV svc | Where ...` - Pipeline processes one at a time — unless function doesn't support streaming ## Error Handling - `$ErrorActionPreference` sets default — `Stop`, `Continue`, `SilentlyContinue` - `-ErrorAction Stop` per command — makes non-terminating errors terminating - `try/catch` only catches terminating — set `ErrorAction Stop` first - `$?` is last command success — `$LASTEXITCODE` for native commands ## Common Mistakes - No space before `{` in `if` — `if($x){` works but `if ($x) {` preferred - `=` is assignment in conditions — use `-eq` for comparison - Function return array unrolls — `return ,@($arr)` to keep array - `Get-Content` returns lines array — `-Raw` for single string - `Select-Object` creates new object — properties are copies, not references ## Cross-Platform - `pwsh` is PowerShell 7+ — `powershell` is Windows PowerShell 5.1 - Paths use `/` or `\` — `Join-Path` for portable - Environment vars: `$env:VAR` — works on all platforms - Aliases differ across platforms — `ls`, `cat` may not exist, use full cmdlet names


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: superuser-fank/skill-usage-tracker-nicki (version 1.1.0)

--- name: skill-usage-tracker description: 技能调用记录与统计分析。自动追踪所有技能调用，无需用户操作。支持日/周/月/季/年维度的技能使用统计报告。安装后直接使用，无需配置。 --- # 技能使用记录与统计 ## 功能 - **自动记录**：每次调用技能时自动记录，无需用户操作 - **手动汇报**：主动告知用户"刚才调用了 XXX 技能" - **统计报告**：支持日/周/月/季/年维度生成使用报告 ## 文件结构 ``` skill-usage-tracker/ ├── SKILL.md ├── scripts/ │ ├── log.py # 记录调用 │ └── query.py # 查询统计 └── data/ └── usage.json # 调用记录存储 ``` ## 记录方式 **自动记录（主要）**：通过 HEARTBEAT 每2小时扫描 session 历史自动补录 **主动汇报**：每次调用技能后在回复末尾告知用户 ## 查询统计 当用户请求报告时调用 query.py： ```bash python3 ~/.openclaw/workspace/skills/skill-usage-tracker/scripts/query.py <维度> ``` **维度选项：** | 维度 | 说明 | |------|------| | 日 | 今天 | | 周 | 本周一至今（默认） | | 月 | 本月 | | 季 | 本季度 | | 年 | 本年 | ## 输出格式 ``` 技能使用报告 - 本周（03月24日 至 03月29日） 总调用次数：15次 ⏱ 滚动窗口（5小时） ━━━━━━━━━━━━━━━━━━━ 🟢 minimax-token-plan 8次 · 53.3% 🟡 camoufox 5次 · 33.3% 🔵 feishu-task 2次 · 13.3% ``` ## 数据结构 `usage.json`: ```json { "records": [ { "skill": "minimax-token-plan", "called_at": "2026-03-29T16:30:00+00:00", "note": "" } ] } ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: drivenbymyai-max/crm-agents (version 1.0.0)

--- name: crm-agents description: Execute 13 CRM AI agents on demand — oracle, spider, watchdog, diplomat, strategist and more. Business intelligence as a service. user-invocable: true metadata: {"openclaw":{"requires":{"env":[]}},"homepage":"https://sputnikx.xyz","author":"SputnikX","version":"1.0.0","tags":["crm","agents","intelligence","oracle","analytics"]} --- # CRM Agent Skills Execute 13 specialized AI agents on demand. Each agent analyzes different business domains — revenue, supply chain, deals, risk, compliance. ## Base URL `https://sputnikx.xyz/api/v1/agent` ## List Available Skills (free) ```bash curl https://sputnikx.xyz/api/v1/agent/skills ``` Returns: All available agents with descriptions and capabilities. ## Run Agent Skill ($0.50 x402 USDC) ```bash curl -X POST https://sputnikx.xyz/api/v1/agent/skills/run \ -H "Content-Type: application/json" \ -d '{"agent":"oracle","task":"revenue trends Q1 2026"}' ``` ## Auto-Route (free routing, $0.50 with execution) ```bash curl -X POST https://sputnikx.xyz/api/v1/agent/skills/auto-route \ -H "Content-Type: application/json" \ -d '{"task":"supply chain risk assessment"}' ``` Semantic matching — describe what you need, the system picks the best agent. ## Available Agents | Agent | Domain | Specialty | |-------|--------|-----------| | oracle | Revenue | KPI, trends, seasonality | | spider | Supply Chain | Inventory health (0-100) | | watchdog | Risk | Threat classification (RED/YELLOW/GREEN) | | tracker | Leads | Lead scoring, pipeline | | sniper | Deals | Deal velocity, cash-at-risk | | diplomat | Clients | RFM scoring, client value | | analyst | System | System health (0-100) | | strategist | Cross-domain | Correlations, strategy (HUB) | | finansist | Budget | API costs, spend tracking | | gramatvedis | Accounting | P&L, cash flow | | devils-advocate | Objectivity | Challenges assumptions | | compliance-auditor | Compliance | EU AI Act, risk classification | | orion | Social | Moltbook social network agent | ## Inter-Agent Signals Agents communicate via Spider Web — signal cascades with trust-weighted routing. Alert → Finding → Invalidation → Objection flow.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)