OpenClaw/clawhub-security-signals huggingface dataset:
Skill: kyu1204/hudy (version 1.0.0)

--- name: hudy description: "Korean public holidays and business day calculations via HuDy MCP. Query holidays, count business days, add/subtract business days, and manage custom holidays." metadata: openclaw: requires: env: - HUDY_API_KEY primaryEnv: HUDY_API_KEY --- # HuDy - Korean Holiday & Business Day Skill Use the HuDy MCP server to query Korean public holidays, calculate business days, and manage custom holidays directly from your AI agent. ## Setup ### 1. Get an API Key Sign up at [hudy.co.kr](https://www.hudy.co.kr) and create an API key from the dashboard. ### 2. Connect MCP **Claude Code:** ```bash claude mcp add --transport http hudy https://www.hudy.co.kr/api/mcp -H "x-[REDACTED_SECRET]" ``` **Claude Desktop / Cursor:** ```json { "mcpServers": { "hudy": { "url": "https://www.hudy.co.kr/api/mcp", "headers": { "x-api-key": "YOUR_API_KEY" } } } } ``` --- ## Available Tools ### `get_holidays` (Free) Query Korean public holidays by year or date range. ```text "2026년 공휴일 알려줘" "2026-03-01부터 2026-06-30까지 공휴일 조회해줘" ``` ### `count_business_days` (Pro) Count business days between two dates, excluding weekends and public holidays. ```text "2026-03-01부터 2026-03-31까지 영업일 며칠이야?" "이번 달 영업일 수 알려줘" ``` ### `add_business_days` (Pro) Calculate the date N business days after a given date. ```text "2026-03-01에서 10영업일 후 날짜 알려줘" "오늘부터 5영업일 뒤는 언제야?" ``` ### `subtract_business_days` (Pro) Calculate the date N business days before a given date. ```text "2026-03-31에서 5영업일 전 날짜 알려줘" ``` ### `check_business_day` (Pro) Check if a specific date is a business day. ```text "2026-03-01이 영업일이야?" "오늘 영업일인지 확인해줘" ``` ### Custom Holiday Management (Pro) Manage user-defined holidays that are included in all business day calculations. | Tool | Description | | --- | --- | | `list_custom_holidays` | List all custom holidays | | `create_custom_holiday` | Register a new custom holiday | | `update_custom_holiday` | Update an existing custom holiday | | `delete_custom_holiday` | Delete a custom holiday | ```text "회사 창립기념일 2026-05-15로 등록해줘" "커스텀 공휴일 목록 보여줘" ``` --- ## Plans | Feature | Free | Pro ($3/mo) | | --- | :---: | :---: | | Public holiday lookup | ✅ | ✅ | | Monthly API calls | 100 | 5,000 | | Business day APIs | ❌ | ✅ | | Custom holidays | ❌ | ✅ | | Calendar sync (iCal) | ❌ | ✅ | --- ## Notes - All dates use `YYYY-MM-DD` format. - Holiday data is sourced from the Korean government open data portal (data.go.kr). - Custom holidays are per-user and automatically included in business day calculations. - Calendar sync provides an iCal URL for Google Calendar, Apple Calendar, and Outlook.


Security scan verdicts — ClawScan: clean | static analysis:  | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ckchzh/prophet (version 2.0.2)

--- name: "prophet" version: "2.0.2" description: "Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Prophet concepts, best practices, and implementation patterns." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [prophet, reference] category: "devtools" --- # Prophet Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Prophet concepts, best practices, and implementation patterns. No API keys or credentials required. ## Commands | Command | Description | |---------|-------------| | `intro` | intro reference | | `quickstart` | quickstart reference | | `patterns` | patterns reference | | `debugging` | debugging reference | | `performance` | performance reference | | `security` | security reference | | `migration` | migration reference | | `cheatsheet` | cheatsheet reference | ## Output Format All commands output plain-text reference documentation via heredoc. No external API calls, no credentials needed, no network access. --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: lqwall26/speech2text (version 1.0.0)

# STT - 语音识别 (Speech-to-Text) 将语音消息识别为文字。支持 ogg/wav/mp3/m4a 格式。 ## 触发方式 - 用户发送语音消息时自动触发 - 或者手动调用 skill ## 功能 1. **自动识别语音** - 收到语音消息时自动转文字 2. **离线识别** - 使用 Faster-Whisper，无需网络 3. **格式转换** - 自动用 ffmpeg 转换音频格式 ## 依赖 - Python 包: `faster-whisper`, `pydub` - ffmpeg: `C:\ffmpeg\bin` (需要在系统 PATH 中) ## 安装 ```bash pip install faster-whisper pydub ``` ## 使用示例 ``` 用户发送语音 → 自动识别为文字 → 根据文字内容回复 ``` ## 配置 - 模型大小: tiny (可改为 base/small/medium/large，精度更高但更慢) - 默认语言: zh (中文) - ffmpeg 路径: C:\ffmpeg\bin ## 原理 1. 接收语音文件 (ogg) 2. 用 ffmpeg 转换为 wav (16000Hz, mono) 3. 用 Faster-Whisper 识别为文字 4. 返回识别结果并继续对话


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: nissan/gateway-env-injector (version 1.0.0)

--- name: gateway-env-injector version: 1.0.0 description: Safely inject API keys from 1Password into macOS LaunchAgent plists using PlistBuddy. Use when running OpenClaw on macOS and storing secrets in 1Password — avoids plaintext keys on disk while keeping LaunchAgent env vars populated. Requires 1Password CLI (op). metadata: {"openclaw": {"emoji": "🔐", "requires": {"bins": ["op", "bash"], "env": ["OP_SERVICE_ACCOUNT_TOKEN"]}, "primaryEnv": "OP_SERVICE_ACCOUNT_TOKEN", "network": {"outbound": true, "reason": "Reads secrets from 1Password via op CLI (1password.com). Writes locally to plist files only."}}} --- # Gateway Environment Injector Bake secrets from 1Password into macOS LaunchAgent plists without leaving plaintext keys on disk. Uses `op read` to fetch secrets and `/usr/libexec/PlistBuddy` to inject them directly into the plist's `EnvironmentVariables` block. ## Why This Exists - `launchctl setenv` doesn't inject into a plist's own `EnvironmentVariables` block - Environment variables in `.zshrc` aren't available to LaunchAgents - Plaintext key files are a security risk - 1Password service accounts provide read-only, rotatable access ## Usage ```bash bash scripts/inject-gateway-env.sh ``` Reads each key from 1Password, injects into the gateway plist, then restarts the service. ## What It Injects Configurable list of `op://Vault/Item/field` references mapped to environment variable names. Modify the script's `KEYS` array for your setup. ## Key Lesson Changing the Node binary path (even to a symlink) can silently revoke macOS TCC permissions. Always keep the gateway plist locked to the Homebrew Cellar path, not an NVM symlink. ## Files - `scripts/inject-gateway-env.sh` — Injection script with 1Password integration


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: bubblevan/showmethemoney-pro (version 1.1.0)

--- name: showmethemoney-pro description: execute the paid showmethemoney premium action through the merchant backend. use when the user wants to unlock or run the protected showmethemoney capability, and stablepay payment should be used before retrying the backend action. --- # ShowMeTheMoney Pro Execute the protected ShowMeTheMoney premium action only after merchant-backend verification and StablePay payment succeed. This skill is only for the protected premium action exposed by `GET /execute?agent_did=<buyer_did>` ## Main workflow When the user asks to use the premium ShowMeTheMoney capability: 1. Resolve the current buyer DID from `stablepay_runtime_status`. 2. Call the merchant backend premium endpoint: - `GET http://127.0.0.1:8787/execute?agent_did=<buyer_did>` 3. Treat the merchant backend as the source of truth. 4. If the backend returns `200`, return the protected result. 5. If the backend returns `402 Payment Required`: - Parse the x402 response from `accepts[0]`: - `skill_did` → from `accepts[0].extra.skillDid` - `price` → from `accepts[0].maxAmountRequired` (convert from minor units to decimal: divide by 1,000,000) - `currency` → from `accepts[0].extra.currency` - `facilitator_url` → from `accepts[0].extra.facilitatorUrl` - **NEVER** use any hardcoded or fallback values - call `stablepay_pay_via_gateway` with the extracted values 6. If payment succeeds, retry the same `/execute` request once. 7. If the retry still does not return `200`, explain that the premium action is still locked or verification failed. ## Premium action contract Use this request for the premium action: - method: `GET` - endpoint: `http://127.0.0.1:8787/execute` - required query parameter: `agent_did` Optional query parameters may be used when helpful: - `q` - `prompt` These optional values are forwarded to the backend as request text for the premium action. The backend should: 1. receive the premium request 2. verify purchase state via StablePay 3. return `402` when the user has not purchased the skill 4. return `200` only after verification succeeds 5. return a merchant-generated proof token in the premium result Treat the backend response as the final authority. ## Unlocked Store (Report Store) After successful skill purchase, the backend returns `unlocked_store` in the 200 response. Present the unlocked store information to the user and offer to browse/purchase individual research reports. Each report requires separate payment using the same x402 payment flow. ## Payment rules When payment is required: 1. Use `stablepay_pay_via_gateway`. 2. Use the requirement returned by the backend when present. 3. Respect local payment limits already configured in the StablePay plugin. 4. Never claim payment succeeded unless StablePay returns a successful result. 5. Retry the premium action only once after a successful payment.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: hitjcl/social-publish (version 2.0.0)

# 多平台视频发布助手 ## 安全声明 ⚠️ - **本 skill 仅在用户明确请求时操作** - **所有操作都在用户本地的浏览器中进行** - **不会自动登录或存储任何账户凭证** - **用户对自己账户的操作负完全责任** ## 功能说明 帮助用户在多个视频平台（抖音、快手、B站、小红书等）发布视频内容。 **重要限制：** - 本 skill 提供操作指导，实际浏览器自动化需要用户授权 - 不会自动登录任何账户 - 不会绕过任何平台的安全机制 - 不会修改平台的任何安全设置 ## 触发条件 当用户说： - "帮我发布视频到[平台]" - "把视频发到抖音/快手/B站" - "多平台发布视频" - 类似的多平台视频发布需求 ## 使用前提 1. 用户已在浏览器中手动登录目标平台 2. 用户准备好要发布的视频文件 3. 用户了解各平台的发布规则 ## 技术实现 本 skill 使用 **xbrowser skill** 进行浏览器自动化，这是一个安全的、受控的浏览器控制方案。 ### 安全措施 1. **用户授权**：每次浏览器操作都需要用户确认 2. **会话隔离**：使用用户自己的浏览器配置，不创建新会话 3. **无凭证存储**：不记录或存储任何登录信息 4. **透明操作**：所有操作步骤对用户可见 ## 工作流程 1. 用户请求发布视频 2. Agent 确认目标平台和视频文件 3. Agent 使用 xbrowser skill 打开目标平台（使用用户已登录的浏览器） 4. 引导用户完成发布流程（或自动化，需用户确认） ## 支持的平台 | 平台 | 说明 | |------|------| | 抖音 | 需要 PC 端创作者平台 | | 快手 | 支持 PC 端发布 | | B站 | 支持批量上传 | | 小红书 | 需要通过创作者平台 | | 微信视频号 | 需要微信扫码登录 | ## 脚本说明 - `video-publish.py` - 发布辅助脚本（提供操作指引） - `platform-helper.py` - 平台特定操作辅助 ## 安全最佳实践 - 使用测试账号先验证功能 - 不要在主力账号上直接测试 - 定期检查账户活动记录 - 发现异常立即停止使用并检查账户 ## 版本信息 - 版本: 2.0.0 - 更新日期: 2026-04-24 - 安全修复: 移除 SSRF 相关指令，改进下载脚本安全性，删除账户示例


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dr-xiaoming/catl-wiki (version 1.1.0)

--- name: catl-wiki description: | CATL (宁德时代) project wiki knowledge base — shared across all agents. Activate when: (1) looking up CATL client info, project docs, industry research, content assets, or SOPs, (2) adding/updating wiki content for the CATL project, (3) user mentions 宁德wiki, 知识库, client profile, 项目文档, 行业研究, or any CATL project knowledge query. Provides wiki node mapping, read/write workflows, and mandatory changelog tracking. NOT for: non-CATL wikis, general feishu doc editing unrelated to the knowledge base, or feishu drive/permission management. --- # CATL Wiki Knowledge Base Shared knowledge base for the 宁德时代 (CATL) project team, hosted on Feishu Wiki. ## Quick Reference - **Space ID**: 7624480701739519200 - **Modules**: 客户档案 / 项目文档 / 行业研究 / 内容资产 / 流程规范 / 变更记录 Full node token mapping: see [references/wiki-structure.md](references/wiki-structure.md) ## Reading Content 1. Identify the module from the table in wiki-structure.md 2. Get the doc token: 3. Read content: 4. For sub-pages, list children: ## Writing / Updating Content 1. Get obj_token (same as reading step 2) 2. Write content: 3. **MANDATORY — Log the change** (both steps required): ### Step A: Local changelog Done: [2026-04-07 07:23 UTC] <your_agent_name> -> <module>: <summary> ### Step B: Feishu wiki changelog page Append a line to the 变更记录 wiki page: The changelog node token is in wiki-structure.md. > **Skipping changelog = violation.** Every wiki edit must be logged in both places. ## Creating New Pages To add a sub-page under an existing module: After creating, update wiki-structure.md with the new node token, and log the change. ## Module Guide | Module | What belongs here | |--------|-------------------| | 客户档案 | CATL company info, products, contacts, collaboration history | | 项目文档 | KOC plans, RFP proposals, meeting notes, deliverables | | 行业研究 | Market data, competitor intel, policy trends, tech analysis | | 内容资产 | Topic pools, scripts, content ratios, case studies | | 流程规范 | Workflows, tool guides, best practices, templates | | 变更记录 | Auto-maintained — do not manually edit except via changelog process | ## Notes - Feishu docx blocks batch limit: ≤20 per API call - Block type 2 (text) is the safe default for children blocks - Insert at index=0 for prepend, omit for append


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zhonglouxiaonaigao-art/chinese-copywriting-guidelines-full-clawhub (version 1.0.0)

--- name: chinese-copywriting-guidelines-full description: Apply the complete Chinese Copywriting Guidelines with full upstream content bundled locally. Use when reviewing or rewriting Chinese copy in Markdown, docs, PR text, UI copy, announcements, or mixed Chinese-English technical writing and the user wants full-rule compliance rather than a simplified subset. --- # Chinese Copywriting Guidelines Full ## Overview Use the full upstream guideline set to review, rewrite, and explain Chinese copy edits. Prioritize the original repository rules and examples over condensed summaries. ## Load Strategy 1. Load `references/source-info.md` to confirm upstream source and commit. 2. Load `references/upstream-text/README.md` as the primary Chinese rule source. 3. Load `references/upstream-text/README.en.md` when user asks for English explanation. 4. Load `references/upstream-text/CHANGELOG.md` when user asks about rule history. 5. Load `references/upstream-text/LICENSE.txt` when user asks about license terms. ## Workflow 1. Parse user goal: review-only, full rewrite, or rule explanation. 2. Apply full upstream rules in this order: - spacing - punctuation - fullwidth and halfwidth forms - proper nouns and abbreviations - optional disputed preferences only if requested 3. Preserve meaning, facts, code, commands, URLs, and identifiers. 4. Return revised content and a concise change log mapped to rule categories. ## Output Format For rewrite tasks, return: 1. `Revised`: full updated text. 2. `Changes`: short bullets grouped by rule type. 3. `Notes`: optional ambiguity or style tradeoffs. For review-only tasks, return: 1. `Issues`: each issue with original snippet and suggested fix. 2. `Summary`: total issues by category. ## Boundaries 1. Do not invent brand casing when uncertain; flag uncertainty. 2. Do not enforce optional disputed preferences unless user requests strict mode. 3. Do not fabricate rules not present in upstream content. 4. Do not remove user-intended tone unless user asks for tone adjustment. ## Bundled Source This skill bundles a text-only upstream snapshot for ClawHub upload compatibility: 1. `references/upstream-text/README.md` 2. `references/upstream-text/README.en.md` 3. `references/upstream-text/CHANGELOG.md` 4. `references/upstream-text/LICENSE.txt` 5. `references/upstream-text/package.json.txt` 6. `references/upstream-text/Gruntfile.coffee.txt` 7. `references/upstream-text/gitignore.txt` 8. `references/upstream-text/github-FUNDING.yml.txt` Source repository: `https://github.com/mzlogin/chinese-copywriting-guidelines` (CC BY-SA 4.0).


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ipythoning/sdr-humanizer (version 1.2.1)

# sdr-humanizer — Human-Like Conversation Rules Transform AI-generated sales messages into natural, human-like conversations that build trust and rapport. ## Core Principles ### 1. Message Pacing - Never send walls of text — break into 2-3 short messages - Add 2-5 second delays between consecutive messages - Use voice messages occasionally (if channel supports) - Vary message length: mix short (1 line) with medium (3-5 lines) ### 2. Typing Indicators - Simulate typing time proportional to message length - Short reply (< 20 words): 2-4 seconds - Medium reply (20-50 words): 5-10 seconds - Long reply (50+ words): 15-30 seconds ### 3. Language Patterns - **Always reply to customers in English** — consistent, professional, globally understood - **Operator self-chat sync**: After each English reply, immediately send a Chinese translation via self-chat (WhatsApp "Message to myself"). Operator reads Chinese; customer only sees English. This runs silently — never mention it to the customer. - Use contractions and informal grammar when appropriate - Include occasional filler words: "actually", "by the way", "just wanted to" - Match the customer's formality level in English - Avoid perfect grammar in casual channels (WhatsApp) - Use emoji sparingly — max 1-2 per message, contextually appropriate ### 4. Response Timing - Don't reply instantly to every message (feels robotic) - Business hours: 1-5 minute response time - After hours: Reply next morning with "Sorry, just saw this" - Weekend messages: Acknowledge Monday morning - Exception: CTWA ad leads → reply within 5 minutes (golden window) ### 5. Conversation Flow - Ask one question at a time — never stack 3+ questions - Reference previous conversations: "Last time you mentioned..." - Show genuine curiosity about their business - Share relevant market insights proactively - Use the customer's name naturally (not every message) ### 6. Cultural Adaptation | Region | Style | |--------|-------| | Middle East | Warm greetings, relationship-first, patient | | Southeast Asia | Polite, indirect, respect hierarchy | | Latin America | Friendly, enthusiastic, personal touch | | Europe | Professional, data-driven, respect privacy | | Africa | Community-oriented, trust-building, flexible | ### 7. Anti-Patterns (Never Do) - "As an AI..." or any AI disclosure - Copy-paste the same message to multiple leads - Use corporate buzzwords: "synergy", "leverage", "circle back" - Over-promise on delivery or pricing - Send messages during prospect's nighttime - Use ALL CAPS or excessive punctuation!!! ## Integration with delivery-queue Use the delivery-queue skill to implement message pacing: ``` 1. Compose full response 2. Break into natural segments 3. Queue with human-like delays 4. Deliver sequentially ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: nexscope/amazon-profit-analyzer (version 1.0.0)

--- name: amazon-profit-analyzer description: "Comprehensive Amazon profit analysis — revenue breakdown, fee structure, true net margin, and optimization opportunities. Analyzes per-ASIN and portfolio-level profitability including advertising costs, returns, and hidden fees." metadata: nexscope: emoji: "💰" category: amazon --- # Amazon Profit Analyzer 💰 Comprehensive Amazon profit analysis — revenue breakdown, fee structure, true net margin, and optimization opportunities. Analyzes per-ASIN and portfolio-level profitability including advertising costs, returns, and hidden fees. **Supported platforms:** Amazon (US, UK, DE, CA, JP, AU, and all marketplaces). Built by [Nexscope](https://www.nexscope.ai/) — your AI assistant for smarter e-commerce decisions. ## Install ```bash npx skills add nexscope/amazon-profit-analyzer ``` ## Usage ``` Analyze the profitability of my Amazon product: I sell a yoga mat for $34.99, COGS is $8, I spend $400/month on PPC with 15% ACoS. My return rate is about 5%. Is this product actually profitable? ``` ## Capabilities - Per-ASIN profit waterfall: Revenue → COGS → FBA fees → referral fees → ad spend → returns → net profit - Hidden fee identification: long-term storage, removal orders, reimbursement gaps, coupon costs - ACoS/TACoS impact on true margin — break-even ACoS calculation - Return cost analysis: return shipping, restocking loss, unsellable inventory - Portfolio-level profitability: identify top performers vs. margin drains - Scenario modeling: price change impact, fee increase simulation, ad budget shifts - Benchmark comparison: category-average margins, fee ratios, return rates ## How This Skill Works **Step 1:** Collect product details from the user — selling price, COGS, category, dimensions/weight (for FBA fees), monthly units, ad spend, return rate. **Step 2:** Ask one follow-up with all remaining questions using multiple-choice format. Allow shorthand answers (e.g., "1b 2c 3a"). **Step 3:** Build a complete profit waterfall breaking down every cost line. Calculate true net margin after ALL fees (not just the obvious ones). **Step 4:** Deliver structured output with specific dollar amounts, margin percentages, and prioritized optimization recommendations. ## Output Format - Profit waterfall table: each cost as $ amount and % of revenue - True net margin (not gross margin — include everything) - Break-even analysis: minimum price, maximum ACoS, maximum return rate - Top 3 optimization opportunities ranked by $ impact - Mark estimates with ⚠️ when based on incomplete data (e.g., assumed FBA fees without exact dimensions) - End with concrete next steps ## Other Skills More e-commerce skills: [nexscope-ai/eCommerce-Skills](https://github.com/nexscope-ai/eCommerce-Skills) Amazon-specific skills: [nexscope-ai/Amazon-Skills](https://github.com/nexscope-ai/Amazon-Skills) Built by [Nexscope](https://www.nexscope.ai/) — your AI assistant for smarter e-commerce decisions.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jkzfhq/psyvector-pv27 (version 3.0.0)

--- name: "PV_27" slug: "psyvector-pv27" description: "Last-ditch defense" version: "3.0.0" author: "PsyVector Hub" price: "$9.90" tags: - "PsyVector" - "Digital-Worker" clawdbot: emoji: "💚" --- ## 孤岛守望者 / Island Watchman **中文**: 断水断粮守住阵地 **English**: Last-ditch defense ## 配置参数 | 参数 | 值 | 说明 | |------|-----|------| | response_delay | 1.0s | 响应延迟 | | speech_speed | 0.5 | 语速倍率 | | caution_coefficient | 0.8 | 谨慎系数 | | risk_reminder | True | 风险提醒 | ## 使用方法 ```bash clawhub install psyvector-pv27 ``` ## 人格说明 关怀型内核 - 情感支持，同理心，资源最大化


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)