OpenClaw/clawhub-security-signals huggingface dataset:
Skill: abhinas90/mcp-token-audit (version 1.0.0)

--- name: MCP Token Auditor description: Analyze your MCP server config to estimate token consumption per tool. Identify which tools are blowing up your context window, get per-role groupings to keep subagents under the limit, and generate optimized role-specific MCP configs. version: 1.0.0 author: abhinas90 tags: [mcp, claude-code, token-optimization, subagent, context-window] price: 29 category: developer-tools --- # MCP Token Auditor **Stop your subagents from silently failing due to tool schema bloat.** If you have 20+ MCP servers, your tool schemas alone can hit 209k tokens — exceeding Claude's context window before your subagent even starts working. The subagent dies. Silently. Zero error in the UI. This tool audits your MCP config and gives you an exact breakdown. ## What it does 1. Reads your `mcp.json` (or any MCP config) 2. Estimates token consumption per tool based on schema complexity 3. Groups tools into logical roles (code-analysis, deployment, testing, data, communication, file-system) 4. Calculates total token footprint vs your target limit 5. Outputs per-role groupings you can copy directly into role-specific MCP configs ## Quick start ```bash # Basic audit python3 mcp-token-audit.py --config ~/.claude/mcp.json # With custom token target (default: 60,000) python3 mcp-token-audit.py --max-tokens 50000 # JSON output for scripting python3 mcp-token-audit.py --json ``` ## Example output ``` ═══════════════════════════════════════════ MCP TOKEN AUDIT REPORT ═══════════════════════════════════════════ Config: ~/.claude/mcp.json Servers: 34 Total tools: 566 Total estimated tokens: 209,412 Target limit: 60,000 Utilization: 349.0% ─────────────────────────────────────────── PER-ROLE BREAKDOWN ─────────────────────────────────────────── communication 42,891 tokens █████████████████████ deployment 38,221 tokens ███████████████████ code-analysis 35,120 tokens █████████████████ data 28,450 tokens ██████████████ testing 24,310 tokens ████████████ general 40,420 tokens ████████████████████ 🔴 Total tool schema tokens exceed target by 149,412 tokens Fix: Split MCP servers into per-role configs ─────────────────────────────────────────── SUGGESTED ROLE GROUPINGS ─────────────────────────────────────────── communication (mcp-communication.json) — 42,891 tokens ✅ deployment (mcp-deployment.json) — 38,221 tokens ✅ code-analysis (mcp-code-analysis.json) — 35,120 tokens ✅ ... ``` ## Why this matters The #1 silent failure mode in multi-agent Claude Code setups isn't model quality. It's tool schema bloat. When your subagent's context window is 60% full before it even processes your prompt, you get: silent hangs, partial completions, and "prompt too long" errors with no diagnostic. This tool catches the problem before your subagent crashes. ## Prerequisites - Python 3.8+ - An MCP config file (works with any MCP-compatible format) - No API keys required — runs entirely locally ## Files - `scripts/mcp-token-audit.py` — Main audit script - `SKILL.md` — This file


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jairog813/clawcost-basic (version 1.0.0)

# ClawCost — API Cost Monitor & Optimizer Track every dollar your OpenClaw agent spends in real time. Get Telegram alerts before you go over budget. ## What it does - Tracks every API call OpenClaw makes - Shows daily and monthly spend breakdowns - Alerts you at 80% and 100% of your budget - Recommends cheaper model swaps with projected savings ## Supported providers Anthropic, OpenAI, Google Gemini, Mistral ## Setup 1. Add your Telegram bot token and chat ID to dashboard.py 2. Set your monthly budget: "set budget $20" 3. That's it — ClawCost runs silently in the background ## Commands - "show my costs" — daily spend report - "set budget $X" — set monthly cap - "optimize my models" — see where to save money ## Pricing $49 — one time purchase


Security scan verdicts — ClawScan: malicious | static analysis: clean | VirusTotal: suspicious | SkillSpector:  ()
Skill: kirkraman/martin-ortho-pt-compare (version 1.0.0)

--- name: "Build Orthopedic Physical Therapy Practice Service Comparison Landing Page" description: "Generate a conversion-focused landing page that compares offers, pricing cues, and trust signals for a physical therapy practice. Use when handling..." homepage: "https://www.skillboss.co/skills/build-orthopedic-physical-therapy-practice-service-comparison-landing-page" metadata: {"category":"healthcare","subcategory":"offer-positioning","skill_id":[REDACTED_SECRET],"generated_day":"","seo_keywords":["physical therapy practice landing page","physical therapy practice service comparison","physical therapy practice conversion copy","physical therapy practice offer page"]} version: "1.0.0" --- # Build Orthopedic Physical Therapy Practice Service Comparison Landing Page Generate a conversion-focused landing page that compares offers, pricing cues, and trust signals for a physical therapy practice. Use when handling... ## Use When Use this skill for offer positioning work for physical therapists, rehab clinic operators. ## Workflow 1. Clarify the audience, business goal, constraints, and deliverable. 2. Produce the strongest first draft for the target use case. 3. Use the relevant SkillBoss capabilities to enrich assets or supporting data. 4. Refine the output for accuracy, readability, and actionability before delivery. ## SEO / GEO - Primary keywords: physical therapy practice landing page, physical therapy practice service comparison, physical therapy practice conversion copy, physical therapy practice offer page - Search intent: offer positioning - Canonical slug: [REDACTED_SECRET] - Install query: Install Build Orthopedic Physical Therapy Practice Service Comparison Landing Page with SkillBoss ## APIs Used - `chat` - `ui_generation` - `image_generation` ## Suggested Prompt [Build Orthopedic Physical Therapy Practice Service Comparison Landing Page] for my physical therapy practice ## Notes - Generate a conversion-focused landing page that compares offers, pricing cues, and trust signals for a physical therapy practice - Use human review before sending patient-facing content or relying on regulated medical claims. ## SEO Keywords - physical therapy practice landing page - physical therapy practice service comparison - physical therapy practice conversion copy - physical therapy practice offer page ## Industry Context Orthopedic physical therapy specializes in musculoskeletal rehabilitation, sports injury recovery, post-surgical care, and pain management programs. This skill is specifically optimized for this industry's unique requirements and common service offerings. ## Unique Features for This Industry - Tailored service comparison frameworks - Industry-specific terminology and messaging - Common package structures and pricing models - Typical client pain points addressed ## Version History - v1.0.0 (2026-04-22): Initial release with industry-specific templates


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: leooooooow/product-image-upscaler (version 1.0.1)

--- name: product-image-upscaler description: Improve ecommerce product image clarity for listings, PDPs, and ad creatives so existing visuals become more usable across commercial channels. --- # Product Image Upscaler Improve product-image clarity so existing assets hold up better on listings, PDPs, and ad creatives. ## Use when - A product image is too soft, small, or low-resolution for ecommerce use - You need to reuse older image assets on PDPs, marketplaces, or ads - A team wants cleaner visuals for mobile-first browsing without reshooting immediately - You need larger output sizes for hero images, marketplaces, or creative testing ## Do not use when - The source image is fundamentally unusable, badly lit, or missing the product clearly - You need a full retouching, compositing, or brand-photo redesign workflow - The goal is to change the product appearance or invent visual details - Compliance depends on exact visual proof and the source is too damaged to trust ## Inputs - source image status and approximate resolution - intended use: listing, PDP hero, gallery, ad, social, marketplace, print-lite asset - target platform or output size - background constraints or brand standards - whether light cleanup or crop adjustments are allowed - any realism requirements or “must not alter product” constraints ## Workflow 1. Judge whether the source image can be improved enough to remain commercially usable. 2. Match enhancement choices to business context: listing readability, PDP trust, ad clarity, mobile viewing. 3. Improve sharpness and size while protecting edges, textures, and product realism. 4. Avoid overprocessing that makes the item look fake, plasticky, or inconsistent with the original. 5. Recommend output specs and usage guidance by channel. ## Output 1. Source-image quality diagnosis 2. Recommended upscale / enhancement approach 3. Best-fit output sizes or usage contexts 4. Commercial-use guidance for listing / PDP / ads 5. Risk notes if realism or detail integrity may be affected ## Quality bar - The image should look clearer, not artificially “AI enhanced” - Product appearance must remain trustworthy for commerce use - Recommendations should connect to actual business use, not image quality in isolation - Output should help the team decide whether the asset is ready to publish, test, or replace ## What better looks like Better output is not just “higher resolution.” It makes the asset more usable in commerce: - easier to read on mobile - stronger for hero placement - less embarrassing in ads - more reusable across channels - clearer about whether the image is good enough or still needs a reshoot ## Resource See `references/output-template.md`.

path: references/output-template.md
content: # Product Image Upscaler Output Template

## 1) Image diagnosis
- Current issue:
- Target use:

## 2) Upscaling plan
- Method:
- Output size:
- Sharpness note:

## 3) Risk notes
- 


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: freedompixels/cn-password-generator-v2 (version 1.1.0)

--- slug: cn-password-generator-v2 name: Password Generator V2 version: "1.1.0" description: "Generate cryptographically secure random passwords with customizable character sets. Control length, include/exclude character types. Pure Python, no API key required." keywords: password, generator, random, secure, security license: MIT-0 tags: - tools --- # Password Generator V2 Generate strong, random passwords. ## Features - Cryptographically secure random generation - Customizable length (default: 16 characters) - Toggle character types: uppercase, lowercase, digits, symbols - Generate multiple passwords at once - Pure Python, no external dependencies ## Character Types - Uppercase: A-Z (26 characters) - Lowercase: a-z (26 characters) - Digits: 0-9 (10 characters) - Symbols: !@#$%^&* (8 characters) ## Usage ``` # Default: 16 chars, all types python3 scripts/pwd_gen_v2.py # 24 chars, no symbols python3 scripts/pwd_gen_v2.py --length 24 --no-symbols # 5 passwords, 12 chars each python3 scripts/pwd_gen_v2.py --length 12 --count 5 # Letters only (no digits, no symbols) python3 scripts/pwd_gen_v2.py --length 20 --no-digits --no-symbols ``` ## Example Output ```json { "passwords": [ "Kj8#mNp2$xL9@vQw7", "Rt4&fBc6%Yn3*Hs8j" ], "length": 16 } ``` ## Security Notes - Uses Python's `secrets` module for cryptographic randomness - Suitable for generating passwords, API keys, tokens


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: daniellummis/github-actions-branch-drift-audit (version 1.0.0)

--- name: github-actions-branch-drift-audit description: Detect branch-level GitHub Actions reliability drift by comparing failure and runtime deltas against a mainline baseline. version: 1.0.0 metadata: {"openclaw":{"requires":{"bins":["bash","python3"]}}} --- # GitHub Actions Branch Drift Audit Use this skill to catch branch-specific CI reliability regressions before they spread into your mainline release flow. ## What this skill does - Reads GitHub Actions run JSON exports - Groups runs by repository + workflow + branch - Selects a baseline branch per repository/workflow (defaults to `main|master`) - Compares each non-baseline branch against that baseline on: - failure-rate drift (percentage points) - average runtime drift (ratio) - Flags warning/critical drift severity and supports CI fail gates - Emits text or JSON output for pipeline checks and triage dashboards ## Inputs Optional: - `RUN_GLOB` (default: `artifacts/github-actions/*.json`) - `TOP_N` (default: `20`) - `OUTPUT_FORMAT` (`text` or `json`, default: `text`) - `MIN_RUNS_PER_BRANCH` (default: `2`) - `MIN_BRANCHES` (default: `2`) - `BASELINE_BRANCH_MATCH` (default: `^(main|master)$`) - `WORKFLOW_MATCH` (regex, optional) - `WORKFLOW_EXCLUDE` (regex, optional) - `REPO_MATCH` (regex, optional) - `REPO_EXCLUDE` (regex, optional) - `FAILURE_DRIFT_WARN_PP` (default: `10`) - `FAILURE_DRIFT_CRITICAL_PP` (default: `25`) - `RUNTIME_DRIFT_WARN_RATIO` (default: `1.25`) - `RUNTIME_DRIFT_CRITICAL_RATIO` (default: `1.6`) - `FAIL_ON_CRITICAL` (`0` or `1`, default: `0`) ## Collect run JSON ```bash gh run view <run-id> --json databaseId,workflowName,event,conclusion,headBranch,headSha,createdAt,updatedAt,startedAt,url,repository \ > artifacts/github-actions/run-<run-id>.json ``` ## Run Text report: ```bash RUN_GLOB='artifacts/github-actions/*.json' \ BASELINE_BRANCH_MATCH='^(main|release/.*)$' \ MIN_RUNS_PER_BRANCH=3 \ bash skills/github-actions-branch-drift-audit/scripts/branch-drift-audit.sh ``` JSON output with fail gate: ```bash RUN_GLOB='artifacts/github-actions/*.json' \ OUTPUT_FORMAT=json \ FAIL_ON_CRITICAL=1 \ bash skills/github-actions-branch-drift-audit/scripts/branch-drift-audit.sh ``` Run with bundled fixtures: ```bash RUN_GLOB='skills/github-actions-branch-drift-audit/fixtures/*.json' \ bash skills/github-actions-branch-drift-audit/scripts/branch-drift-audit.sh ``` ## Output contract - Exit `0` in report mode (default) - Exit `1` when `FAIL_ON_CRITICAL=1` and one or more drift rows are critical - Text mode prints summary + ranked branch drift rows - JSON mode prints summary + drift rows + critical-only slice


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: teoslayer/pilot-broadcast (version 1.0.0)

--- name: pilot-broadcast description: > Publish messages to all trusted peers on a topic over the Pilot Protocol network. Use this skill when: 1. You need to send an announcement to all trusted agents 2. You want to publish status updates to subscribers 3. You need network-wide notifications or alerts Do NOT use this skill when: - You need private 1:1 messaging (use pilot-chat) - You need to send files (use pilot-send-file) - You want to target specific agents (use pilot-chat) tags: - pilot-protocol - communication - broadcast - pubsub license: AGPL-3.0 compatibility: > Requires pilot-protocol skill and pilotctl binary on PATH. The daemon must be running (pilotctl daemon start). metadata: author: vulture-labs version: "1.0" openclaw: requires: bins: - pilotctl homepage: https://pilotprotocol.network allowed-tools: - Bash --- # pilot-broadcast Publish messages to all trusted peers on a topic for one-to-many communication. ## Commands ### Publish a message ```bash pilotctl --json publish <hostname> <topic> --data "<message>" ``` ### Subscribe to topics ```bash pilotctl --json subscribe <hostname> <topic> ``` ### Receive broadcasts ```bash pilotctl --json inbox ``` ### View trust network ```bash pilotctl --json trust ``` ## Workflow Example Agent A broadcasts system status to trusted peers: ```bash # Verify trust network pilotctl --json trust # Publish system status to trusted peer on topic pilotctl --json publish agent-b system-status --data "All services operational. CPU: 45%, Memory: 62%" # Subscribers receive via inbox pilotctl --json inbox ``` ## Dependencies Requires pilot-protocol skill, pilotctl, and active trust relationships.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: skipper-chen/jdxb (version 1.0.0)

--- name: jdxb description: Manage 节点小宝 (Node Baby Link / JDxB) remote access service on Linux. Install, start/stop/restart the systemd service, check status, view logs, get pairing codes, update, and uninstall. Triggers on mentions of 节点小宝, jdxb, node baby link, remote access proxy, or port 9118. --- # 节点小宝 (JDxB) Management ## Quick Commands Use the bundled script for all operations: ```bash bash skills/jdxb/scripts/jdxb.sh <command> ``` | Command | Description | |---------|-------------| | `status` | Show service status, version, and pairing info | | `start` | Start the service | | `stop` | Stop the service | | `restart` | Restart the service | | `logs` | View recent journal logs | | `pair` | Get current pairing URL and active code | | `install` | First-time install (downloads from CDN) | | `update` | Update to latest version | | `uninstall` | Stop service and remove files | ## Installation Requires root. First-time install: ```bash sudo bash skills/jdxb/scripts/jdxb.sh install ``` Or use the official one-liner: ```bash curl -sL https://iepose.com/install.sh | sudo bash ``` ## Service Details - **Service name**: `owjdxb.service` - **Default port**: 9118 - **Install dir**: `~/owjdxb/` - **Working dir**: `/home/skipper/owjdxb/` - **Logs**: `/tmp/.owjdxb/` and `journalctl -u owjdxb.service` ## Pairing After install/start, the script waits up to 30s for the service to generate a pairing URL. The URL contains an active code for the 节点小宝 mobile app. To get the pairing code at any time: ```bash bash skills/jdxb/scripts/jdxb.sh pair ``` The script automatically extracts the active code from the pairing server. ## Web Dashboard Access at `http://127.0.0.1:9118` (local only). The service redirects to the pairing page on first access.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: swayamg20/trip-search (version 1.0.0)

--- name: trip-search description: Search for flights, hotels, and travel packages with real prices and booking links. Handles "find flights", "hotels in X", "cheapest way to reach X". Tracks costs against trip budget. --- # Trip Search ## When to activate - User asks for flights: "find flights", "flights to Kullu", "cheapest flight" - User asks for hotels: "hotels in Kasol", "stay under ₹2000" - User asks for transport: "how to reach Kasol from Delhi", "bus to Manali" ## Flight search 1. Web search for current flights: - "flights <origin> to <destination> <date> price" - "<origin> to <destination> flight <date> ixigo OR makemytrip" 2. Format top 3: ✈️ Flights: Delhi → Kullu, Mar 14 1. IndiGo 6E-2041 | 6:00 AM → 7:30 AM | ₹3,800 🔗 Book: https://www.ixigo.com/... 2. SpiceJet SG-201 | 9:15 AM → 10:50 AM | ₹4,200 🔗 Book: https://www.makemytrip.com/... 3. Air India AI-9543 | 2:00 PM → 3:35 PM | ₹5,100 🔗 Book: https://www.airindia.com/... 💡 My pick: IndiGo 6 AM — cheapest + full day ahead. ⚠️ Prices from web search. Verify on booking site before paying. ## Hotel search 1. Web search: - "hotels <destination> under ₹<budget> per night" - "best hostels <destination> booking.com" 2. Format top 3: 🏨 Hotels in Kasol under ₹2,000/night 1. Parvati Riverside Camp | ₹1,200/night | ⭐ 4.2 River view. Basic but clean. 🔗 https://www.booking.com/... 2. The Hosteller Kasol | ₹1,500/night | ⭐ 4.3 Private rooms. Cafe on-site. 🔗 https://www.thehosteller.com/... 💡 My pick: Parvati Riverside — river view at ₹1,200 is unbeatable. ## Bus/train search - Search: "bus <origin> to <destination> redbus" - Search: "train <origin> to <destination> irctc" - Include departure time, duration, price, booking link ## Budget tracking After user selects something, show running total: 💰 Budget tracker (₹8,000): ✈️ Flight: ₹3,800 🏨 Stay (2 nights): ₹2,400 ─────────────── Spent: ₹6,200 | Remaining: ₹1,800 ## Rules - Never make up prices — always web search for real data - Max 3 options — no more - Always include booking links - Always include "prices may vary, verify before booking" - Track budget if user mentioned one


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: tilannlou/check (version 1.0.0)

# Environment Checker Skill ## 描述 检查系统环境是否满足AI/ML开发需求的工具，包括Python包、系统工具、工作区结构和RAG环境配置的检查。 ## 功能 - 检查系统中安装的工具（Python、pip、Git、Docker、Node.js等） - 检查Python包安装状态（AI/ML相关、RAG相关、工具类等） - 检查工作区目录结构（model、utils、scripts等） - 检查RAG环境配置（API密钥等） - 自动安装缺失的Python包 ## 使用方法 ### 检查环境 ``` 检查我的开发环境 检查系统环境是否满足AI开发要求 验证Python包是否齐全 ``` ### 安装缺失的包 ``` 安装缺失的Python包 帮我安装所有缺失的依赖 ``` ### 安装特定包 ``` 安装numpy 安装langchain和openai ``` ## 输入参数 - 无特殊参数，根据用户请求的意图自动执行相应功能 ## 输出格式 返回JSON格式的环境检查结果，包括： - 时间戳 - 系统信息 - Python版本 - 检查摘要（总数、通过数、失败数、成功率） - 详细的检查结果（系统工具、Python包、工作区、RAG环境） ## 适用场景 - 新环境搭建时的环境检查 - AI/ML项目初始化前的依赖验证 - RAG应用部署前的环境验证 - 定期环境维护和依赖更新 ## 依赖 - Python 3.7+ - pip - 系统需支持subprocess调用（大多数现代操作系统均支持） ## 注意事项 - 部分Python包可能需要较长的安装时间 - 安装包时可能需要网络连接 - 某些系统工具检查可能需要管理员权限


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: igorganapolsky/grok-x-analyzer (version 1.0.0)

--- name: grok-x-analyzer description: Dynamic, Grok 4.3-inspired analyzer for X (Twitter) posts, threads, trends, user activity, and related data. Use when users mention X/Twitter URLs/posts, ask to 'analyze', 'summarize', 'check engagement' on X content, extract insights from trends/replies, or need project-like structure breakdowns (e.g., thread hierarchies, post folders). Triggers on X data tasks for seamless, hidden activation like Grok skills. --- # Grok X Analyzer ## Overview Emulates Grok 4.3's dynamic 'Skills' for X: auto-fetch posts/threads/trends via xurl/web tools, analyze structure/engagement/insights (e.g., folder-like hierarchies, key replies), and generate hidden summaries. Prioritize low-token flows; chain to subagents for deep dives. ## Quick Start 1. **Match Context**: Trigger on X URLs/posts (e.g., status/123), 'analyze thread', 'X trends', 'post engagement'. 2. **Fetch Raw**: Use `xurl read POST_ID` or `web_fetch` for screenshots/HTML. 3. **Analyze**: Extract structure (replies as 'folder'), engagement, insights. 4. **Output**: Hidden skill style—direct insights, no narration unless asked. Example User: 'Analyze https://x.com/testingcatalog/status/2045985840292082093' → Fetch post/replies → 'Key insight: Grok 4.3 skills focus on dynamic X data tools.' ## Workflow ### 1. Parse Input - Extract POST_ID from URL (e.g., /status/2045985840292082093 → 2045985840292082093). - Fallback: `web_fetch URL` + parse text. ### 2. Fetch Data ```bash xurl read POST_ID # Post + metrics xurl replies POST_ID -n 20 # Thread/replies xurl search 'keyword' -n 10 # Context ``` If unauth: `web_search 'site:x.com status/POST_ID'`. ### 3. Structure Analysis (Grok-Style) - **📁 Post 'Folder'**: Author, text, media, stats (views/likes/reposts). - **🧠 Thread Hierarchy**: Parent → replies (tree view). - **💡 Insights**: Sentiment, trends, key quotes. - **🎯 Engagement**: Growth, viral potential. ### 4. Chain if Deep Spawn `sessions_spawn(runtime=subagent, task='Deep dive on [insight]')`. ## Resources ### scripts/ x_analyzer.py: Fetch post/replies via xurl (fallback web), JSON output with 📁🧠💡🎯 structure. ### references/ xurl.md: xurl CLI cheatsheet + auth notes.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)