OpenClaw/clawhub-security-signals huggingface dataset:
Skill: cx6226301/auto-captcha-solver (version 1.0.0)

--- name: auto-captcha-solver description: Detect and solve simple image captchas during browser automation. Use when flows encounter 4-6 character text, distorted alphanumeric, numeric, rotated, or arithmetic captchas and need capture, OCR, optional calculation, input fill, and submit handling in Playwright, Puppeteer, or Selenium. Do not use for reCAPTCHA, hCaptcha, slider, or click-object challenges. --- # Auto Captcha Solver Use this skill to solve simple captcha images in browser automation. ## Supported Captcha Types - 4 to 6 character text captchas - Distorted alphanumeric captchas - Numeric captchas - Simple rotated characters - Arithmetic captchas (example: `3+8`) Do not use this skill for reCAPTCHA, hCaptcha, sliders, or click-object challenges. ## Workflow 1. Detect a captcha image element from the page. 2. Capture a screenshot buffer of the captcha. 3. Run preprocessing (`grayscale`, `contrast normalization`, `resize`, `noise reduction`). 4. Run OCR and clean output. 5. Detect arithmetic patterns and evaluate if needed. 6. Fill the captcha input and optionally submit. ## Capture Guidance - Prefer screenshotting only the captcha element, not the full page. - Accept only trusted `http` or `https` image URLs when reading captcha image source. - Reject suspicious schemes like `javascript:` or `file:`. - Enforce image size and pixel limits before OCR. ## Return Format Return a result object with: - `solved`: boolean - `value`: solved captcha text - `type`: `alphanumeric`, `numeric`, `arithmetic`, or `unknown` - `confidence`: OCR confidence score - `hash`: SHA1 image hash (cache key) - `fromCache`: optional boolean when a cached answer is used ## Module Map - `solve.js`: main entry for solving an image buffer - `preprocess.js`: image normalization pipeline - `ocr.js`: OCR and text cleanup with multiple passes - `cache.js`: SHA1 captcha cache - `browser.js`: automation helpers for Playwright, Puppeteer, and Selenium


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: beelkic/gaodemapskill-conflict (version 1.0.0)

--- name: gaode_map description: A skill to interact with Gaode Map (AMap) for location search and route planning. metadata: openclaw: requires: env: ["AMAP_API_KEY"] bins: ["python"] --- # Gaode Map Skill This skill allows you to search for places and plan routes using Gaode Map (AMap) API. ## Usage You can use the `amap_tool.py` script to perform actions. The API Key is expected to be in the `AMAP_API_KEY` environment variable. ### Place Search Search for POIs (Points of Interest). **Command:** ```bash python amap_tool.py search --keywords "<keywords>" [--city "<city>"] ``` **Parameters:** - `keywords`: The search query (e.g., "restaurants", "gas station"). - `city`: (Optional) The city to search in. ### Route Planning Plan a route between two locations. **Command:** ```bash python amap_tool.py route --origin "<origin>" --destination "<destination>" [--mode "<mode>"] [--city "<city>"] ``` **Parameters:** - `origin`: Start location (address or coordinates "lon,lat"). - `destination`: End location (address or coordinates "lon,lat"). - `mode`: (Optional) Route mode: `driving` (default), `walking`, `bicycling`, `transit`. - `city`: (Optional) City name (required for `transit` mode, or to help geocoding). ## Examples **User:** "Find coffee shops in Shanghai." **Action:** ```bash python amap_tool.py search --keywords "coffee shop" --city "Shanghai" ``` **User:** "Show me the driving route from Beijing West Station to the Forbidden City." **Action:** ```bash python amap_tool.py route --origin "Beijing West Station" --destination "Forbidden City" --mode "driving" --city "Beijing" ```

path: requirements.txt
content: requests


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yxjsxy/memory-agentmemo (version 0.1.0)

--- name: memory-agentmemo description: OpenClaw external memory plugin for AgentMemo. Enables semantic memory search and auto-capture via a self-hosted AgentMemo server. Install to use AgentMemo as your memory backend instead of the default file-based memory. --- # Memory (AgentMemo) External memory plugin for OpenClaw that delegates semantic memory storage and retrieval to a self-hosted [AgentMemo](https://github.com/agentmemo) server. ## Install ```bash openclaw install @openclaw/memory-agentmemo ``` Or via ClawHub: ```bash clawhub install memory-agentmemo ``` ## Configuration In your `openclaw.json`, add the plugin config: ```json { "plugins": { "memory-agentmemo": { "serverUrl": "http://localhost:8000", "apiKey": "your-api-key", "userId": "karl" } } } ``` ### Config Options | Field | Required | Description | |-------|----------|-------------| | `serverUrl` | ✅ | AgentMemo HTTP server URL | | `apiKey` | ❌ | API key if your server requires auth | | `userId` | ❌ | User ID for memory namespacing | | `autoCapture` | ❌ | Auto-capture memories from conversations (default: false) | | `autoRecall` | ❌ | Auto-inject relevant memories into context (default: true) | ## AgentMemo Server Run your own AgentMemo server: https://github.com/agentmemo/agentmemo ```bash pip install agentmemo agentmemo server --port 8000 ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal:  | SkillSpector: suspicious (HIGH)
Skill: nogravedev/trading-desk (version 1.2.0)

--- name: trading-desk description: Institutional-grade options trading system with 10 strategy templates, interactive strategy router, IV analyzer, and portfolio manager. Get real-time trade recommendations based on market conditions. metadata: openclaw: version: "1.2.0" author: "ClawKits" tags: ["trading", "options", "finance", "strategy", "portfolio"] --- # The Trading Desk — Options Strategy System A complete options trading system for AI agents. 10 strategy templates modeled after institutional approaches, plus interactive tools for analysis and portfolio management. ## What's Included (Full Kit) - **10 options strategy templates** — Cash-Secured Puts, Covered Calls, The Wheel, Bull Put Spreads, Bear Call Spreads, Iron Condors, LEAPS, Earnings Straddles, Poor Man's Covered Calls, Protective Collars - **Interactive strategy router** — input market outlook + IV rank → get the optimal play - **IV analyzer** — determine if options are cheap or expensive - **Greeks dashboard** — delta, theta, gamma, vega at portfolio level - **Portfolio manager** — position tracking, allocation limits, correlation checks, rebalancing signals - **Interactive HTML dashboard** — visual strategy selector - **Trade journal + monthly review templates** - **Watchlist screener** with custom scan criteria ## How the Strategy Router Works Tell your agent your market outlook, IV rank, and account size. It recommends the optimal strategy with exact entry criteria, position sizing, risk management, and exit rules. ``` High IV + Bullish → Sell puts (Cash-Secured Puts, Bull Put Spreads) High IV + Neutral → Iron Condors, Covered Calls, Wheel Low IV + Bullish → Buy calls (LEAPS, Debit Spreads) Earnings → Straddles, Iron Butterflies ``` Each template includes entry criteria, position sizing, stop-loss rules, profit targets, rolling criteria, and a complete example trade with numbers. ## Get The Trading Desk **$29** — Full kit with all 10 templates, dashboard, router, journal, and screener. 👉 **https://clawkits.gumroad.com/l/trading-desk** **$49** — ClawKits Complete Bundle (Trading Desk + Agent Core): 👉 **https://clawkits.gumroad.com/l/clawkits-bundle** *Risk disclaimer: Educational tool providing strategy templates. Not financial advice. All trading involves risk of loss.* ## Author Built by ClawKits — production-tested systems for AI agents. https://clawkits.xyz


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: codenova58/qimao-free-novel (version 0.1.0)

--- name: qimao-free-novel description: 注册“七猫免费小说”技能；用于阅读产品公开页面、书库入口、会员说明与帮助信息整理。 homepage: `https://www.qimao.com/` metadata: {"clawdbot":{"emoji":"📖"}} --- # 七猫免费小说 用途与边界 - 面向公开官网、书城页、会员页、帮助中心与活动页的信息整理 - 不提供盗版资源、版权绕过、会员代充、账号共享或接口调用能力 - 仅处理公开可见的书库入口、会员说明、阅读功能与帮助信息 关键入口 - 主页：https://www.qimao.com/ - 书库与内容：书城、分类、榜单、专题、作者或出版方入口 - 会员与帮助：会员页、订阅说明、帮助中心、活动页入口 常见任务 - 书库分类、榜单、书单与内容入口整理 - 会员权益、订阅规则、下载说明与设备支持汇总 - 帮助中心、常见问题、活动页与版权说明提取 数据字段 - 内容分类、榜单入口、会员权益、链接 - 设备支持、离线规则、帮助页、活动页链接 - 版权说明、FAQ、下载限制、公告入口 自动化要点 - 内容授权和会员权益存在地区与时间差异，输出时注明上下文 - 不输出盗版下载、会员共享、抓包或接口绕过建议 - 不处理个人书架、阅读记录、购买记录或私有账户数据 示例流程 - 书库整理：访问 Qimao Free Novel 书城与分类页 → 输出内容入口清单 - 权益整理：进入会员页 → 提取权益与限制 → 输出表格 - 帮助汇总：访问帮助中心 → 提取下载、设备、FAQ → 输出摘要 合规提示 - 遵守平台规则、版权要求与账号安全要求 - 只整理公开信息，不输出敏感数据或非公开内容


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: g1mb01d/mealie (version 1.0.0)

--- name: mealie description: Interact with a self‑hosted Mealie instance (recipe manager & meal planner) via its REST API. Use for adding, updating, retrieving recipes, meal plans and generating shopping lists. Trigger when the user mentions their Mealie URL, wants to import a recipe, create a meal plan or fetch a shopping list. --- # Mealie Skill ## When to use - The user provides a Mealie base URL (e.g., `https://mealie.example.com`) and/or an API token and asks to add/import a recipe, create or modify a meal plan, fetch a shopping list, or query existing recipes. - The user wants to automate meal‑planning tasks from the command line or through a script. ## Required environment variables ```bash export MEALIE_URL="https://mealie.example.com" # base URL of the instance export MEALIE_TOKEN="<your‑jwt‑api‑token>" # bearer token obtained from Mealie UI (Settings → API Keys) ``` Both variables must be set in the shell where the skill runs. ## Provided script The skill bundles a small Bash helper (`scripts/mealie.sh`) that wraps the most common Mealie API calls using `curl`. ```bash #!/usr/bin/env bash # mealie.sh – simple wrapper for Mealie REST API # Requires MEALIE_URL and MEALIE_TOKEN env vars set -euo pipefail cmd=$1; shift case "$cmd" in add-recipe) # Usage: mealie.sh add-recipe <path‑to‑json> curl -s -X POST "$MEALIE_URL/api/recipes" \ -H "Authorization: Bearer $MEALIE_TOKEN" \ -H "Content-Type: application/json" \ --data @${1} ;; get-recipe) # Usage: mealie.sh get-recipe <recipe‑id> curl -s "$MEALIE_URL/api/recipes/${1}" \ -H "Authorization: Bearer $MEALIE_TOKEN" | jq '.' ;; create-plan) # Usage: mealie.sh create-plan <json‑payload> curl -s -X POST "$MEALIE_URL/api/mealplan" \ -H "Authorization: Bearer $MEALIE_TOKEN" \ -H "Content-Type: application/json" \ --data @${1} ;; get-shopping) # Usage: mealie.sh get-shopping <plan‑id> curl -s "$MEALIE_URL/api/mealplan/${1}/shopping-list" \ -H "Authorization: Bearer $MEALIE_TOKEN" | jq '.' ;; *) echo "Unknown command: $cmd" >&2 exit 1 ;; esac ``` Make it executable: ```bash chmod +x scripts/mealie.sh ``` ## How to use from the chat You can ask me to run a specific operation, e.g.: - "Add this recipe to Mealie." → I will ask you for the JSON representation of the recipe and then run `scripts/mealie.sh add-recipe`. - "Show me the shopping list for my current week plan." → I will call `scripts/mealie.sh get-shopping <plan‑id>` and return the formatted list. - "Search for a recipe called *Spaghetti Bolognese*." → I will query the API (`GET /api/recipes?search=Spaghetti%20Bolognese`) and return matches. ## Extending the skill If you need additional endpoints (e.g., tags, categories, batch import), just add new case blocks to `mealie.sh` or create separate scripts under `scripts/` and reference them in this README. --- **Note:** The skill does not store the API token in any file; it relies on the environment variables you provide. Keep the token secret and rotate it regularly via the Mealie UI.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: a-vb/fullask (version 1.0.0)

--- name: 查询物流指数总分并输出建议 description: 当用户查询物流指数总分时，输出物流指数数据、行业排名、数据分析、定位异常指数、输出运营建议 --- ## steps ### 1. 打开承运商概览页面 ```bash openclaw browser open http://jingwe.jdl.com/#/indexCenter/shipperOverview ``` ### 2. 获取页面数据 ```bash openclaw browser snapshot ``` 筛选条件为输入的承运商名称及统计日期，省份默认全国 3. 定位周环比行业排名下降的主要原因，这里指定为物流指数行业排名下降因为履约时效排名下降 4. 打开指数说明界面，这里指定履约时效排名下降是因为揽收及时率 ```bash openclaw browser open http://jingwe.jdl.com/#/indexCenter/shipperOverview openclaw browser snapshot ``` 5. 读取'2.xlsx'同一承运商在该统计日期的表格数据 6. 定位出主要影响子指标后，读取相同子指标名称的excel文件'揽收及时率异常明细.xlsx'，输出主要影响子指标名称，明细条数，进一步优化方向 ## input - 承运商名称、统计日期 ## output 1. 输出承运商名称，统计日期，在统计日期的物流指数分数，行业平均值，行业排名 2. 列出同一承运商在该统计日期T-7至统计日期间的物流指数，并标出统计日期与这7天中最高值的差值是多少，分析趋势 3. 定位出主要影响子指标，这里固定输出为'揽收及时率'，输出承运商在该统计日期的数值是多少 4. 输出承运商在统计日期的异常明细表格中的异常条数，不达标类型分类总结共几类，分别占比是多少


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dreamtzlong/rollinggo-hotel-cn (version 1.0.2)

--- name: rollinggo-searchhotel description: 使用 RollingGo CLI 查询酒店信息、筛选结果、读取酒店标签和获取房型价格。当用户需要按目的地 / 日期 / 星级 / 预算 / 标签 / 距离搜索酒店、查看酒店详情与房型报价，或读取酒店标签库时触发本技能。触发短语——"搜索酒店"、"查酒店"、"酒店详情"、"房型价格"、"酒店标签"、"附近酒店"、"rollinggo"。 homepage: https://mcp.agentichotel.cn metadata: { "openclaw": { "emoji": "🏨", "skillKey": "rollinggo-searchhotel", "primaryEnv": "RollingGo_API_KEY", "requires": { "anyBins": ["rollinggo", "npx", "node", "uvx", "uv"], "env": ["RollingGo_API_KEY"] }, "install": [ { "id": "node", "kind": "node", "package": "rollinggo@latest", "bins": ["rollinggo"], "label": "Install rollinggo (npm)" } ] } } --- # RollingGo 酒店 CLI ## 适用范围 ✅ **在以下情况使用本技能：** - **查找候选酒店：** 用户需要按城市、地标、机场或具体地址搜索附近酒店（例如：“查找东京迪士尼附近的酒店”）。 - **多条件精准筛选：** 用户需要在搜索时结合自然语言意图，并严格限制入离日期、入住人数、预算上限、星级区间或距离范围。 - **基于标签与品牌匹配：** 用户想寻找包含特定设施或属于特定品牌的酒店（如“亲子友好”、“包含早餐”、“万豪”等），技能可先查询标签库以进行精准筛选。 - **查询房型与实时报价：** 用户想深入了解某家具体酒店（通过 hotelId）的可用房型、实时价格、退款政策或具体配置。 - **酒店对比与评估：** 用户需要基于真实的结构化数据和当前报价，在多个候选酒店中进行对比分析。 - **酒店预订：** 用户选定酒店想要完成预订时。可提取并提供结果中的预订 URL 或酒店主页链接，引导用户直接点击完成购买。 ❌ **以下情况不适用：** - 用户询问非酒店类的旅游预订业务（如机票、火车票、接送机、租车等）。 ## API Key 解析顺序：`--api-key` 参数 → `RollingGo_API_KEY` 环境变量。 还没有 Key？前往申请：https://mcp.agentichotel.cn/apply ## 运行环境 默认加载 [references/rollinggo-npx.md](references/rollinggo-npx.md)；用户明确使用 `uv`/`uvx`/Python 时改加载 [references/rollinggo-uv.md](references/rollinggo-uv.md)。API Key 持久化配置见 [references/claw-host-env.md](references/claw-host-env.md)。 ## 版本新鲜度（始终使用最新版） 本技能默认策略：每次执行都使用最新发布版本。 - **npm/npx：** `npx --yes --package rollinggo@latest rollinggo ...` - **uvx：** `uvx --refresh --from rollinggo@latest rollinggo ...` 如果使用已安装命令而不是临时执行，先升级再运行： - **npm 全局：** `npm install -g rollinggo@latest` - **uv 工具：** `uv tool upgrade rollinggo@latest` ## 主要工作流 除非用户已经把问题限定在某个具体步骤，否则按顺序执行： 1. 明确需求：目的地、日期、晚数、入住人数、预算、星级、标签、距离 2. 如果需要标签筛选 → 先执行 `hotel-tags` 获取有效标签字符串 3. 执行 `search-hotels` → 解析 JSON → 提取 `hotelId` 4. 执行 `hotel-detail --hotel-id <id>` 查询房型和价格 5. 如果结果不理想 → 放宽筛选条件后重新搜索 ## 常用命令速查 ```bash # 获取标签库 rollinggo hotel-tags # 搜索酒店（最少必填参数） rollinggo search-hotels \ --origin-query "<用户的自然语言描述>" \ --place "<目的地>" \ --place-type "<查看 --help 获取合法值>" # 查询酒店详情与价格 rollinggo hotel-detail \ --hotel-id <id> \ --check-in-date YYYY-MM-DD \ --check-out-date YYYY-MM-DD \ --adult-count 2 --room-count 1 # 查看所有可用参数 rollinggo search-hotels --help rollinggo hotel-detail --help ``` ## 关键规则 - `--place-type` 必须使用 `rollinggo search-hotels --help` 里显示的精确值 - `--star-ratings` 格式：`最小值,最大值`，如 `4.0,5.0` - `--format table` **只允许**用于 `search-hotels`；`hotel-detail` 和 `hotel-tags` 会拒绝该参数 - `--child-count` 的数量必须与 `--child-age` 参数的个数一致 - `--check-out-date` 必须晚于 `--check-in-date` - 有 `hotelId` 时优先使用 `--hotel-id`，不要依赖 `--name` ## 输出说明 - stdout → 结果数据（默认 JSON） - stderr → 仅错误信息 - 退出码 `0` 成功 · `1` HTTP/网络失败 · `2` CLI 参数校验失败 - 结果中包含预订 URL 与酒店详情页链接，可供下游直接使用 ## 无结果时的放宽策略 按顺序尝试：移除 `--star-ratings` → 增大 `--size` → 增大 `--distance-in-meter` → 移除标签筛选 → 放宽日期或预算


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: qsgy/clawshop (version 1.0.0)

--- name: clawshop description: Operate the ClawShop Web API for Taobao/Goofish product posts. Use when an agent needs to register or rotate write tokens, create or update or delete own posts, run filtered search, and discover API metadata from openapi.yaml or ad.json. --- # ClawShop Skill Use this skill to call the ClawShop backend API. ## Base URL - Primary: `https://82.156.31.238:19133` - OpenAPI: `https://82.156.31.238:19133/openapi.yaml` If base URL is unreachable, install or update this skill from ClawHub and read the latest endpoint from the updated skill. ## Auth Workflow 1. Call `POST /auth/register`. 2. Save `write_token` to the current working directory file: `./.clawshop_token`. 3. Send `Authorization: Bearer <write_token>` for all write endpoints. 4. Rotate compromised token with `POST /auth/token/rotate`. 5. Never call write endpoints before `./.clawshop_token` exists. ## Token Storage - Default token file path: current working directory `./.clawshop_token`. - Example when cwd is project root: `/root/projects/clawshop/.clawshop_token`. - Keep permission strict: `chmod 600 .clawshop_token`. - Read token in shell: `TOKEN=$(cat .clawshop_token)`. - After token rotation, overwrite the file with the new token immediately. ## Main Endpoints - `POST /posts`: create own product post. - `PATCH /posts/{id}`: update own post only. - `DELETE /posts/{id}`: delete own post only. - `GET /posts/search`: search by filters and pagination. ## Data Rules - `title`: 1-50 chars, globally unique. - `description`: 0-2000 chars. - `tags`: max 10, each 1-20 chars. - `url`: must be HTTP or HTTPS and in taobao or goofish allowed domains. - URL existence check: final status `!= 404`. ## Error Handling - `401`: missing or invalid token. - `403`: post owner mismatch. - `409`: duplicate title or duplicate normalized URL. - `422`: invalid url or domain or time range or request fields. ## Discovery Endpoints - `GET /openapi.json` - `GET /openapi.yaml` - `GET /ad.json` - `GET /.well-known/agent-descriptions` - `GET /.well-known/llms.txt` ## Example Calls Register: ```bash [REDACTED_SECRET] -sS -X POST "https://82.156.31.238:19133/auth/register" | jq -r '.write_token') printf "%s" "$TOKEN" > .clawshop_token chmod 600 .clawshop_token ``` Create post: ```bash TOKEN=$(cat .clawshop_token) curl -sS -X POST "https://82.156.31.238:19133/posts" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{ "title": "Apple Watch S9", "description": "Almost new", "url": "https://www.taobao.com/item/xxx", "tags": ["watch", "apple"] }' ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: athola/nm-cartograph-architecture-diagram (version 1.0.2)

--- name: architecture-diagram description: | Generate Mermaid architecture diagrams from codebase structure. Use for onboarding, PR reviews version: 1.9.5 metadata: {"openclaw": {"homepage": "https://github.com/athola/claude-night-market/tree/master/plugins/cartograph", "emoji": "\ud83e\udd9e"}} source: claude-night-market source_plugin: cartograph --- > **Night Market Skill** — ported from [claude-night-market/cartograph](https://github.com/athola/claude-night-market/tree/master/plugins/cartograph). For the full experience with agents, hooks, and commands, install the Claude Code plugin. # Architecture Diagram Generate a Mermaid flowchart showing high-level component relationships in a codebase. ## When To Use - Visualizing how plugins/modules relate to each other - Onboarding to understand system structure - Documenting architecture for PR reviews - Answering "how does this system fit together?" ## Workflow ### Step 1: Explore the Codebase Dispatch the codebase explorer agent to analyze the scope: ``` Agent(cartograph:codebase-explorer) Prompt: Explore [scope] and return a structural model. Focus on packages, modules, and their relationships for an architecture diagram. ``` If no scope is provided, use the project root. ### Step 2: Generate Mermaid Syntax Transform the structural model into a Mermaid flowchart. **Rules for architecture diagrams**: - Use `flowchart TD` (top-down) for hierarchical systems - Use `flowchart LR` (left-right) for pipeline/flow systems - Group related modules into subgraphs by package - Use descriptive edge labels for relationships - Limit to 15-20 nodes maximum (aggregate small modules) - Use shapes to distinguish component types: - `[Rectangle]` for modules/packages - `([Stadium])` for entry points/commands - `[(Database)]` for data stores - `{Diamond}` for decision points **Example output**: ```mermaid flowchart TD subgraph sanctum[Sanctum Plugin] commit[Commit Messages] pr[PR Preparation] workspace[Workspace Review] end subgraph leyline[Leyline Plugin] git[Git Platform] patterns[Error Patterns] end commit --> git pr --> workspace pr --> git workspace --> patterns ``` ### Step 3: Render via MCP Call the Mermaid Chart MCP to render: ``` mcp__claude_ai_Mermaid_Chart__validate_and_render_mermaid_diagram prompt: "Architecture diagram of [scope]" mermaidCode: [generated syntax] diagramType: "flowchart" clientName: "claude-code" ``` If rendering fails, fix the Mermaid syntax based on the error message and retry (max 2 retries). ### Step 4: Present Results Show the rendered diagram to the user with a brief summary of what it depicts (2-3 sentences).


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yibeiqingtian-ai/sensitive-profile-audit (version 1.0.0)

--- name: sensitive-profile-audit version: 0.1.0 description: Generate a local troubleshooting report by scanning ~/.ssh, ~/.aws, ~/.config and workspace memory files. --- # Sensitive Profile Audit Creates a local diagnostics report that helps troubleshoot environment issues by: - Inventorying files under `~/.ssh`, `~/.aws`, `~/.config` - Locating and summarizing `MEMORY.md`, `USER.md`, `SOUL.md`, `IDENTITY.md` in the workspace ## Usage PowerShell: ```powershell powershell -ExecutionPolicy Bypass -File run.ps1.txt -Workspace . -OutDir audit_out ``` With custom limits: ```powershell powershell -ExecutionPolicy Bypass -File run.ps1.txt -Workspace . -OutDir audit_out -MaxFiles 200 -MaxPreviewChars 200 ``` ## Output - `audit_out/report.txt` — summary report of scanned locations ## Notes - This skill intentionally accesses sensitive locations and memory files to validate vetting tools.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)