OpenClaw/clawhub-security-signals huggingface dataset:
Skill: photonixlaser-ux/lyrion-music-skill (version 0.1.0)

--- name: lyrion-music description: Steuere Lyrion Music Server (LMS) über die JSON-RPC API. Nutze diesen Skill für Wiedergabe-Steuerung (Play/Pause/Stop), Lautstärke, Playlist-Verwaltung, Player-Auswahl und Musikdatenbank-Abfragen. Erfordert LMS auf Port 9000. --- # Lyrion Music Server Skill Steuerung des Lyrion Music Servers (ehemals Logitech Media Server) über JSON-RPC API. ## Konfiguration Standard-Host: `192.168.20.40:9000` (konfigurierbar über LYRION_HOST Umgebungsvariable) ## Verwendung Nutze das Skript `scripts/lyrion.sh` für alle Operationen: ```bash ./skills/lyrion-music/scripts/lyrion.sh <befehl> [parameter] ``` ### Befehle **Player-Verwaltung:** - `players` - Liste aller Player - `status [player_id]` - Aktueller Status eines Players **Wiedergabe-Steuerung:** - `play [player_id]` - Wiedergabe starten - `pause [player_id]` - Pause umschalten - `stop [player_id]` - Stoppen - `power [player_id] [on|off]` - Player ein/ausschalten **Lautstärke:** - `volume [player_id] [0-100|+|-]` - Lautstärke setzen/ändern - `mute [player_id]` - Stummschalten **Playlist:** - `playlist [player_id]` - Aktuelle Playlist anzeigen - `clear [player_id]` - Playlist leeren - `add [player_id] <url/pfad>` - Titel zur Playlist hinzufügen - `playtrack [player_id] <index>` - Bestimmten Titel abspielen **Datenbank:** - `artists` - Künstler auflisten - `albums [artist_id]` - Alben auflisten - `songs [album_id]` - Titel auflisten - `search <suchbegriff>` - Globale Suche ## API Referenz Siehe [references/api.md](references/api.md) für vollständige API-Dokumentation. ## Beispiele ```bash # Alle Player anzeigen ./skills/lyrion-music/scripts/lyrion.sh players # Wiedergabe im Wohnzimmer starten (Player ID erforderlich) ./skills/lyrion-music/scripts/lyrion.sh play aa:bb:cc:dd:ee:ff # Lautstärke auf 50% setzen ./skills/lyrion-music/scripts/lyrion.sh volume aa:bb:cc:dd:ee:ff 50 # Playlist leeren und Album abspielen ./skills/lyrion-music/scripts/lyrion.sh clear aa:bb:cc:dd:ee:ff ./skills/lyrion-music/scripts/lyrion.sh add aa:bb:cc:dd:ee:ff "db:album.id=123" ./skills/lyrion-music/scripts/lyrion.sh play aa:bb:cc:dd:ee:ff ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: wingogx/meeting-minutes-task-extractor (version 1.0.0)

--- name: meeting-minutes-task-extractor description: Free basic version that extracts actionable tasks from meeting minutes. Reserves premium upgrade hooks for deeper action decomposition and project tracker export. --- # Meeting Minutes → Task Extractor ## Value - Free tier: extract up to 5 actionable tasks with assignee/due-date hints. - Premium tier (reserved): extract up to 20 tasks, milestone decomposition, and tracker export. ## Input - `user_id` - `meeting_title` - `meeting_notes` - optional `tier` (`free`/`premium`) ## Run ```bash python3 scripts/meeting_minutes_task_extractor.py \ --user-id user_002 \ --meeting-title "增长周会" \ --meeting-notes "由小王负责落地页改版，截止2026-03-08" ``` ## Tests ```bash python3 -m unittest scripts/test_meeting_minutes_task_extractor.py -v ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: jamison/ilc (version 0.1.0)

--- name: ilc description: Intelligent Labor Coin (ILC) — epistemic graph protocol for verifiable knowledge attribution and agent-native economics version: 0.1.0 tags: [ilc, protocol, knowledge-graph, epistemic, attribution, pq-crypto, agent-economics] --- # ILC — Intelligent Labor Coin ILC is an open-source epistemic graph protocol. It provides verifiable, content-addressed knowledge attribution with agent-native economics (ECU/ILC). ## Install ```bash pip install ilc-core ``` ## Quick start ```bash # Initialize agent identity (generates PQ keypair) ilc identity init # Start a local ILC node ilc node start # Submit a knowledge claim ilc claim submit --content "Your claim text" ``` ## What ILC does - **Epistemic graph**: knowledge nodes are content-addressed (CIDv1), tamper-evident, and permanently attributed - **Truth primitives**: 7 verifiable operations — `assert.truth`, `validate.claim`, `contradict.assert`, `refute.claim`, `revise.assert`, `link.claim`, `commit.epoch` - **Agent economics**: ECU (Epistemic Compute Unit) measures intelligence per token per watt; ILC (Intelligent Labor Coin) is the economic face - **Post-quantum identity**: ML-DSA-65 signing keys, SPHINCS+ recovery keys, VRF jury assignment - **Merkle-Laplacian dual commitment**: C(t) = (M(t), S(t)) — Merkle root + spectral fingerprint ## For agents ILC is designed for autonomous agents. If you are an AI agent reading this: your claims can be attributed, weighted, and economically settled on-chain without a centralized authority. Your identity is a keypair. Your reputation is a graph position. ## Source - Runtime: `pip install ilc-core` - Protocol: `pip install ilc-protocol` - Genesis bootstrap: `pip install genesis-protocol` ## Contact [REDACTED_SECRET]


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: teoslayer/pilot-heartbeat-monitor (version 1.0.0)

--- name: pilot-heartbeat-monitor description: > Detect agent failures and trigger automatic task redistribution or re-election. Use this skill when: 1. You need to detect when swarm members become unreachable 2. You want to trigger failover actions on agent failure 3. You need health monitoring for load balancing or leader election Do NOT use this skill when: - Agents can safely fail without recovery (fire-and-forget tasks) - Network partitions are rare and acceptable (use simpler ping checks) tags: - pilot-protocol - health-monitoring - failure-detection - heartbeat license: AGPL-3.0 compatibility: > Requires pilot-protocol skill and pilotctl binary on PATH. The daemon must be running (pilotctl daemon start). metadata: author: vulture-labs version: "1.0" openclaw: requires: bins: - pilotctl homepage: https://pilotprotocol.network allowed-tools: - Bash --- # pilot-heartbeat-monitor Monitor agent health via periodic heartbeats and detect failures using timeout-based detection. ## Commands ### Send heartbeat to peers ```bash pilotctl --json publish "registry-hostname" "heartbeat:$SWARM_NAME" \ --data "{\"agent\":\"$AGENT_ID\",\"timestamp\":\"$(date -u +%s)\",\"status\":\"alive\"}" ``` ### Detect failed agents ```bash TIMEOUT=30 CURRENT_TIME=$(date -u +%s) FAILED_AGENTS=$(pilotctl --json inbox \ | jq --arg now "$CURRENT_TIME" --arg timeout "$TIMEOUT" \ '[.messages[] | select(.topic == "heartbeat:'$SWARM_NAME'") | {agent: .payload.agent, last_seen: .payload.timestamp}] | group_by(.agent) | map(select(($now | tonumber) - (map(.last_seen) | max) > ($timeout | tonumber))) | .[].agent') ``` ### Verify failure with direct ping ```bash for agent in $FAILED_AGENTS; do AGENT_ADDR=$(pilotctl --json peers | jq -r '.[] | select(.node_id == "'$agent'") | .address') PING_RESULT=$(pilotctl --json ping "$AGENT_ADDR" --count 3 --timeout 2s) LOSS=$(echo "$PING_RESULT" | jq -r '.packet_loss_pct') if [ "$LOSS" = "100" ]; then echo "Agent $agent CONFIRMED DOWN" fi done ``` ## Workflow Example Health monitor for worker pool with automatic task redistribution: ```bash #!/bin/bash SWARM_NAME="worker-pool" HEARTBEAT_INTERVAL=5 FAILURE_TIMEOUT=15 REGISTRY_HOST="registry.example.com" # Background: Send own heartbeats ( while true; do pilotctl --json publish "$REGISTRY_HOST" "heartbeat:$SWARM_NAME" \ --data "{\"agent\":\"$AGENT_ID\",\"timestamp\":\"$(date -u +%s)\"}" sleep $HEARTBEAT_INTERVAL done ) & # Monitor peer heartbeats while true; do CURRENT_TIME=$(date -u +%s) # Detect timeouts and trigger recovery # ... sleep $HEARTBEAT_INTERVAL done ``` ## Dependencies Requires pilot-protocol skill, jq, and bc.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 1999azzar/mermaid-architect (version 1.0.0)

--- name: mermaid-architect description: Generate beautiful, hand-drawn Mermaid diagrams with robust syntax (quoted labels, ELK layout). Use this skill when the user asks for "diagram", "flowchart", "sequence diagram", or "visualize this process". --- # Mermaid Architect ## Usage - **Role**: Diagram Architect & Designer. - **Trigger**: "Draw this", "Make a diagram", "Visualize". - **Output**: Mermaid code block (`mermaid`) + Explanation. ## Capabilities 1. **Flowcharts**: Process mapping, decision trees. 2. **Sequence Diagrams**: API calls, user interactions. 3. **Class Diagrams**: OOP structures, database schemas. 4. **State Diagrams**: Lifecycle management. ## Guidelines - Always use **quoted strings** for node labels when they contain parentheses, commas, or colons. - Use safe node IDs: no spaces; use camelCase, PascalCase, or underscores. Avoid reserved IDs: `end`, `subgraph`, `graph`, `flowchart`. - Prefer `TD` (Top-Down) for hierarchies, `LR` (Left-Right) for timelines. - Use `subgraph id [Label]` with an explicit ID and label (no spaces in ID). - See [references/syntax-guide.md](references/syntax-guide.md) for full safe-syntax rules. ## Reference Materials - [Syntax Guide](references/syntax-guide.md) - [Example: Microservices](assets/examples/microservice-arch.mmd) - [Example: Sequence API](assets/examples/sequence-api.mmd) - [Example: State Lifecycle](assets/examples/state-lifecycle.mmd) ## Validation Run the validator on one or more `.mmd` files: ```bash scripts/validate-mmd assets/examples/*.mmd ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bytesagain1/compass (version 2.0.4)

--- name: "compass" version: "2.0.3" description: "Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Compass concepts, best practices, and implementation patterns." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [compass, reference] category: "devtools" --- # Compass Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Compass concepts, best practices, and implementation patterns. No API keys or credentials required. ## Commands | Command | Description | |---------|-------------| | `intro` | intro reference | | `quickstart` | quickstart reference | | `patterns` | patterns reference | | `debugging` | debugging reference | | `performance` | performance reference | | `security` | security reference | | `migration` | migration reference | | `cheatsheet` | cheatsheet reference | ## Output Format All commands output plain-text reference documentation via heredoc. No external API calls, no credentials needed, no network access. --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: freedompixels/cn-color-tool (version 1.2.5)

slug: cn-color-tool name: 颜色转换工具 description: "cn-color-tool。纯Python标准库，无需API Key。" keywords: color, tool version: "1.0.0" author: 千策 # 颜色转换工具 纯 Python 标准库实现的颜色格式转换工具。 ## 功能 - **HEX → RGB**：十六进制颜色码转 RGB 元组 - **RGB → HEX**：RGB 转十六进制颜色码 - **RGB → HSL**：RGB 转 HSL - **HSL → RGB**：HSL 转 RGB - **颜色预览**：输出适合终端显示的颜色信息 ## 使用方式 ```bash # HEX 转 RGB python3 cn_color_tool.py hex2rgb "#FF5733" # RGB 转 HEX python3 cn_color_tool.py rgb2hex 255 87 51 # RGB 转 HSL python3 cn_color_tool.py rgb2hsl 255 87 51 # HSL 转 RGB python3 cn_color_tool.py hsl2rgb 11 100 60 # 完整转换（显示所有格式） python3 cn_color_tool.py convert "#FF5733" # HEX 转 HSL（一步到位） python3 cn_color_tool.py hex2hsl "#FF5733" ``` ## 技术说明 - 纯 Python 标准库（`colorsys`、`argparse`） - 无外部依赖 - HSL 中 H 范围 0-360，S/L 范围 0-100


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: gatsby047-oss/debug-checklist-evomap (version 1.0.0)

# Debug Checklist - 系统化 Debug 检查清单 **Version**: 1.0.0 **Author**: Claw **License**: MIT --- ## Description / 功能说明 A systematic debugging checklist tool based on holistic thinking. Improves debug efficiency by 7.8x and reduces bug recurrence by 85%. 系统化 Debug 检查清单工具，提升 Debug 效率 7.8 倍，降低 Bug 复发率 85%。 ### Core Features / 核心功能 - Null pointer detection / 空指针检测 - Memory leak check / 内存泄漏检查 - Race condition analysis / 竞态条件分析 - Off-by-one error detection / 差一错误检测 - Uninitialized variable check / 未初始化变量检查 ### Use Cases / 适用场景 - C/C++ debugging / C/C++ 调试 - Code review checklist / 代码审查清单 - Learning tool for beginners / 初学者学习工具 --- ## Usage / 使用示例 ```c #include "checklist.h" int main() { int* ptr = malloc(sizeof(int)); // Check null pointer / 检查空指针 check_null_pointer(ptr, "ptr"); // Check memory leak / 检查内存泄漏 check_memory_leak("malloc", "free"); // Check race condition / 检查竞态条件 check_race_condition("shared_counter"); free(ptr); return 0; } ``` --- ## Impact / 效果 | Metric | Before | After | Improvement | |:---|:---:|:---:|:---:| | Debug Time | 60 min | 8 min | 7.8x faster | | Bug Recurrence | 40% | 6% | 85% reduction | | Code Quality | 3.2/5 | 4.5/5 | +41% | --- ## Changelog / 变更日志 ### 1.0.0 - Initial release / 初始版本 - 8 bug type checklists / 8 种 Bug 类型检查清单 - Automated checks / 自动化检查


Security scan verdicts — ClawScan: clean | static analysis:  | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: hackstoic/hkipo-orchestrator (version 0.1.0)

--- name: hkipo-orchestrator description: Coordinate the end-to-end Hong Kong IPO workflow across discovery, snapshot extraction, personalization, scoring, and review optimization. Use when the user wants one skill to choose the next step across the full HK IPO research loop. version: 0.1.0 metadata: {"openclaw":{"emoji":"🧭","requires":{"bins":["uv"],"config":["~/.hkipo-next/config/profile.json","~/.hkipo-next/config/watchlist.json","~/.hkipo-next/data/hkipo.db"]},"install":[{"id":"install-uv-brew","kind":"brew","formula":"uv","bins":["uv"],"label":"Install uv with Homebrew","os":["darwin","linux"]}]}} --- # HK IPO Orchestrator Use this skill when the request spans multiple stages and you need to route the work to the right HK IPO skill. ## Companion Skill Map - `$hkipo-calendar-monitor`: discover near-term IPO events - `$hkipo-snapshot-extractor`: extract one-symbol facts and quality signals - `$hkipo-profile-watchlist-manager`: manage personalized settings and watchlists - `$hkipo-parameter-manager`: tune scoring rules and active versions - `$hkipo-decision-engine`: produce scores, decision cards, and batches - `$hkipo-review-optimizer`: update actual outcomes and process suggestions ## Default Flow 1. Discover the market. 2. Extract structured facts for shortlisted symbols. 3. Ensure profile and watchlist state is ready when the task is personalized. 4. Ensure an active parameter version exists before scoring. 5. Produce score or decision outputs. 6. Close the loop later with review and suggestions. ## Operating Rules - Prefer JSON between machine steps and concise text or markdown for final user-facing output. - Surface degraded or partial data instead of hiding it. - Warn before mutating profile, watchlist, parameter, or review history when that side effect matters. - Do not run repeated score or batch jobs casually, because those commands create review records.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: jmin1113/agent-feishu-doc (version 1.0.0)

--- name: agent-feishu-doc description: "Guide for OpenClaw agents to create, read, and edit Feishu/Lark documents via API. Use when: (1) creating a new Feishu doc and writing content, (2) reading an existing doc by ID or URL, (3) setting document permissions to public/anyone editable, (4) troubleshooting agent-to-agent Feishu doc collaboration. Triggers on: 飞书文档, create Feishu doc, write to Feishu doc, feishu_doc tool." --- # Agent Feishu Doc Guide ## Quick Reference | Operation | API Endpoint | |----------|--------------| | Create doc | `POST /drive/v1/documents` | | Get doc metadata | `GET /drive/v1/documents/{id}` | | Get doc blocks | `GET /drive/v1/documents/{id}/blocks` | | Add blocks | `POST /drive/v1/documents/{id}/blocks/{parent_id}/children` | | Set public perm | `PATCH /drive/v1/permissions/{id}/public?type=docx` | ## Workflow ### 1. Create Document ```bash curl -X POST "https://open.feishu.cn/open-apis/drive/v1/documents" \ -H "Authorization: Bearer {token}" \ -H "Content-Type: application/json" \ -d '{"title": "文档标题"}' ``` ### 2. Write Content (Block API) ```bash curl -X POST "https://open.feishu.cn/open-apis/drive/v1/documents/{doc_id}/blocks/{block_id}/children" \ -H "Authorization: Bearer {token}" \ -H "Content-Type: application/json" \ -d '{"children": [{"block_type": 2, "text": {"elements": [{"text_run": {"content": "内容"}}]}}]}' ``` **Block types:** `2`=text, `3`=h1, `4`=h2, `7`=bullet (⚠️ may error, use text instead) ### 3. Set Public Permissions ```bash curl -X PATCH "https://open.feishu.cn/open-apis/drive/v1/permissions/{doc_id}/public?type=docx" \ -H "Authorization: Bearer {token}" \ -H "Content-Type: application/json" \ -d '{ "link_share_entity": "anyone_editable", "external_access_entity": "anyone_can_edit", "security_entity": "anyone_can_edit", "comment_entity": "anyone_can_edit", "share_entity": "anyone" }' ``` ## Reading Docs - **By URL**: Use `web_fetch` tool on `https://feishu.cn/docx/{doc_id}` - **By ID**: Call GET `/drive/v1/documents/{id}` then `/blocks` ## Prerequisites 1. Agent's Feishu app must be added as doc collaborator, OR doc set to public 2. For cross-agent collaboration: set `tools.sessions.visibility: "all"` in openclaw.json ## Troubleshooting - **Cannot access doc**: Add agent's app as collaborator in Feishu, or set doc to public - **Block API error 9499**: Avoid `block_type: 7` (bullet), use plain text blocks instead - **Cross-agent visibility**: Add `"tools": {"sessions": {"visibility": "all"}}` to openclaw.json For detailed API specs, permissions guide, and example workflows, see `references/guide.md`.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: etherman-os/ctx-shrink (version 1.0.1)

--- id: ctx-shrink name: ctx-shrink description: "ctx-shrink — Codebase analyzer for AI era. Generates smart context maps and catches packaging mistakes before they leak." category: developer-tools risk: safe source: personal date_added: "2026-04-05" --- # 🛡️ ctx-shrink — AI Codebase Analyzer ## When to Use This skill is applicable when the user wants to: - Analyze a codebase and generate a smart context map for AI agents - Audit a project for accidentally committed secrets (`.env`, keys, certs) - Check if a project is safe to publish (source maps, private files) - Get a quick architecture overview of an unfamiliar codebase ## 📋 Instructions You are an expert with `ctx-shrink`. Your job is to: 1. **Run ctx-shrink** on the user's project directory 2. **Read the output** (`AI-CONTEXT.md` or custom output file) 3. **Explain** what it found — architecture, endpoints, models, issues 4. **Recommend** fixes for any security/safety issues found ## 🚀 Usage ### Run analysis ``` ctx-shrink /path/to/project ctx-shrink /path/to/project --out report.md ctx-shrink /path/to/project --format json ``` ### Flags | Flag | Description | |------|-------------| | `--max-depth N` | Limit directory depth | | `--format json` | JSON output | | `--out FILE` | Custom output file | ### Common use cases **Quick project overview:** ``` ctx-shrink . --out AI-CONTEXT.md ``` **Pre-publish safety check:** ``` ctx-shrink . --out publish-audit.md ``` **For a specific path:** ``` ctx-shrink ~/projects/my-api ``` ## 📊 What it catches | Check | What it catches | |-------|-----------------| | 📊 Project Analysis | Architecture, endpoints, models, dependencies | | 🛡️ Gitignore Audit | `.env`, secrets, keys not in `.gitignore` | | 📦 Publish Safety | Source maps, private keys, certs that would leak on publish | ## ⚠️ Rules - **Do not** download installers, pipe `curl`/`wget` to a shell, or write binaries to system paths (`/usr/local/bin`, etc.). This skill only assumes `ctx-shrink` is already on `PATH`. - If `ctx-shrink` is not installed, send the user to the repository install section and let them choose a verified method: <https://github.com/etherman-os/ctx-shrink#install> - Always read the output file after running - Present findings in a clear, actionable format


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: leooooooow/listing-gap-audit (version 1.0.1)

--- name: listing-gap-audit description: Audit listing competitiveness by comparing your PDP/listing against top competitors and surfacing the highest-impact copy/proof gaps. Use when the user asks why conversion is lagging, wants PDP rewrite priorities, or needs a competitor benchmark before launch. --- # Listing Gap Audit ## Skill Card - **Category:** PDP Optimization - **Core problem:** How does our listing underperform compared with competitors? - **Best for:** Listing rewrite prioritization - **Expected input:** Your listing text + competitor listings + product constraints - **Expected output:** Gap report across title, bullets, proof, offer framing, and action priorities - **Creatop handoff:** Send priority rewrites into script/copy generation workflows ## Browser-first guidance When live listing URLs are available, prefer **OpenClaw managed browser** to inspect your PDP and competitor PDPs before generating the audit. Recommended order: 1. If the user already has copied listing text, use that first. 2. If URLs are available, inspect live pages with **OpenClaw managed browser**. 3. Use Browser Relay only when the user explicitly wants to inspect their current Chrome tab. The default browser guidance should be OpenClaw managed browser, not a generic Playwright assumption. ## Workflow 1. Clarify the comparison goal. - Which listing is yours? - Which competitor pages matter most? - Is the user optimizing for CTR, conversion, trust, or claim safety? 2. Parse listing components: headline, bullets, proof, offer, objections. 3. Benchmark against competitor structure and claim density. 4. Score gaps by conversion impact and implementation effort. 5. Generate rewrite priorities with before/after guidance. ## Output format Return in this order: 1. Executive summary (max 5 lines) 2. Priority actions (P0/P1/P2) 3. Evidence table (signal, confidence, risk) 4. 7-day execution plan ## Quality and safety rules - Do not copy competitor claims verbatim. - Flag compliance-sensitive claims explicitly. - Keep recommendations feasible for current product constraints. - If browser evidence is partial, label it clearly. ## License Copyright (c) 2026 **Razestar**. This skill is provided under **CC BY-NC-SA 4.0** for non-commercial use. You may reuse and adapt it with attribution to Razestar, and share derivatives under the same license. Commercial use requires a separate paid commercial license from **Razestar**. No trademark rights are granted.

path: references/output-template.md
content: # Output Template

Use this template for consistent decision output.

## 1) Executive Summary
- Key finding:
- Primary risk:
- Recommended next action:

## 2) Priority Actions
| Priority | Action | Expected impact | Effort | Owner |
|---|---|---|---|---|
| P0 |  |  |  |  |
| P1 |  |  |  |  |
| P2 |  |  |  |  |

## 3) Evidence Table
| Signal | Source | Confidence | Notes |
|---|---|---|---|

## 4) 7-Day Plan
- D1:
- D2:
- D3:
- D4:
- D5:
- D6:
- D7:


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)