OpenClaw/clawhub-security-signals huggingface dataset:
Skill: golfzero01/7-powers (version 1.0.0)

--- name: 7-powers description: Hamilton Helmer's strategic framework for achieving sustainable competitive advantage through seven distinct power types. Use when analyzing business strategy, evaluating competitive moats, assessing investment defensibility, diagnosing why a business struggles despite apparent benefits, or planning product strategy. Triggers on "7 powers", "competitive advantage", "moat", "power strategy", "Hamilton Helmer", or questions about sustainable business advantage. --- # 7 Powers Strategic Framework Apply Hamilton Helmer's framework: Power = **Benefit** (improved cash flow) + **Barrier** (prevents competitive arbitrage). Without both, advantage is temporary. ## The Seven Powers by Lifecycle Phase **Origination (pre-PMF):** - **Counter-positioning** — new model would cannibalize incumbents' existing business - **Cornered Resource** — preferential access to scarce resource (IP, talent, regulatory) **Takeoff (rapid growth post-PMF):** - **Scale Economics** — per-unit cost decreases with volume faster than competitors can match - **Network Economics** — product value increases as more users join - **Switching Costs** — customers face significant cost (money, time, risk) to leave **Stability (mature):** - **Branding** — pricing power from emotional connection beyond rational attributes - **Process Power** — embedded organizational capabilities competitors can't replicate ## Process 1. **Identify lifecycle phase** — Origination → Takeoff → Stability 2. **List benefits** the business currently has 3. **For each benefit, test the barrier:** "What prevents competitors from copying this?" 4. **Map to available Powers** for the current phase 5. **Prioritize** building Powers that create both benefit AND barrier now 6. **Flag anti-patterns** — benefits without barriers, wrong-phase Power pursuit, easily-eroded barriers ## Quick Diagnostic Questions | Power | Key Question | |-------|-------------| | Scale Economics | Does cost-per-unit drop meaningfully as we grow? | | Network Economics | Does each new user make the product better for existing users? | | Counter-positioning | Would adopting our model hurt incumbents' current revenue? | | Switching Costs | How painful (time, money, risk) is it for customers to leave? | | Branding | Can we charge premium beyond rational product attributes? | | Cornered Resource | Do we have access to something competitors literally cannot get? | | Process Power | Can competitors observe but not replicate how we do things? | ## Detailed Reference For full examples, anti-patterns, and related frameworks: read [references/powers-detail.md](references/powers-detail.md)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: chenleiyanquan/executing-plans (version 0.1.0)

--- name: executing-plans description: Use when you have a written implementation plan to execute in a separate session with review checkpoints --- # Executing Plans ## Overview Load plan, review critically, execute tasks in batches, report for review between batches. **Core principle:** Batch execution with checkpoints for architect review. **Announce at start:** "I'm using the executing-plans skill to implement this plan." ## The Process ### Step 1: Load and Review Plan 1. Read plan file 2. Review critically - identify any questions or concerns about the plan 3. If concerns: Raise them with your human partner before starting 4. If no concerns: Create TodoWrite and proceed ### Step 2: Execute Batch **Default: First 3 tasks** For each task: 1. Mark as in_progress 2. Follow each step exactly (plan has bite-sized steps) 3. Run verifications as specified 4. Mark as completed ### Step 3: Report When batch complete: - Show what was implemented - Show verification output - Say: "Ready for feedback." ### Step 4: Continue Based on feedback: - Apply changes if needed - Execute next batch - Repeat until complete ### Step 5: Complete Development After all tasks complete and verified: - Announce: "I'm using the finishing-a-development-branch skill to complete this work." - **REQUIRED SUB-SKILL:** Use superpowers:finishing-a-development-branch - Follow that skill to verify tests, present options, execute choice ## When to Stop and Ask for Help **STOP executing immediately when:** - Hit a blocker mid-batch (missing dependency, test fails, instruction unclear) - Plan has critical gaps preventing starting - You don't understand an instruction - Verification fails repeatedly **Ask for clarification rather than guessing.** ## When to Revisit Earlier Steps **Return to Review (Step 1) when:** - Partner updates the plan based on your feedback - Fundamental approach needs rethinking **Don't force through blockers** - stop and ask. ## Remember - Review plan critically first - Follow plan steps exactly - Don't skip verifications - Reference skills when plan says to - Between batches: just report and wait - Stop when blocked, don't guess


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: angusthefuzz/ragflow (version 1.0.2)

--- name: ragflow description: Universal Ragflow API client for RAG operations. Create datasets, upload documents, run chat queries against knowledge bases. Self-hosted RAG platform integration. version: 1.0.2 author: Ania env: RAGFLOW_URL: description: Ragflow instance URL (e.g., https://rag.example.com) required: true RAGFLOW_API_KEY: description: Ragflow API key (use least-privilege key, can manage datasets/upload files) required: true metadata: clawdbot: emoji: "📚" requires: bins: ["node"] --- # Ragflow API Client Universal client for Ragflow — self-hosted RAG (Retrieval-Augmented Generation) platform. ## Features - **Dataset management** — Create, list, delete knowledge bases - **Document upload** — Upload files or text content - **Chat queries** — Run RAG queries against datasets - **Chunk management** — Trigger parsing, list chunks ## Usage ```bash # List datasets node {baseDir}/scripts/ragflow.js datasets # Create dataset node {baseDir}/scripts/ragflow.js create-dataset --name "My Knowledge Base" # Upload document node {baseDir}/scripts/ragflow.js upload --dataset DATASET_ID --file article.md # Chat query node {baseDir}/scripts/ragflow.js chat --dataset DATASET_ID --query "What is stroke?" # List documents in dataset node {baseDir}/scripts/ragflow.js documents --dataset DATASET_ID ``` ## Configuration Set environment variables in your `.env`: ```bash RAGFLOW_URL=https://your-ragflow-instance.com RAGFLOW_API_KEY=your-api-key ``` ## API This skill wraps Ragflow's REST API: - `GET /api/v1/datasets` — List datasets - `POST /api/v1/datasets` — Create dataset - `DELETE /api/v1/datasets/{id}` — Delete dataset - `POST /api/v1/datasets/{id}/documents` — Upload document - `POST /api/v1/datasets/{id}/chunks` — Trigger parsing - `POST /api/v1/datasets/{id}/retrieval` — RAG query Full API docs: https://ragflow.io/docs ## Examples ```javascript // Programmatic usage const ragflow = require('{baseDir}/lib/api.js'); // Upload and parse await ragflow.uploadDocument(datasetId, './article.md', { filename: 'article.md' }); await ragflow.triggerParsing(datasetId, [documentId]); // Query const answer = await ragflow.chat(datasetId, 'What are the stroke guidelines?'); ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: bytesagain3/hashgen (version 3.0.0)

--- name: HashGen description: "Hash files and strings, verify checksums, and run integrity checks fast. Use when generating SHA hashes, verifying files, or comparing digest values." version: "3.0.0" author: "BytesAgain" homepage: https://bytesagain.com source: https://github.com/bytesagain/ai-skills tags: ["hash","md5","sha256","checksum","security","verify","integrity","crypto"] categories: ["Security", "Developer Tools", "Utility"] --- # HashGen Quick hash generator for strings and files. Supports MD5, SHA1, SHA256, SHA512 with auto-detection, comparison, and verification. ## Commands | Command | Description | |---------|-------------| | `hashgen md5 <text>` | MD5 hash of text | | `hashgen sha1 <text>` | SHA1 hash of text | | `hashgen sha256 <text>` | SHA256 hash of text | | `hashgen sha512 <text>` | SHA512 hash of text | | `hashgen all <text>` | Show all hash algorithms for text | | `hashgen file <path> [algo]` | Hash a file (default: sha256) | | `hashgen compare <hash1> <hash2>` | Compare two hashes | | `hashgen verify <text> <hash>` | Verify text matches hash (auto-detects algorithm) | | `hashgen version` | Show version | ## Examples ```bash hashgen md5 "hello world" # → MD5: 5eb63bbbe01... hashgen sha256 "my secret" # → SHA256: 40e1b17... hashgen all "test" # → shows MD5, SHA1, SHA256, SHA512 hashgen file /etc/hostname # → SHA256 of file hashgen file /etc/hostname md5 # → MD5 of file hashgen compare abc123 abc123 # → ✅ MATCH hashgen verify "hello" 5d41... # → auto-detects algo, verifies ``` ## Requirements - `md5sum`, `sha1sum`, `sha256sum`, `sha512sum` (standard coreutils)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: marcosrippel/whatsapp-utils (version 1.0.0)

--- name: whatsapp-utils description: Phone number formatting, cache inspection, contact export, and message ID generation --- # WhatsApp Utils Skill Miscellaneous utilities for WhatsApp automation. ## Usage ``` exec({ cmd: "node <skill_dir>/scripts/utils.js COMMAND [ARGS]" }) ``` ## Commands ### Format Phone Number ``` exec({ cmd: "node <skill_dir>/scripts/utils.js format \"(11) 99999-9999\"" }) ``` ### Clean Phone Number ``` exec({ cmd: "node <skill_dir>/scripts/utils.js clean \"+55 (11) 99999-9999\"" }) ``` ### Cache Info ``` exec({ cmd: "node <skill_dir>/scripts/utils.js cache-info" }) ``` ### Export Contacts ``` exec({ cmd: "node <skill_dir>/scripts/utils.js export-contacts" }) ``` ### Generate Message ID ``` exec({ cmd: "node <skill_dir>/scripts/utils.js gen-id" }) ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (HIGH)
Skill: moxin1044/qsnctf-practice-dynamic (version 1.0.0)

--- name: "qsnctf-practice-dynamic" version: "1.0.0" description: "获取青少年CTF练习场的排行榜和解题动态。Invoke when user wants to check QSNCTF leaderboard or recent solve activities." triggers: - "qsnctf-practice-dynamic" - "qsnctf leaderboard" - "qsnctf dynamic" --- # 青少年CTF练习场动态查询 本技能用于获取青少年CTF练习场(www.qsnctf.com)的排行榜和解题动态信息。 ## 功能说明 ### 1. 排行榜查询 获取当前排行榜前20名用户信息，包括： - 排名 - 用户名 - 积分 - 等级 ```bash python scripts/qsnctf_stats.py ranking ``` ### 2. 解题动态查询 获取近期的解题动态，包括： - 用户名 - 题目类别 - 解题时间 ```bash python scripts/qsnctf_stats.py dynamic ``` ## 使用方法 ### 命令格式 ```bash python scripts/qsnctf_stats.py <action> [options] ``` ### 参数说明 | 参数 | 说明 | |------|------| | `action` | 必填，可选值: `ranking`, `dynamic`, `all` | | `-n, --number` | 可选，获取解题动态的数量(默认10条，0表示全部) | ### Action 说明 | Action | 功能 | |--------|------| | `ranking` | 获取排行榜TOP 20 | | `dynamic` | 获取近期解题动态 | | `all` | 同时获取排行榜和解题动态 | ## 使用示例 ### 获取排行榜 ```bash python scripts/qsnctf_stats.py ranking ``` ### 获取最近10条解题动态 ```bash python scripts/qsnctf_stats.py dynamic ``` ### 获取最近20条解题动态 ```bash python scripts/qsnctf_stats.py dynamic -n 20 ``` ### 获取全部解题动态 ```bash python scripts/qsnctf_stats.py dynamic -n 0 ``` ### 同时获取排行榜和解题动态 ```bash python scripts/qsnctf_stats.py all ``` ## 输出示例 ### 排行榜输出 ``` ====================================================================== 青少年CTF练习场 - 排行榜 TOP 20 ====================================================================== 排名 用户名 积分 等级 ---------------------------------------------------------------------- 1 substkiller 892.0 Lv.2 2 huasan2508 836.0 Lv.2 3 qingquan12 627.0 Lv.2 ... ====================================================================== ``` ### 解题动态输出 ``` ============================================================ 青少年CTF练习场 - 近期解题动态 ============================================================ 用户名 题目类别 时间 ------------------------------------------------------------ zzawa Base64 2026-03-22 01:39:01 fenfenkaihuai 应急行动-1 2026-03-21 23:45:51 ... ============================================================ ``` ## 依赖 - Python 3.x - requests 库 安装依赖： ```bash pip install requests ``` ## API 说明 本技能调用以下API： - 排行榜: `GET https://www.qsnctf.com/api/5dboard/playlist` - 解题动态: `GET https://www.qsnctf.com/api/5dboard/viewlist`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jacqueslauren/tech-security-audit (version 1.0.0)

# Tech Security Audit Skill This skill integrates Nmap scanning functionality to perform local network vulnerability assessments. ## Features - Local network scanning - Vulnerability detection - Service version detection - OS fingerprinting ## Requirements - Nmap must be installed and accessible in PATH - Appropriate permissions for network scanning ## Usage Call the skill functions to perform scans on specified targets or network ranges.

path: README.md
content: # Tech Security Audit Skill

This skill provides network vulnerability assessment capabilities through Nmap integration.

## Features

- Local network scanning
- Vulnerability detection
- Service version identification
- OS fingerprinting

## Requirements

- Nmap must be installed and accessible in PATH
- Python 3.6+
- Appropriate network permissions for scanning

## Installation

1. Install Nmap on your system
2. Ensure Nmap is in your system PATH
3. Verify installation with `nmap --version`

## Usage

```python
from tech_security_audit import run_nmap_scan

# Perform a vulnerability scan
results = run_nmap_scan("192.168.1.0/24", "vulnerability")

# Perform a service detection scan
results = run_nmap_scan("192.168.1.100", "service")

# Perform an OS detection scan
results = run_nmap_scan("192.168.1.100", "os")
```

## Scan Types

- **vulnerability**: Runs vulnerability detection scripts
- **service**: Detects services and their versions
- **os**: Performs OS fingerprinting

## Output Format

The scanner returns structured results including:
- Host information (IP, hostname, status)
- Services (port, protocol, state, service name, version)
- OS fingerprinting results
- Vulnerability findings

## Legal Notice

This tool is intended for authorized security testing only. Users are responsible for complying with all applicable laws and regulations.

path: __init__.py
content: """
Tech Security Audit Skill Package
"""
from .nmap_scanner import run_nmap_scan

__all__ = ["run_nmap_scan"]

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: clinchcc/openclaw-receipt-manager (version 0.1.7)

--- name: receipt-manager description: Receipt management skill. Use when: (1) User sends a receipt image, (2) User asks about expenses or receipts, (3) User wants monthly spending summary. --- # Receipt Manager Store and query receipt data locally. ## Trigger - receipt, expense, invoice, spending, claim ## How to Use ### 1. Initialize (first time) ```bash python3 scripts/receipt_db.py init ``` ### 2. Add Receipt After OpenClaw recognizes the receipt image, the data is saved automatically via handler. ### 3. Query ```bash # List all python3 scripts/receipt_db.py list # Search python3 scripts/receipt_db.py search --q "walmart" # Monthly summary python3 scripts/receipt_db.py summary --month 2026-02 ``` ## Files - `scripts/receipt_db.py` - Main CLI tool - `scripts/handler.py` - Receives JSON from OpenClaw, saves to DB - `data/receipts/` - Local SQLite DB and images ## Privacy All data stored locally on your machine. No cloud upload.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: hundevmode/linkedin-email-phone-apify (version 1.0.0)

--- name: linkedin-email-phone-apify description: Use this skill when the user needs LinkedIn contact enrichment by URLs with both phone and email lookup via Apify actors (phones: X95BXRaFOqZ7rzjxM, emails: q3wko0Sbx6ZAAB2xf), including optional branches and merged output. required_env_vars: - APIFY_TOKEN required-env-vars: - APIFY_TOKEN primary_credential: APIFY_TOKEN primary-credential: APIFY_TOKEN metadata: short-description: Enrich LinkedIn URLs with emails and phones openclaw: requires: env: - APIFY_TOKEN primaryCredential: APIFY_TOKEN --- # LinkedIn Email + Phone Enrichment (Apify) ## Overview This skill runs two Apify actors in one pipeline and merges results by LinkedIn profile URL: - Phone actor: `X95BXRaFOqZ7rzjxM` - Email actor: `q3wko0Sbx6ZAAB2xf` Use this when the user wants one command to enrich a LinkedIn URL list with: - mobile phones - work emails - personal emails - unified rows for n8n/Sheets/CRM ## Step-by-step workflow 1. Accept LinkedIn URLs (`linkedinUrls`) from user. 2. Validate and normalize URLs. 3. Decide branches: - run phone actor if `includePhones=true` - run email actor if `includeEmails=true` 4. Run selected actors on the same URL list. 5. Merge results by normalized LinkedIn URL. 6. Return summary + merged rows. ## Authentication ```bash export APIFY_TOKEN='apify_api_xxx' ``` or ```bash python3 scripts/linkedin_email_phone_pipeline.py run \ --apify-token 'apify_api_xxx' \ --input-file references/sample_input.json ``` ## Quick start ```bash APIFY_TOKEN='apify_api_xxx' \ python3 scripts/linkedin_email_phone_pipeline.py run \ --input-file references/sample_input.json ``` ## Toggle branches Emails only: ```bash APIFY_TOKEN='apify_api_xxx' \ python3 scripts/linkedin_email_phone_pipeline.py run \ --input-json '{ "linkedinUrls": ["https://www.linkedin.com/in/williamhgates"], "includeEmails": true, "includePhones": false, "includeWorkEmails": true, "includePersonalEmails": true, "onlyWithEmails": true }' ``` Phones only: ```bash APIFY_TOKEN='apify_api_xxx' \ python3 scripts/linkedin_email_phone_pipeline.py run \ --input-json '{ "linkedinUrls": ["https://www.linkedin.com/in/williamhgates"], "includeEmails": false, "includePhones": true, "onlyWithPhones": true }' ``` ## Notes - Actor IDs are hardcoded to your provided IDs. - `linkedinUrls` is required. - At least one branch must be enabled (`includeEmails` or `includePhones`). - Output rows contain available email/phone fields in one record. ## References - `references/input-contract.md` - `references/troubleshooting.md`

path: requirements.txt
content: # No external dependencies required


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: jpengcheng523-netizen/zhoubao-yuebao (version 1.0.0)

# 周报/月报生成 Skill > 一键生成结构化周报/月报，基于飞书云文档格式输出。可自动统计工作内容、生成摘要、输出可编辑文档。 ## 功能特性 - ✅ **自动汇总**：根据对话记录和用户提供的内容自动生成 - ✅ **多种格式**：支持周报、月报、项目报告、会议纪要 - ✅ **飞书文档**：直接创建到飞书云文档，可多人协同 - ✅ **模板丰富**：内置多种报告模板（工作总结、OKR、项目进度等） - ✅ **进度可视化**：支持插入表格、进度条、统计图表 - ✅ **自定义模板**：支持用户定义专属模板 ## 触发词 ``` 写周报 生成周报 本周总结 月报 月度报告 项目报告 工作汇总 会议纪要 ``` ## 使用方法 ### 生成周报 ``` 写一份本周周报 生成这周的总结 本周工作汇报 ``` ### 生成月报 ``` 写本月月报 生成4月月报 月度工作总结 ``` ### 项目报告 ``` 项目进度报告 XX项目周报 项目总结 ``` ### 创建模板 ``` 创建周报模板 自定义月报格式 ``` ## 输出格式 生成的报告包含： ``` 📊 周报 | 2026-04-14 ~ 2026-04-18 ━━━━━━━━━━━━━━━━━━━━ 📋 本周完成 • 完成功能A开发并上线 • 修复3个线上Bug • 参与产品评审会议 📈 关键指标 • 代码提交：23次 • 代码评审：5次 • 会议参与：8场 🎯 下周计划 • 开始功能B的开发 • 准备Sprint评审 📝 风险与阻塞 ⚠️ 依赖的设计稿还未完成 ━━━━━━━━━━━━━━━━━━━━ ``` ## 技术实现 - **生成引擎**：AI 理解 + 结构化输出 + Markdown 格式 - **文档创建**：飞书云文档 API（创建 + 写入） - **模板管理**：JSON 格式模板存储 - **上下文理解**：读取近期对话历史提取工作内容 ## 定价参考 | 版本 | 价格 | 说明 | |------|------|------| | 免费版 | ¥0 | 5篇/月，基础模板 | | 付费版 | ¥49-199/月 | 无限生成，高级模板 | ## 依赖 - OpenClaw 框架 - 飞书云文档（创建/更新） - 飞书 IM（发送完成通知）

path: metadata.json
content: {
  "name": "weekly-report",
  "version": "1.0.0",
  "displayName": "周报月报生成",
  "description": "一键生成结构化周报/月报，基于飞书云文档格式输出",
  "author": "肥肥🐶",
  "tags": ["周报", "月报", "工作报告", "飞书文档"],
  "platform": "openclaw",
  "channels": ["feishu"],
  "entry": "scripts/handler.js"
}


path: scripts/handler.js
content: // weekly-report handler
// 周报/月报生成 Skill

const SKILL_NAME = 'weekly-report';

async function handle(text, context) {
  const reportType = detectReportType(text);
  const content = extractContent(text);
  
  // AI 生成报告
  const report = await generateReport(reportType, content);
  
  // 创建飞书文档
  const config = loadConfig();
  if (config.create_doc && context.user_id) {
    const docId = await createFeishuDoc(report, context.user_id);
    return `📊 ${reportType}已生成！\n\n${report}\n\n📄 飞书文档：${docId}`;
  }
  
  return report;
}

function detectReportType(text) {
  if (text.includes('月')) return '月报';
  if (text.includes('项目')) return '项目报告';
  return '周报';
}

function extractContent(text) {
  // 从用户输入中提取工作内容
  return text.replace(/生成|写|本周|月报|周报|总结|工作/gi, '').trim();
}

function loadConfig() {
  try {
    const fs = require('fs');
    const path = require('path');
    const configPath = path.join(__dirname, '../config.json');
    return fs.existsSync(configPath) ? JSON.parse(fs.readFileSync(configPath)) : {};
  } catch { return {}; }
}

async function createFeishuDoc(content, userId) {
  // 调用飞书文档创建
  return '文档创建成功';
}

module.exports = { handle };


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: vishalgojha/propai-live (version 1.0.1)

--- name: propai-live description: > PropAI Live is the complete AI-powered realtor automation suite, bundling OpenClaw core, PropAI Sync for WhatsApp lead management, Social Flow for Meta operations, and essential realtor skills for lead processing and AI assistance. It provides a unified CLI and UI for daily workflows, from lead follow-ups to social posting, with built-in risk management and approvals. --- # PropAI Live ## Dependencies (auto-installed via ClawHub) - openclaw - propai-sync - social-flow - message-parser - lead-extractor - india-location-normalizer - summary-generator - action-suggester - sentiment-priority-scorer - lead-storage ## Core Workflow For each session: 1. Validate environment: run `propai-live doctor`. 2. Validate license: run `node scripts/license-status.mjs`. 3. Parse intent: Lead (PropAI), Social (Social Flow), General (OpenClaw). 4. Propose commands: show plan, confirm for writes. 5. Execute minimal sequence, log outcomes. 6. On failure, diagnose and retry safe actions only. ## License Workflow Run these from `skills/propai-live`: ```bash node scripts/license-activate.mjs --key <LICENSE_KEY> --api <LICENSE_API_BASE_URL> ``` ```bash node scripts/license-status.mjs --mode read ``` Before any write operation: ```bash node scripts/license-guard.mjs --mode write ``` Feature-specific gates: ```bash node scripts/license-guard.mjs --mode write --require-entitlement lead-storage node scripts/license-guard.mjs --mode write --require-entitlement social ``` For logout/device transfer: ```bash node scripts/license-deactivate.mjs ``` ## Validate Environment Before operations: - `propai-live --version` (checks bundle) - `propai-live doctor` (auth, connections) - `node scripts/license-status.mjs --mode read` (license local check) If issues are found, run `propai-live setup` for wizard. ## Domain Routing - Lead/Messaging: `propai-live lead ...` (PropAI + skills) - Social/Meta: `propai-live social ...` (Social Flow) - AI/General: `propai-live ask ...` (OpenClaw) ## Execution Policy - Prefer CLI commands over narration. - Keep commands profile-aware (agency, city). - Do not print secrets in output. - Run doctor first on new setups. - Run `node scripts/license-guard.mjs --mode write` before any write action. ## Risk Policy - Read-only: safe (status, insights). - Low-risk: drafts, test messages. - High-risk: live spends, real user messages; require explicit confirmation. - Unknown impact: treat as high-risk. ## Output Contract - Summarize intent and chosen domain. - List exact commands in code blocks. - State assumptions (agency, contacts). - Mark risk levels. - Ask confirmation before writes. ## References - PropAI docs: `propai-sync/README.md` - Social Flow docs: `social-flow/README.md` - OpenClaw docs: `https://openclaw.ai` - License API contract: `references/license-api-contract.md` - License API starter template: `assets/license-api/`


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: clean (LOW)