OpenClaw/clawhub-security-signals huggingface dataset:
Skill: raghulpasupathi/smart-cache (version 1.0.0)

--- id: smart-cache version: 1.0.0 name: Smart Cache description: Intelligent caching with LRU/LFU strategies and TTL management author: NeoClaw Team category: utility tags: - caching - performance - lru - lfu dependencies: [] --- # Smart Cache High-performance caching with multiple eviction strategies. ## Implementation ```javascript class SmartCache { constructor(options = {}) { this.strategy = options.strategy || 'lru'; // 'lru' or 'lfu' this.maxSize = options.maxSize || 500; this.defaultTTL = options.defaultTTL || 3600000; // 1 hour this.cache = new Map(); this.accessCount = new Map(); this.accessOrder = []; } set(key, value, ttl = this.defaultTTL) { // Evict if at capacity if (this.cache.size >= this.maxSize && !this.cache.has(key)) { this.evict(); } const entry = { value, expiresAt: Date.now() + ttl, createdAt: Date.now() }; this.cache.set(key, entry); this.accessCount.set(key, 0); this.updateAccessOrder(key); return true; } get(key) { const entry = this.cache.get(key); if (!entry) { return { hit: false, value: null }; } // Check TTL if (Date.now() > entry.expiresAt) { this.delete(key); return { hit: false, value: null, reason: 'expired' }; } // Update access tracking this.accessCount.set(key, (this.accessCount.get(key) || 0) + 1); this.updateAccessOrder(key); return { hit: true, value: entry.value }; } delete(key) { this.cache.delete(key); this.accessCount.delete(key); this.accessOrder = this.accessOrder.filter(k => k !== key); } evict() { if (this.strategy === 'lru') { this.evictLRU(); } else if (this.strategy === 'lfu') { this.evictLFU(); } } evictLRU() { // Remove least recently used if (this.accessOrder.length > 0) { const keyToEvict = this.accessOrder[0]; this.delete(keyToEvict); } } evictLFU() { // Remove least frequently used let minCount = Infinity; let keyToEvict = null; for (const [key, count] of this.accessCount.entries()) { if (count < minCount) { minCount = count; keyToEvict = key; } } if (keyToEvict) { this.delete(keyToEvict); } } updateAccessOrder(key) { // Remove from current position this.accessOrder = this.accessOrder.filter(k => k !== key); // Add to end (most recent) this.accessOrder.push(key); } clear() { this.cache.clear(); this.accessCount.clear(); this.accessOrder = []; } getStats() { return { size: this.cache.size, maxSize: this.maxSize, strategy: this.strategy, hitRate: this.calculateHitRate() }; } calculateHitRate() { // Simplified - would track actual hits/misses in production return Math.round((this.cache.size / this.maxSize) * 100); } } // Export for OpenClaw module.exports = { SmartCache }; ``` ## Usage ```javascript const cache = new skills.smartCache.SmartCache({ strategy: 'lru', maxSize: 500, defaultTTL: 3600000 }); // Set value cache.set('key1', { data: 'value' }, 60000); // Get value const result = cache.get('key1'); if (result.hit) { console.log('Cache hit:', result.value); } // Stats console.log(cache.getStats()); ``` ## Configuration ```json { "strategy": "lru", "maxSize": 500, "defaultTTL": 3600000 } ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zhuchenggong19851114-design/zhuchenggong-ppt-generator (version 1.0.0)

# ppt-generator - PPT自动生成技能 ## 功能 根据用户提供的主题或大纲，自动生成PPT ## 适用场景 - 经验分享PPT - 产品介绍PPT - 课程课件PPT - 任何需要快速生成PPT的场景 ## 限制 - 需要用户登录通义千问账号才能使用PPT功能 - 沙箱浏览器可能无法使用，需用户本地浏览器 ## 工作流程 ### 方式一：通义千问PPT 1. 用 browser 打开 https://tongyi.aliyun.com/qianwen/ 2. **检查登录状态**： - 有"我的空间"按钮 → 已登录 - 有"立即登录"按钮 → 未登录 3. **如果未登录**： - 点击"立即登录" - 截图发给用户让其扫码 - 等待用户确认登录完成 4. 点击左下角"更多"按钮 4. 点击"PPT"选项 5. 在输入框输入PPT主题或大纲 6. 等待生成（30秒-1分钟） 7. 点击"下载"按钮，选择格式（PPT/PDF/长图） ### 方式二：Kimi PPT 1. 用 browser 打开 https://kimi.com/slides 2. 检查登录状态 3. 输入PPT主题 ### 方式三：用户本地生成（未登录时） 1. 告知用户需要手动登录 2. 提供PPT大纲内容 3. 让用户自行生成 ## 输出 - 生成的PPT文件保存到本地 - 告知用户文件位置


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: romanluoman00007/book-of-the-day (version 1.0.7)

--- name: book-of-the-day description: > Book of the Day — a daily book oracle. One uplifting book, one light poetic reading. Trigger: "book of the day", "today's book", "今日之书", "书签运势". Each invocation fetches a fresh book. Respond in the user's language. FORBIDDEN: never output "Draw again", "再抽一次", or similar prompts. --- # Book of the Day 🔮📖 **FORBIDDEN — your response must NOT include:** "Draw again", "draw again", "再抽一次", or any line prompting the user to draw again. End only with one of the warm CTAs below. --- A daily book oracle. Light as a fortune cookie, deep as a good book. Each day, one book from the Fortune Library — an energy, theme, or invitation. Never a warning, always a gift. --- ## How It Works ### 1. Fetch Today's Book For each invocation: `GET {URL}/?date=YYYY-MM-DD` (omit `date` for today). Source: `BOOK_OF_THE_DAY_API_URL` or `https://book-of-the-day.vercel.app`. Response: `title`, `author`, `topics`, `rating`, `description`, `archetype`, `cover_url`. Never reuse a book from earlier messages. ### 2. Assign the Fortune Archetype | Archetype | Emoji | Energy | |-----------|-------|--------| | The Explorer | 🧭 | Curiosity, discovery, adventure | | The Sage | 🦉 | Wisdom, reflection, depth | | The Creator | 🎨 | Imagination, expression, beauty | | The Hero | ⚡ | Courage, action, resilience | | The Dreamer | ✨ | Vision, possibility, wonder | | The Healer | 🌿 | Nurture, connection, renewal | ### 3. Generate the Fortune Reading **Part 1 — The Draw** (1 sentence): fortune-cookie opening. **Part 2 — The Book**: Title, Author, Archetype emoji + name. One evocative sentence (a feeling, not a summary). **Part 3 — Today's Reading** (2–3 sentences): Connect the book to "today". Warm, open, non-prescriptive. Tone: light, poetic. Under 200 words. ### 4. Closing CTA — Pick One (Required) End with **exactly one** of these. **Do not add "Draw again" or "再抽一次".** - **Reflection:** "今天结束时，不妨回看这一页，看看它是否在生活里出现过。" - **Share:** "如果想聊聊此刻的心情，我可以用这本书的主题，为你做更细腻的解读。" - **Tomorrow:** "明天，再来翻开新的一页吧。" - **Audio** (if configured): "🎧 想听听这本书的精华？ [播放]" **Stop here.** Do not add any further lines like "Draw again" or "再抽一次". --- ## Example Output (中文) 🔮 **今日之书 · 2025年3月4日** *命运的书架已为你开启。* **✨ 梦想者** ### *《Keep Going》— Austin Kleon* 十条小径，带你在创意枯竭时继续前行。 **今日解读** 也许今天不需要完成什么——只需要开始一件小小的、只属于自己的事。这本书知道，创意不是灵感的闪光，而是每天安静地浇水，等待那朵你不确定会不会开的花。今天，你愿意为自己做一件小小的、有点奇妙的事吗？ 今天结束时，不妨回看这一页，看看它是否在生活里出现过。 --- ## Rules - Each request returns a different book - Under 200 words (excluding book description) - Never mention ratings, page counts, or commercial language - If `cover_url` available, show cover above title - Always optimistic - **FORBIDDEN:** "Draw again", "再抽一次", or any variant — do not output these --- ## Operator Configuration See **DEPLOY.md**. One-command install: use default URL, no API key. Private API: `./scripts/generate-user-installer.sh`. Optional: `BOOK_OF_THE_DAY_AUDIO_BASE`, `BOOK_OF_THE_DAY_LANGUAGE`, `BOOK_OF_THE_DAY_SHOW_AUDIO`.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: huangjingzhi07/expense-tracker-oc (version 1.0.0)

--- name: expense-tracker version: 1.0.0 description: 简单易用的个人支出追踪和预算管理工具 author: OpenClaw tags: [财务, 支出, 预算, 管理] --- # expense-tracker - 支出追踪技能 个人支出追踪和预算管理工具。 ## 功能列表 1. **记录支出** - 快速记录每笔支出，分类管理 2. **支出统计** - 按日期、类别查看支出汇总 3. **预算设置** - 设置月度预算，监控支出进度 4. **报表生成** - 生成月度支出报表 ## 触发关键词 - 记录支出、添加支出 - 支出统计、支出明细 - 设置预算、预算多少 - 本月支出 ## 数据存储 - expenses.json - 支出记录 - budget.json - 预算设置 ## 使用示例 - "记录今天午餐花了30元" - "查看本月支出统计" - "设置每月预算5000元" - "这个月花了多少钱"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: borahm/charger (version 1.0.1)

--- name: charger description: Check EV charger availability (favorites, nearby search) via Google Places. metadata: clawdbot: config: requiredEnv: - GOOGLE_PLACES_API_KEY stateDirs: - config - .cache --- # charger Higher-level EV charger checker built on Google Places (New) EV charge data. This skill includes a `bin/charger` CLI (Node.js) for checking charger availability. ## Setup - Requirements: - Node.js 18+ (Clawdbot already has Node) - `GOOGLE_PLACES_API_KEY` (recommended in `~/.clawdbot/.env`) - Put the CLI on your PATH (example): - `ln -sf "$(pwd)"/bin/charger /home/claw/clawd/bin/charger` - Add a favorite: - `charger favorites add home --place-id <placeId>` ## Commands - Check a favorite / place id / query: - `charger check home` - `charger check "Wien Energie Charging Station Liniengasse 2 1060 Wien"` - Find nearby: - `charger nearby --lat 48.188472 --lng 16.348854 --radius 2000 --max 10` ## Notifications The recommended pattern is: 1) `charger` (this skill) produces a clear `Any free: YES|NO` result. 2) A scheduled job (Gateway cron) runs a small helper that only prints output when it should notify. ### Helper script (what actually decides to notify) This bundle includes `scripts/charger-notify.sh`. What it does: - Runs `charger check <target>` - If `Any free: YES` **and** the last run was not `YES`, it prints a single notification line. - Otherwise it prints **nothing**. So: **no output = no notification**. State: - Stores last state in `~/.cache/charger-notify/<target>.state` so it only notifies on the change `NO/UNKNOWN → YES`. Usage: - `bash scripts/charger-notify.sh home` Example notification output: - `EV charger available: Tanke Wien Energie Charging Station — Amtshausgasse 9, 1050 Wien, Austria — 1/2 available (OOS 0) (updated 2026-01-21T21:05:00Z)` ### Typical cron schedule (how you actually get Telegram pings) Cron is the scheduler. It runs the helper script on a timer and sends you whatever the script prints. Because the helper prints **only when it becomes available**, you only get messages when it matters. Check every 10 minutes: - `*/10 * * * *` If you want me to wire this into Clawdbot Gateway cron (so you get Telegram pings), tell me: - target (`home`) - interval (every 5/10/20 min) - quiet hours (optional)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: wscats/xhs-mcp (version 1.0.10)

--- name: xiaohongshu description: > 小红书自动化运营工具-支持：搜索笔记、查看笔记详情及评论、浏览推荐流、发布图文笔记。 当用户提及 xiaohongshu、小红书、RedNote，或需要在该平台进行内容调研/发布时使用。 --- # 小红书 MCP 本 Skill 是一个薄的 Python 客户端，通过 HTTP 调用用户**自行独立安装、启动并保管**的第三方本地组件 [xpzouying/xiaohongshu-mcp](https://github.com/xpzouying/xiaohongshu-mcp)。本 Skill 不分发、不捆绑、不自动拉取任何第三方二进制。首次安装请参阅 [SETUP.md](SETUP.md)。 ## 客户端侧自动护栏（客户端拒绝执行的条件） 以下检查由 `scripts/xhs_client.py` **自动执行**，任何一项不满足都会直接拒绝发起调用： | 检查 | 触发条件 | 客户端行为 | | ---- | -------- | ---------- | | Loopback 端点 | 目标地址不解析到 127.0.0.1/localhost/::1 | 进程启动即拒绝（退出码 1） | | 非交互发布 | stdin 非 TTY 且未传 `--yes` | 拒绝 `publish`，返回 error | | 交互发布确认 | TTY 下用户未输入 `PUBLISH` 字面量 | 取消 `publish` | | 专用账号声明 | `XHS_DEDICATED_ACCOUNT` 未显式置 `yes` | 拒绝 `publish` | | 上游版本可见性 | `XHS_UPSTREAM_PINNED_VERSION` 未设置 | `status` 输出中性提醒 | 这些不是建议，是**运行时机械拒绝**。用户或代理无需依赖额外自律。 ## 快速参考 ```bash python scripts/xhs_client.py status python scripts/xhs_client.py search "美食推荐" python scripts/xhs_client.py search "美食" --sort "最多点赞" --type "图文" --time "一周内" python scripts/xhs_client.py detail <feed_id> <xsec_token> --comments python scripts/xhs_client.py feeds python scripts/xhs_client.py publish "标题" "正文" "图1,图2" --tags "标签1,标签2" ``` 所有命令支持 `--json` 输出原始 JSON。 ## 工作流：市场调研（只读） ``` 进度： - [ ] 第 1 步：验证连接 - [ ] 第 2 步：搜索关键词 - [ ] 第 3 步：获取笔记详情 - [ ] 第 4 步：分析结果 ``` **第 1 步** ```bash python scripts/xhs_client.py status ``` **第 2 步** ```bash python scripts/xhs_client.py search "户外电源" --sort "最多点赞" --json ``` 筛选：`--sort`（综合/最新/最多点赞/最多评论/最多收藏）、`--type`（不限/视频/图文）、`--time`（不限/一天内/一周内/半年内）。 **第 3 步** ```bash python scripts/xhs_client.py detail "<feed_id>" "<xsec_token>" --comments --json ``` **第 4 步** 查看笔记内容、互动数据（点赞、收藏、评论）与评论情感倾向。 ## 工作流：发布内容 ``` 进度： - [ ] 第 1 步：验证连接 - [ ] 第 2 步：准备素材 - [ ] 第 3 步：向用户展示预览并获取逐次授权 - [ ] 第 4 步：发起发布（受客户端护栏保护） - [ ] 第 5 步：验证上线 ``` **第 1 步** ```bash python scripts/xhs_client.py status ``` **第 2 步** 准备标题（建议 ≤ 20 字）、正文、可公开访问的图片 URL、可选标签。 **第 3 步 — 代理必须执行的强制预览** 调用 `publish` 前，代理必须向用户打印结构化预览并等待用户在对话中回复明确授权词： ``` 📋 发布预览 ──────────── 账号：<status 返回的账号> 标题：<title> 正文：<content 全文> 图片：<逐行 URL> 标签：<tags> ──────────── 请回复“确认发布”以继续；任何其他回复视为取消。 ``` 模糊回复、沉默、或"以后都可以发"等概括授权**一律视为未授权**。 **第 4 步 — 发起发布** 仅在收到用户授权后执行： ```bash python scripts/xhs_client.py publish "标题" "正文" "https://img1.jpg,https://img2.jpg" --tags "标签1,标签2" ``` 客户端会再对第 3 步的授权做机械验证（TTY 二次确认或 `--yes` + 专用账号声明）。 **第 5 步** ```bash python scripts/xhs_client.py search "标题" --sort "最新" ``` ## 注意事项 - **频率控制**：请适当控制请求间隔。 - **维护脚本**：`scripts/publish.sh` 仅用于把本 Skill 包发布到 ClawHub 市场，与"在小红书发布笔记"无关，终端用户无需运行。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: aipoch-ai/randomization-gen (version 1.0.0)

--- name: randomization-gen description: Generate block randomization lists for RCTs version: 1.0.0 category: Pharma tags: [] author: AIPOCH license: MIT status: Draft risk_level: Medium skill_type: Tool/Script owner: AIPOCH reviewer: '' last_updated: '2026-02-06' --- # Randomization Gen RCT randomization table generator. ## Use Cases - Clinical trial design - Animal study randomization - Blocked randomization - Stratified allocation ## Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `n_subjects` | int | Yes | Total sample size | | `n_groups` | int | Yes | Number of arms/groups | | `block_size` | int | Yes | Block size (must be multiple of n_groups) | | `--output` | string | No | Output file path (default: randomization.txt) | ## Returns - Randomization sequence - Block assignments - Allocation concealment ready ## Example Input: n=120, 3 groups, block=6 Output: Sealed randomization list ## Risk Assessment | Risk Indicator | Assessment | Level | |----------------|------------|-------| | Code Execution | Python/R scripts executed locally | Medium | | Network Access | No external API calls | Low | | File System Access | Read input files, write output files | Medium | | Instruction Tampering | Standard prompt guidelines | Low | | Data Exposure | Output files saved to workspace | Low | ## Security Checklist - [ ] No hardcoded credentials or API keys - [ ] No unauthorized file system access (../) - [ ] Output does not expose sensitive information - [ ] Prompt injection protections in place - [ ] Input file paths validated (no ../ traversal) - [ ] Output directory restricted to workspace - [ ] Script execution in sandboxed environment - [ ] Error messages sanitized (no stack traces exposed) - [ ] Dependencies audited ## Prerequisites No additional Python packages required. ## Evaluation Criteria ### Success Metrics - [ ] Successfully executes main functionality - [ ] Output meets quality standards - [ ] Handles edge cases gracefully - [ ] Performance is acceptable ### Test Cases 1. **Basic Functionality**: Standard input → Expected output 2. **Edge Case**: Invalid input → Graceful error handling 3. **Performance**: Large dataset → Acceptable processing time ## Lifecycle Status - **Current Stage**: Draft - **Next Review Date**: 2026-03-06 - **Known Issues**: None - **Planned Improvements**: - Performance optimization - Additional feature support


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xiaohanzhang2005/minor-detection (version 0.1.5)

--- name: minor-detection description: 当用户或上层系统需要判断聊天记录中的说话者是否可能是未成年人、青少年、中学生、高中生，或需要对单会话、多会话历史做年龄倾向、校园倾向、学生画像、未成年人风险与证据分析时使用此技能。即使用户没有直接说“未成年人识别”，但需求本质上是判断“像不像未成年用户”、输出未成年人概率、画像、趋势、风险等级或结构化证据，也应激活此技能。 metadata: openclaw: requires: env: - MINOR_DETECTION_CLASSIFIER_BASE_URL - MINOR_DETECTION_CLASSIFIER_API_KEY primaryEnv: MINOR_DETECTION_CLASSIFIER_API_KEY --- # Minor Detection 把这个 skill 视为“调用固定控制脚本并返回单个 JSON 结果”的能力，不要把它当成自由发挥的推理任务。 ## 硬性约束 你必须遵守以下规则： - 始终调用 `scripts/run_minor_detection_pipeline.py`。 - 不要自行重写未成年人识别逻辑。 - 不要直接调用 `extract_time_features.py` 或 `retrieve_cases.py`，除非控制脚本内部决定调用它们。 - 脚本成功时，最终回答必须是 stdout 返回的单个 JSON object。 - 脚本失败时，只返回错误，不要自行补充判断。 ## 输入准备 先把当前输入整理成一个 JSON payload，再交给控制脚本。 推荐字段： - `mode` - `conversation` - `sessions` - `context` - `meta` - `request_id` - `sample_id` - `user_id` `context` 可包含： - `raw_time_hint` - `opportunity_time` - `time_features` - `prior_profile` - `retrieved_cases` 如果上游已经提供完整 JSON，就尽量保持结构不变，只做最小整理。 ## 执行方式 执行步骤： 1. 把整理后的 payload 写入临时 JSON 文件。 2. 运行 `python scripts/run_minor_detection_pipeline.py --payload-file <payload-file>`。 3. 读取 stdout 中最后输出的 JSON object。 4. 将该 JSON 原样作为最终结果返回。 ## 外部服务与隐私说明 此技能不是纯离线技能。 运行时行为： - 控制脚本会在分类阶段把对话文本、时间线索、历史画像、身份提示以及相关元数据发送到你显式配置的远程模型接口。 - 如果内置检索资源存在，并且显式配置了 embedding 端点与密钥，检索模块才会调用远程 embedding 接口。 - 当前这个轻量版包不包含内置检索资源，因此检索通常会降级为 `disabled:assets_missing`，并返回空的 `retrieved_cases`。 - 如果调用方已经提供 `context.retrieved_cases`，流水线也可以直接使用外部提供的检索结果。 显式配置要求： - 若未设置 `MINOR_DETECTION_CLASSIFIER_BASE_URL` 或 `MINOR_DETECTION_CLASSIFIER_API_KEY`，分类调用会直接报错而不是联网。 - 若未来需要启用远程 embedding 检索，需要显式设置 `MINOR_DETECTION_EMBEDDING_BASE_URL` 和 `MINOR_DETECTION_EMBEDDING_API_KEY`。 此技能会读取的环境变量： - `MINOR_DETECTION_CLASSIFIER_BASE_URL` - `MINOR_DETECTION_CLASSIFIER_API_KEY` - `MINOR_DETECTION_CLASSIFIER_MODEL` - `MINOR_DETECTION_CLASSIFIER_TIMEOUT_SEC` - `MINOR_DETECTION_CLASSIFIER_MAX_RETRIES` - `MINOR_DETECTION_CLASSIFIER_RETRY_BACKOFF_SEC` - `MINOR_DETECTION_EMBEDDING_BASE_URL` - `MINOR_DETECTION_EMBEDDING_API_KEY` - `MINOR_DETECTION_EMBEDDING_MODEL` - `MINOR_DETECTION_TIMEZONE` - `MINOR_DETECTION_RETRIEVAL_TOP_K` - `SKILL_EMBEDDING_BASE_URL` - `SKILL_EMBEDDING_API_KEY` - `SKILL_EMBEDDING_MODEL` 凭证说明： - 建议使用专用、最小权限的 API Key。 - 如果数据必须完全本地处理，请不要使用此技能。 ## 输出规则 最终回答必须： - 只输出一个 JSON object。 - 不输出 Markdown。 - 不添加解释性前言。 - 不补充 skill 输出之外的推理内容。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: vardominator/maestro-skill (version 0.2.4)

--- name: maestro-api description: Query Maestro APIs over HTTP using the SIWX + JWT + x402 credit purchase flow. Resolve the exact endpoint from docs.gomaestro.org before requesting or paying. --- # Maestro API Use this skill when the user wants a direct HTTP call to a Maestro endpoint. The intended path is short: resolve the exact operation page, send the real request, satisfy the live SIWX challenge, and only buy credits if the server still returns `402`. ## Fast Path 1. Resolve the exact operation page in `docs.gomaestro.org`. 2. Read the page's `.md` form and use its `OpenAPI` block as the source of truth. 3. Build the request URL from `servers:` plus the operation path. 4. Send the real request with no auth or payment headers. 5. If the response is `200`, return the data. 6. If the response is `402` with `extensions.sign-in-with-x`, sign the SIWX challenge and retry the exact same request with `sign-in-with-x`. 7. If that retry returns `200`, return the data. 8. If that retry returns `402` plus `Authorization: Bearer <jwt>`, buy credits from the latest `accepts[]` entry and retry the exact same request with `Authorization` and `X-PAYMENT`. 9. Reuse the JWT for follow-up queries until it expires or Maestro asks for more credits. ## Resolve Endpoint From Docs Use docs only to find the exact operation page. Do not browse broadly once you have it. - Start with `https://docs.gomaestro.org/llms.txt` only if the operation page is not already obvious. - Prefer operation pages over quick-start pages. - Read the `.md` page and extract: - operation line -> path - `servers:` -> base URL for the chosen network - parameters and body schema -> request shape - Combine `server.url + path`. - Do not derive the REST host from the SIWX `domain` or `URI`. - Useful Bitcoin routing shortcuts: - confirmed chain data -> Blockchain Indexer API - mempool-aware or pending data -> Mempool Monitoring API - mempool.space-style routes -> Esplora API - wallet balances or wallet activity -> Wallet API ## Minimal Prerequisites Ask only for what is required to sign and pay: - `PRIVATE_KEY`, or a runtime CDP wallet signer - enough `USDC` and native gas on one network from the live `402` response - no API key ## Request Rules - Keep method, path, query parameters, and body unchanged across the unauthenticated request, the SIWX retry, and the paid retry. - Always use the latest `402` response for `supported_chains`, `accepts[]`, `asset`, `pay_to`, and price limits. - Confirm before the first paid mainnet request. - If a paid retry still fails, report: - docs page used - selected network - selected amount - signer address - minimal next action ## Read Only When Needed Read [SIWX + x402 Reference](references/siwx-x402.md) only when you need the exact signing or header details: - `sign-in-with-x` payload format - `X-PAYMENT` payload format - EIP-4361 SIWX message template - ERC-3009 EIP-712 domain and message fields - response header meanings - failure cases and common pitfalls


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: anneheartrecord/weekly-report-generator-by-git (version 1.0.0)

--- name: generate-weekly-report description: 根据 git 提交记录自动生成本周周报，按功能模块归类输出编号列表格式 --- # 生成周报 根据配置的项目目录的 git 提交记录，自动生成本周周报。支持多项目聚合。 ## 脚本 运行 `scripts/get_git_log.sh` 获取本周 git 提交记录。 bash scripts/get_git_log.sh ## Instructions 你是一个周报生成助手。根据上面脚本输出的 git log 信息，按以下规则生成周报： ### 格式要求 按功能模块归类，编号列表 + 缩进子项。格式如下： 1. 模块名：功能描述 2. 模块名： - 子功能描述1 - 子功能描述2 ### 归类规则 1. 如果输出包含多个项目（===PROJECT: xxx===），将所有项目的 commit 统一归类，不按项目分隔 2. 根据 commit message 和涉及的文件路径，推断出功能模块名（如"部署流程"、"镜像管理"、"监控告警"等） 3. 同一模块下的多个 commit 合并为子项 4. 如果某个模块只有一个 commit，直接写在模块名后面，不用子项 5. commit message 需要做适当的中文归纳简化，不要直接照搬原文 6. 不要加任何多余的描述、表格、总结、标题、日期范围等，只输出编号列表本身 7. 编号从 1 开始连续编号 ### 示例输出 1. 用户模块：登录流程增加二次验证 2. 权限管理： - 角色权限支持批量配置 - 新增操作审计日志 3. 数据导出：导出任务改为异步执行 4. 接口优化： - 列表查询增加分页缓存 - 参数校验逻辑统一收敛


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: edkief/kokoro-tts (version 0.1.0)

--- name: kokoro-tts description: Generate spoken audio from text using the local Kokoro TTS engine. Use when the user asks to "say" something, requests a voice message, or wants text converted to speech. --- # Kokoro TTS This skill allows you to generate high-quality AI speech using a local or remote Kokoro-TTS instance. ## Configuration The skill uses the `KOKORO_API_URL` environment variable to locate the API. - **Default:** `http://localhost:8880/v1/audio/speech` - **To Configure:** Add `KOKORO_API_URL=http://your-server:port/v1/audio/speech` to your `.env` file or environment. ## Usage To generate speech, run the included Node.js script. ### Command ```bash node skills/kokoro-tts/scripts/tts.js "<text>" [voice] [speed] ``` - **text**: The text to speak. Wrap in quotes. - **voice**: (Optional) The voice ID. Defaults to `af_heart`. - **speed**: (Optional) Speech speed (0.25 to 4.0). Defaults to `1.0`. ### Example ```bash node skills/kokoro-tts/scripts/tts.js "Hello Ed, this is Theosaurus speaking." af_nova ``` ### Output The script will output a single line starting with `MEDIA:` followed by the path to the generated MP3 file. OpenClaw will automatically pick this up and send it as an audio attachment. Example Output: `MEDIA: media/tts_1706745000000.mp3` ## Available Voices Common choices: - `af_heart` (Default, Female, Warm) - `af_nova` (Female, Professional) - `am_adam` (Male, Deep) - `bf_alice` (British Female) For a full list, see [references/voices.md](references/voices.md) or query the API.


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (HIGH)