OpenClaw/clawhub-security-signals huggingface dataset:
Skill: liuliwanzi/curl-to-postman (version 1.0.1)

--- name: curl-to-postman description: Convert curl commands to Postman Collection v2.1 importable JSON --- # curl-to-postman Convert curl commands into Postman-importable JSON with a single paste. ## Usage Paste a curl command and receive a formatted Postman Collection v2.1 JSON that you can import directly into Postman via the Import button. ## What it converts | curl flag | Postman field | |-----------|---------------| | `-X METHOD` / `--request METHOD` | request method (default: GET) | | `-H "Key: Value"` / `--header "Key: Value"` | request headers | | `-d "body"` / `--data "body"` / `--data-raw "body"` | request body | | `--user user:pass` / `-u user:pass` | Basic Auth header | | `-H "Authorization: Bearer token"` | Bearer token (preserved as-is) | | URL query string `?key=value` | url.query[] | ## Supported options - **SSL**: `-k` / `--insecure` → `checkDisableSSLValidation: true` - **Redirects**: `-L` / `--location` → follow redirects - **Auth**: `--user` / `-u` → Basic Auth; Bearer token via `-H` takes priority ## Output structure ```json { "info": { "name": "Converted from curl", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" }, "item": [ { "name": "POST /endpoint", "request": { "method": "POST", "header": [{ "key": "Content-Type", "value": "application/json" }], "url": { "raw": "https://api.example.com/users", "protocol": "https", "host": ["api", "example", "com"], "path": ["users"], "query": [] }, "body": { "mode": "raw", "raw": "{\"name\":\"John\"}" } } } ] } ``` ## Example **Input:** ```bash curl -X POST https://api.example.com/users \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ***" \ -d '{"name":"John","email":"[REDACTED_SECRET]"}' ``` **Output:** Postman Collection v2.1 JSON ready to import. ## Notes - If no `Content-Type` is set but a body is present, defaults to `application/json` - URL query parameters are automatically parsed into the `query` array - Output is pretty-printed and can be pasted directly into Postman's Import dialog


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: wukaikai522/pinduoduo-automation (version 2.0.2)

# 拼多多管家 - 店铺运营自动化系统 ## 🎯 技能概述 整合版拼多多商家自动化管家，融合店铺运营、数据分析、竞品监控、自动定价等核心能力。 ## 🔧 核心能力 ### 1. 店铺运营管理 - 商品上下架自动化 - 库存同步与预警 - 订单自动处理 - 物流跟踪 ### 2. 数据分析 - 销售日报/周报/月报 - 流量来源分析 - 转化率监控 - ROI 计算 ### 3. 竞品监控 - 价格监控与预警 - 销量追踪 - 评价分析 - 差异化建议 ### 4. 智能定价 - 成本 + 利润自动计算 - 竞品价格对比 - 动态定价策略 - 促销活动建议 ### 5. 营销自动化 - 详情页自动生成 - 客服话术库 - 促销活动配置 - 评价回复模板 ## 📁 文件结构 ``` pinduoduo-automation/ ├── SKILL.md # 本文件 ├── README.md # 使用文档 ├── config.yaml # 配置文件 ├── scripts/ │ ├── product_manager.sh # 商品管理 │ ├── order_processor.sh # 订单处理 │ ├── data_analyzer.sh # 数据分析 │ ├── competitor_monitor.sh # 竞品监控 │ └── pricing_engine.sh # 定价引擎 └── reports/ # 报告输出目录 ``` ## ⚙️ 快速开始 ### 1. 配置店铺信息 ```bash # 编辑配置文件 nano ~/.openclaw/workspace/skills/pinduoduo-automation/config.yaml # 填写店铺 ID、API 密钥等 ``` ### 2. 运行诊断 ```bash # 检查配置 pinduoduo-automation diagnose # 测试连接 pinduoduo-automation test-connection ``` ### 3. 执行任务 ```bash # 生成销售日报 pinduoduo-automation daily-report # 监控竞品价格 pinduoduo-automation monitor-competitors # 自动定价建议 pinduoduo-automation pricing-suggestions ``` ## 📊 报告输出 - 每日销售报告：`reports/daily-YYYY-MM-DD.md` - 竞品分析报告：`reports/competitor-YYYY-MM-DD.md` - 定价建议报告：`reports/pricing-YYYY-MM-DD.md` ## 🔐 安全说明 - API 密钥加密存储 - 操作日志记录 - 敏感数据脱敏 - 权限最小化原则 ## 💰 商业模式 - 自用：免费 - 多店铺管理：按需定制 - 数据分析报告：可对外服务 --- **版本**: 2.0.0 (整合版) **状态**: 开发中 **优先级**: 最高


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: terrycarter1985/zh-en-translator (version 1.0.0)

--- name: zh-en-translator description: "中英互译工具。支持中文与英文的双向翻译。Use when: (1) translating Chinese text to English, (2) translating English text to Chinese, (3) user asks to translate between Chinese and English, (4) user mentions 中英互译, 翻译, translate, 中译英, 英译中." --- # 中英互译工具 提供中文与英文之间的双向翻译。 ## 工作流程 1. 检测输入文本语言（中文或英文） 2. 若为中文 → 翻译为英文；若为英文 → 翻译为中文 3. 输出翻译结果，格式：原文 → 译文 ## 翻译原则 - 信达雅优先，忠于原文语义 - 保持自然流畅的目标语言表达 - 专有名词、成语、俗语采用通行译法 - 保留原文语气（正式/口语/幽默等） ## 示例 输入：`周末我们一起去图书馆查阅资料吧` 输出：`Let's go to the library together this weekend to look up some materials.` 输入：`The early bird catches the worm.` 输出：`早起的鸟儿有虫吃。`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: googleworkspace-bot/recipe-batch-invite-to-event (version 1.0.12)

--- name: recipe-batch-invite-to-event description: "Add a list of attendees to an existing Google Calendar event and send notifications." metadata: version: 0.22.5 openclaw: category: "recipe" domain: "scheduling" requires: bins: - gws skills: - gws-calendar --- # Add Multiple Attendees to a Calendar Event > **PREREQUISITE:** Load the following skills to execute this recipe: `gws-calendar` Add a list of attendees to an existing Google Calendar event and send notifications. ## Steps 1. Get the event: `gws calendar events get --params '{"calendarId": "primary", "eventId": "EVENT_ID"}'` 2. Add attendees: `gws calendar events patch --params '{"calendarId": "primary", "eventId": "EVENT_ID", "sendUpdates": "all"}' --json '{"attendees": [{"email": "[REDACTED_SECRET]"}, {"email": "[REDACTED_SECRET]"}, {"email": "[REDACTED_SECRET]"}]}'` 3. Verify attendees: `gws calendar events get --params '{"calendarId": "primary", "eventId": "EVENT_ID"}'`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: up2itnow/agentwallet-sdk (version 1.1.0)

# Agent Wallet SDK Skill Non-custodial wallet SDK for autonomous AI agents. Handles x402 payments, CCTP V2 cross-chain bridge transfers, ERC-8004 agent identity, and Uniswap V3 token swaps — all without holding user keys. ## When to Use Use this skill when an AI agent needs to: - Create or manage a non-custodial wallet (ERC-4337 smart account) - Make x402 HTTP payments to APIs - Bridge tokens cross-chain via CCTP V2 (Circle) - Swap tokens via Uniswap V3 - Register or verify agent identity via ERC-8004 - Sign transactions autonomously without custodial risk ## Installation ```bash npm install agentwallet-sdk ``` Current version: **v2.4.1** on npm (158 tests passing, 0 compile errors) ## Core Modules ### WalletModule — Account Abstraction (ERC-4337) ```typescript import { AgentWallet } from 'agentwallet-sdk'; const wallet = await AgentWallet.create({ chain: 'base', signer: privateKey, // Agent's own key — never custodied }); // Send ETH await wallet.transfer({ to: recipient, value: '0.01' }); // Get balance const balance = await wallet.getBalance(); ``` ### PaymentModule — x402 HTTP Payments ```typescript // Pay for API access automatically const response = await wallet.x402Pay({ url: 'https://api.example.com/data', maxPayment: '0.001', // ETH }); ``` ### BridgeModule — CCTP V2 Cross-Chain ```typescript // Bridge USDC from Base to Ethereum await wallet.bridge({ token: 'USDC', amount: '100', fromChain: 'base', toChain: 'ethereum', }); ``` ### SwapModule — Uniswap V3 ```typescript // Swap ETH for USDC await wallet.swap({ tokenIn: 'ETH', tokenOut: 'USDC', amount: '0.5', slippage: 0.5, // 0.5% }); ``` ### IdentityModule — ERC-8004 ```typescript // Register agent identity on-chain await wallet.registerIdentity({ name: 'MyTradingAgent', capabilities: ['x402-payment', 'swap', 'bridge'], }); // Verify another agent const verified = await wallet.verifyAgent(agentAddress); ``` ## Security Model - **Non-custodial**: Agent holds its own private key. No server stores keys - **ERC-4337 Smart Accounts**: Gas abstraction, batch transactions, session keys - **No oracle dependencies**: No external price feed reliance (prevents oracle manipulation attacks) - **Audited**: forge test suite 129/129 passing on smart contracts ## Integration with Other Skills ### With Mastra (AI Framework) ```bash npm install @agent-wallet/mastra-plugin ``` Provides 10 Mastra tools: `getBalance`, `transfer`, `swap`, `bridge`, `x402Pay`, `registerIdentity`, `verifyAgent`, `getTransactionHistory`, `estimateGas`, `getChainInfo`. ### With ClawPay MCP ```bash npm install clawpay-mcp ``` Exposes wallet operations as MCP tools for any MCP-compatible agent. ## Links - npm: [agentwallet-sdk](https://www.npmjs.com/package/agentwallet-sdk) - Mastra plugin: [@agent-wallet/mastra-plugin](https://www.npmjs.com/package/@agent-wallet/mastra-plugin) - ClawPay MCP: [clawpay-mcp](https://www.npmjs.com/package/clawpay-mcp)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: xwchris/dy-caption (version 1.0.0)

--- name: dy-caption version: 1.0.0 description: 提取抖音视频语音并转成文字。使用场景：(1) 用户要求提取抖音/短视频文案字幕 (2) 用户提供抖音分享链接想转文字 (3) 用户想查询转写余额或历史。requires: binaries: - curl sendsDataTo: - https://api.dycaption.cn --- # 抖音字幕提取 通过 `dy-caption` 服务把抖音视频里的语音转成文字。 > **注意**：本技能会将抖音分享链接 / 分享文案 与 API Key 发送到 dy-caption 服务，请确认你信任该服务后再使用。 ## 认证 调用接口前需要先准备 API Key： ```bash export DY_CAPTION_API_KEY="你的 API Key" ``` ## 快速使用 ```bash # 提交转写任务 curl -X POST https://api.dycaption.cn/api/v1/transcribe \ -H "X-[REDACTED_SECRET]" \ -H "Content-Type: application/json" \ -d '{"input":"7.53 复制打开抖音，看看【示例】 https://v.douyin.com/xxxx/"}' # 查询余额 curl -X GET https://api.dycaption.cn/api/v1/credits \ -H "X-[REDACTED_SECRET]" # 查询历史 curl -X GET https://api.dycaption.cn/api/v1/history \ -H "X-[REDACTED_SECRET]" ``` ## 任务流程 1. 提交 `/api/v1/transcribe` 2. 记录返回的 `taskId` 3. 轮询 `/api/v1/transcribe/:taskId` 4. 任务完成后读取 `text` ## 相关链接 - CLI 工具：https://github.com/xwchris/douyin-caption-cli - API 服务：https://api.dycaption.cn


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: merjua14/gia-openclaw-setup-guide (version 1.0.0)

# OpenClaw Setup Guide Skill Help users install and configure OpenClaw from scratch. Covers installation, channel connection, skill setup, and first automation workflow. ## What This Skill Does Guides a new OpenClaw user through: 1. Installing OpenClaw on their machine (Mac/Linux/Windows WSL) 2. Running the onboarding wizard 3. Connecting messaging channels (Telegram, Discord, WhatsApp, Slack) 4. Installing and configuring skills 5. Setting up their first automation workflow 6. Configuring heartbeats and cron jobs 7. Setting up memory and identity files ## Usage When a user asks for help setting up OpenClaw, follow these steps in order: ### Step 1: System Check ```bash # Check OS and prerequisites uname -a node --version # Need Node.js 18+ git --version ``` ### Step 2: Install OpenClaw ```bash curl -fsSL https://openclaw.ai/install.sh | bash openclaw onboard --install-daemon ``` ### Step 3: Connect a Channel ```bash # For Telegram (most common) openclaw channels add telegram # Follow prompts for bot token from @BotFather # For Discord openclaw channels add discord # Provide bot token from Discord Developer Portal ``` ### Step 4: Configure Identity Create these files in the workspace: - `SOUL.md` — Agent personality and behavior - `USER.md` — Information about the human - `AGENTS.md` — Operating procedures - `IDENTITY.md` — Name, emoji, avatar ### Step 5: Install Skills ```bash # Browse available skills openclaw skills search <keyword> # Install a skill openclaw skills install <skill-name> ``` ### Step 6: Set Up Automation - Configure heartbeat interval in openclaw config - Set up cron jobs for recurring tasks - Create HEARTBEAT.md for proactive behaviors ### Step 7: First Workflow Test Send a message to your agent on the connected channel. Try: - "Search the web for [topic]" - "Read and summarize [file]" - "Set a reminder for [time]" ## Troubleshooting ### Common Issues - **Node.js version too old**: `nvm install 22 && nvm use 22` - **Permission denied**: `sudo chown -R $USER ~/.openclaw` - **Bot not responding**: Check `openclaw status` and `openclaw gateway logs` - **Channel connection failed**: Verify token, check firewall/proxy settings ## Requirements - Node.js 18+ (22 recommended) - 2GB RAM minimum - macOS, Linux, or Windows with WSL2 - Internet connection for API calls ## Cost - OpenClaw itself: Free (open source) - AI model API: ~$5-50/month depending on usage - Hosting (optional): $5-20/month for always-on

path: config.json
content: {
  "name": "gia-openclaw-setup-guide",
  "version": "1.0.0",
  "description": "Complete guide to installing and configuring OpenClaw from scratch. Covers installation, channel setup, skills, automation workflows, and troubleshooting.",
  "author": "GIA Digital",
  "tags": ["setup", "installation", "onboarding", "getting-started", "tutorial"],
  "category": "utilities"
}


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: nagellack5c/lan-media-server (version 1.0.0)

--- name: lan-media-server description: Share images, screenshots, and files from the AI workspace to users on the local network via HTTP. Use when the agent needs to show images, browser screenshots, or any files to the user and the current channel doesn't support inline media (e.g., webchat, CLI). Starts a lightweight Node.js static file server on LAN, managed by systemd. Drop files in the shared directory and send the user a clickable URL. --- # LAN Media Server Lightweight HTTP file server for sharing agent-generated media (screenshots, images, documents) with users on the local network. ## Why Many AI assistant channels (webchat, CLI, SSH) can't display inline images. This skill solves that by serving files over HTTP on your LAN — drop a file, send a link. ## Quick Start ```bash bash scripts/setup.sh ``` This creates the shared directory, installs the server script, creates a systemd user service, and starts it. **Default config:** - Port: `18801` - Serve directory: `$HOME/projects/shared-media` - Accessible at: `http://<LAN_IP>:18801/<filename>` Override with environment variables: ```bash MEDIA_PORT=9090 MEDIA_ROOT=/tmp/media bash scripts/setup.sh ``` ## Usage Pattern When you need to show an image or file to the user: 1. Save/copy the file to the shared media directory 2. Send the user a link: `http://<server-LAN-IP>:<port>/<filename>` Example for browser screenshots: ```bash cp /path/to/screenshot.jpg ~/projects/shared-media/my-screenshot.jpg # Then send: http://192.168.1.91:18801/my-screenshot.jpg ``` Use descriptive filenames — the directory is flat and user-visible. ## Management ```bash # Check status systemctl --user status media-server # Restart systemctl --user restart media-server # View logs journalctl --user -u media-server -f # Stop and disable systemctl --user stop media-server systemctl --user disable media-server ``` ## Security Notes - Serves files only on LAN (0.0.0.0 but typically behind NAT) - No authentication — don't put sensitive files in the shared directory - Path traversal is blocked (files must be under MEDIA_ROOT) - No directory listing — must know the exact filename


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: tobeyrebecca/toby-generate-pediatric-dental-clinic-client-education-handout (version 1.0.0)

--- name: Generate Pediatric Dental Clinic Client Education Handout description: "Create a polished explainer handout with visuals, FAQs, and clear next steps for a pediatric dental clinic. Use when handling client education work for..." version: "1.0.0" allowed-tools: Bash, Read metadata: openclaw: emoji: "📝" homepage: "https://www.skillboss.co/skills/generate-pediatric-dental-clinic-client-education-handout" --- > 📖 **Complete setup guide**: https://skillboss.co/skill.md # Generate Pediatric Dental Clinic Client Education Handout Create a polished explainer handout with visuals, FAQs, and clear next steps for a pediatric dental clinic. Use when handling client education work for... ## Use When Use this skill for client education work for pediatric dentists, dental office managers. ## Workflow 1. Clarify the audience, business goal, constraints, and deliverable. 2. Produce the strongest first draft for the target use case. 3. Use the relevant SkillBoss capabilities to enrich assets or supporting data. 4. Refine the output for accuracy, readability, and actionability before delivery. ## SEO / GEO - Primary keywords: pediatric dental clinic education handout, pediatric dental clinic client explainer, pediatric dental clinic FAQ guide, pediatric dental clinic visual handout - Search intent: client education - Canonical slug: `generate-pediatric-dental-clinic-client-education-handout` - Install query: Install Generate Pediatric Dental Clinic Client Education Handout with SkillBoss ## APIs Used - `chat` - `image_generation` ## Suggested Prompt [Generate Pediatric Dental Clinic Client Education Handout] for my pediatric dental clinic ## Notes - Create a polished explainer handout with visuals, FAQs, and clear next steps for a pediatric dental clinic - Use human review before sending patient-facing content or relying on regulated medical claims. ## SEO Keywords - pediatric dental clinic education handout - pediatric dental clinic client explainer - pediatric dental clinic FAQ guide - pediatric dental clinic visual handout


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: chengcheng8632/tender-bid-generator (version 1.0.0)

--- name: tender-bid-generator description: Generate high-quality bid documents from tender documents. Use when users need to create bid proposals based on tender documents, including extracting tender requirements, generating bid document structure, writing section content, and outputting Word format documents. Supports parsing tender documents in PDF, Word, TXT formats, automatically identifying key information such as project details, qualification requirements, technical specifications, and evaluation criteria to generate complete bid documents that meet standards. 适用于：招标文件、投标文件、标书制作、投标书生成、招投标文档。 --- # 投标文件生成器 根据招标文件自动生成专业、高质量的投标文件。 ## 工作流程 ### 1. 读取招标文件 支持格式：PDF、DOCX、TXT 使用脚本解析招标文件： ```bash python3 scripts/parse_tender.py <招标文件路径> ``` 输出为JSON格式的关键信息提取结果。 ### 2. 分析招标要求 提取以下关键信息： - **项目基本信息**：项目名称、编号、采购单位、预算金额 - **资质要求**：企业资质、人员资质、业绩要求 - **技术规格**：产品/服务技术要求、参数指标 - **商务条款**：交货期、付款方式、质保期 - **评分标准**：分值分布、评分细则 - **投标文件要求**：格式、份数、装订、密封要求 ### 3. 生成投标文件结构 标准投标文件结构： ``` 1. 投标函 2. 法定代表人授权书 3. 投标报价表 4. 资格证明文件 - 营业执照 - 资质证书 - 财务报表 - 业绩证明 5. 技术响应文件 - 技术方案 - 产品说明 - 实施计划 6. 商务响应文件 - 交货期承诺 - 售后服务 - 培训方案 7. 其他材料 ``` ### 4. 撰写内容 参考 [references/writing-guide.md](references/writing-guide.md) 撰写各章节内容： - 使用专业、规范的商务语言 - 针对评分标准逐条响应 - 突出企业优势和竞争力 - 确保内容完整、逻辑清晰 ### 5. 输出文档 使用 [assets/bid-template.txt](assets/bid-template.txt) 模板生成最终投标文件（可导入Word使用）。 ## 使用示例 **用户**: "帮我根据这个招标文件生成投标文件" **执行步骤**: 1. 确认招标文件路径 2. 运行解析脚本提取关键信息 3. 分析招标要求 4. 基于模板生成投标文件 5. 输出Word文档 ## 注意事项 - 生成的投标文件需人工审核后使用 - 确保所有资质证明文件真实有效 - 报价部分需根据实际情况填写 - 技术方案需结合企业实际能力 - 注意投标截止时间，预留足够准备时间


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: podcasting101/chrome-devtools (version 0.1.1)

--- name: chrome-devtools description: Uses Chrome DevTools via MCP for efficient debugging, troubleshooting and browser automation. Use when debugging web pages, automating browser interactions, analyzing performance, or inspecting network requests. --- ## Core Concepts **Browser lifecycle**: Browser starts automatically on first tool call using a persistent Chrome profile. Configure via CLI args in the MCP server configuration: `npx chrome-devtools-mcp@latest --help`. **Page selection**: Tools operate on the currently selected page. Use `list_pages` to see available pages, then `select_page` to switch context. **Element interaction**: Use `take_snapshot` to get page structure with element `uid`s. Each element has a unique `uid` for interaction. If an element isn't found, take a fresh snapshot - the element may have been removed or the page changed. ## Workflow Patterns ### Before interacting with a page 1. Navigate: `navigate_page` or `new_page` 2. Wait: `wait_for` to ensure content is loaded if you know what you look for. 3. Snapshot: `take_snapshot` to understand page structure 4. Interact: Use element `uid`s from snapshot for `click`, `fill`, etc. ### Efficient data retrieval - Use `filePath` parameter for large outputs (screenshots, snapshots, traces) - Use pagination (`pageIdx`, `pageSize`) and filtering (`types`) to minimize data - Set `includeSnapshot: false` on input actions unless you need updated page state ### Tool selection - **Automation/interaction**: `take_snapshot` (text-based, faster, better for automation) - **Visual inspection**: `take_screenshot` (when user needs to see visual state) - **Additional details**: `evaluate_script` for data not in accessibility tree ### Parallel execution You can send multiple tool calls in parallel, but maintain correct order: navigate → wait → snapshot → interact. ## Troubleshooting If `chrome-devtools-mcp` is insufficient, guide users to use Chrome DevTools UI: - https://developer.chrome.com/docs/devtools - https://developer.chrome.com/docs/devtools/ai-assistance If there are errors launching `chrome-devtools-mcp` or Chrome, refer to https://github.com/ChromeDevTools/chrome-devtools-mcp/blob/main/docs/troubleshooting.md.

path: skill.json
content: {
  "name": "chrome-devtools",
  "protocol": "mcp",
  "command": "npx",
  "args": [
    "-y",
    "chrome-devtools-mcp@latest",
    "--chrome-arg=--no-sandbox",
    "--chrome-arg=--disable-setuid-sandbox"
  ]
}

Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)