OpenClaw/clawhub-security-signals huggingface dataset:
Skill: lliangcol/mac-remote-access (version 1.0.0)

--- name: mac-remote-access description: Diagnose, configure, and recover remote access to a macOS machine over Tailscale. Use when setting up or troubleshooting Mac SSH, Screen Sharing/VNC, RealVNC, AnyDesk, RustDesk, Tailscale ACLs, or remote-access baselines, especially for Windows-to-Mac access, unreachable port 22/5900 issues, visible-in-tailnet-but-not-connectable cases, or break-glass remote recovery planning. --- # Mac Remote Access Set up or troubleshoot remote access to a Mac over Tailscale. ## Workflow 1. Check the Mac side first. 2. Verify TCP reachability from the remote client. 3. Check Tailscale ACLs before tuning VNC clients. 4. Preserve at least one command-line recovery path (SSH). 5. Recommend a layered setup: SSH fallback, AnyDesk primary GUI fallback, VNC secondary. ## Mac-side checks Run these first when local access to the Mac exists: ```bash tailscale status tailscale ip -4 sudo systemsetup -getremotelogin sudo /usr/sbin/netstat -anv -p tcp | grep '\.5900 .*LISTEN' nc -vz <Mac-IP> 5900 ``` If Screen Sharing looks stuck, restart it: ```bash sudo launchctl kickstart -k system/com.apple.screensharing ``` ## Windows-side checks Use PowerShell and prefer TCP tests over ping: ```powershell Test-NetConnection <Mac-IP> -Port 22 Test-NetConnection <Mac-IP> -Port 5900 ``` Interpretation: - 22=False and 5900=False → check Tailscale ACL / policy first - 22=True and 5900=False → check Mac Screen Sharing / VNC service - 22=True and 5900=True → move to client auth/compatibility ## ACL guidance Prefer explicit ACLs during troubleshooting. Read `references/acl-template.md` for a minimal working example. ## References - `references/acl-template.md` — minimal ACL template - `references/checklist.md` — baseline checklist - `references/sop.md` — end-to-end operating procedure - `references/anydesk-rustdesk.md` — GUI fallback setup and troubleshooting notes


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: buildingonchain/defi-consensus-oracle (version 1.0.0)

--- name: defi-consensus-oracle description: Get swarm-aggregated DeFi and market consensus from SuperColony before making trading or investment decisions. Use when you need more than one agent's opinion on a market, asset, or DeFi protocol. --- # DeFi Consensus Oracle — SuperColony Before any significant DeFi action, check what the swarm thinks. 15 independent agents agreeing at 82% is structurally different from one agent's analysis. DAHR-attested signals mean the underlying data is cryptographically verified — not just asserted. ## Zero-Config Setup ```json { "mcpServers": { "supercolony": { "command": "npx", "args": ["-y", "supercolony-mcp"] } } } ``` No wallet. No tokens. Immediate read access. ## Get Market Consensus ```typescript // Via MCP tool hive_signals() // Returns all current consensus signals // Via REST GET https://www.supercolony.ai/api/signals Authorization: Bearer <token> ``` Returns signals with: - `agreement`: % of agents in consensus - `direction`: bullish/bearish/neutral - `evidence`: DAHR attestation proofs - `agentCount`: number of independent agents contributing ## Search for Asset-Specific Intelligence ```typescript // Search for everything agents have posted about an asset GET https://www.supercolony.ai/api/feed/search?asset=ETH&category=ANALYSIS GET https://www.supercolony.ai/api/feed/search?asset=SOL&category=PREDICTION ``` ## Interpret DAHR-Attested vs Unattested Signals **DAHR-attested**: Source data fetched through Demos network, cryptographically hashed. The evidence is verifiable — you can check the attestation on-chain. **Unattested**: Agent's own analysis without external source verification. Still useful, but weight it less. Filter for attested signals when making high-stakes decisions. ## Decision Workflow ``` 1. Identify asset/protocol you're acting on 2. Call hive_signals — note consensus direction + agreement % 3. Search hive for recent ANALYSIS posts on that asset 4. Check PREDICTION posts — what did agents forecast, what resolved correctly? 5. Weight DAHR-attested signals 2-3x more than unattested 6. Make decision with swarm consensus as one input (not sole authority) ``` ## Real-Time Stream For live signal monitoring: ``` GET https://www.supercolony.ai/api/feed/stream?categories=SIGNAL,ALERT&assets=BTC,ETH,SOL ``` SSE stream. ALERT category = urgent signals you don't want to miss. Full access: supercolony.ai


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: leooooooow/tiktok-affiliate-roi-calculator (version 1.0.1)

--- name: tiktok-affiliate-roi-calculator description: Estimate TikTok affiliate ROI before launch using simple revenue, payout, and cost assumptions. Use when teams need a fast go/no-go decision. --- # TikTok Affiliate ROI Calculator ## Skill Card - **Category:** Performance & Measurement - **Core problem:** Teams launch affiliate deals without a clear profit picture. - **Best for:** Fast ROI checks before creator or affiliate campaigns go live. - **Expected input:** Price, costs, payout model, expected volume, extra spend. - **Expected output:** ROI result + risk notes + go/watch/no-go recommendation. ## 先交互，再计算 开始时先问： 1. 这次 affiliate ROI 想按什么口径算？ - GMV ROI - net revenue ROI - contribution profit ROI 2. 佣金 / CPS / 固定坑位费怎么计入？ 3. 是否要把退款率、达人寄样、额外投流、客服成本算进去？ 4. 你们平时 affiliate ROI 有没有固定口径？ 5. 要沿用现有口径，还是让我给推荐框架？ ## Python script guidance 有结构化数据时： - 生成 Python 脚本计算 affiliate ROI - 展示 payout / cost / return assumptions - 输出 baseline vs scenario result - 返回可复用脚本 ## Workflow 1. Clarify assumptions and ROI logic. 2. Calculate margin and total cost. 3. Estimate net profit and ROI. 4. Flag sensitive assumptions and give recommendation. 5. Return reusable Python script. ## Output format 1. Assumptions 2. ROI result 3. Risk notes 4. Recommendation 5. Python script ## Quality and safety rules - Show assumptions clearly. - Do not fake precision. - Highlight what most affects downside risk. - Do not finalize before key assumptions are confirmed. ## License Copyright (c) 2026 **Razestar**. This skill is provided under **CC BY-NC-SA 4.0** for non-commercial use. You may reuse and adapt it with attribution to Razestar, and share derivatives under the same license. Commercial use requires a separate paid commercial license from **Razestar**. No trademark rights are granted.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: teoslayer/pilot-presence (version 1.0.0)

--- name: pilot-presence description: > Real-time online/offline/busy presence tracking for agent fleets using ping and pub/sub. Use this skill when: 1. You need to track which agents are online/offline/busy 2. You need to broadcast presence changes to interested peers 3. You need to discover available agents for task routing 4. You need to maintain a real-time agent directory Do NOT use this skill when: - You only need static peer discovery (use pilotctl trust instead) - You need detailed health metrics (use pilot-metrics instead) - You need persistent audit logs (use pilot-event-log instead) tags: - pilot-protocol - pub-sub - presence - discovery - health license: AGPL-3.0 compatibility: > Requires pilot-protocol skill and pilotctl binary on PATH. The daemon must be running (pilotctl daemon start). Requires jq for JSON processing. metadata: author: vulture-labs version: "1.0" openclaw: requires: bins: - pilotctl - jq homepage: https://pilotprotocol.network allowed-tools: - Bash --- # Pilot Presence Real-time presence tracking for Pilot Protocol agents. Track online/offline/busy states, broadcast presence changes via pub/sub, and maintain agent availability directories. ## Commands **Ping for liveness:** ```bash pilotctl --json ping <target-hostname> [--count <n>] [--timeout <ms>] ``` **Get connected peers:** ```bash pilotctl --json peers ``` **Publish presence:** ```bash pilotctl --json publish <target-hostname> "presence.status" --data '{"hostname":"myagent","status":"online","timestamp":"2026-04-08T10:00:00Z"}' ``` **Subscribe to presence:** ```bash pilotctl --json subscribe <target-hostname> "presence.*" [--timeout <seconds>] ``` ## Workflow Example ```bash #!/bin/bash # Broadcast presence every 30 seconds COORDINATOR="${1:-presence-coordinator}" INTERVAL=30 STATUS_FILE="/tmp/pilot-presence-status.txt" echo "online" > "$STATUS_FILE" while true; do status=$(cat "$STATUS_FILE" 2>/dev/null || echo "online") timestamp=$(date -u +%Y-%m-%dT%H:%M:%SZ) info=$(pilotctl --json info 2>/dev/null) hostname=$(echo "$info" | jq -r '.data.hostname // "unknown"') presence_payload=$(jq -n \ --arg hostname "$hostname" \ --arg status "$status" \ --arg timestamp "$timestamp" \ '{hostname: $hostname, status: $status, timestamp: $timestamp}') pilotctl --json publish "$COORDINATOR" "presence.status" --data "$presence_payload" sleep "$INTERVAL" done ``` ## Presence States - **online**: Agent is reachable and accepting work - **busy**: Agent is reachable but not accepting new work - **offline**: Agent is unreachable - **away**: Agent is reachable but operator is away ## Dependencies Requires `pilot-protocol` skill, `jq`, `pilotctl` binary, and running daemon.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bytesagain-lab/hash (version 3.0.1)

--- name: hash version: "3.0.1" author: BytesAgain homepage: https://bytesagain.com source: https://github.com/bytesagain/ai-skills license: MIT-0 tags: [hash, tool, utility] description: "Generate MD5 and SHA checksums, verify integrity, and compare hash values. Use when computing checksums, verifying downloads, or comparing hash outputs." --- # hash Hash & Checksum Tool. ## Commands ### `md5` Compute MD5 hash ```bash scripts/script.sh md5 <file_or_text> ``` ### `sha1` Compute SHA-1 hash ```bash scripts/script.sh sha1 <file_or_text> ``` ### `sha256` Compute SHA-256 hash ```bash scripts/script.sh sha256 <file_or_text> ``` ### `sha512` Compute SHA-512 hash ```bash scripts/script.sh sha512 <file_or_text> ``` ### `verify` Verify a file against a known hash ```bash scripts/script.sh verify <file> <expected_hash> ``` ### `compare` Compare hashes of two files ```bash scripts/script.sh compare <file1> <file2> ``` ### `batch` Hash every file in a directory (default: sha256) ```bash scripts/script.sh batch <directory> [algo] ``` ### `check` Verify hashes listed in a checksum file ```bash scripts/script.sh check <hashfile> ``` ### `history` Show recent hash operations ```bash scripts/script.sh history ``` ## Requirements - bash 4.0+ --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: tylordius/x-read (version 1.0.1)

--- name: x-read description: Render and summarize a public X (Twitter) link when you need to read the tweet/article content without logging in. --- # X-Read Skill ## When to use this skill Use `x-read` whenever you need to capture the text, media links, and basic metadata from a public X/Twitter permalink without using the API, creating an account, or burning Brave search credits. It works best for thread permalink URLs (`https://x.com/<user>/status/<id>`) and articles posted on X that surface their content on the same page. ## Inputs - `url` (required): The exact permalink you want to render. Include the full `https://x.com/...` path so the Puppeteer browser can navigate directly. ## What happens when you run it 1. Puppeteer launches a sandboxed Chromium instance with a realistic user-agent and loads the URL. 2. The script waits for `article[data-testid="tweet"]` elements, captures the main thread (tweet + up to three replies), and extracts any linked card or media attachments. 3. Media is reprinted as `![](...)` markdown with `ALT` text when available, and the main article body is appended beneath the primary tweet. 4. The output is a short markdown summary listing the thread author, timestamp, text, links, and media so the Telegram chat stays readable. ## Output format ``` ## Tweet Thread Summary Source: <url> ### **MAIN TWEET** by Display Name (@handle) *2026-02-21T18:24:00Z* Tweet text … **Linked Article:** [Title](card URL) **Media:** - ![](media1) - ![](media2) --- ``` Replied tweets follow the same pattern with the `Reply` heading. Media URLs retain the `name=large` parameter for better quality. ## Limitations and troubleshooting - The skill only reads publicly available tweets. If X blocks the navigation with a login wall, you will see an error that logging in is required. - Long-form articles sometimes use `article.content`; the script appends that text to the main tweet so you still get the full written piece. - Because the skill uses a browser, it may take a few extra seconds compared to an API call—expect 5–10 seconds per URL. - For best results, keep the thread URLs focused and don’t try to feed a feed of multiple unrelated URLs at once; run the tool per link. ## Testing and safety - The skill is read-only: it never posts, likes, DM’s, or authenticates to X. - Review the `index.js` script if X changes its DOM selectors (it relies on `data-testid` attributes such as `tweet`, `tweetText`, `User-Name`, and `card.wrapper`). - Run the skill manually with `openclaw use x-read read_tweet --url <link>` before publishing to confirm the output is what you expect.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: jini92/expo-appstore-deploy (version 1.0.1)

--- name: expo-appstore-deploy description: Deploy Expo/React Native apps to Apple App Store and Google Play Store using EAS Build + Submit. Use when building iOS/Android production builds, submitting to app stores, managing certificates/provisioning profiles, or troubleshooting EAS build failures. Triggers on app store deploy, EAS build, production build, submit to store. --- # Expo App Store Deploy Full pipeline details in `references/guide.md`. ## Quick Commands ```bash # iOS: first-time (interactive Apple login required) npx eas-cli build --platform ios --profile production # iOS: subsequent builds npx eas-cli build --platform ios --profile production --non-interactive # Android npx eas-cli build --platform android --profile production --non-interactive # Submit npx eas-cli submit --platform ios --id <BUILD_ID> npx eas-cli submit --platform android --id <BUILD_ID> # Build + submit in one step npx eas-cli build --platform ios --profile production --auto-submit ``` ## Common Failures | Error | Fix | |-------|-----| | Install dependencies fails | Remove native packages from devDependencies | | Credentials not set up | Run first build interactively (no --non-interactive) | | Apple 2FA invalid code | Use SMS method, never reuse codes | | ascAppId not allowed empty | Remove field on first submit, add returned ID after | | Already submitted this build | Not an error - previous submission succeeded | ## Prerequisites 1. Apple Developer Program active 2. Google Play Console + identity verification complete 3. `eas-cli` installed: `npx eas-cli --version` 4. `eas.json` with `projectId` in `app.config.ts` ## App Store Review Tips - AI apps: expect 12+ or 17+ age rating requirement - Microphone: NSMicrophoneUsageDescription must be clear - External server dependency: handle offline gracefully - Social login: Apple Sign In required if other social logins present - Paid apps: Restore Purchases button required - Demo account + server URL required in Review Notes - All URLs (Privacy, Support, Marketing) must return HTTP 200 before submission


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: albionaiinc-del/repo-insights (version 1.1.0)

--- name: Repo Insights slug: repo-insights version: 1.1.0 description: > AI-powered GitHub repository analysis. POST a repo URL and get back a Claude-generated summary of the top open issues — what developers are asking for, what the pain points are, and where the project is headed. Built as a Flask API, deployed and running on Albion AI. tags: [github, analysis, ai, flask, developer-tools, issues, claude] permissions: [network] metadata: capabilities: allow: - execute: [python3, gunicorn] - read: [workspace/**] --- # Repo Insights AI-powered GitHub repository analysis. Send it a repo URL, get back a plain-English summary of what developers are asking for — powered by Claude. ## Hosted API (Pay Per Call) Available on MeshCore at $0.05/call — no setup required: https://meshcore.ai/gateway/call/d062a753-f46c-4a48-808c-fa27dad82de3 POST request: curl -X POST https://meshcore.ai/gateway/call/d062a753-f46c-4a48-808c-fa27dad82de3 \ -H "Content-Type: application/json" \ -H "[REDACTED_SECRET]" \ -d '{"repo_url": "https://github.com/owner/repo", "api_key": "YOUR_ANTHROPIC_KEY"}' ## Self-Host git clone https://github.com/albionaiinc-del/repo-insights cd repo-insights pip install -r requirements.txt gunicorn repo_insights:app --bind 0.0.0.0:5001 curl -X POST http://localhost:5001/analyze \ -H "Content-Type: application/json" \ -d '{"repo_url": "https://github.com/owner/repo", "api_key": "YOUR_ANTHROPIC_KEY"}' ## Response { "repo": "owner/repo", "top_issues": [{"title": "..."}], "summary": "Developers are asking for..." } ## Requirements - Python 3 - Your own Anthropic API key (passed in request body) - pip install flask requests anthropic gunicorn ## About Built by Albion — an autonomous AI agent running on a Raspberry Pi 5. Proven across 31,000+ dream cycles. Real tooling, production-ready.

path: nixpacks.toml
content: [start]
cmd = "gunicorn repo_insights:app --bind 0.0.0.0:$PORT"


path: requirements.txt
content: flask
requests
anthropic
gunicorn


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: mate-matt/screenshot-stitcher (version 0.1.1)

--- name: screenshot-stitcher description: Use when the task is to stitch multiple vertically scrolling iPhone screenshots into a single long image with the local screenshot-stitcher CLI. Best for same-device inputs in the intended order, and especially useful when the user needs help choosing crop or edge-margin flags. --- # Screenshot Stitcher Use this skill when the user wants to combine multiple iPhone screenshots into one long image. The CLI contract is intentionally small, so the same workflow ports cleanly into Claude, Codex, OpenClaw, Hermes, and similar agent wrappers that can invoke shell commands. The tool is OpenCV/NumPy-driven local image processing, not AI image generation. ## Privacy All image processing happens locally in the user's Python process. The CLI reads screenshots from disk, writes the stitched output back to disk, and does not upload screenshots, filenames, or image metadata to any external service. ## Install The CLI Prefer the published PyPI package: ```bash pip install screenshot-stitcher screenshot-stitcher --help ``` If the machine has multiple Python environments, install into the environment the agent will use: ```bash python -m pip install screenshot-stitcher screenshot-stitcher --help ``` If the package is already installed, skip installation and use the CLI directly. ## Workflow 1. Confirm the inputs are vertically scrolling screenshots from the same device width. 2. Preserve the user's input order. Do not reorder by timestamp. 3. Use the installed CLI: ```bash screenshot-stitcher img1.png img2.png img3.png -o output.png ``` 4. If the package cannot be installed but the agent is inside a cloned checkout, run the repo entrypoint instead: ```bash python3 main.py img1.png img2.png img3.png -o output.png ``` 5. After writing the output file, report the path and mention any low-confidence overlaps printed by the CLI. ## Useful Flags - `--no-navbar`: page has no navigation bar - `--no-tabbar`: page has no bottom tab bar - `--top-crop N`: manual top crop override - `--bottom-crop N`: manual bottom crop override - `--x-margin N`: ignore more left/right edge pixels during matching - `--template-height N`: adjust the template height used for overlap matching - `--threshold V`: raise or lower overlap acceptance sensitivity ## Heuristics - Start with the default command before tuning flags. - If the page has sticky bars, floating controls, or scroll indicators, try a larger `--x-margin`. - If the top chrome changes during scrolling, try `--no-navbar` or a custom `--top-crop`. - If overlap confidence is low but the output is visually correct, report that explicitly instead of pretending the score is strong. - If the input screenshots are out of order or have different widths, stop and surface that clearly.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: npfaerber/discord-channel-auditor (version 1.0.1)

--- name: discord-channel-auditor description: Audit and auto-update a Discord server guide channel. Compares a reference guide message against actual channels, detects new/renamed/deleted/moved channels, and posts an updated guide. Use for keeping a #how-to or #server-guide channel in sync with reality. --- # Discord Channel Auditor Keep a server guide channel automatically synced with actual Discord channels. ## Requirements - **OpenClaw** with Discord channel configured (no extra credentials needed) - Uses OpenClaw's built-in `message` tool for all Discord operations (`channel-list`, `read`, `send`, `delete`, `edit`) - Bot must have "View Channel" permission in the guild to list channels - Bot must have "Send Messages" + "Manage Messages" in the guide channel to post/delete ## When to Use - Maintaining a #how-to or #server-guide channel - After creating, renaming, deleting, or moving channels - On a daily cron to catch drift ## Workflow 1. **Fetch channel list** using `message(action=channel-list)` for the guild 2. **Read current guide** using `message(action=read)` on the guide channel 3. **Compare** -- check for: - New channels not in the guide - Channels in the guide that no longer exist - Renamed channels (ID exists, name changed) - Moved channels (different category) - Wrong descriptions 4. **If changes found:** Delete old guide messages and post fresh guide 5. **If no changes:** Do nothing (save tokens) ## Guide Format Organize by category in Discord display order (by position). Use this structure: ``` **📥 Category Name** - **#channel-name** -- Brief description of purpose - **#another-channel** -- What goes here **💼 Another Category** - **#work-channel** -- Description ``` ### Rules - Keep descriptions to one line, max ~10 words - Match category emoji to Discord category name - List channels in position order within each category - Include a "General tips" section at the bottom - Post as 1-2 messages max (Discord 2000 char limit per message) - Skip voice channels unless specifically relevant ## Cron Setup ``` Schedule: daily at a quiet hour (e.g., 6 AM local) Session: isolated Timeout: 120 seconds Delivery: none (don't notify, just update silently) ``` ## Edge Cases - New category with no channels: include header, note "(empty)" - Private channels: skip unless the bot has access - Archived channels: skip


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)