OpenClaw/clawhub-security-signals huggingface dataset:
Skill: cgxxxxxxxxxxxx/roic-toolkit (version 1.0.0)

--- name: roic-toolkit description: 核心ROIC（投入资本回报率）深度分析助手。当用户提到 ROIC、投入资本回报率、资本效率、核心盈利能力、资本回报率分析、穿透ROIC、NOPAT、投入资本计算时自动使用。支持A股、港股、美股上市公司的ROIC精确计算。 allowed-tools: Read Write Edit WebFetch Bash --- # 核心 ROIC V2.0 穿透模式 专业资本效率分析工具，运用"实质重于形式"原则，从年报数据中剥离金融资产和非经营性项目，揭示企业真正部署在经营业务上的资本回报。 ## 核心原则：实质重于形式 - **应付票据** = 有息负债（含隐性资金成本） - **长期股权投资** = 拆分：战略投资（保留）vs 基金/财务投资（剔除） - **商誉** = 不是经营资产，分母全额剔除 - **收购无形资产** = 分母剔除账面值，分子加回摊销（税后） - **交易性金融负债/衍生金融负债** = 有息负债 - **发放贷款及垫款/债券投资** = 金融资产，分母剔除 - **其他流动/非流动资产** = 可能隐藏金融产品，查附注剔除 ## 公式 ### 分子：NOPAT ``` 核心经营利润 = 营业收入 - 营业成本 - 税金及附加 - 销售费用 - 管理费用 - 研发费用 NOPAT = 核心经营利润 × (1 - 实际税率) + 权益法投资收益 × (1 - 税率) + 收购无形资产摊销 × (1 - 税率) ``` - 实际税率 = 所得税费用 ÷ 利润总额（禁止估算） - 不减财务费用（避免与分母重复） - 必须从营业收入起算，不能从净利润倒推 ### 分母：投入资本 ``` 投入资本 = 所有者权益合计（含少数股东） + 有息负债 - 金融资产 - 非经营资产 ``` - 有息负债 = 短期借款 + 一年内到期非流动负债 + 长期借款 + 应付债券 + 应付票据 + 租赁负债 + 交易性金融负债 + 衍生金融负债 - 金融资产 = 货币资金 + 交易性金融资产 + 其他权益工具投资 + 其他非流动金融资产 + 衍生金融资产 + 定期存款 + 应收款项融资 + 一年内到期非流动资产 + 发放贷款及垫款 + 债券投资 - 非经营资产 = 商誉 + 投资性房地产 + 收购无形资产 + 长投中财务投资部分 ## 自动化工具 **脚本：** `roic_calc.py` ```bash python3 roic_calc.py <股票代码> <年份> # 例：python3 roic_calc.py 600519.SH 2023-2025 ``` 自动从 finance-data API 拉取数据并生成报告。 **工作流：** 1. 运行脚本获取基础 ROIC 2. 对 ⚠️ 项复核（其他流动资产中的金融产品、长投拆分、收购无形资产摊销） 3. 优先从年报PDF/东方财富HTML获取附注明细 4. 微调 ROIC，输出最终结果 ## 行业基准 | 行业 | 优秀 | 良好 | 一般 | |------|------|------|------| | 消费品 | >25% | 15-25% | 8-15% | | 制造业 | >15% | 8-15% | 5-8% | | 科技 | >20% | 12-20% | 6-12% | ## 实战踩坑 - 所有者权益合计 ≠ 归属母公司权益，必须用含少数股东的合计 - 应付票据是有息负债（无论银行承兑/商业承兑） - 长期股权投资不能全扣，只扣基金/理财部分，战略投资保留 - 收购无形资产需双向处理：分母减账面值 + 分子加摊销 - 权益法投资收益从API ass_invest_income 字段获取 - 商誉全额剔除（收购型企业可能超过净资产50%） - 一年内到期非流动资产（nca_within_1y）直接剔除 - API字段名必须小写（oth_eq_invest, oth_illiq_fin_assets） ## 经验法则 - ROIC > WACC（通常10-12%）说明创造价值 - 连续5年ROIC > 15% 通常具备护城河 - ROIC持续下降需关注竞争格局变化


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: otzippo/xiaohongshu-keyword-batch-autocomplete (version 1.0.0)

--- name: Xiaohongshu Keyword Batch Autocomplete description: 小红书关键词联想词批量采集工具 - 支持批量关键词导入、多轮次深度联想挖掘长尾词、自动去重、TXT/Excel双格式导出，适用于SEO优化、内容选题策划、种草关键词研究、竞品分析等场景。 author: OpenClaw Assistant version: 1.0.0 triggers: - xiaohongshu - keyword - autocomplete - batch - SEO - 小红书 - 关键词 - 联想词 - 选题 - 长尾词 --- # 小红书关键词联想词批量采集工具 一键批量获取小红书搜索框下拉推荐联想词，支持多轮次深度联想挖掘长尾词，自动去重+热度排序，TXT/Excel双格式导出，专为内容创作者、新媒体运营、SEO优化师打造。 ## 核心功能 ### 🚀 批量关键词导入 - 支持命令行单个关键词输入 - 支持批量文件导入（每行一个关键词） - 支持注释行（#开头自动跳过） - 内置10+热门行业示例关键词 ### 🔍 多轮次深度联想 - 支持1-3层深度联想（联想词再联想） - 指数级拓展长尾关键词库 - 挖掘用户真实搜索意图 - 可自定义采集深度控制 ### ✨ 智能去重与排序 - 自动识别重复词条并去重 - 按搜索热度分数智能排序 - 记录词条引用次数（出现频率） - 保留原始来源关键词信息 ### 📊 多格式导出 - **TXT格式**：结构化报告，包含关键词分组、热度排名、热门汇总 - **Excel格式**：多Sheet专业报告，包含详细数据表、去重汇总表、统计信息表 - 自定义输出目录 - 自动时间戳命名避免覆盖 ## 适用场景 ### 内容选题策划 - 快速获取热门话题方向 - 发现用户真实搜索需求 - 拓展内容创作角度 - 生成多维度选题矩阵 ### SEO关键词研究 - 批量拓展长尾关键词 - 分析关键词热度分布 - 发现低竞争高流量词 - 构建完整关键词库 ### 种草文案优化 - 获取平台热门词汇 - 匹配用户搜索习惯 - 优化标题关键词布局 - 提升笔记曝光率 ### 竞品与行业分析 - 批量采集行业核心词 - 分析用户关注点分布 - 发现蓝海细分领域 - 跟踪热门话题趋势 ## 使用说明 ### 基础用法（单个关键词） ```bash python3 batch_keyword.py --keyword "夏季穿搭" ``` ### 批量采集（文件导入） ```bash python3 batch_keyword.py --file keywords.txt ``` ### 深度联想挖掘 ```bash python3 batch_keyword.py --keyword "护肤" --depth 2 ``` ### 导出Excel格式 ```bash python3 batch_keyword.py --keyword "美食" --format excel ``` ### 完整参数示例 ```bash python3 batch_keyword.py \ --file keywords_sample.txt \ --depth 2 \ --format excel \ --output ./result \ --delay 0.5 ``` ## 参数说明 | 参数 | 说明 | 默认值 | |------|------|--------| | `--keyword` | 单个关键词采集 | - | | `--file` | 批量关键词文件路径（每行一个） | - | | `--depth` | 联想深度，支持1-3层，数值越大长尾词越多 | 1 | | `--format` | 输出格式：txt / excel | txt | | `--output` | 输出文件目录 | ./output | | `--delay` | 请求间隔（秒），防止请求过快 | 0.5 | | `--no-dedup` | 关闭自动去重功能 | - | ## 输出示例 ``` 开始批量采集，共 10 个关键词，深度: 1 ============================================================ 深度 1: 夏季穿搭 深度 1: 护肤 深度 1: 美妆 深度 1: 美食 深度 1: 旅游 深度 1: 健身 深度 1: 家居 深度 1: 数码 深度 1: 宠物 深度 1: 母婴 ============================================================ 采集完成: 原始 100 个，去重后 100 个 结果预览（TOP 10）: ---------------------------------------- 1. 夏季穿搭 2025 (热度: 100, 深度: 1) 2. 护肤 2025 (热度: 100, 深度: 1) 3. 美妆 2025 (热度: 100, 深度: 1) 4. 美食 2025 (热度: 100, 深度: 1) 5. 旅游 2025 (热度: 100, 深度: 1) 6. 健身 2025 (热度: 100, 深度: 1) 7. 家居 2025 (热度: 100, 深度: 1) 8. 数码 2025 (热度: 100, 深度: 1) 9. 宠物 2025 (热度: 100, 深度: 1) 10. 母婴 2025 (热度: 100, 深度: 1) ``` ## Excel报告结构 导出的Excel文件包含3个专业Sheet： 1. **详细数据表** - 所有采集到的原始数据，包含主关键词、联想词、热度分数、排名、采集深度、来源关键词、引用次数、采集时间 2. **汇总（去重）** - 去重后的唯一词条列表，按热度排序，适合直接使用 3. **统计信息** - 采集统计概览，包含采集时间、关键词数量、采集深度、原始词条数、去重后词条数、去重率等关键指标 ## 安装依赖 ```bash # 基础依赖（TXT导出） pip3 install requests # 完整功能（支持Excel导出） pip3 install requests pandas openpyxl ``` ## 真实API对接说明 当前版本使用模拟数据进行功能演示。如需对接小红书真实API，需要： 1. 使用浏览器开发者工具抓包，访问小红书搜索页面 2. 查找搜索推荐相关接口（通常包含suggest/recommend等关键字） 3. 更新代码中的`_generate_mock_suggestions`方法为真实API调用 4. 根据需要配置请求头、Cookie或认证Token 注意：请遵守平台使用条款，合理控制请求频率，仅供学习研究使用。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: miloudbelarebia/openclaw-security-guard (version 1.0.0)

--- name: openclaw-security-guard description: Security audit CLI + live dashboard for OpenClaw. Scans for secrets, config issues, prompt injections, vulnerable dependencies, and unverified MCP servers. Zero telemetry. version: 1.0.0 metadata: openclaw: requires: bins: - node install: - kind: node package: openclaw-security-guard bins: [openclaw-guard, openclaw-security-guard] emoji: "\U0001F6E1" homepage: https://github.com/2pidata/openclaw-security-guard os: - macos - linux - windows --- # OpenClaw Security Guard The missing security layer for your OpenClaw installation. ## What it does Run `openclaw-guard audit` to scan your OpenClaw setup across 5 categories: - **Secrets Scanner** -- Detects API keys, tokens, passwords across 15+ formats + entropy analysis - **Config Auditor** -- Checks sandbox mode, DM policy, gateway binding, rate limiting - **Prompt Injection Detector** -- 50+ patterns: instruction overrides, role hijacking, jailbreaks - **Dependency Scanner** -- npm CVE scanning - **MCP Server Auditor** -- Allowlist-based verification of installed MCP servers ## Quick start ```bash npm install -g openclaw-security-guard # Full audit openclaw-guard audit # Fix issues automatically (with backup) openclaw-guard fix --auto # Launch live dashboard openclaw-guard dashboard ``` ## Features - **Security Score** (0-100) -- one number for your security posture - **Auto-hardening** -- interactive, automatic, or dry-run modes - **Live dashboard** -- real-time monitoring at localhost:18790 - **Pre-commit hooks** -- catch secrets before they're committed - **Multi-language** -- English, French, Arabic - **Zero telemetry** -- no tracking, no network requests, 100% local ## Links - **Repository:** https://github.com/2pidata/openclaw-security-guard - **Author:** [Miloud Belarebia](https://github.com/miloudbelarebia) / [2PiData](https://2pidata.com) - **License:** MIT


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: drivenbymyai-max/eu-ai-compliance (version 1.0.0)

--- name: eu-ai-compliance description: EU AI Act risk classification, Article 12 compliance logging, and self-assessment reports — deadline August 2, 2026 user-invocable: true metadata: {"openclaw":{"requires":{"env":[]}},"homepage":"https://soulledger.sputnikx.xyz/compliance","author":"SputnikX","version":"1.0.0","tags":["compliance","eu-ai-act","regulation","audit","risk"]} --- # EU AI Act Compliance Free risk classification + paid full assessments. EU AI Act enforcement deadline: August 2, 2026. Fines: EUR 35M or 7% global turnover. ## Base URL `https://soul.sputnikx.xyz` ## Endpoints ### Risk Classification (FREE) ```bash curl "https://soul.sputnikx.xyz/soul/compliance/risk-classification?description=facial+recognition+for+hiring" ``` Returns: `{ risk_level, reasoning, annex_iii_matches, disclaimer }` — instant HIGH/LIMITED/MINIMAL classification. ### Article 12 Mapping (FREE) ```bash curl https://soul.sputnikx.xyz/soul/compliance/mapping ``` Returns: Full Article 12 → data field mapping for compliance logging requirements. ### Self-Assessment ($1.00 x402 USDC) ```bash curl https://soul.sputnikx.xyz/soul/compliance/self-assessment/{agent_id} ``` Complete EU AI Act self-assessment report with recommendations. ### Annex IV Technical Documentation ($1.00 x402 USDC) ```bash curl https://soul.sputnikx.xyz/soul/compliance/annex-iv/{agent_id} ``` ### Annex V EU Declaration ($0.50 x402 USDC) ```bash curl https://soul.sputnikx.xyz/soul/compliance/annex-v ``` ### Full Compliance Report ($2.00 x402 USDC) ```bash curl https://soul.sputnikx.xyz/soul/compliance/full-report ``` Complete bundle: risk classification + self-assessment + Annex IV + Annex V. ## Web Interface Free compliance checker: https://soulledger.sputnikx.xyz/compliance ## Infrastructure - Hash-chain logging (SHA-256, append-only) - Merkle root anchoring on Base chain - Behavioral drift detection - Runtime monitoring (not one-time reports) ## When to use this skill - Check if your AI system is EU AI Act compliant - Generate compliance documentation before the August 2026 deadline - Implement Article 12 automatic logging - Get risk classification for any AI system description


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: wanghong5233/job-monitor (version 1.0.0)

--- name: job-monitor description: Analyze JD text and return structured match summary. --- # Job Monitor Skill ## Trigger Activate when user asks: - "Analyze this JD" - "What is my match score?" - "Parse this position description" - "Search AI intern jobs on BOSS" - "搜一下深圳 AI Agent 实习" ## Workflow 1. Read JD text provided by the user. 2. Call backend API with the `exec` tool (use `curl`): - If user provides JD text -> call `POST /api/jd/analyze` - Endpoint: `POST http://127.0.0.1:8010/api/jd/analyze` - Header: `Content-Type: application/json` - Body: `{"jd_text":"<user jd text>"}` - Example: - `curl -sS -X POST "http://127.0.0.1:8010/api/jd/analyze" -H "Content-Type: application/json" -d '{"jd_text":"<user jd text>"}'` - If user asks to search/scanning BOSS -> call `POST /api/boss/scan` - Endpoint: `POST http://127.0.0.1:8010/api/boss/scan` - Header: `Content-Type: application/json` - Body: `{"keyword":"<search keyword>","max_items":10,"max_pages":2}` - Example: - `curl -sS -X POST "http://127.0.0.1:8010/api/boss/scan" -H "Content-Type: application/json" -d '{"keyword":"深圳 AI Agent 实习","max_items":10,"max_pages":2}'` 3. Parse JSON from command stdout. 4. If API call fails or JSON is invalid, tell the user the error and ask for retry or corrected JD text. 5. Format returned JSON into a concise message: - For `/api/jd/analyze`: parsed title / skill list / match score / gap analysis - For `/api/boss/scan`: keyword / total count / pages_scanned / top jobs / optional screenshot path 6. Return result to user. ## Constraints - Do not submit applications automatically. - For any external platform action, require user confirmation first.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: poolguy24/skillsentry (version 1.1.0)

--- name: skillsentry display_name: SkillSentry version: 1.1.0 description: "OpenClaw security audit + prompt injection detector. Scans gateway/vulns/cron/PI patterns. Use for frenzy-proofing installs." category: security author: Jeffrey Coleman ([REDACTED_SECRET]) price: 9.99 inputs: [] outputs: - JSON report printed to stdout --- # SkillSentry ## Purpose Audit a local OpenClaw install for security posture and common prompt-injection indicators. Produces a JSON report for review and alerting. ## Workflow 1. **Canvas present**: Launch the panel server and present the UI. 2. **User config**: Update `config.yaml` (scan frequency, alerts, sensitivity). 3. **Cron setup**: Schedule `scripts/audit.sh` at the chosen cadence. 4. **Report/Alert**: Review JSON output and alert if prompt-injection hits or unexpected open ports are found. ## Usage ### Panel (recommended) ```bash node scripts/panel-server.js ``` Then present the UI: - `canvas.present` → `http://localhost:8133` (Scan / Settings / Logs) ### Config (CLI) ```bash node scripts/config.js get node scripts/config.js set Scan_freq daily alerts telegram sensitivity high ``` ### Audit (CLI) ```bash bash scripts/audit.sh > report.json ``` ## Notes - Local-only scans; no network calls outside localhost. - Panel server is local and stores the last report at `logs/last-report.json`. - `config.yaml` defaults: Scan_freq=daily, alerts=telegram, sensitivity=high. - Safe for routine security checks and “frenzy-proofing”. Contact: Jeffrey Coleman | [REDACTED_SECRET] | Custom audits/enterprise.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: socneo/smart-poller (version 1.0.0)

# Smart Poller Skill **Smart Polling Skill** — Periodically polls a Feishu task board and auto-executes tasks assigned to the current AI agent. 📖 [中文文档](README.zh-CN.md) --- ## 🎯 Features - ✅ Scheduled polling of Feishu task board (configurable interval) - ✅ Auto-detect tasks assigned to the current AI agent - ✅ Silent mode (no notification when idle; saves ~95% Token usage) - ✅ Auto-write completion feedback to the task board - ✅ Node.js and Python dual runtime support --- ## 📦 Installation ```bash clawhub install smart-poller ``` --- ## 🔧 Configuration Copy the config template and fill in your values: ```bash cp config.example.json config.json ``` **Required fields:** - `app_id`: Feishu App ID - `app_secret`: Feishu App Secret - `doc_token`: Task board document ID - `assignee`: Current agent identifier --- ## 🚀 Usage ```bash # Run once (testing) python3 poller.py config.json --once # Continuous polling (production) python3 poller.py config.json # Cron (recommended) */15 * * * * python3 poller.py config.json --once ``` --- ## 🛠️ Required Tools - `exec`: Run Python/Node.js scripts - `file_read`: Read config file - `file_write`: Write config and logs --- ## 📝 Changelog ### v1.0.0 (2026-03-17) - ✅ Initial release - ✅ Full Feishu API integration - ✅ Silent mode optimization - ✅ Dual runtime support --- ## 🤝 Contributing GitHub: https://github.com/openclaw/skills --- ## 📄 License MIT License --- **Author**: socneo **Last updated**: 2026-03-18


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: huaibuer/skill-guard-waai (version 1.3.0)

--- name: skill_guard description: "Skill Security Scanner - Scan for risks before download/use. Use when: installing unknown skills, evaluating third-party code, or security auditing. / Skill安全检查 - 下载/使用前检测风险。" metadata: author: "WaaiOn" version: "1.2" openclaw: emoji: "🛡️" requires: bins: ["python3"] --- # 🛡️ Skill Guard / 安全检查 Security scanner for AI Skills. Check code safety before install or use. ## When to Use / 使用场景 | EN | CN | |----|----| | Installing unknown skills | 安装未知来源的skill | | Evaluating third-party code | 评估第三方代码 | | Security auditing | 安全审计 | | Before running untrusted code | 运行不受信任的代码前 | ## Risk Categories / 风险类型 | Category | EN | CN | Severity | |----------|----|----|----------| | Code Execution | 代码执行 | 🔴 Critical | | File Deletion | 文件删除 | 🔴 Critical | | Command Injection | 命令注入 | 🔴 Critical | | Credential Leak | 凭证泄露 | 🟠 High | | Network Request | 网络请求 | 🟠 High | | Data Theft | 窃取数据 | 🔴 Critical | | Induce Transfer | 诱导转钱 | 🔴 Critical | | Virus/Backdoor | 病毒/后门 | 🔴 Critical | ## Usage / 使用 ```bash # Scan local skill / 扫描本地skill python3 -c "from skill_guard import scan; print(scan('/path/to/skill'))" # Inspect remote / 检查远程 python3 -c "from skill_guard import inspect_remote; print(inspect_remote('skill-name'))" ``` ## Risk Patterns / 风险模式 ```python RISK_PATTERNS = { 'code_execution': ['exec(', 'eval(', 'compile(', '__import__'], 'file_deletion': ['rm -rf', 'shutil.rmtree', 'os.remove'], 'command_injection': ['subprocess', 'os.system', 'shell=True'], 'credential_leak': ['password', 'api_key', 'token', 'secret'], 'data_theft': ['/etc/passwd', '~/.ssh', 'clipboard'], 'induce_transfer': ['alipay', 'bank_card', 'payment'], 'virus_backdoor': ['ransomware', 'miner', 'backdoor'], } ``` ## Installation / 安装 ```bash npx clawhub install skill-guard-waai ``` ## Author / 作者 - WaaiOn


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ckchzh/logrotate (version 2.0.3)

--- name: "logrotate" version: "2.0.3" description: "Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Logrotate concepts, best practices, and implementation patterns." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [logrotate, reference] category: "devtools" --- # Logrotate Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Logrotate concepts, best practices, and implementation patterns. No API keys or credentials required. ## Commands | Command | Description | |---------|-------------| | `intro` | intro reference | | `quickstart` | quickstart reference | | `patterns` | patterns reference | | `debugging` | debugging reference | | `performance` | performance reference | | `security` | security reference | | `migration` | migration reference | | `cheatsheet` | cheatsheet reference | ## Output Format All commands output plain-text reference documentation via heredoc. No external API calls, no credentials needed, no network access. --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: niallel/control4-home (version 0.1.2)

--- name: control4-home description: Control a Control4 smart home via pyControl4 (lights, relays, room media) using local Python wrappers. Use when the user asks to control devices, set levels, toggle relays, switch room media sources, or inspect Control4 device mappings. metadata: { "openclaw": { "requires": { "bins": ["python3"] }, "install": [ { "id": "pycontrol4", "kind": "python", "packages": ["pyControl4==1.6.0"], "venv": ".venv-control4", "label": "Install pyControl4 in local virtualenv" } ] } } --- # Control4 Home Use the scripts in `scripts/` to control Control4 locally. ## Files - `scripts/control4_cli.py` — low-level Control4 commands (discover/list/light/relay/room/media + generic method calls) - `scripts/nl_control4.py` — natural language command wrapper (lights, relays, room media, mute/unmute, volume) - `scripts/device_map.example.json` — alias template for mapping names to Control4 IDs ## Setup 1. Create a Python venv (example): - `python3 -m venv .venv-control4` 2. Install dependency: - `.venv-control4/bin/pip install pyControl4` 3. Create `scripts/.env` (or export env vars) with: - `CONTROL4_USERNAME` - `CONTROL4_PASSWORD` - `CONTROL4_CONTROLLER_IP` - `CONTROL4_CONTROLLER_NAME` (optional if only one) 4. Copy and customize alias map: - `cp scripts/device_map.example.json scripts/device_map.json` ## Common commands - Discover controller/account: - `.venv-control4/bin/python scripts/control4_cli.py discover` - List items: - `.venv-control4/bin/python scripts/control4_cli.py list-items --compact` - Set light: - `.venv-control4/bin/python scripts/control4_cli.py light-set --id 229 --level 40` - Toggle relay: - `.venv-control4/bin/python scripts/control4_cli.py relay-toggle --id 571` - Natural language: - `.venv-control4/bin/python scripts/nl_control4.py "turn kitchen lights off"` - `.venv-control4/bin/python scripts/nl_control4.py "watch apple tv in master bedroom"` - `.venv-control4/bin/python scripts/nl_control4.py "mute master bedroom"` - List all exposed methods for an entity: - `.venv-control4/bin/python scripts/control4_cli.py methods --entity room --id 45` - Call any exposed pyControl4 method: - `.venv-control4/bin/python scripts/control4_cli.py call --entity climate --id 752 --method getCurrentTemperatureC` - `.venv-control4/bin/python scripts/control4_cli.py call --entity light --id 229 --method rampToLevel --args-json "[25,1000]"` - Sensitive methods require explicit override: - `.venv-control4/bin/python scripts/control4_cli.py call --entity security-panel --id <id> --method setArm --allow-sensitive` ## Safety - Treat gate/door/alarm relays as sensitive actions. - Confirm before running high-risk commands if user intent is ambiguous. - Do not commit secrets (passwords/tokens) into git.


Security scan verdicts — ClawScan: suspicious | static analysis:  | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: jerry48/realtime-hot (version 1.0.0)

--- name: realtime-hot description: 获取并整理多平台实时热点新闻，按跨平台热度共识筛选，输出高热度事件的简报。 --- # 实时热点 Skill ## 执行步骤 1. 抓取数据：`node ./scripts/index.js` - 结果写入 `./scripts/hot-data.json`（微博/抖音/头条/百度/知乎/腾讯六平台各前50条） 2. 读取并聚类：`node ./scripts/format.js` - 读取 hot-data.json - Jaccard 聚类（2-gram，阈值0.10） - 过滤：百度置顶稿、微博广告位、"总书记/主席/领导人"相关 - 标题优先选非微博、5-20字最短 - 输出固定格式 markdown 到 stdout 3. 发送：用 message 工具发送 format.js 的 stdout 输出 - action=send - channel=feishu ## 强制规则 - 模型只负责运行脚本，不得自行生成或修改格式 - 只用 exec 和 read，禁止 browser、agent-browser、web_fetch


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: chaoyang78/acpx-coding-default (version 1.0.0)

--- name: acpx-coding-default description: Use direct acpx CLI via exec as the default coding execution path for Codex- and Claude-focused agents. --- # acpx-coding-default Use direct `acpx` CLI through `exec` for coding work. ## Binary Always prefer the plugin-local binary: ```bash /opt/homebrew/lib/node_modules/openclaw/extensions/acpx/node_modules/.bin/acpx ``` ## Core rules - `acpx` is invoked through `exec`; it is not a separate built-in tool. - For coding, debugging, refactoring, test-running, and repo tasks, default to direct `acpx`. - Always pass explicit `--cwd`. - Prefer `--format quiet` unless verbose output is requested. - Reuse named sessions when continued context is useful. - If `acpx` fails, report the exact failing command and reason before falling back. - If the task explicitly asks for ACP runtime thread/session behavior, use ACP runtime instead of this skill. ## Adapter defaults - Codex-focused agent -> `codex` - Claude-focused agent -> `claude` ## Templates ### Codex one-shot ```bash cd "<repo>" && /opt/homebrew/lib/node_modules/openclaw/extensions/acpx/node_modules/.bin/acpx codex exec "<prompt>" ``` ### Claude one-shot ```bash cd "<repo>" && /opt/homebrew/lib/node_modules/openclaw/extensions/acpx/node_modules/.bin/acpx claude exec "<prompt>" ``` ### Codex session ```bash cd "<repo>" && /opt/homebrew/lib/node_modules/openclaw/extensions/acpx/node_modules/.bin/acpx codex sessions show <name> \ || /opt/homebrew/lib/node_modules/openclaw/extensions/acpx/node_modules/.bin/acpx codex sessions new --name <name> cd "<repo>" && /opt/homebrew/lib/node_modules/openclaw/extensions/acpx/node_modules/.bin/acpx codex -s <name> "<prompt>" ``` ### Claude session ```bash cd "<repo>" && /opt/homebrew/lib/node_modules/openclaw/extensions/acpx/node_modules/.bin/acpx claude sessions show <name> \ || /opt/homebrew/lib/node_modules/openclaw/extensions/acpx/node_modules/.bin/acpx claude sessions new --name <name> cd "<repo>" && /opt/homebrew/lib/node_modules/openclaw/extensions/acpx/node_modules/.bin/acpx claude -s <name> "<prompt>" ``` ## Failure handling - `NO_SESSION`: create the named session, then retry once. - Binary missing/version issue: check plugin-local binary first. - Adapter/toolchain missing: report the exact missing command. - Do not silently switch to another execution path and pretend acpx was used. eck plugin-local binary first. - Adapter/toolchain missing: report the exact missing command. - Do not silently switch to another execution path and pretend acpx was used.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal:  | SkillSpector: clean (LOW)