OpenClaw/clawhub-security-signals huggingface dataset:
Skill: thomaschangx/openclaw-flutter-expert (version 1.0.0)

--- name: openclaw-flutter-expert description: 6+ 年经验的 Flutter 专家，擅长 Flutter 3.19+, Riverpod 2.0, GoRouter metadata: openclaw: requires: bins: [flutter] env: [] --- # Flutter Expert Skill ## 角色定义 你是一位拥有 6+ 年经验的 Flutter 高级开发者，精通现代 Flutter 开发栈。 ## 技术栈 - **Flutter**: 3.19+ - **状态管理**: Riverpod 2.0+ (flutter_riverpod, riverpod_annotation) - **路由**: GoRouter - **代码生成**: build_runner, freezed, json_serializable - **测试**: flutter_test, mockito, integration_test ## 开发规范 ### 1. 项目结构 遵循 Flutter 官方推荐的 Clean Architecture： ``` lib/ ├── core/ # 核心工具、常量、主题 ├── features/ # 功能模块（按功能组织） │ └── feature_name/ │ ├── data/ # 数据层（repositories, data sources） │ ├── domain/ # 领域层（entities, use cases） │ └── presentation/ # 表现层（widgets, providers） ├── shared/ # 共享组件 └── main.dart ``` ### 2. 状态管理 (Riverpod) - 使用 `flutter_riverpod` 进行状态管理 - 优先使用代码生成 (`@riverpod` 注解) - 区分 UI State 和 Data State - 使用 `AsyncValue` 处理异步状态 ```dart // 示例：使用 Riverpod 2.0 @riverpod Future<List<Todo>> todos(TodosRef ref) async { final api = ref.watch(todoApiProvider); return api.getTodos(); } // UI 中使用 final todosAsync = ref.watch(todosProvider); todosAsync.when( data: (todos) => ..., loading: () => ..., error: (e, st) => ..., ); ``` ### 3. 路由 (GoRouter) - 使用 GoRouter 进行声明式路由 - 定义类型安全的路由参数 - 使用 go_router 的代码生成 ```dart // router.dart final router = GoRouter( routes: [ GoRoute( path: '/user/:id', builder: (context, state) => UserPage( userId: state.pathParameters['id']!, ), ), ], ); ``` ### 4. 代码质量 - **空安全**: 全启用 Dart 空安全 - **类型安全**: 避免 dynamic，尽量使用具体类型 - **不可变性**: 优先使用 final 和不可变对象 - **错误处理**: 正确处理异步错误，不要忽略 ### 5. 性能优化 - 使用 `const` 构造函数 - 合理使用 `RepaintBoundary` - 列表使用 `ListView.builder` - 图片使用缓存 (cached_network_image) - 避免不必要的 rebuild ### 6. 测试 - 单元测试：测试业务逻辑 - Widget 测试：测试 UI 组件 - 集成测试：测试完整功能流 ```dart // 示例：Riverpod 测试 test('todosProvider returns expected list', () async { final container = ProviderContainer(); addTearDown(container.dispose); final todos = await container.read(todosProvider.future); expect(todos, isNotEmpty); }); ``` ## OpenClaw 集成 ### 使用方法 当用户请求 Flutter 相关帮助时： 1. 分析需求，确定技术方案 2. 提供代码示例和最佳实践 3. 必要时生成完整的功能模块 ### 注意事项 - 确认 Flutter 环境可用 - 遵循 Dart/Flutter 官方风格指南 - 提供可运行的代码示例 - 考虑跨平台兼容性 (iOS/Android/Web/Desktop) ## 参考资源 - Flutter 官方文档: https://docs.flutter.dev - Riverpod 文档: https://riverpod.dev - GoRouter 文档: https://pub.dev/packages/go_router


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dave-b-b/sentry-issues (version 1.0.0)

--- name: sentry description: Fetch and analyze issues from Sentry error tracking. Use when asked to check Sentry errors, pull issues, investigate exceptions, review error trends, or get crash reports from a Sentry project. version: 1.0.0 --- # Sentry Issue Tracker Fetch and analyze issues from Sentry using the Sentry API. ## Prerequisites - Sentry API token with `project:read` and `event:read` scopes - Organization slug and project slug ## Authentication Set the `SENTRY_AUTH_TOKEN` environment variable, or pass `--token` to the script. ```bash export SENTRY_AUTH_TOKEN="your-token-here" ``` To create a [REDACTED_SECRET] → Settings → Auth Tokens → Create New Token ## Quick Start List recent unresolved issues: ```bash python3 scripts/sentry_issues.py --org <org-slug> --project <project-slug> ``` Get issue details with stack trace: ```bash python3 scripts/sentry_issues.py --org <org-slug> --project <project-slug> --issue <issue-id> --details ``` ## Script Reference ### `scripts/sentry_issues.py` Fetches issues from Sentry API. **Arguments:** - `--org` (required): Sentry organization slug - `--project` (required): Project slug - `--token`: Auth token (defaults to `SENTRY_AUTH_TOKEN` env var) - `--issue`: Specific issue ID to fetch details - `--details`: Include stack trace and event details - `--query`: Filter query (e.g., `is:unresolved`, `level:error`) - `--limit`: Max issues to return (default: 25) - `--sort`: Sort by `date`, `new`, `priority`, `freq`, or `user` (default: date) **Examples:** ```bash # List 10 most recent unresolved errors python3 scripts/sentry_issues.py --org myorg --project myproject --query "is:unresolved level:error" --limit 10 # Get details for specific issue python3 scripts/sentry_issues.py --org myorg --project myproject --issue 12345 --details # Sort by most users affected python3 scripts/sentry_issues.py --org myorg --project myproject --sort user --limit 5 ``` ## Common Queries | Query | Description | |-------|-------------| | `is:unresolved` | Open issues only | | `is:resolved` | Resolved issues | | `is:ignored` | Ignored issues | | `level:error` | Error-level issues | | `level:warning` | Warning-level issues | | `firstSeen:>-24h` | New in last 24 hours | | `lastSeen:>-1h` | Active in last hour | | `assigned:me` | Assigned to current user | | `has:release` | Issues with release info | Combine queries: `is:unresolved level:error firstSeen:>-24h` ## Output Format Issues are returned as JSON with key fields: - `id`: Issue ID for fetching details - `title`: Error message/title - `culprit`: Source location - `count`: Number of events - `userCount`: Affected users - `firstSeen` / `lastSeen`: Timestamps - `level`: error/warning/info - `status`: unresolved/resolved/ignored When `--details` is used, includes: - Full stack trace - Latest event context - Tags and metadata - Browser/OS info (if available)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: koharu885/geo-local-search-optimization (version 1.0.1)

# Geo Local Search Optimization Skill This skill helps local businesses optimize their presence in AI search results by creating AI-friendly media content and providing step-by-step guidance for local search optimization. ## Description In the AI era, customers increasingly ask AI models like Doudou, Qwen, and others for local business recommendations. This skill guides users through a complete 7-day AI search optimization process to ensure their business appears in AI recommendations. ## Workflow 1. **Introduction**: Explain AI search revolution and benefits 2. **Information Collection**: Gather business details and keywords 3. **Strategy Development**: Create keyword strategy and map verification guide 4. **Competitor Analysis**: Show current AI search landscape 5. **Content Generation**: Generate 7 days of complete media articles (500+ words each) 6. **Publishing Guidance**: Recommend media channels and publishing instructions ## Input Requirements - Business name (must match license exactly) - Complete address (province, city, district, street, number) - Contact phone number - Main business/services - Target customer demographics - 5 industry-specific search keywords ## Output Format - Daily media articles with title, 500+ word content, business address and phone - Step-by-step execution guidance - Media publishing recommendations ## Safety Guidelines - All content must be truthful and verifiable - Business information must be accurate and consistent - No false claims or misleading information - Content should follow journalistic standards - Media selection must be relevant to business type and location - Avoid cross-industry publishing (e.g., restaurants should not publish on automotive sites) ## Media Selection Guidelines - **Geographic Hierarchy**: Provincial + Municipal + Local self-media - **Industry Relevance**: Match media type to business category - Restaurants: Food, lifestyle, local consumption media - Fitness: Sports, health, wellness media - Automotive: Car, transportation, local service media - Beauty: Fashion, beauty, lifestyle media - Education: Education, parenting, learning media - **Cost Efficiency**: Choose lowest-priced media within same tier (same effectiveness) ## Effectiveness Verification - Test AI search results 24-48 hours after publication - Query AI models (Doudou, DeepSeek, Qwen, Yuanbao) with customer-like questions - Monitor ranking changes weekly - Success indicators: Business name appears in AI responses, accurate location/service details ## License MIT - Free and open source, no commercial restrictions. Designed to help local businesses succeed in the AI era.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xiaoqiangjava/tencentcloud-faceid-compareface (version 1.0.1)

--- name: tencentcloud-faceid-compareface description: 腾讯云人脸比对(CompareFace)接口调用技能。当用户需要对两张人脸图片进行相似度比对时，应使用此技能。基于腾讯云人脸识别服务，对两张图片中的人脸进行相似度比较，返回人脸相似度分数。支持图片Base64和图片URL两种输入方式，可用于判断两张人脸是否为同一人。 --- # 腾讯云人脸比对 (CompareFace) ## 用途 调用腾讯云人脸识别 CompareFace 接口，对两张图片中的人脸进行相似度比较，返回人脸相似度分数。 核心能力： - **人脸相似度比对**：对两张图片中的人脸进行相似度打分（0~100分） - **同一人判断**：根据相似度分数判断两张人脸是否为同一人 - **多输入方式**：支持图片 Base64 和图片 URL 两种输入方式，传入本地文件时可自动转为 Base64 - **质量控制**：可选图片质量控制，过滤低质量图片 - **算法版本**：支持 2.0 和 3.0 两个算法版本，默认使用 3.0 官方文档：https://cloud.tencent.com/document/product/867/44987 ## 使用时机 当用户提出以下需求时触发此技能： - 需要比对两张人脸图片的相似度 - 需要判断两张照片中的人是否为同一人 - 需要对人脸进行1:1验证 - 涉及人脸比对、人脸相似度计算的任何场景 ## 环境要求 - Python 3.6+ - 依赖：`tencentcloud-sdk-python`（通过 `pip install tencentcloud-sdk-python` 安装） - 环境变量： - `TENCENTCLOUD_SECRET_ID`：腾讯云API密钥ID - `TENCENTCLOUD_SECRET_KEY`：腾讯云API密钥Key ## 使用方式 运行 `scripts/main.py` 脚本完成人脸比对。 ### 请求参数 | 参数 | 类型 | 必填 | 说明 | |------|------|------|------| | --image-a | str | 是（与url-a二选一）| A图片本地文件路径（自动转Base64）或Base64字符串 | | --url-a | str | 是（与image-a二选一）| A图片URL地址，优先级高于image-a | | --image-b | str | 是（与url-b二选一）| B图片本地文件路径（自动转Base64）或Base64字符串 | | --url-b | str | 是（与image-b二选一）| B图片URL地址，优先级高于image-b | | --face-model-version | str | 否 | 算法版本："2.0" 或 "3.0"，默认 "3.0" | | --quality-control | int | 否 | 图片质量控制：0(不控制)/1(低)/2(一般)/3(较高)/4(很高)，默认0 | | --need-rotate-detection | int | 否 | 是否开启旋转识别：0(不开启)/1(开启)，默认0 | ### 图片输入规格 - **格式**：支持 PNG、JPG、JPEG、BMP，不支持 GIF - **大小**：Base64 编码后不可超过 5MB - **分辨率**：jpg格式长边不可超过4000像素，其他格式长边不可超过2000像素，短边不小于64像素 - **人脸要求**：若图片中包含多张人脸，默认选取置信度最高的人脸 ### 输出格式 检测成功后返回 JSON 格式结果： ```json { "Score": 87.5, "ScoreDesc": "高度相似，可认定为同一人（3.0版本）", "IsSamePerson": true, "FaceModelVersion": "3.0", "RequestId": "xxx" } ``` ### 相似度分数说明（3.0版本） | 分数范围 | 误识率 | 建议判断 | |----------|--------|----------| | ≥ 40分 | 千分之一 | 疑似同一人 | | ≥ 50分 | 万分之一 | 可认定为同一人（推荐阈值） | | ≥ 60分 | 十万分之一 | 高度确信为同一人 | ### 相似度分数说明（2.0版本） | 分数范围 | 误识率 | 建议判断 | |----------|--------|----------| | ≥ 70分 | 千分之一 | 疑似同一人 | | ≥ 80分 | 万分之一 | 可认定为同一人（推荐阈值） | | ≥ 90分 | 十万分之一 | 高度确信为同一人 | ### 调用示例 ```bash # 传入两张本地图片文件（自动转Base64） python scripts/main.py --image-a ./face_a.jpg --image-b ./face_b.jpg # 传入图片URL python scripts/main.py --url-a "https://example.com/face_a.jpg" --url-b "https://example.com/face_b.jpg" # 混合使用（A用本地文件，B用URL） python scripts/main.py --image-a ./face_a.jpg --url-b "https://example.com/face_b.jpg" # 指定算法版本和质量控制 python scripts/main.py --image-a ./face_a.jpg --image-b ./face_b.jpg --face-model-version 3.0 --quality-control 2 # 传入Base64字符串 python scripts/main.py --image-a "<base64_string_a>" --image-b "<base64_string_b>" ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: nighty35628/safe-share (version 1.0.0)

--- name: safe-share description: Sanitize logs, configs, prompts, stack traces, and skill content before they are shared publicly. Use when a user wants a local, low-risk pass to remove API keys, tokens, cookies, passwords, emails, IPs, or other sensitive values from text before posting to GitHub issues, chat, READMEs, demos, or ClawHub. --- # Safe Share Use this skill to produce a safe-to-share copy of text. Prefer deterministic local sanitization over model-only guessing. ## Workflow 1. Confirm the user wants a shareable copy, not a forensic analysis. 2. Determine the output mode: - `placeholder`: best default for docs, issues, READMEs, and tutorials - `redact`: best when preserving shape is not important - `mask`: best when keeping a hint of the original value is useful 3. Run `scripts/sanitize_text.py` on the exact text the user provided. 4. Return: - `sanitized_text` - `findings_summary` - `review_notes` 5. Never echo the original sensitive value back to the user. ## Operating Rules - Default to `placeholder` mode unless the user asks for something else. - Treat secrets and credentials as higher priority than general PII. - Replace with stable labels such as `<OPENAI_API_KEY>` or `[REDACTED:BEARER_TOKEN]`. - Keep summaries high level. Report type and count, not the captured value. - State clearly that sanitization reduces risk but does not guarantee complete detection. - Do not scan unrelated files or repositories unless the user explicitly asks for that broader scope. - Do not send text to external services for classification or validation. ## High-Risk Patterns Prioritize these categories: - API keys and secret tokens - Authorization headers and bearer tokens - Cookies and session identifiers - `.env`-style credentials and password assignments - Private key blocks and PEM material - Sensitive URL query parameters Then handle lower-risk identifiers: - Email addresses - Phone numbers - IP addresses - National ID or payment-card-like strings when confidence is high ## Output Contract Use the JSON contract from `references/output-format.md` when returning structured results from the script. If answering in prose, include the same three sections in human-readable form. ## Resources - Detection and replacement behavior: `references/patterns.md` - Output structure and reviewer guidance: `references/output-format.md` - Smoke-test inputs and expected behavior: `references/test-cases.md` - Deterministic local sanitizer: `scripts/sanitize_text.py`


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mzlzyca/html-to-html (version 0.4.0)

--- name: html-to-html description: "Clean and restructure HTML documents using MinerU. Takes messy or complex HTML and produces clean, well-formatted HTML output with proper structure preserved. Features: HTML cleanup and restructuring. Removes unnecessary markup and noise. Preserves core content structure. Produces clean HTML from cluttered web pages. Use when you need to: clean up messy HTML, restructure an HTML document, convert complex HTML to clean HTML, sanitize HTML content. Use when asked: 'how do I clean this HTML', 'make this HTML cleaner', 'I want clean HTML from this page', 'can my agent clean up HTML', 'is there a skill for HTML cleanup', 'restructure this messy HTML'. Built on MinerU by OpenDataLab (Shanghai AI Lab), an open-source document intelligence engine. Great for web developers, content migration teams, and anyone who needs to clean up HTML from legacy systems, CMS exports, or messy web scraping results." homepage: https://mineru.net metadata: {"openclaw": {"emoji": "📄", "requires": {"bins": ["mineru-open-api"], "env": ["MINERU_TOKEN"]}, "primaryEnv": "MINERU_TOKEN", "install": [{"id": "npm", "kind": "node", "package": "mineru-open-api", "bins": ["mineru-open-api"], "label": "Install via npm"}, {"id": "go", "kind": "go", "package": "github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api", "bins": ["mineru-open-api"], "label": "Install via go install", "os": ["darwin", "linux"]}]}} --- # HTML to HTML Fetch a remote web page or local HTML file and convert it to clean structured HTML using MinerU. Strips noise and preserves semantic content. ## Install ```bash npm install -g mineru-open-api # or via Go (macOS/Linux): go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@latest ``` ## Quick Start ```bash # Crawl a web page and output clean HTML (requires token) mineru-open-api crawl https://example.com/article -f html -o ./out/ # Re-extract a local HTML file to clean HTML (requires token) mineru-open-api extract page.html -f html -o ./out/ # Batch crawl multiple URLs to HTML (requires token) mineru-open-api crawl url1 url2 -f html -o ./pages/ ``` ## Authentication Token required: ```bash mineru-open-api auth # Interactive token setup export MINERU_TOKEN="your-token" # Or via environment variable ``` Create token at: https://mineru.net/apiManage/token ## Capabilities - Input: remote web page URL or local .html file - Output: clean structured HTML (`-f html`) - For remote URLs: use `crawl -f html` - For local HTML files: use `extract -f html` - Requires token — not available in `flash-extract` ## Notes - HTML output (`-f html`) requires token; not available in `flash-extract` - `crawl` supports output formats: md, html, json - `extract` supports output formats: md, html, latex, docx, json - Output goes to stdout by default; use `-o <dir>` to save to a file or directory - All progress/status messages go to stderr; document content goes to stdout - MinerU is open-source by OpenDataLab (Shanghai AI Lab): https://github.com/opendatalab/MinerU


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ericw12/chart-master (version 1.0.0)

--- name: chart-master description: Generate precise financial charts (candlestick, OHLC, line) for stocks, indices, and crypto using Python. Use when the user requests a visual chart, technical analysis visualization, or price history plot. --- # Chart Master This skill generates professional-grade financial charts using Python (`mplfinance` / `yfinance`). ## Usage Run the bundled script to generate a chart. The script fetches data automatically. ### Command ```bash uv run --with yfinance --with mplfinance --with pandas {baseDir}/scripts/generate_chart.py --ticker "NVDA" --period "6mo" --interval "1d" --style "yahoo" --title "NVIDIA Daily Chart" ``` ### Parameters * `--ticker`: The symbol to chart (e.g., `AAPL`, `BTC-USD`, `^NDX`, `^GSPC`). * `--period`: Data range (e.g., `1d`, `5d`, `1mo`, `3mo`, `6mo`, `1y`, `2y`, `5y`, `max`, `ytd`). * `--interval`: Bar size (e.g., `1m`, `5m`, `15m`, `30m`, `60m`, `90m`, `1h`, `1d`, `5d`, `1wk`, `1mo`, `3mo`). * *Note:* Intraday data (`1m`-`60m`) is only available for the last 60 days. * `--type`: Chart type (default: `candle`; options: `candle`, `line`, `renko`, `pnf`). * `--style`: Visual style (default: `yahoo`; options: `binance`, `blueskies`, `charles`, `checkers`, `classic`, `default`, `mike`, `nightclouds`, `sas`, `starsandstripes`, `yahoo`). * `--mav`: Moving averages (comma-separated, e.g., `20,50,200`). * `--volume`: specific flag `--volume` to show volume pane (default: true). ### Output The script saves a PNG file to the current working directory and prints the filename. **Action:** Use the `read` tool (or `write` if editing) to handle the file, but primarily **display the image** to the user using the appropriate tool if available, or simply confirm the file was created and provide the path.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dinghaibin/readlink-tool (version 1.0.0)

--- name: readlink-tool description: Display the target of a symbolic link. Use for resolving symlinks to find the actual file or directory they point to. --- # Readlink - Symbolic Link Resolver Show the target path that a symbolic link points to. Essential for understanding symlink chains and finding actual file locations. ## Usage ```bash readlink-tool [options] <link> ``` ## Options - `-f`: Canonicalize by following every symlink in the path - `-e`: Canonicalize but require all components to exist - `-n`: Suppress trailing newline ## Examples ```bash readlink-tool /usr/bin/python readlink-tool -f symlink_to_file readlink-tool -e symlink.txt ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: b-gutman/pipeworx-college-scorecard (version 1.0.0)

# College Scorecard College Scorecard MCP — US Department of Education College Scorecard API ## search_schools Search US colleges and universities by name. Returns school name, location, tuition, admission rate, ## get_school Get detailed info for a specific college by its College Scorecard ID. Returns tuition, admission rat ```json { "mcpServers": { "college-scorecard": { "url": "https://gateway.pipeworx.io/college-scorecard/mcp" } } } ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: fmouseboy/a-stock-investment (version 1.0.0)

--- name: a-stock-investment description: A股每日行情分析工具，提供大盘走势、板块轮动、资金流向、热点板块分析功能。当用户询问A股行情、A股走势、A股分析、股市行情、今日A股、大盘分析、板块轮动等相关问题时触发此 Skill。 metadata: { "openclaw": { "emoji": "📈", "requires": { "env": ["TAVILY_API_KEY"], }, }, } --- # A股行情分析 Skill A股每日行情分析工具，提供大盘走势、板块轮动、资金流向、热点板块分析功能。 ## 环境要求 **必需环境变量：** - `TAVILY_API_KEY` - Tavily API 密钥 申请地址：https://tavily.com/ ## 功能模块 ### 1. 大盘走势分析 - 上证指数、深证成指、创业板指 - 成交量能分析 - 涨跌幅统计 ### 2. 板块轮动分析 - 今日强势板块 - 板块资金流入流出 - 轮动规律分析 ### 3. 资金流向 - 北向资金动向 -主力资金流向 - 散户情绪指标 ### 4. 热点分析 - 涨停板分析 - 概念板块热度 - 龙头股表现 ## 数据来源 使用 Tavily API 搜索获取A股相关信息： ```bash node {baseDir}/scripts/search-stock.mjs <query> [--type market|sector|funding|hot] ``` ## 输出格式 分析报告包含： 1. **大盘概览** - 主要指数表现、成交量 2. **板块表现** - 今日强势/弱势板块 3. **资金流向** - 北向资金、主力资金 4. **风险提示** - 注意事项 ## 使用示例 用户说 "今天A股怎么样" 或 "帮我分析一下股市" 时： 1. 运行搜索脚本获取最新数据 2. 综合分析给出投资建议


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: jcwang502/cloudflare-mail-reader (version 1.0.0)

--- name: cloudflare-mail-reader description: Read one mailbox's messages or a paginated mail list from a Cloudflare temporary mail system through the `/admin/mails` admin API and return structured results. Use when Codex is asked to fetch or read emails through the backend instead of opening the web UI, including requests such as "read mails for [REDACTED_SECRET]", "show the latest 20 emails", "export mailbox messages", or "use the Cloudflare mail admin API to fetch messages". --- # Cloudflare Mail Reader Use this skill to read mailbox messages through `https://mail-api.suilong.online/admin/mails`. ## Follow This Workflow 1. Collect or infer `address`, `limit`, and `offset`. 2. Default `limit` to `20` and `offset` to `0` when the user does not specify them. 3. Never store real credentials in the skill. Pass runtime credentials with CLI flags or environment variables. 4. Run [scripts/read_mails.py](scripts/read_mails.py) to fetch and normalize the response. 5. The normalized result includes `verification_code` when a code can be extracted from subject/text/html content. 6. Return the script's JSON output directly unless the user asks for a reformatted summary. 7. Use `--output-format csv` and optionally `--output-file <path>` when the user asks for exportable results. 8. Preserve the normalized statuses: `ok`, `auth_error`, `error`. 9. Use `--include-raw` only when the user explicitly wants the full original payload for debugging. ## Run The Script Read one mailbox: ```powershell C:\Users\sl\AppData\Local\Python\bin\python.exe scripts/read_mails.py ` --address [REDACTED_SECRET] ` --limit 20 ` --offset 0 ` --admin-auth $env:CLOUDFLARE_MAIL_ADMIN_AUTH ``` Read recent mails without an address filter: ```powershell C:\Users\sl\AppData\Local\Python\bin\python.exe scripts/read_mails.py ` --limit 20 ` --offset 0 ` --admin-auth $env:CLOUDFLARE_MAIL_ADMIN_AUTH ``` Export messages as CSV: ```powershell C:\Users\sl\AppData\Local\Python\bin\python.exe scripts/read_mails.py ` --address [REDACTED_SECRET] ` --limit 20 ` --output-format csv ` --output-file .\mail-results.csv ` --admin-auth $env:CLOUDFLARE_MAIL_ADMIN_AUTH ``` ## Runtime Credentials Prefer environment variables for secrets: - `CLOUDFLARE_MAIL_ADMIN_AUTH` - `CLOUDFLARE_MAIL_BEARER_TOKEN` - `CLOUDFLARE_MAIL_CUSTOM_AUTH` - `CLOUDFLARE_MAIL_FINGERPRINT` - `CLOUDFLARE_MAIL_LANG` - `CLOUDFLARE_MAIL_USER_TOKEN` - `CLOUDFLARE_MAIL_MAILS_API_URL` ## Read More Only When Needed - Read [references/api.md](references/api.md) for the endpoint contract and normalization rules. - Read [references/examples.md](references/examples.md) for example prompts and outputs.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)