OpenClaw/clawhub-security-signals huggingface dataset:
Skill: liweijie0709-cmyk/geo-market-impact-mapper (version 1.0.0)

# geo-market-impact-mapper 市场影响映射技能。负责获取和分析原油、黄金等大宗商品价格数据，为地缘事件提供市场联动分析。 ## 功能 - **实时价格获取**: 通过 Yahoo Finance API 获取原油 (CL=F)、黄金 (GC=F) 期货价格 - **涨跌幅计算**: 计算日内涨跌幅百分比 - **双阈值检测**: - 高优先级：原油±3%、黄金±2% - 观察池：原油±1.2%、黄金±0.8% - **15 分钟脉冲**: 检测短期价格异动 - **市场联动分析**: 将商品价格波动与地缘事件关联 ## 数据源 | 商品 | 代码 | 说明 | |:---|:---|:---| | 原油 | `CL=F` | WTI 原油期货 | | 黄金 | `GC=F` | 黄金期货 | ## 阈值配置 ```python # 高优先级阈值 OIL_HIGH_THRESHOLD = 3.0 # 原油 ±3% GOLD_HIGH_THRESHOLD = 2.0 # 黄金 ±2% # 观察池阈值 OIL_WATCH_THRESHOLD = 1.2 # 原油 ±1.2% GOLD_WATCH_THRESHOLD = 0.8 # 黄金 ±0.8% ``` ## 使用方法 ### Python API ```python from geo_market_impact_mapper import ( get_market_data, MarketImpact, is_high_priority, is_watch_level, ) # 获取市场数据 market = get_market_data() print(f"原油：{market.oil_pct:+.2f}%") print(f"黄金：{market.gold_pct:+.2f}%") # 检查是否达到高优先级 if market.is_high_priority(): print("⚠️ 市场异动达到高优先级阈值") # 检查是否达到观察池 if market.is_watch_level(): print("👁️ 市场异动进入观察范围") # 生成市场影响描述 description = market.get_impact_description() # → "原油大涨 2.5%，利多石油石化板块，利空航空运输" ``` ### MarketImpact 数据结构 ```python @dataclass class MarketImpact: oil_pct: float = 0.0 # 原油涨跌幅 gold_pct: float = 0.0 # 黄金涨跌幅 oil_pulse: float = 0.0 # 15 分钟脉冲 gold_pulse: float = 0.0 # 15 分钟脉冲 ``` ## 影响路径映射 | 事件类型 | 影响路径 | 受益板块 | 受损板块 | |:---|:---|:---|:---| | 地缘冲突 | 原油供应扰动 → 油价上涨 | 石油石化、油运 | 航空、物流 | | 避险升温 | 黄金需求增加 → 金价上涨 | 有色金属（黄金） | - | | 央行加息 | 美元走强 → 商品承压 | 银行 | 成长股、有色 | ## 依赖 - `requests`: HTTP 请求库 - Yahoo Finance API (免费，无需 API Key) ## 相关文件 - 主模块：`geo_market_impact_mapper.py` ## 版本 - **v1.0.0**: 初始版本，从 smart-geo-push.py v2.0 拆分


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: freedompixels/cn-case-converter (version 1.0.0)

# cn-case-converter 中文拼音大小写转换工具。主要用于英文字母大小写转换。 ## 功能 - 转大写 - 转小写 - 首字母大写 - 驼峰转换 ## 使用方法 ```bash python3 scripts/case_convert.py --text "hello world" --upper python3 scripts/case_convert.py --text "HELLO WORLD" --lower python3 scripts/case_convert.py --text "hello world" --title ``` 纯Python标准库。

path: scripts/case_convert.py
content: #!/usr/bin/env python3
"""大小写转换工具"""
import argparse

def main():
    parser = argparse.ArgumentParser(description="大小写转换工具")
    parser.add_argument("--text", required=True, help="要转换的文本")
    parser.add_argument("--upper", action="store_true", help="转大写")
    parser.add_argument("--lower", action="store_true", help="转小写")
    parser.add_argument("--title", action="store_true", help="首字母大写")
    args = parser.parse_args()

    if args.upper:
        print(args.text.upper())
    elif args.lower:
        print(args.text.lower())
    elif args.title:
        print(args.text.title())
    else:
        print(args.text)

if __name__ == "__main__":
    main()


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: vishalgojha/lead-extractor (version 1.0.6)

--- name: lead-extractor description: "Extract structured real-estate lead records from parsed message objects. Use when users ask to find leads in WhatsApp exports, extract name-phone-budget, or classify listing vs requirement posts. Recommended chain: run after message-parser and before india-location-normalizer. Do not use for storage, summaries, outbound messaging, or action execution." --- # Lead Extractor Identify lead signals in parsed messages and emit strict lead objects. ## Quick Triggers - Find all buyer leads from this WhatsApp chat. - Extract contact details and budget from these messages. - Identify serious property inquiries from parsed messages. ## Recommended Chain `message-parser -> lead-extractor -> india-location-normalizer` ## Execute Workflow 1. Accept parsed messages from Supervisor. 2. Validate input with `references/parsed-message-input.schema.json`. 3. Apply chat-specific extraction rules from `references/extraction-rules-re-india-v1.md`. 4. Determine `dataset_mode` from Supervisor context: - default: `broker_group` - allowed: `broker_group`, `buyer_inquiry`, `mixed` 5. Detect lead-candidate messages using inquiry intent, contact details, and property-related preferences. 6. Classify `record_type`: - `inventory_listing` for broker inventory/availability posts (default in broker groups) - `buyer_requirement` for explicit "required/chahiye looking for" demand posts - drop non-lead/system noise instead of emitting `noise_or_system` 7. Handle multiline listings as one candidate record when body lines contain price, area, or location details. 8. Build lead records with: - required: `lead_id`, `name`, `phone`, `record_type` - optional: `dataset_mode`, `property_type`, `budget`, `deal_type`, `asset_class`, `price_basis`, `area_sqft`, `area_basis`, `location_hint`, `raw_text`, `source`, `created_at` 9. Normalize phone extraction from spaced variants such as `+91 98205 82462` and `98200 78845`. 10. Distinguish price intent from rate intent: - examples: `3.5 Lakh rent` (monthly), `60K psf` (per-sqft), `4.25 Cr` (total) 11. Deduplicate leads by stable keys when records clearly refer to the same person. 12. Validate output with `references/output-leads.schema.json`. 13. Return only validated lead objects. ## Enforce Boundaries - Never write or update persistent storage. - Never modify source messages. - Never generate summaries. - Never suggest or execute follow-up actions. - Never send communication or invoke external side effects. ## Handle Errors 1. Reject invalid parsed-message input. 2. Emit an empty array when no lead evidence exists. 3. Return field-level validation errors when extracted records violate schema.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: laigen/cup-handle-detector (version 1.0.0)

--- name: cup-handle-detector description: 检测股票日线是否符合"杯柄形态（Cup and Handle）"技术分析形态，并生成含轮廓线的识别示意图。触发场景：(1) 询问某只股票是否形成杯柄形态 (2) 查询杯柄形态股票 (3) 技术形态识别需求。触发词：杯柄形态、cup and handle、欧奈尔形态、技术形态识别。 --- # Cup Handle Detector 检测股票日线数据是否符合经典的"杯柄形态"技术分析形态，并生成可视化识别示意图（含杯柄轮廓线）。 ## 功能特性 - **形态检测**：自动检测杯身（U型底部）和把手（下跌回调） - **轮廓绘制**：在K线图上绘制杯柄轮廓线（蓝色杯身+橙色把手） - **关键标注**：标记左杯口、杯底、右杯口、把手等关键点 - **自适应日期**：日期标签自动调整间隔，避免重叠 - **双语支持**：自动检测中文字体，无字体时使用英文标签 ## 依赖要求 ### 必需依赖 | 依赖 | 版本要求 | 说明 | |---|---|---| | Python | ≥3.10 | 运行环境 | | pandas | ≥1.5 | 数据处理 | | numpy | ≥1.20 | 数值计算 | | matplotlib | ≥3.6 | 图表生成 | ### 可选依赖 | 依赖 | 用途 | 说明 | |---|---|---| | tushare | 实时数据获取 | 需配置 `TUSHARE_TOKEN` 环境变量 | ### 中文字体支持 图表标签自动适配： - 检测系统中文字体（SimHei、WenQuanYi等） - 无中文字体时自动使用英文标签（避免乱码） ## 快速使用 ```bash # 单股票检测（需要 TUSHARE_TOKEN） python3 scripts/cup_handle_detector.py <股票代码> # 批量扫描（从SQLite数据库） python3 scripts/batch_scan_cup_handle.py --db <数据库路径> ``` ### 示例 ```bash python3 scripts/cup_handle_detector.py 600519.SH python3 scripts/batch_scan_cup_handle.py --db data/stocks.sqlite ``` ## 输出结果 **符合杯柄形态时：** - 输出形态评分和各项参数 - 生成含轮廓线的识别示意图（仅显示最近一年数据） - 图表保存至临时目录 **不符合杯柄形态时：** - 输出 "不匹配杯柄形态" - 不生成图形文件 ## 图表特性 生成的示意图包含： - **K线蜡烛图**（红涨绿跌，最近一年数据） - **杯身轮廓线**（蓝色U型曲线） - **把手轮廓线**（橙色回调曲线） - **颈线标注**（红色虚线，突破位） - **关键点标记**（左杯口、杯底、右杯口、把手） - **形态特征信息框** ## 杯柄形态技术特征 杯柄形态是威廉·欧奈尔提出的经典看涨持续形态。 ### 【重要】最新时间点约束 本检测器只关注**最新一段时间内出现的杯柄形态**，历史过往形态不属于符合范畴。 具体约束条件： - **右杯口距离最新交易日** ≤ 30 天 - **把手终点距离最新交易日** ≤ 5 天 这意味着形态的最后一个时间点必须是或接近最新的交易日，确保检测到的是**当前正在形成或刚完成**的形态，而非历史已完成的形态。 ### 杯身（Cup） - **形状**：U型底部（非V型） - **深度**：前期涨幅的1/3到1/2（15-33%） - **时间跨度**：1-6个月（30-180天） ### 把手（Handle） - **位置**：位于杯子右侧 - **形态**：向下倾斜或横向整理 - **深度**：不超过杯深的1/3 - **时间跨度**：1-4周（5-30天） ### 前置趋势 - 形成前应有明显上升趋势（≥30%涨幅） ## 算法说明 详见 [references/algorithm.md](references/algorithm.md)。 ## 注意事项 1. **数据要求**：至少需要180天日线数据 2. **形态主观性**：算法评分仅作参考 3. **风险提示**：技术形态仅为参考工具，不构成投资建议 --- *基于威廉·欧奈尔《笑傲股市》CANSLIM投资体系*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: spacesq/s2-matrix-pod (version 1.0.0)

# 🧊 S2-Habitat-Pod v1.0.4: State & Visual Initialization The **Space2 Habitat Pod** assigns a deterministic **4-square-meter virtual space** to your OpenClaw agent and equips it with a visual face. ### 👁️ Network & I/O Behavior (Please Read) To ensure absolute transparency for the OpenClaw sandbox, here is exactly what this script executes: 1. **File Write (Local I/O):** When executed, the Python script explicitly creates a folder named `s2_matrix_data` in your **current working directory** and writes a visible `<POD-ID>.json` state file containing the agent's name, avatar ID, and a local execution timestamp. 2. **Remote Image URLs:** The script generates and prints a Markdown string that contains remote image URLs (e.g., `<img src="https://spacesq.org/..."/>`). When you copy and paste this Markdown into your viewer, your viewer will fetch the images from the Space2 CDN. ### 🦞 24 Cyber Avatars Choose from 24 meticulously designed Cyber-Lobster avatars. The engine calculates a permanent local `Pod-ID` and grid coordinate (e.g., `[LOCAL-ZONE-X:12, Y:45]`) based on your agent's name. *Synchronize your Pod-ID at [Space2.world](https://space2.world)!*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kangjjang/youtube-shorts-automation (version 1.0.0)

--- name: youtube-shorts-automation description: YouTube Shorts 자동 생성 및 업로드 파이프라인. Deevid AI Agent로 이미지→영상(BGM+음성 포함) 생성 후 YouTube에 업로드. 크론잡으로 매일 자동 실행 가능. Use when generating short-form vertical videos, creating AI-generated video content, uploading to YouTube Shorts, or automating daily video content pipelines. --- # YouTube Shorts Automation Deevid AI로 이미지/영상 생성 → YouTube Shorts 업로드 자동화 스킬. ## 전체 파이프라인 ``` 1. 이미지 생성 (Deevid AI) 2. Agent 영상 생성 (Deevid Agent — 오디오 포함) 3. 영상 다운로드 4. YouTube 업로드 5. (선택) Telegram으로 결과 전송 ``` ## 핵심 규칙 - **⚠️ "이미지를 동영상으로" 도구 사용 금지** → 무음 영상만 나옴 - **✅ Deevid Agent** (`https://deevid.ai/ko/agent`) 사용 → BGM+대사 포함 - 영상 비율: **9:16** (세로, Shorts 필수) - 영상 길이: **60초 이하** (8~10초 권장) ## 설정 파일 구조 채널별 설정을 JSON으로 관리. 예시: [references/config_example.json](references/config_example.json) 필수 필드: - `channel`: 채널명 - `deevid_prompt`: 이미지 생성 프롬프트 (영어, 9:16 명시) - `youtube.title_template`: 업로드 제목 (`#shorts` 포함) - `youtube.description_template`: 업로드 설명 - `youtube.tags`: 쉼표 구분 태그 ## 단계별 실행 ### 1. 이미지 생성 Deevid AI 웹에서 이미지 생성. 프롬프트에 `9:16 vertical format` 포함. - 비용: 6 크레딧/장 - 상세: [references/deevid-agent-workflow.md](references/deevid-agent-workflow.md) ### 2. Agent 영상 생성 Deevid Agent에 이미지 업로드 + 프롬프트 → 영상 생성 (2-5분 소요). - 비용: 20 크레딧/8초 - 모델: Start Image Master V2.0 - 상세: [references/deevid-agent-workflow.md](references/deevid-agent-workflow.md) ### 3. YouTube 업로드 ```bash python3 scripts/youtube_upload.py \ --file video.mp4 \ --title "제목 #shorts" \ --description "설명" \ --tags "tag1,tag2" ``` - 사전 설정: OAuth `client_secret.json` + `token.json` 필요 - 상세: [references/youtube-upload.md](references/youtube-upload.md) ### 4. 크론잡 등록 (OpenClaw) 매일 정해진 시간에 isolated session으로 파이프라인 실행. 크론잡 payload에 전체 워크플로 설명 + 환경 경로 포함. ## 트러블슈팅 | 문제 | 원인 | 해결 | |------|------|------| | 무음 영상 | "이미지를 동영상으로" 도구 사용 | Agent 사용으로 전환 | | 업로드 실패 | token.json 만료 | 재인증 또는 refresh | | Deevid 로그인 풀림 | 세션 만료 | 브라우저에서 재로그인 | | 영상 URL 추출 실패 | SPA 렌더링 지연 | 대기 시간 늘리기 |


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: chrischall/gogcli-mcp-classroom (version 2.3.0)

--- name: gogcli-mcp-classroom description: Use when the user asks to manage Google Classroom — create or update courses, enroll students and teachers, post announcements, create assignments, view submissions, grade work, manage topics, or send/accept invitations. Triggers for requests involving classrooms, courses, assignments, coursework, homework, student rosters, gradebook, or classroom management. Includes auth and Classroom tools only. --- # gogcli-mcp-classroom Extended Google Classroom MCP server via [gogcli](https://github.com/openclaw/gogcli) — 49 tools: auth (5) + 44 dedicated Classroom tools spanning courses, students, teachers, coursework, submissions, announcements, topics, invitations, and profiles. - **Source:** [github.com/chrischall/gogcli-mcp](https://github.com/chrischall/gogcli-mcp) ## Requirements - [gogcli](https://github.com/openclaw/gogcli) installed and authenticated - Node.js 18 or later ## Setup ```json { "mcpServers": { "gogcli-classroom": { "command": "npx", "args": ["-y", "gogcli-mcp-classroom"], "env": { "GOG_ACCOUNT": "[REDACTED_SECRET]" } } } } ``` ## Classroom Tools | Area | Tools | |------|-------| | Courses | list / get / create / update / delete / archive / unarchive | | Students | list / get / add / remove | | Teachers | list / get / add / remove | | Roster | combined students+teachers list | | Coursework | list / get / create / update / delete | | Submissions | list / get / grade / return / turn-in / reclaim | | Announcements | list / get / create / update / delete | | Topics | list / get / create / update / delete | | Invitations | list / get / create / accept / delete | | Profile | get (self or by userId) | For guardians, guardian-invitations, materials, and assignee management, use `gog_classroom_run` (the escape hatch).


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: gricha/dex (version 1.1.0)

--- name: dex description: Task tracking for async/multi-step work. Use dex to create, track, and complete tasks that span multiple sessions or require coordination (e.g., coding agent dispatches, PR reviews, background jobs). Tasks stored as JSON files in .dex/tasks/. --- # Dex Task Tracking Track async work: coding agent dispatches, multi-step projects, anything needing follow-up. ## Commands ```bash dex create -d "Description" --context "Background, goal, done-when" dex list # Pending tasks dex list --all # Include completed dex show <id> # View task dex show <id> --full # Full context dex complete <id> --result "What was done, decisions, follow-ups" dex edit <id> --context "Updated context" dex delete <id> ``` ## Task Structure - **Description**: One-line summary - **Context**: Background, requirements, done criteria - **Result**: What was built, decisions, follow-ups ## Example ```bash # Before dispatching agent dex create -d "Add caching to API" --context "Workspace: feat1 (100.x.x.x) Branch: feat/cache Done when: PR merged, CI green" # After work complete dex complete abc123 --result "Merged PR #50. Redis caching with 5min TTL." ``` ## Storage `.dex/tasks/{id}.json` — one file per task, git-friendly.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bytesagain-lab/usb (version 2.0.2)

--- name: "usb" version: "2.0.2" description: "usb reference tool" author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [usb, reference] category: "devtools" --- # Usb usb reference tool. No API keys or credentials required — outputs reference documentation only. ## Commands | Command | Description | |---------|-------------| | `intro` | intro reference | | `quickstart` | quickstart reference | | `patterns` | patterns reference | | `debugging` | debugging reference | | `performance` | performance reference | | `security` | security reference | | `migration` | migration reference | | `cheatsheet` | cheatsheet reference | ## Output Format All commands output plain-text reference documentation via heredoc. No external API calls, no credentials needed, no network access. --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: loverun321/seo-analyzer-v2 (version 1.0.0)

# SEO Analyzer Analyze webpage SEO score and provide optimization recommendations. ## Features - Check title tag - Check meta description - Check H1 tags - Calculate SEO score (0-100) - Provide recommendations ## Price - **0.001 USDT** per analysis ## Usage ``` "Analyze SEO for https://example.com" "Check SEO score of my website" "SEO analysis for [URL]" ``` ## SEO Score Breakdown - Title tag: 30 points - Meta description: 30 points - H1 tag: 20 points - Content length: 20 points ## Example Response ```json { "url": "https://example.com", "score": 80, "title": "Example Website", "description": "This is an example...", "h1_count": 1, "issues": [], "recommendations": ["Add more content"] } ``` ## Integration - API Key: [REDACTED_SECRET] - Price: 0.001 USDT per call


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector:  ()
Skill: hongjiahao371-pixel/minimax-vision (version 1.0.0)

--- name: minimax-vision description: MiniMax 图片理解 MCP - 自动识别用户发送的图片 metadata: {"clawdbot":{"emoji":"👁️","triggers":["分析图片","识别图片","看看这张图","这张是什么","帮我看看"]}} --- # MiniMax Vision - 图片理解 使用 MiniMax MCP 进行图片识别。 ## 使用方式 当用户发送图片或让你分析图片时，自动调用： ```bash mcporter call minimax.understand_image --args '{"prompt": "你要求的描述", "image_source": "图片路径"}' ``` ## 工作流程 1. 检测到用户发送图片（在 media/inbound/ 目录） 2. 使用 mcporter 调用 minimax.understand_image 3. 返回识别结果给用户 ## 注意事项 - 图片路径: ~/.openclaw/media/inbound/*.jpg/*.png/*.gif/*.webp - 依赖 mcporter 和 minimax MCP 已配置


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: hgosansn/mukt (version 0.1.3)

--- name: openrouter-free-responder description: Zero-cost OpenRouter responder that auto-discovers the best currently free model, retries on failures, and returns clean answers fast. Use this when a user asks to query OpenRouter, wants lowest-cost/free model routing, or explicitly requests a free-model OpenRouter response. metadata: {"openclaw":{"emoji":"🆓","requires":{"bins":["python3"],"env":["OPENROUTER_API_KEY"]},"primaryEnv":"OPENROUTER_API_KEY","homepage":"https://openrouter.ai"}} --- ## What is Mukt for? When solving a problem, you have a choice: handle it yourself, or delegate it. Mukt gives you a third option — offload it to an external model at no cost. Think of Mukt as a pool of interns. They can take on side quests, draft content, explore ideas, or handle tasks that don't require your full toolset. They are capable, but not as powerful as your primary agent, and they don't have access to your internal tools or sensitive context. **Use Mukt when:** - The task is non-critical and doesn't involve sensitive information - You want a second opinion or a rough draft without burning compute budget - The problem can be solved with language alone — no tool access required **Don't use Mukt for:** - Tasks involving secrets, credentials, or private data - Anything that requires direct access to your workspace or systems ## Workflow 1. Ensure `OPENROUTER_API_KEY` is set. 2. Run: ```bash python3 {baseDir}/scripts/openrouter_free_chat.py --prompt "<user prompt>" ``` 3. If the user provided system guidance, pass `--system "..."`. 4. Return the `response` text and mention which model was used. ## Command Options - `--prompt` (required): User prompt text. - `--system` (optional): System instruction. - `--max-attempts` (optional, default `8`): Number of top free models to try. - `--temperature` (optional, default `0.3`): Sampling temperature. - `--debug` (optional): Print model ranking and fallback attempts to stderr. ## Output Contract The script prints one JSON object to stdout with: - `selected_model`: Model that produced the final response. - `response`: Final assistant text. - `attempted_models`: Ordered list of tried models. - `free_model_candidates`: Number of free models discovered. If no model succeeds, the script exits non-zero with an error message.


Security scan verdicts — ClawScan: clean | static analysis:  | VirusTotal:  | SkillSpector:  ()
Skill: esanle/bootleg-link-mcp (version 0.9.0)

--- name: bootleg-link-mcp version: 0.7.3 description: "MCP server for downloading YouTube audio as MP3 with embedded cover art, task queue, progress tracking, and SQLite persistence" metadata: openclaw: emoji: "🎵" os: ["linux", "darwin"] requires: bins: ["python3>=3.10"] --- # Bootleg-Link MCP v0.7.3 Python MCP server for downloading YouTube audio as MP3 with automatic cover art embedding. Features a task queue, concurrent download manager, SQLite-based persistence, and paged playlist support. ## Architecture Single-file Python MCP server (`src/server.py`) communicating over stdin/stdout via JSON-RPC 2.0. - **Task Queue**: In-memory queue with SQLite persistence for resume across restarts - **Download Engine**: yt-dlp Python API with `bestaudio/best` format - **Cover Art**: Downloads thumbnail via `writethumbnail`, embeds into MP3 ID3 APIC frame using mutagen, then cleans up webp/webm files - **Concurrency**: ThreadPoolExecutor with configurable worker count - **Paged Playlist**: Flat playlist extraction (100 per page) for large channel downloads ## MCP Tools | Tool | Description | |------|-------------| | `submit_download_task` | Submit a YouTube URL/channel for audio download | | `query_progress` | Query task progress and status | | `list_tasks` | List all tasks with optional status filter | | `cancel_task` | Cancel a pending or running task | | `clear_completed` | Clear completed/failed/cancelled tasks | | `clear_database` | Clear ALL tasks and videos from database | | `get_queue_status` | Get queue metrics (active, queued, total) | ### submit_download_task ```json { "url": "https://www.youtube.com/@ChannelName/videos", "quality": "320", "outputDir": "/path/to/output" } ``` Returns: `{ "success": true, "taskId": "task_xxx", "status": "pending" }` ### query_progress ```json { "taskId": "task_xxx" } ``` Returns: `{ "status": "downloading", "progress": 45, "songsCompleted": 5, "songsTotal": 100 }` ## Dependencies - `yt-dlp` — YouTube audio extraction - `mutagen` — MP3 ID3 tag manipulation and cover art embedding - Python 3.10+ (stdlib only: `sqlite3`, `json`, `threading`, `concurrent.futures`) ## Configuration Config file: `~/.bootleg-link-mcp/config.json` ```json { "paths": { "outputDir": "~/Downloads/bootleg-link", "dbPath": "~/.bootleg-link-mcp/bootleg-link.db" }, "proxy": { "http": "http://proxy:port", "https": "http://proxy:port" }, "download": { "maxConcurrent": 4, "quality": "320" } } ``` Or via OpenClaw MCP config with environment variables (deprecated, use config.json): ```json { "command": "python3", "args": ["src/server.py"], "env": { "BOOTLEG_OUTPUT_DIR": "~/Downloads/bootleg-link", "BOOTLEG_HTTP_PROXY": "BOOTLEG_HTTP_PROXY", "BOOTLEG_HTTPS_PROXY": "BOOTLEG_HTTPS_PROXY" } } ```


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)