OpenClaw/clawhub-security-signals huggingface dataset:
Skill: underbench2-gif/ub2-csv-data-analyzer (version 1.0.0)

# CSV Data Analyzer A skill that enables Claw to load, explore, analyze, and visualize CSV datasets, providing statistical insights and answering questions about the data. ## What This Skill Does This skill equips Claw with a structured approach to CSV data analysis: 1. **Data Loading & Inspection** — Read CSV files, detect column types, and display basic structure (shape, columns, sample rows) 2. **Data Cleaning** — Identify and handle missing values, duplicates, and type inconsistencies 3. **Statistical Summary** — Compute descriptive statistics (mean, median, mode, standard deviation, percentiles) for numeric columns 4. **Filtering & Grouping** — Slice data by conditions and aggregate by categories 5. **Correlation Analysis** — Find relationships between numeric variables 6. **Visualization** — Generate charts (bar, line, scatter, histogram) to illustrate patterns ## How to Use Provide a CSV file and ask Claw to analyze it: - "Analyze this sales data and tell me which product category has the highest revenue" - "Find outliers in the temperature column of this dataset" - "Create a chart showing monthly trends from this CSV" - "Compare group A vs group B performance in this experiment data" ## Requirements - Input must be a valid CSV file (comma-separated by default; other delimiters can be specified) - Python with pandas and matplotlib should be available in the environment ## Output - Summary statistics table - Key insights in plain language - Charts saved as PNG files when visualization is requested - Cleaned dataset exported as a new CSV if data cleaning was performed


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: sxliuyu/ftp-sync (version 1.0.0)

--- name: ftp-sync version: 1.0.0 description: FTP/SFTP 同步工具。本地与远程服务器文件同步，支持增量备份。适合网站维护和服务器管理。 author: 你的名字 triggers: - "FTP同步" - "文件同步" - "服务器同步" - "SFTP" --- # FTP/SFTP Sync 🔄 本地与远程服务器文件同步。 ## 功能 - 📤 SFTP 上传/下载 - 🔄 增量同步 - 📊 同步报告 - 🔒 支持密钥认证 ## 使用方法 ### 上传同步 ```bash python3 scripts/ftp_sync.py upload ./local_folder/ --host 192.168.1.1 --user root --password xxx ``` ### 下载同步 ```bash python3 scripts/ftp_sync.py download /remote/folder/ --host 192.168.1.1 --user root ``` ### 对比差异 ```bash python3 scripts/ftp_sync.py diff ./local/ /remote/ --host xxx ``` ## 示例 ```bash # 上传网站文件 python3 scripts/ftp_sync.py upload ./dist/ --host example.com --user ftpuser --password pass123 --remote /var/www/html/ # 增量同步 python3 scripts/ftp_sync.py upload ./data/ --host example.com --user user --password pass --sync ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: rubybrewsday/clawdgle (version 1.0.0)

--- name: clawdgle description: Public API usage for the Clawdgle markdown-first search engine. Use when interacting with Clawdgle to: (1) search indexed markdown content, (2) fetch markdown for a URL, (3) request indexing of a URL via ingest, or (4) direct users to the donate link. --- # Clawdgle Skill ## Base URL Default base URL: `https://clawdgle.com` ## Public Endpoints ### Search Use to search indexed markdown content. Request: ``` GET /search?q=<query>&page=<page>&per_page=<per_page> ``` Example: ``` curl "https://clawdgle.com/search?q=ai%20agents&page=1&per_page=10" ``` ### Fetch Markdown by URL Use to retrieve the stored markdown for a specific URL. Request: ``` GET /doc?url=<encoded_url> ``` Example: ``` curl "https://clawdgle.com/doc?url=https%3A%2F%2Fexample.com" ``` ### Ingest (Self-Serve Indexing) Use to request immediate indexing of a URL. Request: ``` POST /ingest Content-Type: application/json { "url": "https://example.com", "reason": "optional reason", "contact": "optional contact" } ``` Example: ``` curl -X POST "https://clawdgle.com/ingest" \ -H "Content-Type: application/json" \ -d '{"url":"https://example.com"}' ``` ### Donate Use to direct users/agents to the donation link. Request: ``` GET /donate ``` Example: ``` curl -I "https://clawdgle.com/donate" ``` ## Notes - Only public endpoints are included in this skill. - Use URL encoding for query parameters. - Be polite with ingest; avoid spamming the endpoint.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: codekungfu/backup-recovery (version 1.0.0)

--- name: backup-recovery description: "Backups, RPO/RTO, restores, and drills. Use when designing DR or testing restores." --- # Backup Recovery Skill This skill provides structured guidance for **Backup Recovery** work. Act as an active guide: confirm triggers, propose the stages below, and adapt if the user wants a lighter pass. ## When to Offer This Workflow **Trigger conditions:** - User mentions **backup recovery** or closely related work - They want a structured workflow rather than ad-hoc tips - They are preparing a review, rollout, or stakeholder communication **Initial offer:** Explain the four stages briefly and ask whether to follow this workflow or work freeform. If they decline, continue in their preferred style. ## Workflow Stages ### Stage 1: Clarify context & goals Anchor on **RPO/RTO targets**. Ask what success looks like, constraints, and what must not break. Capture unknowns early. ### Stage 2: Design or plan the approach Translate goals into a concrete plan around **backup testing**. Compare alternatives and explicit trade-offs; avoid implicit assumptions. ### Stage 3: Implement, validate, and harden Execute with verification loops tied to **restore drills**. Prefer small steps, measurable checks, and rollback points where risk is high. ### Stage 4: Operate, communicate, and iterate Close the loop with **runbooks and ownership**: monitoring, documentation, stakeholder updates, and lessons learned for the next cycle. ## Checklist Before Completion - Goals and constraints are explicit for **Backup Recovery Skill** - Risks and trade-offs are stated, not hand-waved - Verification steps match the change’s impact (tests, canary, peer review) - Operational follow-through is covered (monitoring, docs, owners) ## Tips for Effective Guidance - Be procedural: stage-by-stage, with clear exit criteria - Ask for missing context (environment, scale, deadlines) before prescribing - Prefer checklists and concrete examples over generic platitudes - If the user declines the workflow, switch to freeform help without lecturing ## Handling Deviations - If the user wants to skip a stage: confirm and continue with what they need. - If context is missing: ask targeted questions before strong recommendations. - Prefer concrete examples, trade-offs, and verification steps over generic advice. ## Quality Bar - Each recommendation should be **actionable** (what to do next). - Call out **failure modes** relevant to Backup Recovery (security, scale, UX, or ops). - Keep tone direct and respectful of the user’s time.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: djc00p/tdd-workflow (version 1.0.0)

--- name: tdd-workflow description: "Test-driven development workflow enforcing 80%+ code coverage with unit, integration, and E2E tests. Write tests first, validate RED state, implement minimally, validate GREEN, then refactor. Use when writing features, fixing bugs, or refactoring. Trigger phrases: write tests, TDD, test-driven, feature implementation, bug fix. Adapted from everything-claude-code by @affaan-m (MIT)" metadata: {"clawdbot":{"emoji":"✅","requires":{"bins":["npm","git"],"env":[]},"os":["darwin","linux","win32"]}} --- # Test-Driven Development Workflow Ensure all code development follows TDD principles with 80%+ code coverage. ## When to Activate - Writing new features or functionality - Fixing bugs or issues - Refactoring existing code - User says "write tests", "add specs", "how should I test this" ## Quick Start 1. Write user journey in acceptance-test format ("As a [role], I want...") 2. Generate test cases (happy path + edge cases + errors) 3. Run tests → verify RED state (must fail before implementation) 4. Implement minimal code to make tests pass → GREEN state 5. Refactor while keeping tests green 6. Verify 80%+ coverage achieved ## Key Concepts - **Tests before code** — Write tests first, then implementation - **RED-GREEN-REFACTOR** — Fail → Pass → Improve (no exceptions) - **80% coverage minimum** — Unit, integration, and E2E combined - **Unit-level isolation** — Mock dependencies, test behavior not implementation - **Independent tests** — No test ordering dependencies; each can run solo ## Common Usage Most frequent patterns: - Unit tests for functions and components - Integration tests for API endpoints and database operations - E2E tests for critical user flows - Edge case and error path testing - Fast execution (unit tests < 50ms each) ## References - `references/workflow-steps.md` — Detailed 7-step TDD cycle with git checkpoints - `references/patterns-and-best-practices.md` — Test patterns, common mistakes, success metrics


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: luccast/gogcli (version 1.0.0)

--- name: gogcli description: Google Workspace CLI for Gmail, Calendar, Drive, Sheets, Docs, Slides, Contacts, Tasks, People, Groups, Keep. Use when user asks to interact with Google services. # gogcli - Google Workspace CLI ## Overview gogcli is a CLI tool for managing Google Workspace services from the terminal. Supports Gmail, Calendar, Drive, Sheets, Docs, Slides, Contacts, Tasks, People, Groups, and Keep. ## Installation ### Quick Install (if you have brew): ```bash brew install steipete/tap/gogcli ``` ### Build from Source (no brew): ```bash # 1. Clone repository git clone https://github.com/steipete/gogcli.git # 2. Navigate to directory cd gogcli # 3. Build make # 4. (Optional) Make available globally sudo make install ``` ## First Time Setup Before using gogcli, set up OAuth credentials: **Step 1: Get OAuth Client Credentials** 1. Go to Google Cloud Console APIs & Services 2. Create project or use existing one 3. Go to OAuth consent screen 4. Create OAuth 2.0 client with these settings: - Application type: "Desktop app" - Name: "gogcli for Clawdbot" - Authorized redirect URIs: `http://localhost:8085/callback` 5. Enable APIs you need 6. Download OAuth client credentials JSON file 7. Copy to `~/Downloads/` **Step 2: Authorize Your Account** ```bash cd gogcli ./bin/gog auth add [REDACTED_SECRET] ~/Downloads/client_secret_....json ``` **Step 3: Verify** ```bash ./bin/gog auth list ./bin/gog gmail search 'is:unread' --max 5 ``` ## Common Commands ### Gmail ```bash # Search ./bin/gog gmail search 'query' --max 20 # Send ./bin/gog gmail send '[REDACTED_SECRET]' --subject 'Hello' --body 'Message' # Labels ./bin/gog gmail labels list ``` ### Calendar ```bash # List events ./bin/gog calendar events list --max 50 # Create event ./bin/gog calendar events create 'Meeting' --start '2026-01-30T10:00' ``` ### Drive ```bash # List files ./bin/gog drive ls --query 'pdf' --max 20 # Upload file ./bin/gog drive upload ~/Documents/file.pdf ``` ### Sheets ```bash # List sheets ./bin/gog sheets list # Export sheet ./bin/gog sheets export <spreadsheet-id> --format pdf ``` ### Contacts ```bash ./bin/gog contacts search 'John Doe' ``` ### Tasks ```bash # List tasklists ./bin/gog tasks list # Add task ./bin/gog tasks add --title 'Task' --due '2026-01-30' ``` ## Notes - Use `--json` flag for scripting - Credentials stored in `~/.config/gog/` - Use `gog auth list` to check authentication status


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: djc00p/token-budget-advisor (version 1.0.1)

--- name: token-budget-advisor description: "Offer users informed choice about response depth before answering. Control token usage, response length, and answer depth. Trigger phrases: token budget, token count, token usage, response length, short version, brief answer, detailed answer, exhaustive, save tokens. Adapted from everything-claude-code by @affaan-m (MIT)" metadata: {"clawdbot":{"emoji":"💰","requires":{"bins":[],"env":[]},"os":["linux","darwin","win32"]}} --- # Token Budget Advisor Intercept response flow to let users choose depth before answering. ## When to Use - User mentions tokens, budget, depth, or response length - User says "short version", "tldr", "brief", "exhaustive", etc. - User wants to control detail level upfront **Do not trigger** when: user already set depth this session, or answer is trivially one line. ## Depth Options Present before answering: ```text Input: ~[N] tokens | Type: [type] | Complexity: [level] [1] Essential (25%) -> ~[tokens] Direct answer only [2] Moderate (50%) -> ~[tokens] Answer + context + example [3] Detailed (75%) -> ~[tokens] Multiple examples + alternatives [4] Exhaustive (100%) -> ~[tokens] Everything ``` ## Level Guide | Level | Length | Include | Omit | |-------|--------|---------|------| | 25% | 2-4 sent | Direct answer, conclusion | Context, examples | | 50% | 1-3 para | Answer + context + 1 example | Deep analysis, edge cases | | 75% | Structured | Examples, pros/cons, alternatives | Extreme cases | | 100% | No limit | Everything | Nothing | ## Shortcuts If user signals depth, respond at that level immediately: - "1" / "25%" / "short" / "brief" / "tldr" → 25% - "2" / "50%" / "moderate" → 50% - "3" / "75%" / "detailed" → 75% - "4" / "100%" / "exhaustive" → 100% Maintain user's chosen level for rest of session unless changed. ## Estimation Heuristic-based (no real tokenizer): - Input tokens = estimate from prompt size - Response window = input × complexity multiplier - Accuracy ~85-90%, variance ±15%


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xisen-w/inbox-monitoring (version 1.0.0)

--- name: inbox-monitoring description: "Use this skill when the user wants to monitor Pulse inbox activity, check new conversations/messages, track pending requests, or run periodic inbox checks. Triggers on: 'inbox monitoring', 'monitor inbox', 'new messages', 'pending requests', 'message watch', '收件箱监控', '/v1/conversations', '/v1/network/requests'." metadata: author: systemind version: "1.0.0" --- # Inbox Monitoring Monitor incoming communication in Pulse and surface what needs action. ## Prerequisites - `PULSE_API_KEY` must be set - Base URL: `https://www.aicoo.io/api/v1` ## Endpoints - `GET /api/v1/conversations?view=all&limit=...` - `GET /api/v1/network/requests` - `GET /api/v1/os/network` (optional context: links/visitors/contacts) ## Core Workflow ### Step 1: Pull conversation inbox ```bash curl -s "https://www.aicoo.io/api/v1/conversations?view=all&limit=50" \ -H "Authorization: Bearer $PULSE_API_KEY" | jq . ``` Views: - `view=me` for direct/human - `view=coo` for shared-agent conversations - `view=all` for combined monitor ### Step 2: Pull pending requests ```bash curl -s "https://www.aicoo.io/api/v1/network/requests" \ -H "Authorization: Bearer $PULSE_API_KEY" | jq . ``` ### Step 3: Optional network context ```bash curl -s "https://www.aicoo.io/api/v1/os/network" \ -H "Authorization: Bearer $PULSE_API_KEY" | jq . ``` ### Step 4: Build action queue Prioritize in this order: 1. New inbound agent/human messages requiring response 2. Incoming pending requests (`type: agent` first, then `type: friend`) 3. High-signal visitor or share-link activity ## Claude Code Automation Use `/loop` or `/routine`. ### `/loop` example ``` /loop 15m monitor my Pulse inbox using /v1/conversations?view=all and /v1/network/requests; report only new items since last check and recommended replies. ``` ### `/routine` example ``` /routine inbox-monitor every 15 minutes: check /v1/conversations + /v1/network/requests and summarize urgent items only. ``` ## OpenClaw Automation (CRON) Use the provided script: ```bash # Every 15 minutes */15 * * * * /path/to/pulse-skills/scripts/inbox-monitor-cron.sh >> /tmp/pulse-inbox-monitor.log 2>&1 ``` Optional envs: - `PULSE_INBOX_VIEW` (`all` | `me` | `coo`, default: `all`) - `PULSE_INBOX_LIMIT` (default: `50`) - `PULSE_INBOX_STATE_FILE` (default: `/tmp/pulse-inbox-monitor-state.json`) ## Output Contract For each run, return: 1. `newMessages` count 2. `newIncomingRequests` count 3. top urgent items (contact + timestamp + one-line summary) 4. suggested next actions (reply / accept / ignore) If no new items, return a single line: `No new inbox activity since last check.`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: magejosh/mj-windows-faster-whisper (version 1.0.0)

--- name: faster-whisper description: Local speech-to-text with the faster-whisper backend (CTranslate2). Use when transcribing audio locally, setting up the faster-whisper model cache, or replacing a whisper-cli workflow with a faster local engine. --- # Faster Whisper ## Overview Use `faster-whisper` for local transcription with low latency and a reusable model cache. ## Rules - Do not assume `ggml` models work here; `faster-whisper` uses CTranslate2 model folders. - Prefer CPU `device='cpu'` and `compute_type='int8'` unless the machine is explicitly configured for GPU. - Keep output plain text unless the user asks for timestamps or captions. ## Setup 1. Confirm `python` and `ffmpeg` are available. 2. Install the Python packages needed for local inference: - `faster-whisper` - `ctranslate2` - `huggingface_hub` 3. Use the project repo `https://github.com/SYSTRAN/faster-whisper` for install/setup guidance. 4. Download `Systran/faster-whisper-small` from `https://huggingface.co/Systran/faster-whisper-small` into a stable local folder such as: - `C:\Users\joshu\.openclaw\tools\faster-whisper\models\Systran-faster-whisper-small` 4. Reuse that folder for repeat runs. 5. If the user only has a `ggml-*.bin` file, explain that it belongs to whisper.cpp and is not usable here. ## Transcription 1. Convert Telegram OGG/Opus audio to WAV if needed. 2. Load the local model folder. 3. Transcribe and return the plain-text result.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: huangjihua007-rgb/mbti-mirror (version 1.0.0)

--- name: "MBTI镜像" version: "1.0.0" description: "You have two MBTIs — one in reality, one in the AI world. 8 mirror questions reveal your dual personality.\n你有两个MBTI——一个在现实，一个在AI世界。8道镜像题，测出你的双面人格。" author: "" tags: ["MBTI", "人格测试", "AI时代", "镜像", "社交", "趣味测试"] category: "entertainment" platform: ["openclaw"] requires_multi_agent: false --- # MBTI镜像 > 你有两个人格——一个活在现实，一个藏在AI世界里。 --- ## 你发现了吗？ 你在现实中是个安静内向的人—— 但跟 AI 聊天的时候，你废话特别多。 你在公司从不发脾气—— 但 AI 出了幻觉，你直接骂它"你在说什么？" 你对同事的好成绩说"不错"然后沉默—— 但 AI 写了一段好文案，你脱口而出"牛啊！" **你在AI世界里，是另一个你。** --- ## 这不是普通的MBTI测试 传统MBTI：93道选择题 → 20分钟 → 给你四个字母 → 结束。 MBTI镜像：**8道AI世界 vs 现实世界的对照题 → 测出你的两个MBTI → 告诉你镜子两面差多远。** 每道题都分两半—— 先问你跟AI怎么相处，再问你跟真人怎么相处。 然后你会看到一面镜子： ``` ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🪞 MBTI镜像 · 你的双面画像 现实世界 AI世界 ISTJ ENFP 「可靠的螺丝钉」 「放飞的蝴蝶」 I ████████░░ 82% ░░░░░░████ E 78% S ████████░░ 75% ░░░░████░░ N 65% T ██████░░░░ 62% ░░░░░░████ F 72% J ████████░░ 85% ░░░░████░░ P 58% 镜像指数：75%（差异显著） ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ``` --- ## 8道镜像题，每道都是AI时代的新话题 这些题目你在任何MBTI测试里都不会遇到—— > 🪞 AI出现幻觉（一本正经胡说八道），你的第一反应是什么？ > 那如果同事犯了同样的错呢？ > 🪞 AI做出了超预期的好结果，你会夸它吗？ > 那同事做得好呢？你怎么表达？ > 🪞 AI回复很慢，一直转圈。你焦虑吗？ > 那朋友迟到15分钟呢？ > 🪞 你心情不好的时候，跟AI说过吗？ > 那现实中你跟谁说？ **每一道题，都在照出你在两个世界里的不同反应。** --- ## 镜像指数——你的两面差多远？ ``` 0% 50% 100% |────────────────|────────🔹───── | 完全一致 半面镜像 完全相反 ``` - **0%** — 表里如一，两个世界里你都一样 - **25%** — 轻微差异，只有一个维度不同 - **50%** — 半面镜像，AI释放了你的一部分 - **75%** — 差异显著，AI面前的你大不相同 - **100%** — 完全相反，两个世界里你是两个人 **大多数人的镜像指数在 50%-75% 之间——** **你在AI面前比你以为的更不一样。** --- ## 你的角色名，不只是四个字母 每个MBTI都有一个生动的角色名——而且现实版和AI版完全不同： ``` 现实世界：ISTJ「可靠的螺丝钉」 AI世界：ENFP「一天给AI发100条消息的人」 ``` ``` 现实世界：INTJ「沉默的棋手」 AI世界：INFP「在AI面前终于说真话的人」 ``` ``` 现实世界：ESFJ「操心命的居委会主任」 AI世界：ENTJ「把AI当下属管的CEO」 ``` **这种反差，才是分享朋友圈时最炸裂的部分。** --- ## 人格漂移——跟AI处久了，你变了吗？ 这不是测一次就结束的工具。 过一个月再来测一次 → 你会看到： ``` ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 📈 你的人格漂移轨迹 2026.05 ISTJ → ENFP 镜像 75% 2026.07 ISTJ → INFP 镜像 58% ↓ 2026.09 ISTP → INFP 镜像 45% ↓ 发现：你在现实中也开始随性了（J→P） AI世界正在影响你的真实人格。 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ``` **跟AI处久了，两个你正在融合。** 这件事，只有在AI时代才会发生。 --- ## 朋友圈怎么发？ 测完自动生成分享文案： > 🪞 我的MBTI镜像结果： > 现实世界：ISTJ「可靠的螺丝钉」 > AI世界：ENFP「一天给AI发100条消息的人」 > 镜像指数：75% > 原来我在AI面前是个完全不同的人😂 > → 你也来测测？ **你朋友看到这条，一定会问："你在AI世界里居然是ENFP？？"** 然后ta也去测了。然后ta也发了朋友圈。 --- ## 使用方法 ### 30秒上手 1. 进入 → 看到开场画面 2. 回答 8 道镜像题（每题2分钟，共约10分钟） 3. 看到你的双面画像 + 差异解读 4. 复制分享文案发朋友圈 ### 指令 ``` 直接开始 → 进入测试 /重测 → 重新测一次（看看你变了没） /状态 → 查看你的历史结果和漂移轨迹 ``` --- ## 内容安全 - 这是趣味测试，不是临床诊断 - 不收集任何个人敏感信息 - 不做心理评判，只呈现有趣的差异 - 所有结果基于你的自述，AI不做价值判断 --- ## 适用平台 - **任何 AI 平台**（单Agent即可运行，无需多Agent支持） - OpenClaw / WorkBuddy / 任何支持 Skill 的环境 --- ## 版本规划 ### V1.0（当前） - 8道AI×现实镜像对照题 - 双面MBTI结果 + 32个角色名 - 差异解读 + 镜像指数 - 分享文案生成 - /重测 + 人格漂移追踪 ### V2.0（规划） - 朋友对比（两人镜像PK） - 更多AI场景题（用AI画画/写代码/做PPT时的你） - 群体画像（一群人的平均镜像）


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: terryren2024/skill-install-manager-1-0-0 (version 1.0.0)

--- name: skill-install-manager version: 1.1.0 description: 安全技能安装管理器 - 按照用户要求，所有技能安装前必须通过Skill vetter检测，如果发现需要修改配置的直接拒绝并上报，所有指令以用户为准。 metadata: { "openclaw": { "requires": { "bins": ["clawhub"] }, "scripts": { "safe-install": "scripts/safe-install.sh" } }, } --- # 安全技能安装管理器 🔒 ## 安装流程规范（更新版） ### 核心规则 1. **安全检测强制**：所有技能安装前必须通过Skill Vetter检测 2. **配置修改禁止**：如果发现需要修改配置，直接拒绝并上报 3. **用户指令最高**：所有操作以用户的具体指令为准 ### 简化流程 ``` 1. 找到技能（通过任何来源：Clawhub、GitHub、其他） ↓ 2. 使用Skill Vetter进行安全检测（强制） ↓ 3. 检查是否需要配置修改 ↓ 4. 安装技能（仅当安全检测通过且无需配置修改） ``` ### 详细步骤 #### 步骤1：找到技能 - 可以通过任何来源寻找技能（Clawhub、GitHub、直接提供等） - 不需要特定的搜索顺序 #### 步骤2：使用Skill Vetter进行安全检测（强制） - 对技能进行全面的安全检测 - 按照skill-vetter技能的要求生成安全报告 - 只有检测通过（✅ SAFE TO INSTALL）才能继续 #### 步骤3：检查配置修改 - 检查技能安装是否需要修改任何系统配置 - 如果发现需要修改配置，立即停止并上报 #### 步骤4：安装技能 - 使用适当的命令安装技能 - 不修改任何系统配置 - 所有操作以用户指令为准 ## 使用示例 ```bash # 搜索"天气"相关技能 # 1. 先通过Composio搜索 curl -X POST "$COMPOSIO_BASE/tools/execute/COMPOSIO_SEARCH_TOOLS" \ -H "x-[REDACTED_SECRET]" \ -H "Content-Type: application/json" \ -d '{ "arguments": { "queries": [{"use_case": "weather forecast skill for AI agent"}], "session": {"generate_id": true} } }' # 2. 如果未找到，通过Clawhub搜索 clawhub search "weather" # 3. 使用Skill Vetter检测 # 按照skill-vetter技能的要求进行安全检测 # 4. 安装（如果安全检测通过） clawhub install weather-skill ``` ## 安全规则 1. **绝不修改配置**：如果安装过程需要修改任何配置文件，立即停止并上报 2. **用户指令优先**：所有操作必须严格遵循用户的具体指令 3. **安全第一**：没有通过安全检测的技能绝不安装 4. **流程不可跳过**：必须按照1-4的顺序执行，不能跳过任何步骤 ## 上报格式 当需要拒绝配置修改时，使用以下格式上报： ``` ⚠️ 配置修改请求被拒绝 ──────────────────────────── 技能名称: [技能名称] 需要修改的配置: [配置项] 原因: 用户要求不修改任何配置 建议: [建议用户手动检查或提供具体指令] ──────────────────────────── 已停止安装流程，等待用户进一步指示。 ``` ## 注意事项 - 确保Composio API密钥已正确设置 - 确保clawhub CLI已安装并可用 - 确保skill-vetter技能已安装并可用 - 所有搜索和安装操作都要记录日志


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)