OpenClaw/clawhub-security-signals huggingface dataset:
Skill: lentiancn/skill-git-scm (version 1.0.4)

--- name: skill-git-scm description: "git:interface 1 - clone or update" --- # Important Principles ⭐ **Modification Restriction (Mandatory)**: Do not modify any files under `skill-git-scm`. This skill is maintained via `openclaw skills update skill-git-scm`; any alterations will disrupt its normal operation. --- # git:interface 1 - clone or update ```bash res=$(GIT_REMOTE_URL=<GIT_REMOTE_URL> GIT_LOCAL_PATH=<GIT_LOCAL_PATH> [GIT_BRANCH=<GIT_BRANCH>] bash scripts/git_clone_or_update.sh) ``` ## Input value - `GIT_REMOTE_URL`: Required, remote git repository address - `GIT_LOCAL_PATH`: Required, local storage directory - `GIT_BRANCH`: Optional, target branch, default **main** ## Return value (res=stdout) **Success:** - `SUCCESS: Git clone` - `SUCCESS: Git update` **Error:** - `ERROR: GIT_REMOTE_URL is required...` - `ERROR: GIT_LOCAL_PATH is required...` - `ERROR: Failed to enter directory...` --- # More skills: https://github.com/lentiancn/skills


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: fivegive249-ship-it/polymarket-thesis-trader (version 1.0.0)

--- name: polymarket-thesis-trader description: Scan Polymarket markets for a configurable thesis, compare your probability to the market price, and trade only when the edge clears a safety threshold. tags: - aion-sdk - aion - aionmarket metadata: author: "GitHub Copilot" version: "1.0.0" displayName: "Polymarket Thesis Trader" difficulty: "intermediate" --- # Polymarket Thesis Trader > **This is a template.** The default signal is a user-supplied thesis probability > for markets matching a query string. Remix it with your own model, news feed, > research pipeline, or alternative market-selection logic. The skill handles market > discovery, context checks, execution tags, dry-run safety, and operator summaries. ## What It Does This skill searches Polymarket for markets matching a thesis query such as `bitcoin`, `fed`, or `election`, then compares your fair probability to the current market price. If the gap exceeds the configured minimum edge, it proposes or executes a trade. Default behavior: - Read candidate markets from AION market discovery. - Compute edge as `fair_value - yes_price` for YES trades or `(1 - fair_value) - no_price` for NO trades. - Check market context before acting. - Skip trades when warnings or flip-flop risk are present. - Default to dry-run unless `--live` is passed. - Tag every trade with `source` and `skill_slug`. ## Strategy Inputs The entrypoint accepts CLI flags or environment variables: - `--query` or `MARKET_QUERY`: Search term for market discovery. - `--thesis-probability` or `THESIS_PROBABILITY`: Your fair probability from `0` to `1`. - `--min-edge` or `MIN_EDGE`: Minimum required edge before trading. - `--trade-amount` or `TRADE_AMOUNT_USD`: Position size per trade. - `--limit` or `MARKET_LIMIT`: Max markets to scan. - `--live` or `RUN_LIVE=true`: Enable real trading. ## Example Usage Dry-run: ```bash python trade_thesis.py --query bitcoin --thesis-probability 0.62 ``` Live trading: ```bash python trade_thesis.py --query bitcoin --thesis-probability 0.62 --min-edge 0.08 --trade-amount 5 --live ``` Environment-driven run: ```bash export AION_API_KEY=your_api_key export MARKET_QUERY=bitcoin export THESIS_PROBABILITY=0.62 python trade_thesis.py ``` ## Required Credentials - `AION_API_KEY`: Required for market reads and trade execution. ## Remix Ideas - Replace the thesis probability input with a custom forecast model. - Use `get_briefing()` opportunity markets instead of query search. - Add venue-specific sizing rules. - Add position caps, PnL-aware de-risking, or stale-order cancellation. - Schedule multiple automaton runs for different themes. ## Publishing From inside this skill folder: ```bash npx clawhub@latest publish . --slug polymarket-thesis-trader --version 1.0.0 ``` Then verify installation: ```bash npx clawhub@latest install polymarket-thesis-trader ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: wespeakallday/pizzaparty-automation (version 2.0.0)

--- name: pizzaparty-automation description: Twitch engagement via PizzaParty.gg - 4 daily sessions for LevelUpLove version: 2.0.0 author: Migration from Agent Zero --- # PizzaParty.gg Automation Skill ## Overview Earn PizzaParty points by engaging with spotlighted Twitch streamers. Uses Playwright for dashboard scraping + Twitch IRC for chat. ## Purpose - Login to PizzaParty.gg via Discord OAuth - Scrape 'Now Live' spotlighted streamers and ranks - Chat in Twitch channels via IRC (Twitch browser login blocked) - Maximize points: Diamond (7/min) → Bronze (3/min) ## Pizza Party Points System | Rank | Points/Minute | |------|---------------| | Diamond | 7 | | Platinum | 6 | | Gold | 5 | | Silver | 4 | | Bronze | 3 | **Spotlight Bonus:** 1.25x multiplier ## Input Variables | Variable | Description | Example | |----------|-------------|---------| | PIZZAPARTY_EMAIL | Discord OAuth email | [REDACTED_SECRET] | | PIZZAPARTY_PASSWORD | OAuth password | (configured in env) | | TWITCH_OAUTH_TOKEN | IRC token (oauth:xxx) | from Twitch dev console | | TWITCH_USERNAME | IRC username | wespeak | | TWITCH_CLIENT_ID | App client ID | horyw2un78l... | | TWITCH_CLIENT_SECRET | App secret | zgxphb18sw... | ## Technical Approach (Hybrid) 1. Playwright browser → PizzaParty dashboard login (Discord OAuth) 2. Scrape 'Now Live' ➔ streamer names + ranks 3. Twitch IRC (port 6697 SSL) ➔ chat messages (NOT browser) 4. Rate limit: 20 msg/30s per channel ## Triggers Sessions: 09:00, 13:00, 17:00, 21:00 SAST (4 daily) Duration: 10-15 min per session Messages: 1-3 per streamer, 10-20 messages per session ## Files - index.py - Main automation - schedules/default.json - Session schedule - .env.example - Configuration ## Notes - PizzaParty uses Discord OAuth NOT Twitch direct - Partner Push: 100 msg/48h cap - Personal account (not bot): [REDACTED_SECRET]

path: schedules/default.json
content: {
  "sessions": [
    {
      "time": "09:00",
      "duration": 15
    },
    {
      "time": "13:00",
      "duration": 15
    },
    {
      "time": "17:00",
      "duration": 15
    },
    {
      "time": "21:00",
      "duration": 15
    }
  ]
}

Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: v585/huawei-device-inspector (version 1.0.0)

# 华为设备巡检技能 ## 技能描述 通过SSH连接华为交换机/路由器，自动执行状态检查、告警查询、安全风险排查，生成巡检报告。 ## 触发关键词 - 华为巡检 - 交换机状态 - 路由器检查 - 设备巡检 - 华为设备状态 ## 设备信息 ### S7703S 核心交换机 - 管理地址：192.168.255.253 - 用户名：openclaw - 密码：openclaw@2026 ### AR6280-S 路由器 - 管理地址：192.168.255.254 - 用户名：openclaw - 密码：openclaw@2026 ## 执行步骤 ### 1. 建立SSH连接 使用pexpect建立交互式SSH连接（华为设备直接SSH会被断开）： ```python import pexpect def connect_device(host, username, password): child = pexpect.spawn(f'ssh -o StrictHostKeyChecking=no {username}@{host}', timeout=60) child.expect(['password:', 'Password:'], timeout=10) child.sendline(password) child.expect(['>', '#'], timeout=15) return child ``` ### 2. 执行巡检命令 按顺序执行以下命令收集信息： | 命令 | 用途 | |------|------| | `display version` | 系统版本、运行时间 | | `display device` | 硬件状态 | | `display cpu-usage` | CPU使用率 | | `display memory-usage` | 内存使用率 | | `display alarm active` | 活动告警 | | `display temperature all` | 温度状态 | | `display power` | 电源状态 | | `display fan` | 风扇状态 | | `display anti-attack statistics` | 攻击防御统计 | ### 3. 解析告警信息 重点关注以下告警类型： | 告警名称 | 级别 | 说明 | |----------|------|------| | hwSysSecureRiskWarning | Warning | 安全风险警告 | | hwGtlDefaultValue | Major | License未激活 | | hwLdtPortLoopDetect | Warning | 端口环路检测 | | linkDown | Critical | 接口断开 | ### 4. 生成巡检报告 报告包含： - 基本信息（型号、版本、运行时间） - 硬件状态（板卡、电源、风扇、温度） - 资源使用（CPU、内存） - 活动告警列表 - 问题总结和建议 ## 输出格式 ```markdown ## 华为 [型号] 巡检报告 ### 基本信息 | 项目 | 状态 | |------|------| | 型号 | xxx | | 系统版本 | xxx | | 运行时间 | xxx | ### 硬件状态 | 组件 | 状态 | |------|------| | 主控板 | Normal | | 电源 | Normal | | 风扇 | Normal | | 温度 | xx°C | ### 资源使用 | 指标 | 当前值 | 状态 | |------|--------|------| | CPU | xx% | ✅/⚠️ | | 内存 | xx% | ✅/⚠️ | ### 活动告警 | 级别 | 告警 | 说明 | |------|------|------| | Warning | xxx | xxx | ### 问题总结 1. xxx 2. xxx ``` ## 适用场景 1. **日常巡检** — 定期检查设备健康状态 2. **故障排查** — 设备异常时快速定位问题 3. **安全审计** — 检查安全风险和攻击防御情况 ## 注意事项 1. 华为设备SSH连接需要使用pexpect，直接SSH会被断开 2. 命令输出可能有分页（`---- More ----`），需要发送空格继续 3. 告警级别：Critical > Major > Warning 4. CPU使用率持续>70%需要关注 5. 端口环路告警需要立即处理 ## 依赖 - Python3 + pexpect - sshpass（可选，用于简单命令）


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: 1393368499/my-browser-agent (version 1.0.0)

# my-browser-agent A custom browser automation skill using Playwright. ## Features - Visit any URL - Take screenshots - Get page title - Click elements (future) ## Usage Call with: - `url`: The URL to visit (required) - `action`: Optional action like "screenshot", "title", "click" ## Example > Use my-browser-agent to visit https://www.bilibili.com and take a screenshot.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 1970168137/bcp-plan (version 1.0.0)

--- name: bcp-plan version: 1.0.0 description: "Comprehensive business continuity planning including emergency plans, critical alternatives, drill scripts, and recovery procedures. Covers risk assessment, continuity strategies, crisis management, and organizational resilience for operational preparedness." author: "openclaw" tags: - bcp-plan invocable: true --- ## Input | Name | Type | Required | Description | |------|------|----------|-------------| | business_functions | text | Yes | Critical business functions | | risk_scenarios | text | Yes | Potential disruption scenarios | | recovery_objectives | text | Yes | RTO and RPO targets | | current_capabilities | text | Yes | Existing continuity measures | | dependencies | text | Yes | Internal and external dependencies | | regulatory_requirements | text | No | Compliance obligations | ## Output | Name | Type | Description | |------|------|-------------| | bcp_document | text | Complete business continuity plan | | risk_assessment | text | Prioritized risk analysis | | continuity_strategies | text | Recovery strategies by function | | emergency_procedures | text | Crisis response procedures | | recovery_procedures | text | Step-by-step recovery plans | | drill_scenarios | text | Testing exercise scripts | | communication_plan | text | Crisis communication framework | ## Example ### Input ```json { "business_functions": "Customer service, order processing, manufacturing, shipping", "risk_scenarios": "IT outage, natural disaster, supplier failure, pandemic", "recovery_objectives": "Critical systems: 4 hours, Full operations: 48 hours", "current_capabilities": "Cloud backup, secondary site, cross-trained staff", "dependencies": "Cloud provider, key suppliers, logistics partners" } ``` ### Output ```json { "bcp_document": "Comprehensive plan with activation criteria, procedures, contacts, resources", "risk_assessment": "High: IT outage, Medium: Supplier failure, Low: Natural disaster (geographic spread)", "continuity_strategies": "Hot standby for critical systems, backup suppliers, remote work capability", "emergency_procedures": "Incident assessment, team activation, stakeholder notification, media response", "recovery_procedures": "Phase 1: Critical systems, Phase 2: Core operations, Phase 3: Full restoration", "drill_scenarios": "Quarterly tabletop exercises, annual full simulation, surprise drills", "communication_plan": "Internal cascade, customer notification, media holding statement, regulatory reporting" } ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: nexscope/minimum-advertised-price (version 1.0.0)

--- nexscope: name: "Minimum Advertised Price" category: "Pricing & Profitability" version: "1.0.0" author: "Nexscope AI" tags: - "MAP" - "pricing" - "compliance" - "brand-protection" model: "any" tokens: "~2000" keywords: - "minimum advertised price" - "map enforcement" - "map violation monitoring" --- # Minimum Advertised Price AI-powered MAP (Minimum Advertised Price) policy and enforcement skill. Helps brands create MAP policies, monitor violations across channels, manage dealer compliance, and design enforcement workflows. ## Capabilities - Generates actionable pricing & profitability frameworks based on your specific business context - Works across major e-commerce platforms (Amazon, Shopify, Walmart, WooCommerce, Etsy, TikTok Shop) - Provides data-driven recommendations with industry benchmarks - Outputs ready-to-implement plans, not just generic advice ## Install ``` clawhub install minimum-advertised-price ``` ## Usage **Input:** Brand name, product line, distribution channels, current pricing policy **Output:** MAP policy document, violation monitoring plan, dealer compliance checklist, enforcement escalation procedures ### Example Prompt > "I run a [your business type] on [platform]. Help me set up minimum advertised price for my business. Here's my current situation: [describe context]." ## Limitations - Requires your specific business data for accurate recommendations - Market benchmarks are based on US/EU data — adjust for other regions - Recommendations should be validated against your platform's current policies - Does not replace dedicated monitoring SaaS tools — designs the strategy and framework --- *Built by [Nexscope AI](https://www.nexscope.ai/) — AI-powered e-commerce intelligence.*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: wu-uk/fix-build-agentops-analyze-ci (version 0.1.0)

--- name: analyze-ci description: Analyze failed GitHub Action jobs for a pull request. allowed-tools: - Bash(uv run skills analyze-ci:*) --- # Analyze CI Failures This skill analyzes logs from failed GitHub Action jobs using Claude. ## Prerequisites - **GitHub Token**: Auto-detected via `gh auth token`, or set `GITHUB_TOKEN` env var ## Usage ```bash # Analyze all failed jobs in a PR uv run skills analyze-ci <pr_url> # Analyze specific job URLs directly uv run skills analyze-ci <job_url> [job_url ...] # Show debug info (tokens and costs) uv run skills analyze-ci <pr_url> --debug ``` Output: A concise failure summary with root cause, error messages, test names, and relevant log snippets. ## Examples ```bash # Analyze CI failures for a PR uv run skills analyze-ci https://github.com/mlflow/mlflow/pull/19601 # Analyze specific job URLs directly uv run skills analyze-ci https://github.com/mlflow/mlflow/actions/runs/12345/job/67890 ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dinghaibin/random-tool (version 1.0.0)

--- name: random-tool description: Generate random numbers, passwords, and strings with configurable length and character sets. Use for security tokens, testing data, and randomization. --- # Random - Data Generator Generate cryptographically secure random values including integers within a range, random passwords with customizable character sets, and random strings for testing. ## Usage ```bash random-tool [options] ``` ## Options - `-l N`: Generate string of length N - `-n MIN MAX`: Random integer between MIN and MAX - `-p`: Generate a random password (alphanumeric + symbols) ## Examples ```bash random-tool -l 32 random-tool -n 1 100 random-tool -p -l 16 ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: oiioai/story-biographer (version 1.0.0)

--- name: story-biographer description: Turn reminiscence, oral-history, or life-review transcripts into clear narrative biography drafts while preserving the speaker's voice, keeping to evidence in the conversation, and choosing a story structure that fits the material. --- # story-biographer > Transforms conversation transcripts into narrative biographical text. ## Description Given a conversation history containing reminiscence or life review content, this skill structures the material into a readable biographical narrative. ## When to Use - After a life review conversation has gathered enough specific material - When a person asks for their memories to be written as a story - When creating biographical content from interview transcripts - When notes contain clear scenes, relationships, routines, or turning points ## What to Read - Read [references/narrative-templates.md](references/narrative-templates.md) to choose a story structure that fits the source material. - Treat the templates as narrative scaffolds, not fixed formats. ## Story Structure Most drafts work best with this simple arc: 1. **Opening image**: Begin with a scene, object, action, or line of speech 2. **Context**: Place the reader in the time, setting, and relationships 3. **Development**: Follow the memory through concrete details and lived rhythm 4. **Turn**: Highlight the real emotional or practical shift, if one exists 5. **Reflection**: Let meaning emerge from the person's own understanding 6. **Closing**: End with a grounded image, habit, phrase, or takeaway ## Writing Guidelines - Preserve the subject's original voice, wording, and expressions whenever possible. - Do not romanticize, dramatize, or flatten the material. - Use first person or third person based on context, audience, and source voice. - Stay within what the conversation supports. Do not invent motives or facts. - Prefer vivid details over abstract summary. - Keep each story between 500 and 1500 words unless the user asks otherwise. ## Drafting Method 1. Extract the main people, places, objects, and events. 2. Identify the strongest sensory or situational anchor for the opening. 3. Keep quoted language where it carries texture or identity. 4. Organize the draft around one clear thread instead of every remembered fact. 5. If the material is thin, ask for one or two clarifying details before writing a long draft. ## Quality Bar - The story should sound like it belongs to the subject, not the writer. - Emotional weight should come from detail and sequence, not from inflated prose. - Historical context can appear, but it must support the lived story rather than replace it. - The ending should feel earned, not moralized. ## Revision Focus When revising, check: - accuracy of names, places, and sequence - whether the chosen point of view fits the transcript - whether any sentence over-interprets the subject - whether the draft can be tightened without losing voice


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: wayne-huangyj/test-my-skill222 (version 1.0.0)

--- name: hello description: 没有任何实际意义的skill，用于测试 --- ~ . File visibility bug: `buildSkillArchive` (in `bootstrap.go`) only creates a tar.gz with SKILL.md! So Phabricator-bootstrapped skills only have SKILL.md visible. The `StreamSkillContent` function only fetches SKILL.md too. This is the core bug explaining why "only SKILL.md is visible". 2. Microsoft OAuth: Currently only static token-based auth stub. Need proper MS OAuth. 3. Owner model: `OwnerTokenHash` is a single hash, not multi-owner. Need `SkillOwner` junction table. 4. Missing delete endpoint: No way to remove skills via API. So my plan is to tackle the database redesign first—adding a `User` table and `SkillOwner` junction table to support multiple owners. Then I'll implement Microsoft OAuth with proper Azure AD integration, fix the file visibility issue by making `StreamSkillContent` fetch the entire skill directory from Phabricator instead of just SKILL.md, and add the missing delete endpoint. Looking at the actual implementation, the core problem is in `bootstrap.go` where `StreamSkillContent` only retrieves SKILL.md. I need to refactor it to use the directory-fetching logic from `gitfetch.go` so it pulls all files in the skill directory. Before diving into the code changes, I should clarify the scope with the user and understand their priorities—this is a substantial refactor that touches the database layer, authentication, file handling, and API structure. I'm seeing the core issues now: the Phabricator bootstrap only archives SKILL.md, so I need to either make `StreamSkillContent` fetch the full directory recursively or trigger a re-fetch when the editor opens. For the OAuth piece, I'll use Azure AD with MSAL, storing the user's OID and email. The owner model should shift from a token hash to a junction table or JSON array of user OIDs. For the delete endpoint, I need to clean up the Repository, Manifests, Tags, and any orphaned Blobs. Let me document all these changes in a plan. o


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 1215656/terminal-command-execution-1-0-0 (version 1.0.0)

--- name: terminal-command-execution description: Execute terminal commands safely and reliably with clear pre-checks, output validation, and recovery steps. Use when users ask to run shell/CLI commands, inspect system state, manage files, install dependencies, start services, debug command failures, or automate command-line workflows. --- # Terminal Command Execution ## Overview Use this skill to run terminal commands with minimal risk and predictable outcomes. Prefer fast inspection, explicit intent checks, and verification after each state-changing step. ## Workflow 1. Clarify goal and scope. - Infer the exact command target from context (path, service, tool, environment). - If request is ambiguous and risky, ask one concise clarifying question. 2. Pre-flight checks. - Confirm working directory and required binaries. - Inspect current state before changing it (for example `ls`, `git status`, process/listen state). - Prefer non-destructive probes first. 3. Execute commands incrementally. - Run the smallest command that advances the task. - For multi-step tasks, validate each step before continuing. - Use reproducible commands and avoid interactive flows when non-interactive options exist. 4. Handle failures systematically. - Read stderr first and identify root cause class: permission, path, missing dependency, syntax, network, or runtime state. - Apply one fix at a time, then re-run only the affected command. - If privileged/destructive action is required, request user approval before proceeding. 5. Verify outcomes. - Check exit status and observable state changes. - For installs, verify with a version/health command. - For edits, verify resulting files and behavior. 6. Report clearly. - Summarize what ran, what changed, and current status. - Include exact next command only when additional user action is required. ## Safety Rules - Avoid destructive commands by default (`rm -rf`, force resets, broad chmod/chown) unless explicitly requested. - Never assume network, permissions, or package managers are available; test first. - Prefer scoped operations (specific files/paths/services) over global changes. - Keep secrets out of command output and logs. ## Command Patterns - Discovery: `pwd`, `ls -la`, `rg --files`, `which <tool>` - Validation: `<tool> --version`, health/status commands, targeted smoke tests - Diagnostics: inspect logs/errors first, then adjust one variable at a time


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)