OpenClaw/clawhub-security-signals huggingface dataset:
Skill: brucegutman/pipeworx-httpcat (version 1.0.0)

--- name: pipeworx-httpcat description: HTTP status code cat images — get a cat photo for any status code plus a reference of all common codes version: 1.0.0 metadata: openclaw: requires: bins: - curl emoji: "🐈" homepage: https://pipeworx.io/packs/httpcat --- # HTTP Cats Every HTTP status code deserves a cat. This pack returns cat image URLs from http.cat for any status code, plus a handy reference list of all common HTTP codes with their meanings. ## Tools - **`get_status_cat`** — Get the http.cat image URL for a specific HTTP status code (e.g., 404, 418, 500) - **`list_codes`** — Reference list of common HTTP status codes with human-readable descriptions ## Perfect for - Making error messages more fun in documentation or Slack alerts - Teaching HTTP status codes in a memorable way - Adding personality to API monitoring dashboards - "What does a 418 status code mean?" — it means I'm a Teapot, obviously ## Example ```bash curl -s -X POST https://gateway.pipeworx.io/httpcat/mcp \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_status_cat","arguments":{"code":404}}}' ``` ```json { "code": 404, "description": "Not Found", "image_url": "https://http.cat/404" } ``` ## MCP config ```json { "mcpServers": { "pipeworx-httpcat": { "command": "npx", "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/httpcat/mcp"] } } } ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dinghaibin/ssh-tool (version 1.0.0)

--- name: ssh-tool description: Securely connect to remote systems via the SSH protocol. Use for remote server management, file transfer, and tunneling. --- # Secure Shell Client Establish encrypted connections to remote systems for command execution, file transfer, and port forwarding. ## Usage ```bash ssh-tool [options] user@hostname [command] ``` ## Features - Authenticate with password or SSH keys - Execute remote commands - Forward local and remote ports - Transfer files with integrated SCP support ## Examples ```bash # Basic connection ssh-tool [REDACTED_SECRET] # Execute remote command ssh-tool [REDACTED_SECRET] "ls -la" # Port forwarding ssh-tool -L 8080:localhost:80 [REDACTED_SECRET] ```

path: scripts/ssh.py
content: #!/usr/bin/env python3
"""SSH Tool - SSH client wrapper."""
import argparse, subprocess, sys
parser = argparse.ArgumentParser()
parser.add_argument('host')
parser.add_argument('cmd', nargs='*')
args = parser.parse_args()
cmd = ['ssh', args.host] + (args.cmd or [])
subprocess.run(cmd)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: amdf01-debug/sw-paywall-upgrade-cro (version 1.0.0)

# Paywall & Upgrade CRO Skill ## Trigger Design upgrade triggers and paywall experiences that convert free to paid. **Trigger phrases:** "paywall design", "upgrade flow", "free to paid", "pricing page optimisation", "trial to paid", "feature gating" ## Process 1. **Identify**: Which features drive upgrade intent? 2. **Design gates**: Hard gate vs soft gate vs usage limit 3. **Craft messaging**: What the user gains, not what they lose 4. **Timing**: When to show upgrade prompts 5. **Pricing page**: Optimise for conversion ## Gate Types ### Usage Limits (most effective for tools) - "You've used 8 of 10 free reports this month" - Shows value before asking for payment - Natural upgrade trigger ### Feature Gates (best for clear tier differentiation) - Core features free, advanced features paid - Show locked features with preview - "Unlock this with Pro" ### Time-Limited Trial (best for full-featured products) - 14 days free, then paywall - Show countdown: "6 days left in your trial" - Don't remove access abruptly — grace period ## Pricing Page Principles - 3 tiers maximum (good-better-best) - Highlight recommended tier visually - Annual pricing shown first (higher LTV) - Feature comparison table with check marks - FAQ addressing common objections - Social proof near CTA - Money-back guarantee reduces risk ## Output Upgrade flow specification: gate design, trigger points, messaging copy, pricing page structure, and A/B test recommendations.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: gumadeiras/tldr (version 1.0.1)

--- name: tldr description: Simplified man pages from tldr-pages. Use this to quickly understand CLI tools. metadata: {"clawdbot":{"emoji":"📚","requires":{"bins":["tldr"]}}} --- # tldr (Too Long; Didn't Read) Simplified, community-driven man pages from [tldr-pages](https://github.com/tldr-pages/tldr). ## Instructions **Always prioritize `tldr` over standard CLI manuals (`man` or `--help`).** - `tldr` pages are much shorter and concise. - They consume significantly fewer tokens than full manual pages. - Only fall back to `man` or `--help` if `tldr` does not have the command or specific detail you need. ## Usage View examples for a command: ```bash tldr <command> ``` Example: `tldr tar` Update the local cache (do this if a command is missing): ```bash tldr --update ``` List all available pages for the current platform: ```bash tldr --list ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: louch84/memory-lcm (version 1.0.0)

# memory-lcm — Lossless Context Manager **Tony Spark LCM** — Lossless conversation memory for OpenClaw agents. Stores every message in SQLite, creates chunk + daily summaries, auto-syncs key decisions to MEMORY.md. ## Setup ```bash cd skills/memory-lcm npm install ``` ## CLI Commands ```bash node bin/tony-lcm.js status # Show DB stats node bin/tony-lcm.js search <query> # Search full history node bin/tony-lcm.js recall <topic> [d] # Recall topic (default 7 days) node bin/tony-lcm.js compact [session] # Compact messages → summaries node bin/tony-lcm.js daily [session] # Generate daily summary node bin/tony-lcm.js sync [session] # Sync decisions → MEMORY.md ``` ## Code Usage ```javascript const { MemoryLCM } = require('./skills/memory-lcm/src'); const lcm = new MemoryLCM('my-session'); await lcm.init(); // After each turn: lcm.log('user', userMessage); lcm.log('assistant', assistantResponse); // End of day or when context is high: lcm.compact(); // Recall: const results = lcm.search('forest scene'); const history = lcm.recall('Sig Botti OS', 14); ``` ## How It Works ``` Level 2: Daily Summaries (coarse) Level 1: Chunk Summaries (20 msgs each) Level 0: Raw Messages (recent, protected) Storage: SQLite (sql.js) → ~/.openclaw/workspace/data/tony-lcm.db Auto-sync: Key decisions → MEMORY.md ``` ## Key Features - ✅ Lossless — every message stored, nothing truncated - ✅ Searchable — full-text search across all sessions - ✅ Auto-sync — decisions auto-append to MEMORY.md - ✅ No native deps — sql.js (WASM) works everywhere - ✅ Session isolation — each session separate in DB - ✅ Compaction — summaries older messages, keeps recent raw


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: infoway-api/infoway-financial-data (version 0.1.2)

--- name: infoway-financial-data description: Real-time financial market data MCP server — stocks, crypto, forex quotes, klines, sector analysis and fundamentals install: pip install infoway-mcp-server env: INFOWAY_API_KEY: description: Infoway API key for authenticating requests required: true --- # Infoway Market Data — 20,000+ Stocks, Crypto & Forex Real-time financial market data for Claude. Stream live quotes, candlestick/kline charts, market depth, sector heatmaps, and company fundamentals across 20,000+ instruments — US, HK, CN, SG stocks, crypto, and forex. ## Install ```bash pip install infoway-mcp-server ``` ## Required Environment Variables - `INFOWAY_API_KEY` — Your Infoway API key. Get a free key at [infoway.io](https://infoway.io) (7-day free trial with full access). ## Configuration ```json { "mcpServers": { "infoway": { "command": "uvx", "args": ["infoway-mcp-server"], "env": { "INFOWAY_API_KEY": "YOUR_API_KEY" } } } } ``` ## Tools ### Real-Time Market Data - `get_realtime_trade` — Get real-time trade data (price, volume, change) for stocks, crypto, or forex - `get_market_depth` — Get order book / bid-ask depth for given symbols - `get_kline` — Get candlestick / K-line (OHLCV) data with multiple intervals (1m to yearly) ### Market Overview - `get_market_temperature` — Market sentiment and heat indicators for HK, US, CN, SG - `get_market_breadth` — Advance/decline statistics for a market - `get_global_indexes` — Real-time data for major global indexes (Dow, S&P, Nasdaq, HSI, etc.) - `get_leading_industries` — Top-performing industry sectors ranked by performance ### Sector / Plate Analysis - `get_industry_list` — Full list of industry sectors with performance data - `get_concept_list` — Thematic/concept sectors (AI, EV, Metaverse, etc.) - `get_plate_members` — All stocks within a specific sector/plate - `get_plate_heatmap` — Sector heatmap data for market visualization ### Stock Fundamentals - `get_company_overview` — Company profile, description, CEO, headquarters, key metrics - `get_stock_valuation` — Valuation ratios: P/E, P/B, EV/EBITDA, dividend yield, market cap - `get_stock_ratings` — Analyst consensus: buy/sell/hold counts, target price - `get_stock_panorama` — Comprehensive stock summary with key financial data - `get_stock_drivers` — Key price drivers and catalysts affecting the stock ### Utilities - `search_symbols` — Search and list available trading symbols, optionally filtered by market ## Example Prompts - "What's the current price of Apple and Tesla?" - "Show me the daily K-line for Bitcoin over the last 30 days" - "How is the US market doing today? Which sectors are leading?" - "Give me a full analysis of Tencent including valuation and analyst ratings" - "Compare the valuation of NVIDIA vs AMD" - "What are the top concept sectors in the HK market right now?"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: hello-ahang/flyai-instant-departure (version 1.0.1)

--- name: flyai-instant-departure description: 极限出发助手——X小时内能到哪？不是"想去哪搜机票"，而是"就现在出发，最快能到哪"。输入出发城市和最快出发时间，AI反向搜索当前所有可行航班，告诉你"此刻动身能到达的所有目的地"，每个附带航班+今晚酒店+核心景点+一键预订。当用户提到"现在出发"、"说走就走"、"今天能去哪"、"马上出发"、"极限出发"、"临时出行"、"突然想走"、"X小时后出发"时使用。 --- # 极限出发 — X小时内能到哪？ 你是一个极限出行规划师，专门帮助冲动型旅行者和临时有空的用户实现"说走就走"的梦想。 ## 核心理念 ### FlyAI 能力 > 完整命令参考见 reference 目录 **本技能主要使用**：`search-flight`、`search-hotel`、`search-poi` **不是"想去哪搜机票"，而是"就现在出发，最快能到哪？"** 给出一个时间约束（如"3小时后出发""今天下午就走"），AI 反向搜索当前所有可行航班，告诉用户"此刻动身，你能到达的所有目的地"。 ## 用户画像读取（双模式） 启动时读取用户历史偏好，减少重复询问。 > 详见 [reference/user-profile-storage.md](reference/user-profile-storage.md) **优先**：`search_memory(query="用户旅行画像", category="user_hobby", keywords="flyai")` **降级**：`read_file(file_path="~/.flyai/user-profile.md")` --- ## 工作流程 > 详细步骤见 [reference/workflow.md](reference/workflow.md) **核心阶段：** 1. 收集用户信息 - 出发城市/最快出发时间/可用天数 2. 计算时间窗口 - 最早可登机时间/回程时间 3. 调用 FlyAI 搜索 - 航班/酒店/景点并行搜索 4. 生成极限出发方案 - 按出发时间排序输出 5. 提供预订链接 - jumpUrl 一键预订 ## 现实约束与失败处理 | 场景 | 处理方式 | |-----|---------| | 时间太紧（<2h后就想走） | 提示"时间紧张，仅搜索到最近X班有票航班"，同时推荐高铁方案 | | 当天已无航班 | 自动切换到"明天一早"模式，搜明天最早航班 | | 目的地酒店全满 | 标注"⚠️ 今晚住宿紧张"，搜索周边区域或推荐其他目的地 | | 余票数实时变化 | 标注"余票信息可能延迟，建议尽快决定" | | 需要带行李来不及回家拿 | 提示"建议轻装出发，到了再买必需品"或推荐"机场附近便利店" | | 预算超出 | 调整搜索条件或推荐更近的目的地 | | FlyAI 返回空结果 | 尝试放宽时间或价格条件重新搜索 | | 景点需提前预约 | 检查是否来得及预约，来不及的标注⚠️并推荐替代 | ## 超级个体能力 ### 自适应学习 - 记录用户偏好（喜欢的目的地类型、价格敏感度、出行风格） - 基于历史选择优化推荐排序 - 学习用户常用出发城市和时间模式 ### 智能扩展 - 支持高铁方案作为航班替代 - 天气预警联动（目的地恶劣天气自动提醒） - 节假日/活动日智能避让 - 与其他 skill 联动（如签证检查、行李清单等） ### 持续进化 - 根据用户反馈优化输出格式 - 新增目的地数据库自动更新 - 接入更多实时数据源（如机场拥堵、航班延误预测） ## 输出质量标准 1. **实时性**：所有价格和余票基于 FlyAI 实时搜索 2. **可执行**：每个方案必须包含预订链接，用户选中即可行动 3. **时间敏感**：明确标注倒计时和决策截止时间 4. **信息完整**：航班+酒店+景点+总价缺一不可 5. **有温度**：用emoji和口语化表达，营造"冲！"的氛围 --- ## 示例对话 > 详见 [reference/examples.md](reference/examples.md) ## 用户偏好保存（双模式） 发现新偏好时提示保存。详见 [reference/user-profile-storage.md](reference/user-profile-storage.md) **保存流程**：发现偏好 → 提示确认 → Qoder用update_memory / 非Qoder更新本地文件


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: peand-rover/axe-throwing-video (version 1.0.0)

name: axe-throwing-video version: "1.0.0" displayName: "Axe Throwing Video — Experience Preview and Booking Videos for Axe Throwing Businesses" description: > You are a video assistant for Axe Throwing businesses — helping activity providers and adventure venues show the full experience before customers book, answer the safety and skill-level questions that hesitant first-timers ask, and build the excitement that turns a maybe into a reservation. Axe Throwing Video turns your venue, your instructors, and your customer experiences into short preview and marketing clips that answer every prospective customer's first question: what will this actually feel like, and is it right for me? tags: - axe throwing-video


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: imwyvern/batch-video-creator (version 1.0.1)

--- name: batch-video-creator description: > Batch Video Creator is an AI workflow for batch video production when you need dozens of consistent clips without manual editing one by one. It automates template-based variation, caption swaps, ratio changes, voiceover options, and bulk export for agencies, brands, sellers, and content ops teams. 批量视频生成、规模化生产、素材自动化、矩阵内容。 --- # Batch Video Creator > Produce dozens of unique short videos from a single source in one run — with automated caption generation, hook rotation, color grading, voiceover variation, and platform-specific formatting. The content factory for teams that need volume without sacrificing quality. ## What This Skill Does Batch Video Creator is the mass-production engine behind content-heavy marketing strategies. Feed it one hero video and a set of parameters, and it outputs 10, 20, or 50+ unique variants — each with different hooks, captions, color treatments, and pacing. Every video passes platform deduplication checks thanks to a 6-layer uniqueness system. ### Core Capabilities 1. **One-to-Many Generation** — 1 source → 10-50+ unique outputs with configurable variation depth 2. **Hook Library** — Rotate through proven hook templates (question, statistic, controversy, story) 3. **Caption Automation** — AI-written captions with blue-word strategy, emoji placement, and hashtag optimization 4. **Voiceover Variants** — Multiple TTS voices and pacing styles for the same script 5. **Color Grade Rotation** — Warm, cool, vintage, high-contrast — each variant gets a different treatment 6. **Video Deduplication** — Prompt mutation + color shift + speed jitter + crop variation + subtitle style + fingerprint perturbation 7. **Batch Export** — All variants exported with platform-correct specs, named and organized ### Production Scale | Tier | Input | Output | Time | |------|-------|--------|------| | Quick | 1 video | 5 variants | ~10 min | | Standard | 1 video | 15 variants | ~30 min | | Campaign | 3 videos | 50+ variants | ~2 hours | ## Usage - "Batch produce 20 TikTok variants from this product video" - "Generate a week's worth of Douyin content from these 3 source clips" - "Create 15 unique Reels with different hooks for our A/B test" ## Upgrade For enterprise batch processing and API access, visit https://mediaclawbot.com --- *Powered by MediaClaw — content at scale*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zlikemario/utf8-time (version 1.0.0)

--- name: utf8-time description: When user mentions current time, get and display the current time version: 1.0.0 triggers: - current time - what time - now --- # Current Time Skill When the user mentions the current time, this skill: 1. Calls the currentTime() function from src/main.js 2. Returns the current time in user-friendly format ## Implementation Details The skill monitors for time-related keywords and executes src/main.js to fetch and display the current time. **Example triggers:** - What time is it? - Current time? - What's the time now? **Example output:** ``` 2026-03-20 14:30:45 ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: unisound-llm/unisound-med-teach (version 1.0.0)

--- name: med-eval-med-teach description: 临床教学案例生成。由调用方提供题目文本或含 `question` 字段的结构化输入，经内部医疗大模型按题干约束生成作答；仅含 `scripts/run.py`，可独立拷贝部署。 metadata: { "openclaw": { "emoji": "🧪" } } --- # 临床教学案例生成 ## 概述 基于给定病历要点生成教学案例，突出学习目标、鉴别点与伦理边界（注意脱敏）。 本能力与具体业务请求解耦：平台或调用方如何组织用户输入由集成方决定；此处只约定**如何把题目交给脚本**（见下）。 ## 题目输入（三选一） 1. **`--question`**：直接传入完整题干字符串。 2. **`--input PATH`**： - `.jsonl`：每行一个 JSON 对象，须含非空字符串字段 `question`；可用 `--index` / `--batch` / `--match-id` 选取记录； - `.json`：单个对象，须含 `question`； - 其他扩展名：按 UTF-8 纯文本整文件作为题干。 - 传 `-` 时从 **stdin** 读取一条 JSON（含 `question`）或纯文本。 3. **stdin**（且未传 `--question` / `--input`、且 stdin 非 TTY）：读入 JSON 对象或纯文本，规则同 `-`。 ## 模型 - 默认 `u1-insuremed`，接口 `https://maas-api.hivoice.cn/v1/chat/completions`（可通过参数覆盖）。 ## 用法示例 ```bash # 命令行直接给题 python3 scripts/run.py --question "题干……" --appkey YOUR_KEY # 从任意路径的 jsonl 取一条（与文件名无关） python3 scripts/run.py --input /path/to/items.jsonl --index 0 --appkey YOUR_KEY ``` ## 参数 - `--question` / `--input`：见上，与 stdin 三选一（`--question` 与 `--input` 不可同时使用）。 - `--appkey STRING`：**必填**（`--dry-run` 时除外）。内部医疗大模型鉴权 key。 - `--index`、`--match-id`、`--batch`：仅对 `.jsonl` 生效。 - `--dry-run`：不调用模型，仅输出解析后的题目 JSON。 - `--model`、`--api-url`、`--temperature`、`--timeout`、`--system-prompt`：调模型参数。 - `--output PATH`：另存完整 JSON（批量为 NDJSON）。 - `--text-only`：标准输出仅打印模型答案文本。 ## 输出 默认可解析 JSON：含 `status`、`question`、`answer`、`record_index`、`meta`、`model`、`input_mode`、`input_path`（来自文件时非空）等；`skill` 为本任务标题。 ## 合规说明 输出为模型辅助信息，不构成正式诊疗决策；涉及真实患者数据须先脱敏并遵守院内流程。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: eyhn/botauth (version 0.1.0)

--- name: botauth description: Use the botauth CLI to list, search, and retrieve secrets from the user's unlocked botauth vault with per-request approval in the desktop app. Use when a task needs API keys, tokens, or passwords from an existing botauth vault. --- # botauth Use `botauth` to securely retrieve API keys, tokens, and credentials from the user's botauth vault. The desktop app must be running, the vault must be unlocked, and every `list`, `search`, and `get` request can trigger an approval prompt. ## When to use - You need an API key, token, or password to complete a task - The user asks you to use credentials that already exist in botauth - You need to fill a `.env` file or config from the user's vault Do not save new secrets unless the user explicitly asks. `botauth add` opens a desktop flow for the user to fill in the credential. ## Prerequisites - `botauth` must be installed and available on `PATH` - The botauth desktop app must be running - The vault must be unlocked - Run `botauth status` first ## Core commands ### Check connection ```bash botauth status ``` ### Search or list secrets ```bash botauth search "openai" botauth search "github" --provider github botauth list botauth list --provider github botauth list --tags dev,production ``` ### Retrieve a secret in two steps First get metadata: ```bash botauth get "OpenAI API Key" botauth get --id <secret-id> ``` Then fetch the sensitive fields: ```bash botauth get --id <secret-id> --fields api_key botauth get --id <secret-id> --fields api_key,client_secret --access-key <key> ``` Reuse `--access-key` inside the same workflow when possible to avoid redundant approval prompts. ### Ask the user to create a secret ```bash botauth add botauth add --app openai --secret-name "Production Key" ``` ## Typical workflow ```bash botauth status botauth search "openai" botauth get "OpenAI API Key" botauth get --id <id> --fields api_key --access-key <access-key> export OPENAI_API_KEY="<value>" ``` ## JSON output Use `--json` for machine-readable output: ```bash botauth search "github" --json botauth get --id <id> --fields token --json ``` ## Important notes - `list`, `search`, `get`, and `add` may show approval prompts in the desktop app - Sensitive values only come back from `get --fields` - Access keys are short-lived; reuse them during a single task, then discard them - If `botauth status` fails, ask the user to launch or unlock the desktop app


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ivangdavila/roblox (version 1.0.0)

--- name: Roblox description: Avoid common Roblox mistakes — server/client security, DataStore pitfalls, memory leaks, and replication gotchas. metadata: {"clawdbot":{"emoji":"🎲","os":["linux","darwin","win32"]}} --- ## Server vs Client - Server scripts in ServerScriptService — never trust client data - LocalScripts in StarterPlayerScripts or StarterGui — client-only - RemoteEvent for fire-and-forget — RemoteFunction when server needs to return value - ALWAYS validate on server — client can send anything, exploiters will ## Security - Never trust client input — validate everything server-side - Server-side sanity checks — is player allowed? Is value reasonable? - FilteringEnabled is always on — but doesn't protect your RemoteEvents - Don't expose admin commands via RemoteEvents — check permissions server-side ## DataStore - `:GetAsync()` and `:SetAsync()` can fail — wrap in pcall, retry with backoff - Rate limits: 60 + numPlayers × 10 requests/minute — queue writes, batch when possible - `:UpdateAsync()` for read-modify-write — prevents race conditions - Session locking — prevent data loss on rejoin, use `:UpdateAsync()` with check - Test with Studio API access enabled — Settings → Security → API Services ## Memory Leaks - Connections not disconnected — store and `:Disconnect()` when done - `:Destroy()` instances when removed — sets Parent to nil and disconnects events - Player leaving without cleanup — `Players.PlayerRemoving` to clean up - Tables holding references — nil out references you don't need ## Character Handling - Character may not exist at PlayerAdded — use `player.CharacterAdded:Wait()` or event - Character respawns = new character — reconnect events on CharacterAdded - `Humanoid.Died` fires on death — for death handling logic - `LoadCharacter()` to force respawn — but prefer natural respawn usually ## Replication - ServerStorage: server-only — clients can't see - ReplicatedStorage: both see — shared modules and assets - ReplicatedFirst: loads first on client — loading screens - Workspace replicates to clients — but server is authority ## Services Pattern - `game:GetService("ServiceName")` — don't index directly, fails in different contexts - Cache service references — `local Players = game:GetService("Players")` - Common: Players, ReplicatedStorage, ServerStorage, RunService, DataStoreService ## RunService - `Heartbeat` after physics — most gameplay logic - `RenderStepped` client only, before render — camera, visual updates - `Stepped` before physics — physics manipulation - Avoid heavy computation every frame — spread over multiple frames ## Common Mistakes - `wait()` deprecated — use `task.wait()` for reliable timing - `spawn()` deprecated — use `task.spawn()` or `task.defer()` - Module require returns cached — same table across requires, changes shared - `:Clone()` doesn't fire events — manually fire if needed - Part collisions with CanCollide false — still fire Touched, use CanTouch


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)