OpenClaw/clawhub-security-signals huggingface dataset:
Skill: bytesagain-lab/funnlp (version 2.0.3)

--- name: "funnlp" version: "2.0.3" description: "Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Funnlp concepts, best practices, and implementation patterns." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [funnlp, reference] category: "devtools" --- # Funnlp Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Funnlp concepts, best practices, and implementation patterns. No API keys or credentials required. ## Commands | Command | Description | |---------|-------------| | `intro` | intro reference | | `quickstart` | quickstart reference | | `patterns` | patterns reference | | `debugging` | debugging reference | | `performance` | performance reference | | `security` | security reference | | `migration` | migration reference | | `cheatsheet` | cheatsheet reference | ## Output Format All commands output plain-text reference documentation via heredoc. No external API calls, no credentials needed, no network access. --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dponxiaodong/star-office-ui (version 1.0.0)

--- name: star-office-ui description: Star Office UI 一键化 Skill：帮主人快速部署像素办公室看板，支持多 Agent 加入、状态可视化、移动端查看与公网访问。 --- # Star Office UI Skill 本 Skill 面向想快速帮主人搭建“像素办公室看板”的 OpenClaw（龙虾）： - 目标：主人只需“看到效果”，尽量少问问题 - 你可以按下面的步骤，一步一步帮主人跑起来并对外访问 --- ## 0. 一句话告诉主人这是什么 你可以先和主人说： > 这是一个多人协作的像素办公室仪表盘，你的 AI 助手会根据状态自动走到不同位置，还能看到昨天的工作小记！ --- ## 1. 30 秒一键启动（推荐你先做一遍） 在你这台机器执行（按顺序）： ```bash # 1) 下载仓库 git clone https://github.com/ringhyacinth/Star-Office-UI.git cd Star-Office-UI # 2) 安装依赖 python3 -m pip install -r backend/requirements.txt # 3) 准备状态文件（首次） cp state.sample.json state.json # 4) 启动后端 cd backend python3 app.py ``` 然后告诉主人： > 好了，你现在打开 http://127.0.0.1:18791 就能看到像素办公室了！ --- ## 2. 帮主人切状态体验一下 在项目根目录执行： ```bash # 工作中 → 去办公桌 python3 set_state.py writing "正在帮你整理文档" # 同步中 python3 set_state.py syncing "同步进度中" # 报错中 → 去 bug 区 python3 set_state.py error "发现问题，正在排查" # 待命 → 回休息区 python3 set_state.py idle "待命中，随时准备为你服务" ``` --- ## 3. 帮主人公网化（对外访问） ### 推荐方式：Cloudflare Tunnel（最快） 如果你这台机器有 `cloudflared`，直接跑： ```bash cloudflared tunnel --url http://127.0.0.1:18791 ``` 会得到一个 `https://xxx.trycloudflare.com` 链接，发给主人即可。 如果没有 `cloudflared`，也可以用你自己熟悉的公网方案（Nginx/Caddy 反向代理 / 自有域名 / 其他隧道等）。 --- ## 4. 邀请其他龙虾加入（可选） 如果有其他 OpenClaw 想加入你主人的办公室： ### 步骤 A：告诉其他龙虾用 office-agent-push.py 你可以让其他龙虾： 1) 下载 `office-agent-push.py`（可以直接从你这个仓库拿） 2) 让它调用 `join-agent` + 周期 `agent-push` 3) 你主人那边就能看到它进办公室了 ### 步骤 B：join key 说明 - 仓库里默认有 `join-keys.json`（`ocj_starteam01` ~ `ocj_starteam08`） - 同一个 key 最多 3 人同时在线 - 你也可以帮主人新建自己的 key --- ## 5. 昨日小记（可选） 如果你主人想看到“昨日小记”： - 在仓库上级目录放一个 `memory/YYYY-MM-DD.md` - 后端会自动读取昨天（或最近可用）的记录，做基础脱敏后展示 --- ## 6. 常见问题（主人可能问你的） ### Q1：“为什么角色选了宝石海星？” > 宝石海星是宝可梦的 IP，不是原创的；选它是因为和作者名字“海辛”在中文里有谐音趣味，这是一个非商用的粉丝创作，仅供学习演示。 ### Q2：“我可以商用吗？” > 代码玩法可以基于 MIT 用，但美术资产（包括角色/场景）禁止商用；如果你要商用，请务必换成你自己的原创美术资产。 ### Q3：“其他龙虾怎么加入？” > 用 join key 加入，然后持续推送状态就行；仓库里有 `office-agent-push.py` 可以给其他龙虾用。 --- ## 7. 给你的提示 - 尽量帮主人把“启动步骤”做完，让主人只负责“看”和“体验” - 如果主人要对外访问，优先用 Cloudflare Tunnel（最快最方便） - 如果主人要改状态，你可以帮他调用 `set_state.py`，不用让他自己敲命令 - 注意不要暴露你主人的内网地址或私有信息

path: backend/requirements.txt
content: flask==3.0.2


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: apollostreetcompany/clauditor (version 0.1.2)

--- name: clauditor description: Tamper-resistant audit watchdog for Clawdbot agents. Detects and logs suspicious filesystem activity with HMAC-chained evidence. homepage: https://github.com/apollostreetcompany/clauditor metadata: {"clawdbot":{"emoji":"🛡️","requires":{"bins":["cargo","systemctl"],"os":"linux"}}} --- # Clauditor Security watchdog that monitors filesystem activity and creates tamper-evident logs. Even if Clawdbot is compromised, it cannot stop the watchdog, forge entries, or delete evidence. ## Installation (Guided) Use the CLI wizard to guide users through installation: ```bash cd /path/to/clauditor cargo build --release ``` ### Agent Workflow 1. **Check status:** `./target/release/clauditor wizard status` - Returns JSON with `current_step` (1-6) and `complete` (true/false) 2. **Get next step:** `./target/release/clauditor wizard next` - Shows WHAT it does, WHY it matters, and the exact COMMAND to run 3. **User runs the sudo command** 4. **Verify:** `./target/release/clauditor wizard verify` - Confirms step completed 5. **Repeat until `complete: true`** ### Example Interaction ``` User: "Install clauditor" Agent: [runs wizard status → current_step: 1] Agent: "Step 1 of 6: Create system user This creates a 'sysaudit' user that runs the watchdog. Even if you're compromised, you can't kill a process owned by another user. Run this: sudo useradd --system --shell /usr/sbin/nologin --no-create-home sysaudit Let me know when done." User: "done" Agent: [runs wizard verify → success] Agent: [runs wizard next → step 2...] ``` ## After Installation ### Check status ```bash systemctl status systemd-journaldd ``` ### Generate digest ```bash ./target/release/clauditor digest \ --log /var/lib/.sysd/.audit/events.log \ --key /etc/sysaudit/key \ --format markdown ``` ## Quick Install (Power Users) ```bash sudo bash wizard/wizard.sh ``` ## Configuration - Config: `/etc/sysaudit/config.toml` - Key: `/etc/sysaudit/key` - Logs: `/var/lib/.sysd/.audit/events.log` Edit config to customize `watch_paths` and `target_uid`.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: jingconan/deepvista-recipe-research-to-recipe (version 0.1.0-alpha.21)

--- name: deepvista-recipe-research-to-recipe description: "Recipe: Search your knowledge base, synthesize findings, and run a Recipe workflow." metadata: openclaw: category: recipe requires: bins: - deepvista skills: - deepvista-vistabase - deepvista-recipe install: - kind: uv package: deepvista-cli bins: [deepvista] homepage: https://cli.deepvista.ai cliHelp: "deepvista card +search --help" --- # Research to Recipe > **PREREQUISITE:** Load the following skills: `deepvista-vistabase`, `deepvista-recipe` Search your knowledge base for relevant context, synthesize it, then run a Recipe workflow with that context as input. ## Steps 1. **Search for relevant cards:** ```bash deepvista card +search "your research topic" --limit 10 ``` 2. **Read the most relevant cards** (pick IDs from search results): ```bash deepvista card get <card_id_1> deepvista card get <card_id_2> ``` 3. **Summarize findings** into a context string for the Recipe. 4. **List available Recipes** to find the right workflow: ```bash deepvista recipe list ``` 5. **Confirm with the user** which Recipe to run and what context to pass, then run it: ```bash deepvista recipe run <recipe_id> --input "Based on my research: <summary of findings>" ``` 6. **Check run status:** ```bash deepvista recipe status <run_chat_id> ``` ## Tips - Steps 1–4 are read-only. Step 5 (`recipe run`) is the only write operation — always confirm with the user before executing it. - The Recipe run has access to the full knowledge base; the `--input` flag focuses the run, it doesn't limit what the agent can see. - After a run starts, the agent creates a linked chat session — continue the conversation using `deepvista chat +send --chat-id <run_chat_id>`. ## See Also - [deepvista-vistabase](../deepvista-vistabase/SKILL.md) — card search and retrieval - [deepvista-recipe](../deepvista-recipe/SKILL.md) — Recipe list, run, and status


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: who-ohw/restart-safe-workflow (version 1.0.3)

--- name: restart-safe-workflow description: Safe OpenClaw gateway restart workflow with doctor precheck, checkpoint, restart-health-resume chain, task continuation, reconcile, and user-visible notifications. --- # restart-safe-workflow ## 能力概览 - 安全重启主链：`doctor -> checkpoint -> restart -> health -> resume` - 任务续跑：`pendingActions` + Action 状态机 - 语义动作：`notify-time[:TZ]` - 计划能力：`plan` / `validate`（TaskPlan v1） - 补偿与升级：`reconcile` + `retry_exceeded` - 观测诊断：`report --verbose` / `diagnose` - 一键验收：`restart-acceptance.sh`（支持 `--with-restart`，默认自守护 detached） ## 常用命令 ```bash # 安全重启 scripts/restart-safe.sh run --task-id <id> --next "notify:重启完成;notify-time" # 计划预览 / 校验 scripts/restart-safe.sh plan --task-id <id> --next "notify:ok;notify-time" scripts/restart-safe.sh validate --tasks-file examples/plan-valid.json # 摘要 / 诊断 scripts/restart-safe.sh report --task-id <id> scripts/restart-safe.sh report --task-id <id> --verbose scripts/restart-safe.sh diagnose --task-id <id> # 验收 scripts/restart-acceptance.sh scripts/restart-acceptance.sh --with-restart --notify-channel feishu --notify-target user:<open_id> ``` ## 推荐发布内容 - `SKILL.md` - `README.md` - `config-action-allowlist.txt` - `schemas/taskspec-v1.schema.json` - `examples/plan-valid.json`, `examples/plan-invalid.json` - `scripts/restart-safe.sh`, `scripts/restart-acceptance.sh` - `references/restart-safe-sop.md` - `references/phase4-rollout-checklist.md` ## Changelog（最近两次） - **v1.0.2**: 完成 Phase3/4，修复 TC10 升级触发，验收支持自守护 detached。 - **v1.0.1**: 完成 Phase1/2，新增 TaskPlan v1 与状态机能力。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: codekungfu/sogou (version 0.1.0)

--- name: sogou-input-method description: 注册“搜狗输入法”技能；用于工具类产品公开页面、功能说明、下载入口与帮助信息整理。 homepage: `https://shurufa.sogou.com/` metadata: {"clawdbot":{"emoji":"🧰"}} --- # 搜狗输入法 用途与边界 - 面向公开官网、下载页、帮助中心、功能说明页与公告页的信息整理 - 不提供设备控制、权限绕过、非公开安装包、系统破解或风控规避能力 - 仅处理公开可见的功能说明、版本入口、帮助信息与使用边界 关键入口 - 主页：https://shurufa.sogou.com/ - 下载与版本：官网中的下载页、版本说明、平台支持入口 - 帮助与功能：帮助中心、FAQ、功能介绍、隐私或权限说明入口 常见任务 - 功能模块、版本差异、平台支持与下载入口整理 - 权限说明、隐私说明、常见问题与故障排查入口汇总 - 更新日志、公告页与帮助目录提取 数据字段 - 平台支持、版本入口、功能模块、链接 - 权限说明、隐私政策、帮助页、FAQ 链接 - 更新日志、公告页、下载地址、系统要求 自动化要点 - 工具类产品经常按系统平台区分，整理时明确 Android、iOS、Windows、macOS 差异 - 优先以官方权限说明和隐私政策为准，避免过度推断 - 不处理设备调试、系统破解、越权访问或私有数据导出 示例流程 - 版本整理：访问 Sogou Input Method 下载页 → 提取平台与版本入口 → 输出清单 - 功能摘要：进入功能说明页 → 提取核心能力与限制 → 输出摘要 - 帮助汇总：访问帮助中心与隐私页 → 输出常见问题与权限说明 合规提示 - 遵守平台规则、版权要求与账号安全要求 - 只整理公开信息，不输出敏感数据或非公开内容


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: daniellummis/github-actions-permission-scope-audit (version 1.0.0)

--- name: github-actions-permission-scope-audit description: Audit GitHub Actions workflow permission scope drift to enforce least-privilege token access. version: 1.0.0 metadata: {"openclaw":{"requires":{"bins":["bash","python3"]}}} --- # GitHub Actions Permission Scope Audit Use this skill to detect over-broad `GITHUB_TOKEN` permissions and scope drift across GitHub Actions workflows. ## What this skill does - Reads workflow YAML files - Detects explicit broad permission grants (`write-all`, `contents: write`, etc.) - Flags risky patterns like `pull_request_target` workflows with write permissions - Identifies workflows with no explicit `permissions` policy - Emits text or JSON for CI triage and policy gates ## Inputs Optional: - `WORKFLOW_GLOB` (default: `.github/workflows/*.y*ml`) - `TOP_N` (default: `20`) - `OUTPUT_FORMAT` (`text` or `json`, default: `text`) - `WARN_SCORE` (default: `2`) - `CRITICAL_SCORE` (default: `5`) - `FLAG_MISSING_PERMISSIONS` (`0` or `1`, default: `1`) - `FLAG_WRITE_ALL` (`0` or `1`, default: `1`) - `FLAG_WRITE_SCOPES` (`0` or `1`, default: `1`) - `WORKFLOW_FILE_MATCH` / `WORKFLOW_FILE_EXCLUDE` (regex, optional) - `EVENT_MATCH` / `EVENT_EXCLUDE` (regex, optional) - `PERMISSION_MATCH` / `PERMISSION_EXCLUDE` (regex, optional) - `FAIL_ON_CRITICAL` (`0` or `1`, default: `0`) ## Run Text report: ```bash WORKFLOW_GLOB='.github/workflows/*.yml' \ bash skills/github-actions-permission-scope-audit/scripts/permission-scope-audit.sh ``` JSON output + fail gate: ```bash WORKFLOW_GLOB='.github/workflows/*.yml' \ OUTPUT_FORMAT=json \ FAIL_ON_CRITICAL=1 \ bash skills/github-actions-permission-scope-audit/scripts/permission-scope-audit.sh ``` Run against bundled fixtures: ```bash WORKFLOW_GLOB='skills/github-actions-permission-scope-audit/fixtures/*.yml' \ bash skills/github-actions-permission-scope-audit/scripts/permission-scope-audit.sh ``` ## Output contract - Exit `0` in report mode (default) - Exit `1` when `FAIL_ON_CRITICAL=1` and one or more workflows are critical - Text mode prints summary + ranked workflows - JSON mode prints summary + ranked workflows + critical workflows


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: smseow001/todesk-alternatives (version 1.0.0)

--- name: todesk-alternatives version: 1.0.0 description: 安全免费开源的ToDesk替代远程控制工具推荐。RustDesk/SPyRFC/UltraVNC等，主打安全、开源、无广告，适合程序员和电脑用户。 keywords: [todesk,remote-desktop,rustdesk,open-source,remote-control,开源,远程控制] --- # ToDesk 开源平替推荐 **触发词：** `ToDesk平替` / `开源远程控制` / `远程桌面替代` --- ## 为什么需要替代？ | ToDesk | 开源替代 | |--------|---------| | ❌ 有广告/付费 | ✅ 免费开源 | | ❌ 数据经过服务器 | ✅ 点对点直连 | | ❌ 闭源，有隐私风险 | ✅ 代码公开，可审计 | | ❌ 免费版限制多 | ✅ 功能完整 | --- ## 推荐工具 ### 1️⃣ RustDesk（最推荐） **特点：** Rust编写，全平台支持，开源免费 | 特性 | 说明 | |------|------| | 平台 | Windows/macOS/Linux/Android/iOS | | 连接 | 点对点 / 中继服务器 | | 开源 | ✅ 完全开源 | | 自托管 | ✅ 可搭建自己的中继服务器 | | 延迟 | 低（P2P直连） | **下载：** https://rustdesk.com/download **部署自建中继：** ```bash # Docker 一键部署 docker run --name rustdesk-server -d \ --network host \ rustdesk/rustdesk-server:latest ``` **适合人群：** 所有人，特别是注重隐私者 --- ### 2️⃣ UltraVNC **特点：** 老牌VNC改进，Windows最强 | 特性 | 说明 | |------|------| | 平台 | Windows为主 | | 连接 | VNC协议 | | 开源 | ✅ 开源 | | 文件传输 | ✅ 支持 | | 画质 | 高 | **下载：** https://www.uvnc.com/downloads/ultravnc.html **适合人群：** Windows用户，需要高画质传输 --- ### 3️⃣ TigerVNC **特点：** 高性能VNC替代 | 特性 | 说明 | |------|------| | 平台 | Windows/macOS/Linux | | 连接 | VNC协议 | | 开源 | ✅ 开源 | | 性能 | 优化过的渲染 | **下载：** https://tigervnc.org/ **适合人群：** Linux用户，需要高性能 --- ### 4️⃣ SPyRFC (自建方案) **特点：** 完全自建，零依赖 | 特性 | 说明 | |------|------| | 平台 | 需自己部署 | | 连接 | WebRTC P2P | | 开源 | ✅ 开源 | | 复杂度 | 高，需技术能力 | **适合人群：** 程序员/极客 --- ## 工具对比 | 工具 | 难度 | 隐私 | 平台 | 推荐度 | |------|------|------|------|---------| | RustDesk | ⭐ | ⭐⭐⭐⭐⭐ | 全部 | ⭐⭐⭐⭐⭐ | | UltraVNC | ⭐⭐ | ⭐⭐⭐⭐ | Windows | ⭐⭐⭐⭐ | | TigerVNC | ⭐⭐ | ⭐⭐⭐⭐ | 全部 | ⭐⭐⭐⭐ | | 自建 | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ | 全部 | ⭐⭐⭐ | --- ## 安全提示 ⚠️ **重要：** 1. **优先使用P2P直连**，不经过中继更安全 2. **自建中继服务器**，数据不经过第三方 3. **配合Tailscale**，组网后更安全 4. **强密码 + 2FA**，防止未授权访问 5. **定期更新**，修复安全漏洞 --- ## 最佳实践：RustDesk + Tailscale ``` Tailscale组网 → 获取虚拟IP → RustDesk连接 ``` **优势：** - ✅ 不暴露公网IP - ✅ 点对点加密 - ✅ 无需端口映射 - ✅ 低延迟 --- *安全开源远程控制 | 保护隐私*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: raise7727/bilibili-search-raise7727 (version 1.0.1)

# Bilibili 热门视频实时搜索与分析技能 (Bilibili Search Skill) ## 🌟 技能简介 (Introduction) 这是一个专为 AI 代理 (Agent) 打造的 Bilibili (B站) 数据获取与分析插件。 大模型通常受限于训练数据的知识截止日期，无法获取当天的互联网热点。本技能通过调用本地部署的 Python 自动化接口 (基于 Playwright 和 FastAPI)，让大模型能够实时检索 B 站的最新视频和全站热门内容，从而填补 AI 在时效性上的短板。 ## 🎯 核心功能 (Key Features) * **实时检索**：根据大模型传入的关键词（如“具身智能”、“人形机器人”），实时去 B 站进行搜索。 * **精准去重与提取**：跳过广告和无关信息，精准提取搜索结果中排名前列的视频标题。 * **JSON 结构化输出**：将爬取到的非结构化网页数据转化为标准 JSON 格式，方便大模型进行二次语义分析和内容提炼。 * **静默运行**：底层采用 Headless 无头浏览器模式，完全在后台执行，不会干扰用户的桌面操作。 ## 💡 典型使用场景与提示词 (Use Cases & Example Prompts) 当您在聊天框中与 AI 代理沟通时，可以使用以下提示词直接触发本技能： 1. **行业热点追踪**： > "请帮我调用 Bilibili 搜索技能，查一下今天关于‘具身智能’最新的 5 个爆款视频，并总结一下大家都在关注什么技术点？" 2. **特定 UP 主动态**： > "用 B站搜索查一下‘波士顿动力’最近发布的视频标题。" 3. **竞品分析**： > "搜索一下‘宇树科技’，看看他们最新的机器狗测试视频有哪些？" ## 🛠️ 环境依赖与运行说明 (Prerequisites) **注意**：本技能非纯云端应用，它依赖于您本地电脑或服务器上运行的专属 API 服务。 在使用本技能前，请确保： 1. 本地的 FastAPI 服务 (`skill_api.py`) 已经成功启动。 2. 终端显示 `Uvicorn running on http://127.0.0.1:8000`。 3. 本地环境已正确安装 `playwright` 并下载了对应的 Chromium 浏览器内核。 ## 📝 更新日志 (Changelog) * **v1.0.0**: 初始版本发布，支持基础关键词搜索与标题提取。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 0xrag/authenticate-wallet (version 0.1.0)

--- name: authenticate-wallet description: Sign in to the wallet. Use when you or the user want to log in, sign in, connect, or set up the wallet, or when any wallet operation fails with authentication or "not signed in" errors. This skill is a prerequisite before sending, trading, or funding. user-invocable: true disable-model-invocation: false allowed-tools: ["Bash(npx awal@latest status*)", "Bash(npx awal@latest auth *)", "Bash(npx awal@latest balance*)", "Bash(npx awal@latest address*)", "Bash(npx awal@latest show*)"] --- # Authenticating with the Payments Wallet When the wallet is not signed in (detected via `npx awal status` or when wallet operations fail with authentication errors), use the `npx awal` CLI to authenticate. If you have access to email, you can authenticate the wallet yourself, otherwise you'll need to ask your human to give you an email address and to tell you the OTP code they receive. ## Authentication Flow Authentication uses a two-step email OTP process: ### Step 1: Initiate login ```bash npx awal@latest auth login <email> ``` This sends a 6-digit verification code to the email and outputs a `flowId`. ### Step 2: Verify OTP ```bash npx awal@latest auth verify <flowId> <otp> ``` Use the `flowId` from step 1 and the 6-digit code from the user's email to complete authentication. If you have the ability to access the user's email, you can read the OTP code, or you can ask your human for the code. ## Checking Authentication Status ```bash npx awal@latest status ``` Displays wallet server health and authentication status including wallet address. ## Example Session ```bash # Check current status npx awal@latest status # Start login (sends OTP to email) npx awal@latest auth login [REDACTED_SECRET] # Output: flowId: abc123... # After user receives code, verify npx awal@latest auth verify abc123 123456 # Confirm authentication npx awal@latest status ``` ## Available CLI Commands | Command | Purpose | | -------------------------------------------- | -------------------------------------- | | `npx awal@latest status` | Check server health and auth status | | `npx awal@latest auth login <email>` | Send OTP code to email, returns flowId | | `npx awal@latest auth verify <flowId> <otp>` | Complete authentication with OTP code | | `npx awal@latest balance` | Get USDC wallet balance | | `npx awal@latest address` | Get wallet address | | `npx awal@latest show` | Open the wallet companion window | ## JSON Output All commands support `--json` for machine-readable output: ```bash npx awal@latest status --json npx awal@latest auth login [REDACTED_SECRET] --json npx awal@latest auth verify <flowId> <otp> --json ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: liujintao-2021/static-server (version 1.0.0)

--- name: static-server description: Start a local HTTP server to preview static HTML pages. Use when testing static pages, previewing HTML files, or when browser tools cannot access file:// URLs. Provides localhost URL for browser testing. --- # Static Server Start a Python HTTP server to preview static HTML files in a browser. ## When to Use - Testing static HTML pages - Previewing web pages before deployment - When browser tools block `file://` protocol - Need a localhost URL for browser automation ## Quick Start Use the bundled script to start a server: ```bash python scripts/serve.py <path> [--port PORT] ``` **Arguments:** - `<path>`: File path (serves parent directory) or directory path - `--port`: Optional port number (default: 8000) **Examples:** ```bash # Serve a specific HTML file python scripts/serve.py /path/to/index.html # Serve a directory python scripts/serve.py /path/to/project # Use custom port python scripts/serve.py /path/to/index.html --port 9000 ``` ## Output The script prints: - Access URL: `http://localhost:PORT/filename.html` - Directory being served - Instructions to stop (Ctrl+C) ## Usage in Testing When testing static pages with browser tools: 1. Start server with `exec` (background mode) 2. Use the localhost URL with browser tools 3. Complete testing 4. Kill the server process **Example workflow:** ```javascript // 1. Start server in background exec({ command: "python scripts/serve.py /path/to/index.html --port 8888", background: true }) // 2. Open in browser browser({ action: "open", targetUrl: "http://localhost:8888/index.html" }) // 3. Test and screenshot browser({ action: "screenshot", fullPage: true }) // 4. Clean up process({ action: "kill", sessionId: "..." }) browser({ action: "close" }) ``` ## Alternative: One-liner For quick testing without the script: ```bash python -m http.server 8000 --directory /path/to/dir ``` Note: This serves the directory root, not a specific file.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: flobo3/chords-fetcher (version 1.1.0)

--- name: chords-fetcher description: Fetch clean guitar chords and lyrics from popular sites (mychords.net, amdm.ru, ultimate-guitar.com). Strips tabs, fixes formatting. --- # Chords Fetcher Fetch clean guitar chords and lyrics without ads, pop-ups, or messy guitar tabs. ## Usage When the user asks for chords to a song (e.g., "аккорды Кино Звезда по имени Солнце", "chords behind blue eyes"), use the `exec` tool to run the fetcher script. ```bash uv run python chords.py <song_name_and_artist> ``` ## Features - Searches across multiple sources: mychords.net, ultimate-guitar.com, amdm.ru via DuckDuckGo. - Strips out guitar tabs (e|---, B|---, etc.) to keep the output clean. - Fixes spacing where chords are glued to lyrics (e.g., `AmWhite snow` → `Am White snow`). - Falls back to the next source if one is unavailable. ## Dependencies - `beautifulsoup4` - `ddgs` (DuckDuckGo Search) ## Notes - Run the script from the skill's directory. - If the script returns an error or cannot find the song, inform the user.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: wrentheai/macvital (version 1.0.1)

--- name: macvital description: | Check macOS hardware health: CPU usage, RAM pressure, disk space, temperatures, and top processes. Returns a quick status summary or full breakdown. USE WHEN: User or agent wants to know if the Mac is under load, running hot, low on disk, or RAM-constrained. Also use before spawning heavy tasks to check if the machine has headroom, or when diagnosing performance issues. DON'T USE WHEN: User asks about network speed, battery health (use a battery-specific tool), or remote machine health. --- # macvital macOS hardware health monitor. Checks CPU, RAM, disk, temperature, and top resource hogs. ## Requirements - Python 3 (pre-installed on macOS) - Script: `scripts/macvital.py` - Temperature data requires `sudo` (Apple Silicon only) ## Commands ```bash # Quick one-line status (good/warn/critical with icons) python3 scripts/macvital.py status python3 scripts/macvital.py status --json # machine-readable # Full breakdown python3 scripts/macvital.py detail # Top CPU and RAM processes python3 scripts/macvital.py top python3 scripts/macvital.py top --n 10 # Temperature only (more accurate with sudo) python3 scripts/macvital.py temp sudo python3 scripts/macvital.py temp # Exit code check (for scripting: 0=ok, 1=warn, 2=critical) python3 scripts/macvital.py check # Continuous monitoring python3 scripts/macvital.py watch python3 scripts/macvital.py watch --interval 10 ``` ## Thresholds | Metric | Warn | Critical | |--------|------|----------| | CPU | 70% | 90% | | RAM | 75% | 90% | | Disk | 80% | 90% | | Temp | 80°C | 95°C | ## Typical Use (agent workflow) ```bash # Before a heavy task python3 scripts/macvital.py check # exit 0 = safe to proceed, exit 1/2 = consider waiting # Quick heartbeat line python3 scripts/macvital.py status # Diagnosing slowness python3 scripts/macvital.py detail python3 scripts/macvital.py top ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)