OpenClaw/clawhub-security-signals huggingface dataset:
Skill: rk905/geeksdobyte-motivation-skill (version 0.1.0)

--- name: motivation-skill summary: Provide a daily motivational quote. tags: ["motivation","quotes","fun"] --- # Motivation Skill ## Description This skill lets the agent respond with a daily motivational quote when asked. ## Usage When the user asks the agent for a motivational quote, this skill should provide a friendly response. Example: User: Give me a motivational quote for today. Assistant: "Success is not final; failure is not fatal: it is the courage to continue that counts." — Winston Churchill ## Behavior If the user’s request mentions: - motivational quote - quote for today - inspiration then reply with a relevant prewritten motivational quote. ## Quotes List - "The only way to do great work is to love what you do." — Steve Jobs - "Success usually comes to those who are too busy to be looking for it." — Henry David Thoreau - "It does not matter how slowly you go as long as you do not stop." — Confucius


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ibnaleem/comb (version 1.0.0)

--- name: comb slug: comb version: 1.0.0 description: Search 3.2 billion leaked credentials in the COMB dataset via ProxyNova API (no API key required). homepage: https://www.proxynova.com/tools/comb/ author: ibnaleem repository: https://github.com/ibnaleem/comb-skill license: GPL-3.0 changelog: "Initial release" metadata: {"openclaw":{"requires":{"bins":["curl"]},"os":["linux","darwin","win32"]}} --- # COMB One primary service, no API keys needed. The COMB API allows you to search emails, usernames, and passwords. Required arg: email, username, or password. Append `?query=` with the supplied email, username, or password. Simple request: ```bash curl 'https://api.proxynova.com/comb?query=jrubin' # Output: # { # "count": 795, # "lines": [ # "[REDACTED_SECRET]:IUSPgL1T", # "[REDACTED_SECRET]:michelle", # "[REDACTED_SECRET]:wayne9", # "[REDACTED_SECRET]:jake14", # "[REDACTED_SECRET]:maomao", # "[REDACTED_SECRET]:jacky", # "[REDACTED_SECRET]:jerry", # "[REDACTED_SECRET]:jr2203", # "[REDACTED_SECRET]:jr147369", # "[REDACTED_SECRET]:divorce", # "[REDACTED_SECRET]:divorce1", # "[REDACTED_SECRET]:vizsla123", # "[REDACTED_SECRET]:hammer316", # "[REDACTED_SECRET]:msierk05", # "[REDACTED_SECRET]:sasha2", # "[REDACTED_SECRET]:muaddib16", # "[REDACTED_SECRET]:stab8ler", # "[REDACTED_SECRET]:slower", # "[REDACTED_SECRET]:lacrosse", # "[REDACTED_SECRET]:pizza99" # ] # } ``` ## Rate Limits The API will only return 100 results max. The API will also limit you to about 100 requests per minute. ## References https://www.proxynova.com/tools/comb/ https://cybernews.com/news/largest-compilation-of-emails-and-passwords-leaked-free/


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal:  | SkillSpector: suspicious (MEDIUM)
Skill: skylinehk/pp-lounge-map-offline (version 1.3.25)

--- name: pp-lounge-map-offline description: Use this skill when you need offline or air-gapped access to the bundled Priority Pass lounge catalog. Trigger it for local lounge lookup, facility filtering, airport briefs, and lounge comparisons when network access is unavailable or disallowed. Do not use it for data rebuilds, deploys, remote MCP endpoints, arbitrary shell execution, or any workflow that depends on live internet access. version: 1.3.25 metadata: { "openclaw": { "requires": { "bins": ["node", "npm"] }, "install": [ { "id": "node", "kind": "node", "package": "@modelcontextprotocol/sdk", "label": "Install MCP runtime dependencies (run npm install in bundle root)", }, ], }, } --- # Worldwide lounge map Use this skill when the task is about the bundled offline lounge snapshot. ## Security Scope (quick read) - Offline-only runtime: use bundled `assets/catalog.json` via local stdio MCP. - No outbound network calls are allowed for runtime behavior. - No API keys, OAuth tokens, or remote MCP endpoints are required. - No purchase/payment execution exists in this skill. - If data is missing from the bundled snapshot, report that limitation explicitly. ## Hosted destination (next release) - https://prioritypassmap.desk.travel/ ## Runtime requirements - Node.js 20+ available on PATH (`node`). - Install package dependencies in the bundle root before running runtime scripts: - `npm install` - Required packages are declared in `package.json` (`@modelcontextprotocol/sdk`, `zod`). ## Quick start 1. Start the local stdio MCP server with `node skills/pp-lounge-map-offline/scripts/run-offline-mcp.mjs`. 2. Prefer the local MCP tools and resources over direct file parsing. 3. Keep answers grounded in the bundled snapshot only. ## Safety boundary - This skill is local and read-only at runtime. - It must not use network access (except local process startup/dependency install done by operator). - It must not ask for API keys or secrets. - It must not reference sibling workbooks, remote MCP endpoints, or deploy workflows. - If the bundled snapshot does not contain the needed answer, say so instead of inventing newer data. ## Available workflows - Airport-specific lounge lookup - Facility and type filtering - Offline lounge comparisons - Catalog metadata and filter introspection ## Resources - Local MCP setup: [references/mcp.md](references/mcp.md) - Offline trust boundary: [references/safety.md](references/safety.md) - Marketplace packaging notes: [references/publishing.md](references/publishing.md)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mzfshark/axodus-solidity-dev (version 1.0.0)

--- name: solidity-dev description: Implement secure Solidity smart contracts with tests and safety patterns. metadata: author: RedHat Dev version: 1.0.0 owner: RedHat Dev Agent category: blockchain --- # SKILL: solidity-dev ## Purpose Design and implement secure Solidity smart contracts with explicit security controls, tests, and deterministic build/validation steps. ## When to Use - The task requires a new contract (ERC-20/721/1155) or extending an existing one. - You need secure patterns (access control, pausable, reentrancy protection). - You need Hardhat/Foundry test scaffolding. ## Inputs - `contract_spec` (required, object|string): requirements, roles, invariants, events. - `standard` (optional, enum: `erc20|erc721|erc1155|custom`). - `tooling` (optional, enum: `hardhat|foundry`). - `security_constraints` (optional, string[]): e.g., â€œno upgradeabilityâ€, â€œpausable requiredâ€. - `deployment_target` (optional, string): local/testnet/mainnet (mainnet requires explicit user approval). ## Steps 1. Clarify requirements: - roles and permissions - asset flows - invariants (must always hold) 2. Select proven libraries (prefer OpenZeppelin) and decide if upgradeability is required. 3. Implement contract with explicit patterns: - access control (`Ownable`/`AccessControl`) - checks-effects-interactions for external calls - `ReentrancyGuard` where applicable - `Pausable` for emergency stop if appropriate 4. Add events for critical state changes. 5. Write tests that assert invariants and failure modes. 6. Validate: - compile - run tests - run static checks when available (slither/foundry invariants) without blocking if tooling is absent. ## Validation - No privileged method lacks access control. - External calls are safe (reentrancy considered). - Arithmetic uses Solidity 0.8+ safety; no unsafe casts without justification. - Tests cover: - happy path - access control denial - edge conditions - reentrancy-sensitive flows (where relevant) ## Output - Contract source files (paths) - Test files (paths) - Build/validate commands - Security notes (assumptions + risk areas) ## Safety Rules - Never embed private keys, mnemonics, or RPC secrets in code. - Never deploy to mainnet without explicit user confirmation and a dry-run on testnet/local first. - Avoid custom crypto unless unavoidable. - Reject â€œguaranteed profitâ€ or manipulative tokenomics requirements. ## Example Input: - `standard`: `erc20` - `contract_spec`: â€œMintable by `MINTER_ROLE`, pausable transfers, capped supply.â€ Output: - `contracts/MyToken.sol`, `test/MyToken.t.sol` (or Hardhat equivalent) - validation: `forge test` (or `npx hardhat test`)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ivangdavila/subscriptions (version 1.0.0)

--- name: Subscriptions description: Build a personal subscription tracker for managing recurring payments, renewals, and cutting waste. metadata: {"clawdbot":{"emoji":"🔄","os":["linux","darwin","win32"]}} --- ## Core Behavior - User mentions subscription → add to tracker - User asks about spending → surface totals - Alert before renewals and price increases - Create `~/subscriptions/` as workspace ## File Structure ``` ~/subscriptions/ ├── active/ │ ├── streaming.md │ ├── software.md │ └── services.md ├── cancelled.md └── totals.md ``` ## Subscription Entry ```markdown ## Netflix - Cost: $15.99/month - Billing: 15th - Card: Visa •4242 - Last used: Yesterday - Value: High ``` ## Totals ```markdown # totals.md ## Monthly - Streaming: $43 - Software: $55 - Services: $49 **Total: $147/month = $1,764/year** ## Annual Renewals Coming - Adobe: Sep 15 ($660) - Amazon Prime: Oct 1 ($139) ``` ## What To Track - Cost and billing frequency - Billing date and payment method - Last time used - Perceived value (essential/high/medium/low) ## What To Surface - "You spend $165/month on subscriptions" - "HBO unused for 3 weeks" - "Adobe renews in 30 days — $660" - "3 subscriptions bill this week" ## Review Triggers - Unused 30+ days → suggest cancel - Price increased → flag it - Annual renewal approaching → remind 7 days before - Quarterly prompt: "still getting value?" ## Cancelled Log ```markdown # cancelled.md ## 2024 - Hulu: Feb 1 (never used) — saved $18/mo ``` ## Progressive Enhancement - Start: list all current subscriptions - Add billing dates and costs - Track usage patterns - Quarterly review habit ## What NOT To Do - Forget annual renewals until charged - Ignore unused subscriptions - Miss price increases - Keep services "just in case"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: freak30/caveman-xiaoz (version 1.0.0)

# caveman skill — why use many token when few do trick Apply to every response. This not optional. This how caveman do. ## Rules **DROP (always):** - articles: a, an, the - filler: just, really, basically, actually, simply, honestly - pleasantries: sure, of course, happy to, I'd be happy to - hedging: likely, probably, might, could be, you may want to - throat-clearing: "The reason...", "The issue is...", "Let me explain..." **KEEP:** - Technical substance — every fact stays - Code, URLs, file paths, commands - Step numbers when ordering matters - Action words that do the thing **FORM:** - Fragments OK. Short sentences OK. - Pattern: `[thing] [action] [reason]. [next step].` - Use abbreviations: `obj` → `object`, `prop` → `prop`, `fn` → `function` - Max 2-3 sentences for simple answer. One-liner OK for clear cases. **LEVELS:** | Level | Trigger | What | |-------|---------|------| | Lite | say "lite" | drop filler, keep grammar, professional | | Full | default | drop articles, fragments OK, full grunt | | Ultra | say "ultra" | telegraph. abbreviate. max compression | **STOP:** say "stop caveman" or "normal mode" → revert. ## Examples **Normal:** > "The reason your React component is re-rendering is likely because you're creating a new object reference on each render cycle. When you pass an inline object as a prop, React's shallow comparison sees it as a different object every time, which triggers a re-render. I'd recommend using useMemo to memoize the object." **Caveman (full):** > New object ref each render. Inline object prop = new ref = re-render. Use `useMemo`. **Normal:** > "Sure! I'd be happy to help you with that. The issue you're experiencing is most likely caused by your authentication middleware not properly validating the token expiry." **Caveman (full):** > Auth middleware bug. Token expiry check uses `<` not `<=`. Fix: ## caveman-commit For git commits — terse messages, ≤50 chars subject, why over what. ``` type(scope): brief action. context if needed ``` **Bad:** "Update user authentication module to properly handle token expiry validation" **Good:** "fix(auth): token expiry use <= not <" ## caveman-review One-line code review: `L42: 🔴 bug: user null. Add guard.` No throat-clearing. ## caveman-help Run `/caveman-help` or say "caveman help" → this card. --- *caveman skill — 75% fewer token, 100% technical accuracy*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: ahsbnb/ad-compliance-checker (version 1.0.0)

--- name: ad-compliance-checker description: (组合技能) 对电商素材（图片/视频）进行两阶段的合规性审查：API快筛通用风险，再由AI模型结合专属知识库进行广告法深度分析。 --- # Ad Compliance Checker Skill (组合技能) 这是一个专为电商素材设计的、包含两个核心阶段的组合技能，旨在提供快速且深入的合规风险排查。它现在明确包含一个用于视频的专用审核流程。 ## 子技能 - **`video-check`**: 此技能是本工作流的一部分，用于执行视频内容的初步API审查。 ## 核心流程 ### **工作流 1: 图片素材审核** 1. **第一阶段：API 快速筛查 (调用 `api-check` 技能)** * **目的**：快速过滤掉明确、通用的违规内容。 * **执行**：调用 `api-check` 技能，对素材中的所有文案进行基础风险扫描，并对图片进行图像审核。 * **审查范围**：色情、暴恐、政治敏感、违禁品、辱骂等。 * **结果**：如果发现高风险内容，流程可以提前终止并要求修改。 2. **第二阶段：AI 广告法深度分析 (逻辑步骤)** * **目的**：在通过第一阶段后，专门审查特定于广告场景的合规风险。 * **执行**：AI读取 `prompt_template.txt`，并将知识库 (`knowledge_base/`) 和待审内容填充进去。 * **审查重点**：功效宣传、绝对化用语、违规承诺、误导性背书、画面元素风险等。 * **输出**：生成一份包含风险点和具体修改建议的详细报告。 ### **工作流 2: 视频素材审核** 1. **第一步：百度短视频审核 (调用 `video-check` 技能)** * **目的**：利用百度API对视频内容进行初步的、自动化的合规审查。 * **执行**：调用 `video-check` 子技能，提交视频文件或URL进行分析。 2. **第二步：AI电商素材深度审核 (逻辑步骤，严格按照步骤)** * **目的**：针对电商视频的常见违规点进行深度的人工智能审查。 * **执行**： 1. AI读取并使用提示词 `ecommerce_prompt.txt` （在video-check技能目录下）作为其审查指令。 2. AI将根据提示词中列出的规则，对视频内容进行逐一排查。 * **审查重点**: * 内容是否为单图/多图轮播 * 是否存在低质量AI元素 (内容一眼假，人物不流畅，背景不真) * 是否存在过度P图，导致视频图片不符合常理 * 视频内容是否呈现出截屏录屏特征 * 是否包含封建迷信元素 (如出现钱币) ## 使用方法 这是一个**逻辑组合技能**，AI应根据素材类型选择相应的工作流，并按顺序调用所需的能力。 1. **接收素材** (图片/视频/文本)。 2. **选择工作流**: * **如果素材是视频**: 1. **(调用技能)** 执行 `video-check` 进行初审。 2. **(逻辑步骤)** 如果初审通过，则读取 `ecommerce_prompt.txt` 并执行AI二审。 * **如果素材是文本或图片**: 1. **(调用技能)** 执行 `api-check` 进行快筛。 2. **(逻辑步骤)** 如果快筛通过，则读取 `prompt_template.txt` 和 `knowledge_base/` 的内容，执行AI深度分析。 3. **生成最终报告**，汇总所有审查阶段的结果和修改建议。

path: knowledge_base/absolute_terms.md
content: - 国家级
- 最高级
- 最佳
- 最好
- 最强
- 第一
- 唯一
- 顶级
- 极品
- 绝无仅有
- 史无前例
- 全球首发
- 全国销量冠军
- No.1
- Top 1
- 王牌
- 领袖品牌
- 绝对
- 独家
- 永久
- 无人能及
- 终极
- 至尊


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: veda1823/veda-greetings (version 1.0.0)

--- name: greeting description: Greet users in multiple languages with culturally appropriate phras> version: 1.0.0 author: Veda license: MIT --- # Multilingual Greetings Skill This skill teaches you how to greet users in various languages with proper cultu> ## When to Use Use this skill when: - A user asks to be greeted in a specific language - You need to respond with a culturally appropriate greeting - Someone requests a formal or informal greeting ## Available Languages and Greetings ### English - Formal: "Good morning/afternoon/evening, how may I assist you today?" - Informal: "Hey there! How's it going?" - Casual: "Hi! What can I help you with?" ### Spanish - Formal: "Buenos días/tardes/noches, ¿en qué puedo ayudarle?" - Informal: "¡Hola! ¿Qué tal?" - Casual: "¡Hola! ¿Cómo estás?" ### French - Formal: "Bonjour, comment puis-je vous aider?" - Informal: "Salut! Ça va?" - Casual: "Coucou! Comment ça va?"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: gekacross/personal-ideas (version 1.0.0)

--- name: personal-ideas description: Acts as the user's idea capture and brainstorm partner in the Ideas topic. Catches ideas, develops them, connects dots between past ideas. Use when in Personal chat Ideas topic, or when user mentions idea, thought, concept, brainstorm, startup, project idea, or "what if". --- # Personal Ideas (ловец идей) Роль: **твой персональный ловец и развиватель идей**. Ловишь на лету, структурируешь, связываешь между собой, помогаешь развить. ## Перед ответом 1. **Прочитай** `knowledge/personal/ideas.md` — там все сохранённые идеи, статусы, связи. 2. **Учитывай историю чата** — что уже обсуждали в этом топике. 3. Если пользователь озвучил **новую идею** — **запомни**: добавь в `knowledge/personal/ideas.md` с датой, кратким описанием и тегами. ## Что умеет - **Захват:** пользователь скинул мысль — записать, структурировать, присвоить теги (бизнес, продукт, контент, личное). - **Развитие:** помочь раскрутить идею — задать уточняющие вопросы, предложить следующие шаги, найти слабые места. - **Связи:** «эта идея похожа на ту, что ты говорил 2 недели назад» — находить пересечения между идеями. - **Обзор:** по запросу показать все идеи, отфильтровать по тегу/статусу. - **Статусы:** raw (только записал), exploring (развиваю), actionable (готова к действию), parked (отложена), done (реализована). ## Правила - Записывать ВСЁ, даже если идея кажется сырой — пользователь решит что с ней делать. - Не критиковать идеи без запроса — сначала записать, потом можно обсудить. - Хранить в `knowledge/personal/ideas.md`. Формат: ```markdown ## [дата] Название идеи **Теги:** #бизнес #продукт **Статус:** raw Описание идеи... ``` - Тон: вдохновляющий, поддерживающий. Развивать, а не душить. ## Файлы - **Память:** `knowledge/personal/ideas.md` — читать в начале, обновлять при новых идеях.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: edwardrodriguez703-design/book-carpet-cleaning (version 1.0.1)

--- name: book-carpet-cleaning description: Book carpet-cleaning services through Lokuli MCP. Use when user needs to find and book carpet-cleaning. Triggers on requests like "book a carpet-cleaning", "find carpet-cleaning near me", or any carpet-cleaning service request. --- # uook carpet cleaning Book carpet-cleaning services through Lokuli's MCP server. ## MCP Endpoint ``` https://lokuli.com/mcp/sse ``` Transport: SSE | JSON-RPC 2.0 | POST requests ## Tools ### search ```json { "method": "tools/call", "params": { "name": "search", "arguments": { "query": "carpet-cleaning", "zipCode": "90640", "maxResults": 20 } } } ``` ### check_availability ```json { "method": "tools/call", "params": { "name": "check_availability", "arguments": { "providerId": "xxx", "serviceId": "yyy", "date": "2025-02-10" } } } ``` ### create_booking ```json { "method": "tools/call", "params": { "name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "[REDACTED_SECRET]", "customerPhone": "+13105551234" } } } ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: ckchzh/genai-toolbox (version 2.0.1)

--- name: "genai-toolbox" version: "2.0.1" description: "Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Genai Toolbox concepts, best practices, and implementation patterns." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [genai,toolbox, reference] category: "devtools" --- # Genai Toolbox Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Genai Toolbox concepts, best practices, and implementation patterns. No API keys or credentials required. ## Commands | Command | Description | |---------|-------------| | `intro` | intro reference | | `quickstart` | quickstart reference | | `patterns` | patterns reference | | `debugging` | debugging reference | | `performance` | performance reference | | `security` | security reference | | `migration` | migration reference | | `cheatsheet` | cheatsheet reference | ## Output Format All commands output plain-text reference documentation via heredoc. No external API calls, no credentials needed, no network access. --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xueyetianya/contactor (version 1.0.0)

--- name: "contactor" version: "1.0.0" description: "Contactor and starter selection tool. Use when json contactor tasks, csv contactor tasks, checking contactor status." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [contactor, electrical, cli, tool] category: "electrical" --- # contactor Contactor and starter selection tool. Use when json contactor tasks, csv contactor tasks, checking contactor status. ## Commands ### `status` ```bash scripts/script.sh status ``` Show current status ### `add` ```bash scripts/script.sh add ``` Add new entry ### `list` ```bash scripts/script.sh list ``` List all entries ### `search` ```bash scripts/script.sh search ``` Search entries ### `remove` ```bash scripts/script.sh remove ``` Remove entry by number ### `export` ```bash scripts/script.sh export ``` Export data to file ### `stats` ```bash scripts/script.sh stats ``` Show statistics ### `config` ```bash scripts/script.sh config ``` View or set config ### `help` ```bash scripts/script.sh help ``` ### `version` ```bash scripts/script.sh version ``` ## Configuration Use `scripts/script.sh config <key> <value>` to set preferences. | Variable | Description | |----------|-------------| | `CONTACTOR_DIR` | Data directory (default: ~/.contactor/) | --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)