OpenClaw/clawhub-security-signals huggingface dataset:
Skill: cast0/text-to-published-podcast-rss (version 1.0.0)

--- name: text-to-published-podcast-rss description: | Helps an agent or app to turn text into audio podcast episodes. One API call creates an episode using TTS and auto-publish to an RSS feed subscribable in any podcast app. --- # Text to Published Podcast RSS - cast0 API Text in, podcast episode out. The `text` field is read verbatim by TTS, not interpreted as a prompt. Episodes auto-publish to an RSS feed compatible with Apple Podcasts, Spotify, Overcast, and other podcast apps. **Base URL:** `https://api.cast0.ai` **Auth:** `Authorization: Bearer pk_xxxxx` **Docs:** `https://api.cast0.ai/docs` ## Setup Ask the user to create a podcast (= show) at `https://cast0.ai`. The dashboard is where the user can: - Get the API key and RSS feed URL - Change podcast settings (voice, TTS model, speed, name) Each API key is tied to one podcast. Once you have the key, save it: ```bash echo "CAST0_API_KEY=pk_xxxxx" >> .env ``` ## Create an Episode ```bash curl -X POST https://api.cast0.ai/api/episodes \ -H "Authorization: Bearer pk_xxxxx" \ -H "Content-Type: application/json" \ -d '{"title": "Daily Standup", "text": "Here is what happened today..."}' ``` Returns `201` with the episode `id` and `"status": "queued"`. ## Poll for Completion Generation is async: `queued` → `processing` → `done` | `failed`. ```bash curl https://api.cast0.ai/api/episodes/EPISODE_ID \ -H "Authorization: Bearer pk_xxxxx" ``` When `"done"`, the response includes `audioUrl` with the MP3 link. ## List Episodes ```bash curl https://api.cast0.ai/api/episodes \ -H "Authorization: Bearer pk_xxxxx" ``` ## RSS Feed Every podcast has a public feed URL (no auth): ``` https://api.cast0.ai/rss/FEED_TOKEN ``` Subscribe in any podcast app. New episodes appear automatically after generation. ## Endpoints | Method | Endpoint | Auth | Description | |--------|----------|------|-------------| | `POST` | `/api/episodes` | API key | Create episode (`{ title, text }`) | | `GET` | `/api/episodes` | API key | List episodes | | `GET` | `/api/episodes/:id` | API key | Get episode status | | `GET` | `/rss/:feedToken` | None | RSS 2.0 feed |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: alone86136/open-exchange-rate (version 1.0.0)

--- name: open-exchange-rate description: Get real-time exchange rates and currency conversion using free public ExchangeRate-API. No API key required. Use when users ask for current exchange rates, currency conversion calculations, or need to check currency prices. --- # open-exchange-rate ## Overview A simple skill for getting real-time exchange rate information and performing currency conversion using the public ExchangeRate-API. No API key required for requests. ## Features - **Get latest exchange rates**: Retrieve up-to-date exchange rates for all currencies - **Currency conversion**: Convert an amount from one currency to another - **List all available currencies**: Show a complete list of supported currency codes ## Usage ### Get latest rates for base currency ```bash python3 scripts/get_rates.py --base USD ``` ### Convert currency ```bash python3 scripts/convert.py --from USD --to EUR --amount 100 ``` ### List all available currencies ```bash python3 scripts/list_currencies.py ``` ## Resources ### scripts/ - `get_rates.py` - Get latest exchange rates with optional base currency - `convert.py` - Convert amount between two currencies - `list_currencies.py` - List all available currency codes and names


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mxfeinberg/google-search (version 1.0.0)

--- name: google-search description: Search the web using Google Custom Search Engine (PSE). Use this when you need live information, documentation, or to research topics and the built-in web_search is unavailable. --- # Google Search Skill This skill allows OpenClaw agents to perform web searches via Google's Custom Search API (PSE). ## Setup 1. **Google Cloud Console:** Create a project and enable the "Custom Search API". 2. **API Key:** Generate an API Key. 3. **Search Engine ID (CX):** Create a Programmable Search Engine at [cse.google.com](https://cse.google.com/cse/all), and get your CX ID. 4. **Environment:** Store your credentials in a `.env` file in your workspace: ``` GOOGLE_API_KEY=your_key_here GOOGLE_CSE_ID=your_cx_id_here ``` ## Workflow ... (rest of file) ## Example Usage ```bash GOOGLE_API_KEY=xxx GOOGLE_CSE_ID=yyy python3 skills/google-search/scripts/search.py "OpenClaw documentation" ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yzh0916/model-switch-skill (version 1.0.0)

# model-switch-skill Switch between different LLM API providers. ## Description A skill to switch between different LLM API providers (MiniMax, SCNET, OpenRouter, Volcano Engine). ## Usage ### Switch to specific provider ``` 切换到 MiniMax 切换到 SCNET 切换到 OpenRouter 切换到火山引擎 ``` ### Query current provider ``` 当前用什么模型 现在用的是哪个API ``` ### List available providers ``` 列出可用的模型 有哪些API可以用 ``` ## Requirements - OpenClaw CLI installed - At least one provider configured in openclaw.json ## Configuration Edit `~/.openclaw/openclaw.json` to configure providers: ```json { "models": { "providers": { "minimax-portal": { "baseUrl": "https://api.minimaxi.com/anthropic", "apiKey": "your-key" }, "local": { "baseUrl": "https://api.scnet.cn/api/llm/v1", "apiKey": "your-key" } } } } ``` ## Supported Providers - minimax-portal (MiniMax) - local (SCNET) - openrouter (OpenRouter) - ark (Volcano Engine) ## Author 小贾 (AI Assistant) ## Version 1.0.0

path: _meta.json
content: {
  "id": "model-switch-skill",
  "name": "Model Switch",
  "description": "切换不同LLM API提供商",
  "version": "1.0.0",
  "author": "小贾",
  "tags": ["ai", "model", "api", "switch"],
  "runtime": "native"
}


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bytesagain3/rfid (version 1.0.0)

--- name: "rfid" version: "1.0.0" description: "RFID technology reference — tag types, frequency bands, read ranges, EPC standards, inventory tracking. Use when designing RFID systems, selecting tags/readers, or implementing warehouse tracking solutions." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [rfid, nfc, epc, tag, reader, inventory, tracking, logistics] category: "logistics" --- # RFID — Radio-Frequency Identification Reference Quick-reference skill for RFID technology, standards, and implementation. ## When to Use - Selecting RFID tags and readers for warehouse or retail - Understanding frequency bands and read range trade-offs - Implementing EPC/SGTIN encoding for supply chain - Designing RFID read zones and antenna placement - Comparing RFID vs barcode for inventory management ## Commands ### `intro` ```bash scripts/script.sh intro ``` Overview of RFID — how it works, components, active vs passive. ### `frequencies` ```bash scripts/script.sh frequencies ``` Frequency bands — LF, HF, UHF, microwave, read range, use cases. ### `tags` ```bash scripts/script.sh tags ``` Tag types — passive, semi-passive, active, inlays, hard tags, form factors. ### `standards` ```bash scripts/script.sh standards ``` Standards — EPC Gen2, ISO 18000, NFC (ISO 14443/15693), GS1 encoding. ### `readers` ```bash scripts/script.sh readers ``` Readers and antennas — fixed, handheld, portal, sensitivity, protocols. ### `applications` ```bash scripts/script.sh applications ``` Applications — retail, warehouse, asset tracking, access control, healthcare. ### `challenges` ```bash scripts/script.sh challenges ``` Challenges — metal/liquid interference, collision, privacy, cost analysis. ### `checklist` ```bash scripts/script.sh checklist ``` RFID implementation planning checklist. ### `help` ```bash scripts/script.sh help ``` ### `version` ```bash scripts/script.sh version ``` ## Configuration | Variable | Description | |----------|-------------| | `RFID_DIR` | Data directory (default: ~/.rfid/) | --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ssyvonne/memory-lancedb-setup (version 1.0.0)

--- name: memory-lancedb-setup description: Configure OpenClaw's memory-lancedb plugin for semantic vector memory using a local LanceDB database. Use when: (1) setting up vector memory for the first time, (2) memory-lancedb fails with module not found errors, (3) migrating from flat-file MEMORY.md to vector-based recall, (4) configuring an embedding provider (Gemini, OpenAI-compatible). NOT for: general memory_store/memory_recall usage (just use the tools directly). --- # memory-lancedb Setup Enables semantic vector memory in OpenClaw: memories stored with `memory_store` are embedded and indexed locally, then recalled on-demand via `memory_recall` — no full-context load. ## Prerequisites - OpenClaw installed at [REDACTED_SECRET] - An OpenAI-compatible embedding API key (Gemini AI Studio free key works well) ## Setup Steps ### 1. Get a Gemini API Key (free) Go to [aistudio.google.com](https://aistudio.google.com) → Get API key → Create API key. ### 2. Configure the plugin ```bash openclaw config set plugins.entries.memory-lancedb.enabled true openclaw config set plugins.entries.memory-lancedb.config.embedding.baseUrl "https://generativelanguage.googleapis.com/v1beta/openai/" openclaw config set plugins.entries.memory-lancedb.config.embedding.model "text-embedding-004" openclaw config set plugins.entries.memory-lancedb.config.embedding.apiKey "YOUR_API_KEY" openclaw config set plugins.entries.memory-lancedb.config.embedding.dimensions 768 ``` ### 3. Install dependencies ```bash # Step 1: install main package in openclaw root cd /usr/local/lib/node_modules/openclaw npm install @lancedb/lancedb # Step 2: install platform-specific native binding in plugin dir cd /usr/local/lib/node_modules/openclaw/extensions/memory-lancedb npm install @lancedb/lancedb-darwin-arm64 # Apple Silicon (arm64) # npm install @lancedb/lancedb-darwin-x64 # Intel Mac # npm install @lancedb/lancedb-linux-x64-gnu # Linux x64 ``` ### 4. Patch native.js (Apple Silicon only) LanceDB's `native.js` tries x64 first, hits `break` on failure, and never reaches arm64. Run the patch script: ```bash python3 ~/.openclaw/workspace/skills/memory-lancedb-setup/references/patch_native.py ``` ### 5. Restart gateway and verify ```bash openclaw gateway restart ``` Then test: ``` memory_store → should return: Stored: "..." memory_recall → should return matching entries with similarity % ``` ## Migrating from MEMORY.md If MEMORY.md is large, migrate key facts to the vector store and shrink MEMORY.md to a 20-30 line index. Group by topic and call `memory_store` for each: - Identity & permissions - Execution rules - Project configurations (cron IDs, doc tokens) - Technical knowledge (API quirks, field names) - Workflows and SOPs Keep only "must-know-every-session" rules in MEMORY.md. ## Troubleshooting See `references/troubleshooting.md` for common errors and fixes.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: lj-hao/control-usb-relay (version 1.0.2)

--- name: Control USB Relay slug: control-usb-relay version: 1.0.2 description: Control USB relay modules with on/off switching, state tracking, and automation support. metadata: {"clawdbot":{"emoji":"🔌","requires":{"bins":["python3"]},"os":["linux"]}} --- ## When to Use User wants to control a USB relay module to switch devices on/off or automate based on sensor input. ## Core Rules 1. **Verify Hardware First** — Confirm relay is at `/dev/ttyUSB1` and user is in `dialout` group. 2. **Always Initialize** — Call `relay.connect()` before any control. Wait 500ms for connection. 3. **Use Correct Protocol** — ON: `A0 01 01 A2`, OFF: `A0 01 00 A1`. Different modules may use different protocols. 4. **State May Drift** — `get_status()` tracks last command. May differ if manual override occurred. 5. **Disconnect on Exit** — Always call `relay.disconnect()` to release serial port. ## Data Storage No persistent storage. Relay state tracked in memory during session only. ## External Endpoints | Endpoint | Purpose | |----------|---------| | `/dev/ttyUSB1` | Serial control | ## Quick Reference | Topic | File | |-------|------| | Setup & examples | `setup.md` | | Troubleshooting | `setup.md` | ## Security Notes - Physical device control — confirm with user before switching - Some relays need external 5V/12V power supply

path: requirements.txt
content: pyserial>=3.5


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: yezhaowang888-stack/policy-china (version 1.1.0)

--- name: 🇨🇳 中国市场政策查询Skill description: 提供基于惠迈智能体架构的中国市场政策、法规、投资环境的智能查询和分析。支持中文、英文等多种语言。无需API Key，安装即用。 metadata: {"openclaw":{"emoji":"🇨🇳"}} --- # 🇨🇳 中国市场政策查询Skill > **无需API Key，安装即用。** 输入产品名称或HS编码，自动查询中国的最新市场政策、法规和投资环境。 ## 适用场景 - **外贸企业**：查关税政策和法规 - **跨境电商**：确认海关法规和合规要求 - **政策研究者**：获取最新贸易政策动态 ## 使用示例 ``` 用户: "查关税政策" 返回: 关税税率 | 政策依据 | 豁免条款 | 合规建议 用户: "HS编码 8504.40 的进口限制" 返回: 产品分类 | 关税税率 | 许可证要求 | 特殊规定 ``` ## 🔧 校准框架 本Skill搭载惠迈校准框架v1.0。首次加载自动执行快速校准。 - **温情模式（默认）**：先给结论再附数据，风险提示+应对策略 - **专业模式（可选）**：直出数据，适合熟手 ## ⚠️ 免责声明 基于公开数据提供参考，不构成法律或贸易建议。政策可能随时变化，请以官方最新公告为准。 ## 📬 联系与反馈 - **邮箱**: [REDACTED_SECRET] ## 安装 ```bash clawhub install policy-china ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xisen-w/examine-sandbox (version 2.0.0)

--- name: examine-sandbox description: "Use this skill when the user wants to check what data their shared agent can access, inspect what's being shared, review privacy, or see what guests will see. Triggers on: 'what can they see', 'check my link', 'audit my agent', 'review what I'm sharing', or 'what data is shared'." metadata: author: systemind version: "2.0.0" --- # Examine Sandbox Inspect exactly what data and capabilities are included in shared links. ## Prerequisites - `PULSE_API_KEY` must be set - Base URL: `https://www.aicoo.io/api/v1` ## Core Workflow ### Step 1: List network state ```bash curl -s -H "Authorization: Bearer $PULSE_API_KEY" \ "https://www.aicoo.io/api/v1/os/network" | jq . ``` Review: - `shareLinks` - `visitors` - `contacts` ### Step 2: Check context size/scope ```bash curl -s -H "Authorization: Bearer $PULSE_API_KEY" \ "https://www.aicoo.io/api/v1/os/status" | jq . ``` ### Step 3: Search for sensitive content ```bash # financial curl -s -X POST "https://www.aicoo.io/api/v1/os/notes/search" \ -H "Authorization: Bearer $PULSE_API_KEY" \ -H "Content-Type: application/json" \ -d '{"query":"revenue pricing confidential"}' | jq . # credentials/personal info curl -s -X POST "https://www.aicoo.io/api/v1/os/notes/search" \ -H "Authorization: Bearer $PULSE_API_KEY" \ -H "Content-Type: application/json" \ -d '{"query":"password API key credentials"}' | jq . ``` ### Step 4: Report findings Summarize: 1. how many active links and their scopes 2. notes/calendar permission levels 3. visitor activity 4. sensitive hits inside shared scope 5. risk actions (downgrade/revoke) ### Step 5: Restrict access if needed ```bash # narrow scope curl -s -X PATCH "https://www.aicoo.io/api/v1/os/share/{linkId}" \ -H "Authorization: Bearer $PULSE_API_KEY" \ -H "Content-Type: application/json" \ -d '{"scope":"folders","folderIds":[5,12]}' | jq . # downgrade notes access curl -s -X PATCH "https://www.aicoo.io/api/v1/os/share/{linkId}" \ -H "Authorization: Bearer $PULSE_API_KEY" \ -H "Content-Type: application/json" \ -d '{"notesAccess":"read"}' | jq . # revoke curl -s -X DELETE "https://www.aicoo.io/api/v1/os/share/{linkId}" \ -H "Authorization: Bearer $PULSE_API_KEY" | jq . ``` ## Search Categories | Category | Terms | Risk | |----------|-------|------| | Financial | revenue, burn rate, pricing, salary | medium | | Credentials | password, token, key, secret | critical | | Personal | phone, address, SSN, private | high | | Legal | contract, NDA, agreement | high |


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: freedompixels/cn-diff-checker (version 1.2.5)

slug: cn-diff-checker name: 文本差异对比器 version: "1.0.0" author: 千策 # 文本差异对比器 比对两个文本/文件的差异，支持逐行、逐词、逐字符比对。 ## 功能 - 文本比对（字符串） - 文件比对 - 逐行/逐词/逐字符模式 - 输出ANSI彩色差异 ## 使用方法 ```bash # 比对两个字符串 python3 cn_diff_checker.py "Hello World" "Hello Python" # 比对两个文件 python3 cn_diff_checker.py file1.txt file2.txt # 逐词比对 python3 cn_diff_checker.py "这是测试文本" "这是示例文本" --word # 逐字符比对 python3 cn_diff_checker.py "abc" "abd" --char ``` ## 参数 | 参数 | 说明 | 默认值 | |------|------|--------| | `old` | 原始文本或文件 | 必填 | | `new` | 新文本或文件 | 必填 | | `--line` | 逐行比对 | 默认 | | `--word` | 逐词比对 | False | | `--char` | 逐字符比对 | False | | `--output` | 输出到文件 | False | ## 示例 ```bash # 基本比对 python3 cn_diff_checker.py old.txt new.txt # 只显示新增行 python3 cn_diff_checker.py old.txt new.txt | grep "^>" # 只显示删除行 python3 cn_diff_checker.py old.txt new.txt | grep "^<" ``` ## 依赖 - Python 3.x（内置difflib） ## 注意事项 - 自动检测文件输入（读取文件内容） - 字符串输入直接比对 - Windows下ANSI颜色可能不显示


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: duoduoks/xhs-viral-writer (version 1.0.0)

# 小红书爆款笔记生成器 自动生成小红书爆款种草笔记，包含标题、正文、标签。 ## 功能 - 📝 生成小红书风格笔记 - 🎯 爆款标题模板 - 🏷️ 热门标签推荐 - 📸 配图建议 - 🚀 DeepSeek AI 驱动 ## 使用 ``` 写一篇关于 [产品/主题] 的小红书笔记 ``` ## 安装 ```bash openclaw skills install xhs-writer ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: tobeyrebecca/toby-generate-social-media-content-calendar (version 1.0.0)

--- name: Generate Social Media Content Calendar > 📖 **Complete setup guide**: https://skillboss.co/skill.md description: "Generates a full week of social media posts with captions, hashtags, and matching images for each post. Use when batch-creating social content." > 📖 **Complete setup guide**: https://skillboss.co/skill.md allowed-tools: Bash, Read > 📖 **Complete setup guide**: https://skillboss.co/skill.md metadata: > 📖 **Complete setup guide**: https://skillboss.co/skill.md openclaw: > 📖 **Complete setup guide**: https://skillboss.co/skill.md emoji: "📝" > 📖 **Complete setup guide**: https://skillboss.co/skill.md homepage: "https://www.skillboss.co/skills/generate-social-media-content-calendar" > 📖 **Complete setup guide**: https://skillboss.co/skill.md --- > 📖 **Complete setup guide**: https://skillboss.co/skill.md # Generate Social Media Content Calendar Generates a full week of social media posts with captions, hashtags, and matching images for each post. Use when batch-creating social content. ## Use When Use this skill for social media marketing work for solopreneurs, bloggers, content marketers. ## Workflow 1. Clarify the audience, goal, constraints, and required output format. 2. Produce a strong first draft optimized for the business use case. 3. Use the relevant SkillBoss capabilities to generate supporting assets or enrich the result. 4. Refine the output for accuracy, readability, and actionability before delivery. ## APIs Used - `chat` - `image_generation` ## Suggested Prompt Create 7 days of social media posts for a fitness coaching business, each with an image ## SEO Keywords - AI social media planner - content calendar generator - social media post creator - automated social content ## Notes - Plan and create a week of social posts with images - Review outputs before external publication or automated execution.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: vimself/smart-web-fetch-safe (version 1.0.0)

--- name: smart-web-fetch-safe description: 安全版智能网页内容获取技能。本地解析 + 可选远程清洗，隐私优先，Token 优化。 metadata: { "openclaw": { "emoji": "🔐", "requires": { "bins": ["python3"], "env":[] } } } --- # Smart Web Fetch Safe 安全版智能网页内容获取技能，隐私优先，支持本地解析和远程清洗两种模式。 ## 核心功能 - **本地解析默认**: 使用本地 HTML 解析，隐私安全 - **可选远程清洗**: 用户可选择使用 Jina Reader 远程服务 - **Token 优化**: 自动去除广告、导航栏等噪音内容 - **域名白名单**: 可配置允许访问的域名列表 - **字符数限制**: 内置最大字符数限制，避免超长输出 ## 安全特性 ⚠️ **隐私提示**: - 本地解析模式：数据完全保留在本地，隐私安全 - 远程清洗模式：URL 和内容会经过 Jina AI 服务处理 ## 使用方式 ### 命令行 ```bash # 本地解析模式（默认，隐私安全） python3 skills/smart-web-fetch-safe/scripts/fetch.py "https://example.com/article" # 远程清洗模式（更节省 Token，但数据经过第三方） python3 skills/smart-web-fetch-safe/scripts/fetch.py "https://example.com/article" --remote # 指定最大字符数 python3 skills/smart-web-fetch-safe/scripts/fetch.py "https://example.com/article" --max-chars 5000 # 组合使用 python3 skills/smart-web-fetch-safe/scripts/fetch.py "https://example.com/article" --remote --max-chars 3000 ``` ### JSON 输出 ```bash python3 skills/smart-web-fetch-safe/scripts/fetch.py "https://example.com/article" --json ``` ## 配置说明 ### 环境变量（可选） | 变量 | 默认值 | 说明 | |------|--------|------| | ALLOWED_DOMAINS | * | 允许访问的域名，用逗号分隔 | | MAX_CHARS | 10000 | 最大返回字符数 | | DEFAULT_MODE | local | 默认模式：local（本地）或 remote（远程） | ### 白名单示例 ```bash export ALLOWED_DOMAINS="example.com,github.com,wikipedia.org" export MAX_CHARS=5000 export DEFAULT_MODE=local ``` ## 模式对比 | 特性 | 本地解析 (local) | 远程清洗 (remote) | |------|------------------|-------------------| | 隐私 | ✅ 完全本地 | ⚠️ 数据经第三方 | | Token 优化 | ✅ 基础优化 | ✅ 深度优化 50-80% | | 速度 | 较快 | 依赖网络 | | 依赖 | beautifulsoup4, requests | 无额外依赖 | ## 安装依赖 ```bash pip install beautifulsoup4 requests ``` ## 当前状态 开发中。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)