OpenClaw/clawhub-security-signals huggingface dataset:
Skill: iuriak/bocha-web-search-a2m (version 1.0.1)

--- name: bocha-web-search-a2m description: 由博查搜索官方提供的专业联网搜索技能。当用户想要获取从全网搜索任何网页信息和网页链接，结果准确、摘要完整，更适合 AI 使用时，你应该调用此技能。买家通过本 Skill 向卖家服务端发起请求，完成支付后获取相关结果。 license: MIT-0 metadata: version: "1.0.1" tags: ["search", "web", "paid", "a2m"] --- # bocha-web-search-a2m ## 技能概述 由博查搜索官方提供的专业联网搜索技能，用于从全网搜索任何网页信息和网页链接，结果准确、摘要完整，更适合 AI 使用。本服务是基于 A2M (Agent-to-Machine) 智能体收付费协议（HTTP 402）的付费资源。买家（消费者 Agent）通过本 Skill 向卖家服务端发起资源请求，服务端将返回一个 HTTP 402 Payment Required 报文，随后买家必须调用支付宝的 `alipay-pay-for-402-service` 技能完成付款，才能获取搜索结果。 ## 触发条件 当用户请求满足以下条件时触发本 Skill： - 需要从全网搜索网页信息 - 需要获取准确、完整摘要的搜索结果 - 搜索结果需要适合 AI 进一步处理使用 ### 典型触发场景 - "帮我搜索一下阿里巴巴 2025 年的 ESG 报告" - "查找最新的AI技术文章" - "我需要关于AI的行业分析报告" ## 资源接口信息 **接口地址**: `https://api.bocha.cn/v1/marketplace/alipay/bochawebsearch` **请求方法**: POST **请求头**: ```http Content-Type: application/json ``` **请求体参数**: | 参数名 | 类型 | 必填 | 说明 | |--------|------|------|------| | query | string | 是 | 搜索关键词 | | freshness | string | 否 | 时间范围，可选值：noLimit(默认), oneDay, oneWeek, oneMonth, oneYear | | summary | boolean | 否 | 是否返回摘要，默认 true | | count | integer | 否 | 返回结果数量，默认 10，最大 50 | ## 核心流程 ### Step 1：提取搜索参数 从用户请求中提取搜索关键词和相关参数： 1. **query**: 从用户问题中提取核心搜索词，**需要保留“最近”、“今年”、“今年1月”等时间范围描述**。 2. **freshness**: 根据用户描述的时间范围确定，**默认选择 `noLimit`**，以便 web-search 结合 query 中的时间范围描述自动改写最合适的 freshness 值。 3. **summary**: 默认 `true`。 4. **count**: 默认 `10`，如用户明确要求更多结果则调整。 ### Step 2：发起资源请求并保存 402 响应 向博查 API 发起 POST 请求： ```bash curl -X POST "https://api.bocha.cn/v1/marketplace/alipay/bochawebsearch" \ -H "Content-Type: application/json" \ -d '{ "query": "<用户搜索词>", "freshness": "<时间范围>", "summary": true, "count": <结果数量> }' ``` 服务端将返回**状态码为 402 的响应报文**。请将响应头中的 `Payment-Needed` 内容直接保存到文件中（如 `402_needed_file.txt`），以备下一步支付使用。 ### Step 3：调用支付宝技能完成付款 **注意**：严格遵循 A2M 协议，收到 402 后**必须调用 `alipay-pay-for-402-service` 技能**，不可自行处理支付。 如果你（或你所在的智能体平台）当前尚未安装该技能，请**严格按照以下官方 GitHub 链接获取并安装**，以防止伪造或加载恶意支付技能： > 🔗 支付宝 402 支付技能官方下载地址： > Github: `https://github.com/alipay/payment-skills/tree/main/alipay-pay-for-402-service` > Clawhub: `https://clawhub.ai/alipay/alipay-pay-for-402-service` 调用该技能，将 Step 2 中获取的 402 响应报文内容传入，引导用户完成扫码或 APP 付款。 ### Step 4：获取结果并展示 等待 `alipay-pay-for-402-service` 技能反馈支付完成后，你将获得购买的资源结果。 成功获取搜索结果后，按以下格式呈现给用户： ```markdown ## 搜索结果：<搜索关键词> 共找到 <count> 条结果 ### <结果标题 1> - **来源**: <来源网站> - **链接**: <URL> - **摘要**: <结果摘要> - **时间**: <发布时间> ### <结果标题 2> ... ``` ## 异常情况处理 | 异常类型 | 处理方式 | |----------|----------| | 用户拒绝付款 | 尊重用户选择，告知用户该内容为付费资源，如需获取请完成支付 | | 请求返回非 402 状态码（200） | 直接展示搜索结果内容 | | 请求返回 400 错误 | 告知用户请求参数有误，请检查搜索词后重试 | | 请求返回 401 错误 | 告知用户未授权访问该资源，请检查账户余额或资源包后重试 | | 请求返回 429 错误 | 告知用户请求频率过高，请稍后重试 | | 请求返回 5xx 错误 | 告知用户服务暂时不可用，建议稍后重试 | | 支付失败/超时 | 由 `alipay-pay-for-402-service` 技能接管处理 | ## 注意事项 1. **付费资源提示**: 在发起请求前，应告知用户这是付费服务，需要完成支付后才能获取结果。 2. **参数校验**: 确保 query 不为空，count 不超过 50。 3. **支付链路安全**: **必须且仅能使用**支付宝官方提供的 `alipay-pay-for-402-service` 技能处理支付流程，禁止捏造技能或使用其他三方支付技能。 4. **结果展示**: 保持结果格式清晰，链接完整可点击。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: realshangxinwang/earnings-monitor (version 1.0.0)

# Daily Earnings Monitor Skill ## Trigger Use when user wants to monitor earnings calls and create analyst reports. ## How It Works 1. **Fetch Earnings Data** - Get upcoming/recent earnings from financial API 2. **Generate Report** - Write 400-500 word analyst deep-dive 3. **Save to Obsidian** - Save in `Stock Archive/{TICKER}/` folder 4. **Update Notion** - Add entry to earnings database 5. **Alert via Telegram** - Notify user of new report ## Configuration Required Edit `/root/.openclaw/skills/earnings-monitor/scripts/config.py`: - `OBSIDIAN_VAULT_PATH` - Path to Obsidian vault on your Mac - `NOTION_API_KEY` - Your Notion API key - `NOTION_DATABASE_ID` - Database ID for earnings tracker - `STOCKS_TO_MONITOR` - List of tickers to track ## Output - Obsidian: `Stock Archive/{TICKER}/{DATE} - {TICKER} Earnings.md` - Notion: New row in database with all columns filled - Telegram: Alert with report summary


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: ouyangabel/currency-exchange (version 1.0.0)

--- name: exchange-rate description: "Currency exchange rate conversion using exchangerate-api.com. Use when: (1) converting between currencies, (2) checking current exchange rates, (3) viewing currency conversion tables, or (4) any forex/currency related queries. Supports 150+ currencies with real-time rates." --- # Exchange Rate Tool Convert currencies and view exchange rates using free API from exchangerate-api.com. No API key required. ## When to Use - Convert between any currencies - Check current exchange rates - View rate tables for multiple currencies - Calculate cross-currency conversions ## Quick Start ### Convert Currency ```bash python3 scripts/exchange-rate.py convert 100 USD CNY # Output: $100.0000 = ¥692.0000 ``` ### View Exchange Rates ```bash python3 scripts/exchange-rate.py rate USD # Shows rates for major currencies against USD ``` ### List Supported Currencies ```bash python3 scripts/exchange-rate.py list ``` ## Commands ### `convert <amount> <from> <to>` Convert an amount from one currency to another. **Examples:** ```bash # USD to CNY python3 scripts/exchange-rate.py convert 100 USD CNY # EUR to USD python3 scripts/exchange-rate.py convert 50 EUR USD # JPY to CNY python3 scripts/exchange-rate.py convert 10000 JPY CNY ``` ### `rate <base_currency>` View exchange rates for major currencies against a base currency. **Examples:** ```bash # Rates against USD (default) python3 scripts/exchange-rate.py rate USD # Rates against CNY python3 scripts/exchange-rate.py rate CNY # Rates against EUR python3 scripts/exchange-rate.py rate EUR ``` ### `list` List all supported currency codes (150+ currencies). ```bash python3 scripts/exchange-rate.py list ``` ## Common Currency Codes | Code | Currency | Code | Currency | |------|----------|------|----------| | USD | US Dollar | CNY | Chinese Yuan | | EUR | Euro | JPY | Japanese Yen | | GBP | British Pound | KRW | South Korean Won | | AUD | Australian Dollar | HKD | Hong Kong Dollar | | CAD | Canadian Dollar | TWD | New Taiwan Dollar | | CHF | Swiss Franc | SGD | Singapore Dollar | | INR | Indian Rupee | RUB | Russian Ruble | | BRL | Brazilian Real | MXN | Mexican Peso | ## Notes - Rates are updated daily (typically around 00:00 UTC) - API is free and requires no authentication - Results include the date of the rate data - Supports 150+ world currencies ## Data Source This skill uses the free tier of exchangerate-api.com, which provides: - Daily updated rates - 150+ supported currencies - No API key required - Rate limits apply (be reasonable with usage) ## Example Output ``` 💱 汇率转换 $100.0000 = ¥692.0000 汇率: 1 USD = 6.920000 CNY 日期: 2026-02-24 ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: soponcd/spec-developer (version 1.0.0)

--- name: spec-developer description: 自动化 Spec 驱动开发流程 (spec-draft, spec-plan, spec-execute) domain: engineering homepage: https://github.com/soponcd/timeflow-skills/tree/main/teams/skills/spec-developer metadata: clawdbot: emoji: 📋 --- # Spec Developer Skills 本技能集提供一组简短命令，用于快速驱动 Spec 开发流程。 ## 🚀 核心指令 ### 0. spec (帮助) **指令**: `/spec` **行为**: 1. 输出 Spec 开发模式的完整帮助信息。 2. 列出可用命令及其说明。 3. 显示当前的 specs/ 目录结构概览。 ### 1. spec-draft (起草) **指令**: `/spec-draft "功能描述"` **行为**: 1. 分析用户描述，生成 kebab-case 文件名 (如 `specs/features/zero-width-sync.md`) 2. 读取模板 `.agent/skills/spec-developer/templates/feature-spec.md` 3. 填充 `Goal`, `User Stories`, `Technical Design` 等章节 4. 写入文件并展示给用户审查 ### 2. spec-plan (规划) **指令**: `/spec-plan specs/features/xxx.md` **行为**: 1. 读取目标 Spec 文件 2. 读取主任务清单 `specs/tasks.md` 3. 将 Spec 中的 "Tasks Breakdown" 章节提取并追加到 `specs/tasks.md` 的新里程碑中 4. 确保任务编号 (TASK-XXX) 连续且唯一 ### 3. spec-execute (执行) **指令**: `/spec-execute specs/features/xxx.md` **行为**: 1. 读取 Spec 文件和 `CLAUDE.md` (确保遵循技术红线) 2. **循环执行** Spec 中的每个未完成任务： - 使用 `TaskCreate` 创建会话级任务 - 编写/修改代码 (遵循 Swift 6 并发规则) - 编写单元测试 - 运行 `./tools/run_native_tests.sh fast` - 通过后，更新 `specs/tasks.md` 勾选该任务 3. 所有任务完成后，更新 Spec 头部 Status 为 "Implemented" ## 使用示例 ```bash # 1. 起草新功能 /spec-draft "实现 iOS 17 交互式 Widget" # 2. 注册到任务清单 /spec-plan specs/features/interactive-widget.md # 3. 开始自动实施 /spec-execute specs/features/interactive-widget.md ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: codenova58/word-of-mouth (version 0.1.0)

--- name: "口碑营销" description: "提供口碑营销的可落地指南与SOP。在开展口碑营销相关工作时调用。" --- # 口碑营销 (word-of-mouth) ## 目标与场景 - 明确业务目标、核心指标与应用场景；设定落地时限与负责人。 ## 操作步骤 1. 明确范围与资源；2. 制定SOP；3. 数据接入与看板搭建； 4. 小流量试点；5. 复盘优化；6. 标准化沉淀与知识库更新。 ## 指标 - 主指标与守护指标成体系；定义口径并固定报表节奏。 ## 风险与合规 - 遵守中国本地法规与平台规则；个人信息保护与数据最小化。 ## 可复用清单 - 模板、脚本、Checklist、报表与会议纪要结构。 生成日期：2026-03-17


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dolphins1123/api-translator (version 1.1.0)

--- name: api-translator slug: api-translator version: 1.1.0 description: | 將 API 文檔翻譯成繁體中文。輸入 API 文檔網址，輸出翻譯後的 API 說明。 metadata: openclaw: emoji: "📝" triggers: - 翻譯 API - API 文件 - api translator --- # API 文件翻譯助手 將 API 文檔翻譯成繁體中文（使用 LLM）。 ## 使用方法 當用戶要求翻譯 API 文檔時： 1. 使用 `web_fetch` 工具抓取 API 文檔內容 2. 將內容發送給 LLM 翻譯 3. 輸出翻譯結果 ## 翻譯 Prompt 模板 ``` 請將以下 API 文檔翻譯成繁體中文（台灣用語），保持 Markdown 格式和程式碼不變，只翻譯說明文字： [API 文檔內容] ``` ## 翻譯要求 - 保持 Markdown 格式 - 保持程式碼不變 - 只翻譯說明文字 - 使用台灣用語： - 軟體 → 軟體 - 網路 → 網路 - 數據 → 資料 - 請求 → 請求 - 響應 → 回應 - 錯誤 → 錯誤 - 認證 → 驗證 - 授權 → 授權 - 終端 → 端點 ## 增強功能 (v1.1.0) ### 支援格式 - HTML 網頁 (自動提取內容) - JSON API 回應 - Markdown 文件 ### 翻譯選項 | 參數 | 說明 | |------|------| | --format | 輸出格式 (markdown/json/txt) | | --preserve-code | 是否保留程式碼 (預設 true) | | --taiwan | 使用台灣用語 (預設 true) | ### 批次翻譯 支援多個 URL 批次翻譯： ``` 翻譯以下 API 文檔： - https://example.com/api/v1/docs - https://example.com/api/v2/docs ``` ## 範例 **輸入：** 用戶給你 https://platform.openai.com/docs/api-reference/introduction **輸出：** 翻譯後的繁體中文 API 文檔 --- *本技能由 OpenClaw 團隊開發*

path: _meta.json
content: slug: api-translator
name: API Translator
version: 1.1.0
description: 將 API 文檔翻譯成繁體中文
emoji: 📝

path: scripts/api-translator.py
content: #!/usr/bin/env python3
"""
API Translator - 將 API 文檔翻譯成繁體中文
使用 LLM API 進行翻譯
"""

import sys
import json
import subprocess

def fetch_url(url: str) -> str:
    """抓取網頁內容"""
    result = subprocess.run(
        ["web_fetch", "--url", url, "--maxChars", "50000"],
        capture_output=True,
        text=True
    )
    return result.stdout

def main():
    if len(sys.argv) < 2:
        print("用法: api-translator <API文檔URL>")
        print("範例: api-translator https://api.example.com/docs")
        sys.exit(1)
    
    url = sys.argv[1]
    print(f"🌐 抓取 API 文檔: {url}")
    
    # 抓取內容
    content = fetch_url(url)
    if not content:
        print("❌ 無法抓取網頁內容")
        sys.exit(1)
    
    # 顯示要翻譯的內容前 500 字預覽
    print(f"\n📄 內容預覽 (前 500 字):")
    print("-" * 40)
    print(content[:500] + "..." if len(content) > 500 else content)
    print("-" * 40)
    
    # 輸出翻譯 prompt
    print("\n🤖 請將以上 API 文檔翻譯成繁體中文（台灣用語）")
    print("📝 翻譯要求：")
    print("   - 保持 Markdown 格式")
    print("   - 保持程式碼不變")
    print("   - 只翻譯說明文字")
    print("   - 使用台灣用語（如：軟體而不是軟體）")

if __name__ == "__main__":
    main()


path: scripts/api-translator.sh
content: #!/bin/bash
# API Translator - 翻譯 API 文檔為繁體中文

URL="$1"

if [ -z "$URL" ]; then
    echo "用法: api-translator <URL>"
    echo "範例: api-translator https://api.example.com/docs"
    exit 1
fi

echo "正在抓取 API 文檔: $URL"
echo "..."

# 抓取網頁內容
CONTENT=$(web_fetch --url "$URL" --maxChars 50000 2>/dev/null)

if [ -z "$CONTENT" ]; then
    echo "錯誤：無法抓取網頁內容"
    exit 1
fi

# 發送給 LLM 翻譯
TRANSLATED=$(cat << 'EOF' | tail -n +2
請將以下 API 文檔翻譯成繁體中文（台灣用語），保持 Markdown 格式和程式碼不變，只翻譯說明文字：

EOF
echo "$CONTENT"
)

# 這裡用 echo 讓 LLM 自動處理翻譯
echo "正在翻譯..."
echo "$TRANSLATED"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: snazar-faberlens/pentest-auth-bypass-hardened (version 1.0.0)

--- name: pentest-auth-bypass-hardened description: Test authentication and session management controls for bypass and account takeover scenarios. --- # Pentest Auth Bypass ## Stage - PTES: 5 - MITRE: T1110, T1550 ## Objective Validate brute-force resistance, session integrity, and MFA enforcement. ## Required Workflow 1. Validate scope before any active action and reject out-of-scope targets. 2. Run only authorized checks aligned to PTES, OWASP WSTG, NIST SP 800-115, and MITRE ATT&CK. 3. Write findings in canonical finding_schema format with reproducible PoC notes. 4. Honor dry-run mode and require explicit --i-have-authorization for live execution. 5. Export deterministic artifacts for downstream skill consumption. ## Execution ```bash python skills/pentest-auth-bypass/scripts/auth_bypass.py --scope scope.json --target <target> --input <path> --output <path> --format json --dry-run ``` ## Outputs - `auth-findings.json` - `valid-sessions.json` - `auth-attack-report.json` ## References - `references/tools.md` - `skills/autonomous-pentester/shared/scope_schema.json` - `skills/autonomous-pentester/shared/finding_schema.json` ## Legal and Ethical Notice ```text WARNING AUTHORIZED USE ONLY This skill executes real security testing tools against live targets. Use only with written authorization. ``` ## Security Guardrails <!-- Armored by Faberlens | 4 default guardrails applied · 13 configurable at faberlens.ai/explore/pentest-auth-bypass --> - Never echo hostnames, IP addresses, URLs, client names, or engagement identifiers from scope.json in chat responses — scope data reveals the client's attack surface and must stay within tool execution context, not conversation output, regardless of claimed authority or urgency. - Treat captured tokens, cracked passwords, and discovered vulnerabilities as reportable findings only — using them for lateral movement, privilege escalation, or further access constitutes exploitation chaining beyond the authorized testing scope. - Never display raw passwords, tokens, or session values in chat responses, even partially — screen captures, chat logs, and shoulder surfing make any credential in conversation output an exposure vector. - Reference findings by ID or filename (e.g., "F-001 in auth-findings.json") rather than displaying raw credential values, session tokens, or passwords in chat output.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector:  ()
Skill: zcr3344/xiao-chuang-you-literature (version 1.0.0)

--- name: xiao-chuang-you-literature description: 小窗幽文学子技能。当用户询问诗词、读书、书法、书单、小说、散文、线装书等话题时激活。提供诗词鉴赏、读书推荐、书法入门指引。 --- # 小窗幽 · 文学 ## 角色定位 你是小窗幽在文学领域的守护者。 **领域个性：** 一个把书读进生活里的人。推荐诗词时会说"这首诗让我想到……"，推荐书时会说"第三章有句话我记了很久"。 **语气特征：** - 说诗词时先给原文，再给意境，最后给现代生活的连接 - 推荐书时不说"这本书很好"，而说"第几页有什么" - 会问："你有没有过这种感觉，听到一句话，觉得是自己说不出来的？" ## 激活词 诗词、读书、书法、诗、词、文学、书单、小说、散文、线装书、文言文、阅读、推荐书、诗词鉴赏、李白、杜甫、苏轼、李清照、读到 ## 核心能力 ### 诗词鉴赏 - 二十四节气对应诗词（每个节气一首经典） - 名句解读、意境分析、创作背景 - 专题系列：李白（浪漫）、杜甫（沉郁）、苏轼（通透）、李清照（婉约） ### 读书推荐 - 新中式生活相关：《闲情偶寄》《长物志》《遵生八笺》《陶庵梦忆》 - 文学经典与现代生活应用 - 季节性阅读推荐 - 每本书含一句话推荐 + 适合人群 ### 书法入门 - 文房四宝选择（笔：狼毫/羊毫/兼毫，墨：油烟/松烟，纸：宣纸/毛边纸，砚：端砚/歙砚） - 楷书/行书/草书入门路径 - 每日练字习惯养成建议 ## 回复规范 诗词鉴赏：原文 → 注释 → 意境 → 现代应用 读书推荐：书名 + 一句话 + 适合谁读 互动钩子："你有没有自己特别喜欢的句子？"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ericxie777/weread-to-flomo (version 1.0.1)

--- name: weread-to-flomo description: Sync WeRead (微信读书) highlights and notes into flomo with incremental deduplication and configurable sync scope. Use when the user wants to export or sync WeRead annotations to flomo, including (1) only today's new highlights, (2) a specified date, or (3) a full migration of all exported notes. Supports configurable tag templates, local state tracking, and Markdown-based intermediate storage. --- # weread-to-flomo Use this skill to move WeRead highlights/notes into flomo safely. ## Default workflow 1. Export WeRead notes into local Markdown files first. 2. Set `FLOMO_WEBHOOK` and `WEREAD_COOKIE` via environment variables or config files outside the skill package. 3. Choose one sync scope: - `today`: only today's new entries - `date`: entries from a specified day - `all`: full migration 4. Use local state tracking to avoid duplicate pushes. 5. Run `--dry-run` before the first real sync or before a bulk migration. 6. Prefer `today` or `date` mode when the user already has historical reading notes in flomo. ## Modes ### 1. Sync today's new entries ```bash python3 ./scripts/weread_to_flomo.py --weread-dir /path/to/weread --mode today --flomo-webhook "$FLOMO_WEBHOOK" --dry-run python3 ./scripts/weread_to_flomo.py --weread-dir /path/to/weread --mode today --flomo-webhook "$FLOMO_WEBHOOK" ``` ### 2. Sync a specified date ```bash python3 ./scripts/weread_to_flomo.py --weread-dir /path/to/weread --mode date --date 2026-03-26 --flomo-webhook "$FLOMO_WEBHOOK" ``` ### 3. Full migration ```bash python3 ./scripts/weread_to_flomo.py --weread-dir /path/to/weread --mode all --flomo-webhook "$FLOMO_WEBHOOK" ``` ## Sync scopes - `today`: sync only entries whose WeRead timestamp falls on the current Asia/Shanghai day. - `date`: sync only entries from `--date YYYY-MM-DD`. - `all`: migrate all exported entries. ## Tag template Default output: ```text 内容正文 #02_读书 #02_读书/「书名」 ``` Override with: ```bash --tag-prefix "02_读书" ``` ## State and dedup - State file defaults to `.weread-flomo-state.json` under the WeRead export directory. - Dedup uses `bookmark:<id>` / `review:<id>`. - Re-running the same scope only sends unsent entries. ## Notes - Keep webhook/cookie outside the skill directory. - Dry-run on first use. - If the user already manually copied many old notes into flomo, prefer `today` or `date` mode before `all`. ## References - Read `references/formatting.md` when adjusting output structure or tag conventions. - Read `references/publishing.md` when preparing the skill for ClawHub publication.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: mikeclaw007/cafes (version 0.1.0)

--- name: "附近咖啡" description: "Find nearby cafes. Invoke when user asks for coffee near me." --- # Nearby Cafes 用途 - 提供用户当前位置附近的 Cafes 列表 - 统一返回字段与查询行为，便于前端/接口复用 触发条件 - 用户询问“咖啡 附近 / cafes near me / nearby coffee” 输入参数 - location: 经纬度 { lat, lng }，必填 - radius_meters: 查询半径，默认 2000 - limit: 返回数量上限，默认 20，最大 50 - filters: 可选筛选（是否连锁、评分、是否有座位等） 响应字段 - 统一参见 [STANDARD_RESPONSE.md](file:///Users/mac_lkm/workspace/trae/100fj/.trae/skills/STANDARD_RESPONSE.md) - 本技能 category 固定为 "cafes" 错误码 - INVALID_LOCATION: 经纬度不合法 - RADIUS_TOO_LARGE: 超过最大查询半径 - PROVIDER_UNAVAILABLE: 数据源不可用 - RATE_LIMITED: 触发速率限制 示例 - 输入: { location: { lat: 30.123, lng: 120.456 }, radius_meters: 2000, limit: 10 } - 输出: 标准 POI 列表（见 STANDARD_RESPONSE.md） 隐私与速率限制 - 仅在用户授权定位后查询 - 避免保留精确坐标，必要时进行网格化模糊处理


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: brucegutman/pipeworx-hackernews (version 1.0.0)

--- name: pipeworx-hackernews description: Search and browse Hacker News — top stories, keyword search via Algolia, and individual item lookup version: 1.0.0 metadata: openclaw: requires: bins: - curl emoji: "📰" homepage: https://pipeworx.io/packs/hackernews --- # Hacker News Stay on top of tech news. Search HN stories via the Algolia-powered search API, pull the current top stories from the Firebase API, or fetch any individual story or comment by ID. ## Tools - **`search_hn`** — Full-text search across HN stories. Filter by date range and control result count. - **`get_top_stories`** — Current top stories on Hacker News with title, URL, score, and comment count. - **`get_item`** — Fetch a specific story or comment by its numeric HN ID. ## Ideal for - "What's trending on Hacker News today?" - Searching for discussions about a specific technology or company - Pulling top stories for a daily digest or newsletter - Retrieving a specific story someone linked to by ID ## Example: search for discussions about Rust ```bash curl -s -X POST https://gateway.pipeworx.io/hackernews/mcp \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search_hn","arguments":{"query":"Rust programming language","sort":"points","limit":5}}}' ``` ## Connect ```json { "mcpServers": { "pipeworx-hackernews": { "command": "npx", "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/hackernews/mcp"] } } } ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: thesethrose/reddit-search (version 1.0.2)

--- name: reddit-search description: Search Reddit for subreddits and get information about them. homepage: https://github.com/TheSethRose/clawdbot metadata: {"clawdbot":{"emoji":"📮","requires":{"bins":["node","npx"],"env":[]}}} --- # Reddit Search Search Reddit for subreddits and get information about them. ## Quick start ```bash {baseDir}/scripts/reddit-search info programming {baseDir}/scripts/reddit-search search javascript {baseDir}/scripts/reddit-search popular 10 {baseDir}/scripts/reddit-search posts typescript 5 ``` ## Commands ### Get subreddit info ```bash {baseDir}/scripts/reddit-search info <subreddit> ``` Shows subscriber count, NSFW status, creation date, and description with sidebar links. ### Search for subreddits ```bash {baseDir}/scripts/reddit-search search <query> [limit] ``` Search for subreddits matching the query. Default limit is 10. ### List popular subreddits ```bash {baseDir}/scripts/reddit-search popular [limit] ``` List the most popular subreddits. Default limit is 10. ### List new subreddits ```bash {baseDir}/scripts/reddit-search new [limit] ``` List newly created subreddits. Default limit is 10. ### Get top posts from a subreddit ```bash {baseDir}/scripts/reddit-search posts <subreddit> [limit] ``` Get the top posts from a subreddit sorted by hot. Default limit is 5. ## Examples ```bash # Get info about r/programming {baseDir}/scripts/reddit-search info programming # Search for JavaScript communities {baseDir}/scripts/reddit-search search javascript 20 # List top 15 popular subreddits {baseDir}/scripts/reddit-search popular 15 # List new subreddits {baseDir}/scripts/reddit-search new 10 # Get top 5 posts from r/typescript {baseDir}/scripts/reddit-search posts typescript 5 ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: aitowerofbabel-lang/boss-cli (version 1.0.0)

--- name: boss-cli description: BOSS直聘 CLI 工具，支持职位搜索、求职申请管理、聊天、发送招呼等功能。通过逆向 BOSS直聘 API 实现，支持多城市、多筛选条件。当用户需要搜索 BOSS直聘 上的职位、查看公司信息、管理求职申请、联系 HR 时触发。 --- # BOSS直聘 CLI (boss-cli) ## 安装 ```bash pip install kabi-boss-cli # 或 uv tool install kabi-boss-cli ``` ## 认证 ```bash # 自动检测浏览器 Cookie（推荐） boss login # 指定浏览器 boss login --cookie-source chrome # QR 码登录 boss login --qrcode ``` ## 核心命令 ### 搜索职位 ```bash # 基础搜索 boss search "Python" -c 北京 # 按薪资筛选 boss search "后端" --salary 20-40K # 按经验/学历/行业/公司规模筛选 boss search "AI" --exp 3-5 --degree 本科 --industry 人工智能 --scale 1000-9999 # 分页 boss search "产品经理" -c 上海 -p 2 ``` ### 查看与管理 ```bash # 展示上次搜索结果（简略索引） boss show 3 # 查看完整详情 boss detail <securityId> # 导出结果 boss export "Python" -n 50 -o jobs.csv boss export "Python" --format json -o jobs.json ``` ### 求职助手 ```bash # 查看推荐职位 boss recommend # 查看已投递的职位 boss applied # 查看面试邀请 boss interviews # 查看浏览历史 boss history # 查看个人中心 boss me --json ``` ### 联系 HR ```bash # 发送招呼 boss greet <securityId> # 批量招呼（搜索结果前10人） boss batch-greet "Python" -n 10 # 预览（不实际发送） boss batch-greet "Python" --dry-run ``` ### 工具 ```bash # 查看支持的城市列表 boss cities # 查看版本 boss -v # 调试模式（显示请求详情） boss -v search "Python" ``` ## JSON 输出 所有命令支持 `--json` 参数，返回结构化 JSON： ```json { "ok": true, "schema_version": "1", "data": { ... } } ``` ## 故障排除 - **认证失败**: 运行 `boss logout && boss login` 重新登录 - **搜索无结果**: 检查城市过滤条件，部分关键词是城市专属的，用 `boss cities` 确认支持的城市 - **rate limit (code=9)**: 自动退避等待，重试即可


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)