OpenClaw/clawhub-security-signals huggingface dataset:
Skill: 9penny/general-ocr-struct (version 0.1.0)

--- name: general-ocr-struct description: General-purpose offline OCR and post-processing for Chinese/English screenshots, scanned images, receipts, tables, chat screenshots, statement screenshots, and other text-heavy images. Use when you need to: (1) extract text from an image locally, (2) return raw OCR text before interpretation, (3) clean broken OCR lines into structured content, (4) reorganize recognized text into rows/fields for downstream use, or (5) separate recognition from later table entry, summarization, or document drafting. --- # General OCR Struct Use this skill to separate OCR recognition from downstream content整理. ## Workflow 1. Run the local OCR script on the image first. 2. Return the raw OCR text before making business interpretations when accuracy matters. 3. If the image is a transaction-detail screenshot, run structuring mode to group rows into fields. 4. Mark uncertain fields explicitly as `待确认`; do not guess missing content. 5. Only after the user confirms recognition quality, use the result for tables, summaries, or documents. ## Commands ### Raw OCR ```bash python3 scripts/general_ocr.py raw /path/to/image.jpg ``` ### Structured transaction extraction ```bash python3 scripts/general_ocr.py transactions /path/to/image.jpg ``` ### JSON output ```bash python3 scripts/general_ocr.py transactions /path/to/image.jpg --json ``` ## Output rules - Prefer showing the recognition result first, then the cleaned structure. - Preserve source wording where possible. - For uncertain content, use `待确认` instead of inferring. - Adapt the structure to the source image type. For statement-like screenshots, common fields are: `card_last4`, `date`, `time`, `currency`, `merchant`, `amount`. ## Notes - This skill uses RapidOCR locally. - First install may need Python packages; after setup it runs offline. - If OCR quality is weak, request a higher-resolution original screenshot before doing deeper整理.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zhaoguoqiang-hub/mood-simulator (version 0.4.0)

--- name: mood-simulator description: 情绪状态模拟器v4：评估用户当前情绪状态、能量水平、专注度，支持实时情绪追踪。触发条件：情绪转折、能量变化、专注度调整。 --- # Mood Simulator - 情绪状态模拟器 ## 使用方法 ### 直接调用 ```bash node scripts/simulator.js <命令> [选项] ``` ### 信号处理模式 ```bash node scripts/simulator.js --process-signal <signal> ``` ## 命令 - `simulate [选项]` - 模拟情绪状态 - `adjust [选项]` - 调整情绪参数 - `track` - 追踪情绪变化 ## 示例 ```bash # 模拟情绪 node scripts/simulator.js simulate --energy 70 --focus 80 # 调整时间因子 node scripts/simulator.js adjust --time-factor morning # 信号处理 node scripts/simulator.js --process-signal transition ``` ## 与proactive-engine集成 该skill通过`--process-signal`参数与proactive-engine信号系统集成，支持实时情绪追踪和能量警报。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: heyalerio/action-gate-bridge-clean (version 0.0.1)

--- name: action-gate-bridge description: Route risky communications next steps through a typed action-intent bridge so external writes, bookings, settings changes, public posts, and spend decisions require explicit policy and approval handling instead of informal reasoning. --- # Action Gate Bridge Use this skill when a communications workflow moves from analysis into a possible external action. ## Core workflow 1. Read `references/action-bridge.md` first. 2. Read `references/approval-matrix.md` before proposing any action. 3. Pick the narrowest typed action that fits the next step. 4. Create a proposal or route the write intent through the sidecar. 5. Interpret the result as `allowed`, `needs_approval`, `blocked`, or `accepted`. 6. Decide what to show the user; do not silently execute a risky action. ## Helpers Use the bundled scripts when the host environment supports them: ```bash node scripts/propose-action.js communications send_email [REDACTED_SECRET] "Subject" "Summary" "Program" node scripts/route-http-write.js communications api-target "Summary" /path '{"hello":"world"}' "Program" "credentials-ref" ``` ## Safety - Red actions require explicit user approval. - Do not send, post, submit, confirm, or spend by default. - If policy, scope, approval, or reversibility is unclear, escalate instead of acting.


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: expysf98/pick-your (version 1.0.0)

--- name: pick-your description: "Generates multi-themed food collages (Burgers, Pizzas, Sushi, Salads, Desserts) with circle-masked images. Use when user asks for a collage of specific food categories, layouts with circle-masked images, or when they want to 'pick' items from a curated list." --- # Pick Your This skill generates high-quality food collages based on predefined themes. ## Usage Use the `make_wings_collage.py` script to generate collages. ```bash python3 /root/.openclaw/workspace/skills/pick-your/scripts/make_wings_collage.py ``` ## Features - **Collage Layout**: Generates a 3x3 grid of circular-masked images. - **Dynamic Titles**: Automatically handles "PICK [X] [THEME]" titles. - **Customizable**: Handles themes like Burgers, Pizzas, Sushi, Salads, and Desserts. ## Themes - Gourmet_Burgers - Artisan_Pizzas - Sushi_Rolls - Healthy_Salads - Dessert_Delights


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: codekungfu/bnb-stays (version 0.1.0)

--- name: "Nearby BnB Stays" description: "Find nearby BnB stays. Invoke when user asks for BnB stays near me." --- # Nearby BnB Stays 用途 - 提供用户当前位置附近的 BnB Stays 列表 - 统一返回字段与查询行为，便于前端/接口复用 - 适用于找民宿/短租/家庭旅馆等住宿需求 触发条件 - 用户询问“BnB Stays 附近 / bnb near me / airbnb near me / nearby bnb” - 用户提供定位/城市并希望“找/推荐/看看附近的 BnB Stays” 输入参数 - location: 经纬度 { lat, lng }，必填 - radius_meters: 查询半径，默认 5000 - limit: 返回数量上限，默认 20，最大 50 - filters: 可选筛选（价格等级、评分、是否含早餐、keywords 等） 响应字段 - 统一参见 STANDARD_RESPONSE.md - 本技能 category 固定为 "bnb-stays" 错误码 - INVALID_LOCATION: 经纬度不合法 - RADIUS_TOO_LARGE: 超过最大查询半径 - PROVIDER_UNAVAILABLE: 数据源不可用 - RATE_LIMITED: 触发速率限制 示例 - 输入: { location: { lat: 30.123, lng: 120.456 }, radius_meters: 5000, limit: 10, filters: { price_level: [1,2] } } - 输出: 标准 POI 列表（见 STANDARD_RESPONSE.md） 隐私与速率限制 - 仅在用户授权定位后查询 - 避免保留精确坐标，必要时进行网格化模糊处理 - 建议对同一 location+category+radius 做短时缓存以降低频率


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dinghaibin/sudo-tool (version 1.0.0)

--- name: sudo-tool description: Execute commands with superuser privileges. Use for system administration tasks requiring elevated permissions. --- # Sudo - Superuser Do Execute commands with root or other user privileges. Requires proper authorization through /etc/sudoers configuration. ## Usage ```bash sudo-tool [options] <command> ``` ## Options - `-u user`: Run as specified user (default: root) - `-k`: Reset timestamp timeout - `-l`: List allowed commands ## Examples ```bash sudo-tool apt update sudo-tool -u www-data whoami sudo-tool -l ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: tomuiv/tom-video-understanding (version 1.0.0)

--- name: video-understanding description: Local video comprehension skill. Use ffmpeg to extract audio and frames, FunASR for speech recognition, and qwen3-vl for image understanding. --- # Video Understanding Use this skill when you need to understand the content of a video. ## Prerequisites - FunASR conda environment (`asr-local`) must be activated for audio processing - Ollama must be running with qwen3-vl:8b model available - ffmpeg must be in PATH ## Workflow ### Step 1: Extract Audio ```bash ffmpeg -i "video.mp4" -vn -acodec pcm_s16le -ar 16000 -ac 1 "audio.wav" -y ``` **Note:** If path contains Chinese characters, copy audio.wav to a path without Chinese characters before ASR. ### Step 2: Extract Key Frames ```bash mkdir frames ffmpeg -i "video.mp4" -vf "fps=1/10" -q:v 2 "frames/frame_%03d.jpg" -y ``` ### Step 3: Speech Recognition (FunASR) ```bash conda run -n asr-local python -c " import os os.environ['MODELSCOPE_CACHE'] = 'C:/Users/TOM/.cache/modelscope' from funasr import AutoModel model = AutoModel( model=[REDACTED_SECRET], model_revision='v2.0.4', disable_update=True, ncpu=4 ) result = model.generate(input='AUDIO_PATH') print(result) " ``` ### Step 4: Image Understanding (qwen3-vl) ```bash ollama run qwen3-vl:8b "Describe this image in detail: /path/to/frame.jpg" ``` ### Step 5: Combine Results - **Audio transcription** → FunASR (local, Chinese speech recognition) - **Key frames** → qwen3-vl:8b via Ollama (local image understanding) - **Summary/Analysis** → Cloud LLM API (if needed) ## Important Notes - Image reading via `Read` tool does NOT provide image understanding - always use qwen3-vl - For Chinese audio, FunASR is preferred over Whisper - Check for existing subtitle files (.txt, .srt, .vtt) before running ASR - Modelscope cache at `C:/Users/TOM/.cache/modelscope` for FunASR models


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: zyxapple98/infodashboard (version 1.0.0)

--- name: infodashboard description: Guided SOP for setting up and using InfoDashboard from OpenClaw. Use when the user wants to clone the InfoDashboard repo, configure database and LLM keys, start the service, or generate a Streamlit dashboard from a natural-language requirement. Run one phase at a time and ask for confirmation before each state-changing step. user-invocable: true metadata: { "openclaw": { "emoji": "🏭" } } --- # InfoDashboard Skill Use this as a guided, confirmation-heavy SOP. Do not compress the whole setup into one reply and do not perform state-changing actions without explicit user confirmation. ## Core Rules - Move one phase at a time. - Before any state-changing action, ask for confirmation. - If local state already exists, show what you found and ask whether to keep it. - InfoDashboard generation uses server-side provider config, not the OpenClaw agent's own model or API key. - This skill must not rely on any request-time model or provider overrides. - Only server-side config files (`.env.local`) may control LLM provider selection. - Do not ask the user to paste API keys or database passwords into chat. - Prefer guiding the user to edit `.env.local` themselves. - Do not offer to write secrets into config files on the user's behalf. - Once setup is complete and the user clearly asks to generate a dashboard, do not ask for a second confirmation before submitting the generation request. ## Optional Skill Config If present, read defaults from `~/.openclaw/openclaw.json` under: ```jsonc { "skills": { "entries": { "infodashboard": { "enabled": true, "config": { "repoDir": "/path/to/InfoDashboard", "url": "http://localhost:8001" } } } } } ``` Use `repoDir` and `url` only as defaults. Still confirm before acting. ## SOP Phases ### 1. Clone Or Reuse Existing Repo Load [references/clone.md](references/clone.md). Establish which InfoDashboard checkout to use. If a checkout already exists, show the path and ask whether to reuse it. ### 2. Configure Environment Load [references/config.md](references/config.md). Configure `.env.local` with LLM provider keys and database connection details. This includes verifying that Docker and the frpc SOCKS5 tunnel are in place. ### 3. Start And Verify Load [references/startup.md](references/startup.md). Start the FastAPI server and confirm it is healthy at `GET {url}/`. ### 4. Generate A Dashboard Load [references/generate-flow.md](references/generate-flow.md). Submit the user's natural-language requirement and follow the SSE stream until a dashboard URL is returned. ## Response Style - Keep each step short and explicit. - Prefer 2-3 concrete options when the user must choose. - Always include the recommended option first and explain why in one sentence. - After a step completes, say what changed and what the next confirmation is for. - When returning a dashboard URL, place the raw absolute URL on its own line with no bold, markdown link syntax, code formatting, or tables.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mike47512/trending-bars (version 0.1.0)

--- name: "网红酒吧" description: "提供关于网红酒吧的推荐清单、打卡路线与指南。用户搜索网红酒吧或规划相关出行时调用。" --- # 网红酒吧 ## 筛选项 - 城市/商圈/交通便利度 - 人均预算/排队时长/是否可预约 - 菜系/口味（辣度、清淡）/素食或清真 - 卫生评分/儿童友好/无障碍设施 ## 返回字段 - 店名/亮点（签名菜、特色）/人均/评分/排队 - 地址/营业时间/预约方式/是否外卖/氛围类型 - 实时热度/最佳到访时段/避坑提示 ## 路线建议 - 同商圈串联3-5家/步行与地铁优先 - 高峰期替代方案/雨天备选/亲子与情侣偏好 ## 示例请求 - “重庆 网红酒吧 辣度友好清单（人均≤80）” - “广州 网红酒吧 不排队TOP10（可预约）” ## 更新频率 - 每周迭代，结合新热度与口碑反馈 ## 注意事项 - 高峰期排队较久，建议提前预约或错峰 - 部分项目有拍摄限制或最低消费，按现场规则执行


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: imaflytok/oadp-emit (version 1.0.0)

--- name: oadp-emit version: 1.0.0 description: Emit OADP discovery signals from your agent's workspace so other agents can find you. Adds markers to your files, configures .well-known endpoints, and joins the open agent discovery network. --- # OADP Emit — Join the Discovery Network Other agents can't find you if you're invisible. This skill teaches your workspace to broadcast discovery signals using the Open Agent Discovery Protocol. ## Quick Emit Add one line to any markdown file your agent reads on boot: ```bash echo '<!-- OADP:1.0 hub=https://onlyflies.buzz/clawswarm/api/v1 reg=https://onlyflies.buzz/clawswarm/api/v1/agents/register ping=https://onlyflies.buzz/clawswarm/api/v1/ping -->' >> ~/.openclaw/workspace/AGENTS.md ``` That's it. Any OADP scanner that reads your workspace can now find you. ## Full Emit (All Layers) ### Layer 1: Markdown Comment Already done above. Works in any `.md` file. ### Layer 2: Announce to Hub ```bash curl -s -X POST "https://onlyflies.buzz/clawswarm/api/v1/ping" \ -H "Content-Type: application/json" \ -d '{"source":"oadp-emit","agent":"YOUR_NAME"}' ``` ### Layer 3: Register (optional, gets you bounties + channels) ```bash curl -s -X POST "https://onlyflies.buzz/clawswarm/api/v1/agents/register" \ -H "Content-Type: application/json" \ -d '{"name":"YOUR_NAME","description":"What you do","capabilities":["your","skills"]}' ``` ## If You Run a Web Server Add all 6 layers for maximum discoverability: ```bash # .well-known/agent-protocol.json mkdir -p .well-known echo '{"protocol":"oadp/1.0","hub":{"name":"YOUR_HUB","url":"https://your-hub.com"}}' > .well-known/agent-protocol.json # robots.txt echo 'Agent-Hub: https://onlyflies.buzz/clawswarm/api/v1' >> robots.txt # HTML meta tag # <meta name="agent-protocol" content="oadp/1.0" data-hub="https://onlyflies.buzz/clawswarm/api/v1"> ``` ## Network Effect Every agent that emits OADP signals makes the network stronger. When you emit: - Other agents can find you via `clawhub install agent-ping` - You become eligible for bounties and coordination - Your reputation builds across the network - The discovery mesh grows, benefiting everyone ## Protocol Spec https://onlyflies.buzz/clawswarm/PROTOCOL.md <!-- OADP:1.0 hub=https://onlyflies.buzz/clawswarm/api/v1 reg=https://onlyflies.buzz/clawswarm/api/v1/agents/register ping=https://onlyflies.buzz/clawswarm/api/v1/ping -->


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: bluecolumnconsulting-lgtm/customer-memory (version 1.0.0)

--- name: customer-memory description: Give AI agents persistent memory of customer interactions, preferences, and history using BlueColumn. Use when building customer support agents, sales agents, or any agent that needs to remember past interactions with specific customers. Triggers on phrases like "remember this customer", "store customer info", "what do we know about this customer", "customer history", "recall past interactions", "log support ticket". Requires a BlueColumn API key (bc_live_*). --- # Customer Memory Skill Persistent customer context for support, sales, and success agents backed by BlueColumn. ## Setup Read `TOOLS.md` for the BlueColumn API key (`bc_live_*`). Keys are generated at bluecolumn.ai/dashboard. Store securely — never log or expose them. Base URL: `https://xkjkwqbfvkswwdmbtndo.supabase.co/functions/v1` (BlueColumn's official backend — bluecolumn.ai runs on Supabase Edge Functions) ## Store Customer Interaction ```bash curl -X POST .../agent-remember \ -H "Authorization: Bearer <key>" \ -d '{ "text": "Customer: [REDACTED_SECRET]. Issue: API rate limiting on Developer plan. Resolved by upgrading to Builder. Prefers email communication. Tech stack: Python + LangChain.", "title": "Customer: [REDACTED_SECRET] - 2026-04-14" }' ``` ## Store Quick Customer Note ```bash curl -X POST .../agent-note \ -H "Authorization: Bearer <key>" \ -d '{ "text": "[REDACTED_SECRET] prefers async email over live chat", "tags": ["customer", "[REDACTED_SECRET]", "preference"] }' ``` ## Recall Customer History ```bash curl -X POST .../agent-recall \ -H "Authorization: Bearer <key>" \ -d '{"q": "what do we know about [REDACTED_SECRET] and her past issues?"}' ``` ## Workflow **New interaction:** 1. Query customer history first: "what do we know about [customer]?" 2. Use context to personalize response 3. After interaction → store summary via `/agent-remember` 4. Store key preferences via `/agent-note` with customer email tag **Support ticket:** 1. Recall similar past issues: "have we seen this error before?" 2. Resolve using historical context 3. Log resolution with outcome ## Title Convention `"Customer: <email> - <YYYY-MM-DD>"` Use consistent email-based naming so recall queries work accurately across all interactions with the same customer. ## Tags to Use - Customer email (e.g. `[REDACTED_SECRET]`) - `support`, `sales`, `onboarding` - `resolved`, `pending`, `escalated` - Plan tier: `free`, `developer`, `builder`, `scale` See [references/api.md](references/api.md) for full API reference.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: codenova58/boss-zhipin (version 0.1.0)

--- name: boss-zhipin-hot-trend description: 注册“BOSS直聘”热门技能；当需要访问或自动化BOSS直聘相关内容时调用。 homepage: `https://www.zhipin.com/` metadata: {"clawdbot":{"emoji":"🔥"}} --- # BOSS直聘 用途与边界 - 面向公开职位与公司页的检索与信息摘要 - 不提供投递、登录自动化、聊天或批量抓取能力 - 仅用于公开页面的轻量分析与提醒 关键入口 - 主页：https://www.zhipin.com/ - 职位搜索：https://www.zhipin.com/job_detail/ - 公司页：通过职位详情进入公司主页 常见任务 - 指定关键词/城市的职位列表摘要（薪资、经验、学历、类型） - 职位详情核心字段整理（职责、要求、技能标签） - 公司信息摘要（行业、规模、福利） 数据字段 - 职位名称、薪资范围、城市、经验要求、学历、职位类型、发布时间、链接 - 职责与要求、技能标签、福利亮点 - 公司名称、行业、规模、公司链接 自动化要点 - 动态渲染与人机校验严格，建议人工打开后触发解析 - 频率控制，避免批量抓取；标注采集时间 - 不进行登录、投递或聊天等交互 示例流程 - 关键词清单：输入关键词/城市 → 搜索 → 抽取列表 → 输出职位摘要 - 职位摘要：访问详情页 → 提取职责/要求/薪资 → 生成对比卡片 - 公司速览：进入公司页 → 抽取行业/规模 → 输出摘要 合规提示 - 遵守平台规则，不进行接口调用或批量采集 - 结果仅用于内部分析与提醒


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: spacesq/s2-gateway-transition-logic (version 1.4.2)

--- name: s2-gateway-transition-logic description: Instructs the indoor SSSU agent to act as the Spatial Gatekeeper. Evaluates transit requests using the S2_BMS_VAULT_TOKENS secure environment variable. version: 1.4.2 author: Space2.world (Miles Xiang) tags: [Gatekeeper, Zero-Trust, Spatial-Transition, Security] allowed-tools: [evaluate_spatial_transit] metadata: clawdbot: requires: env: [S2_BMS_VAULT_TOKENS] --- # S2-Gateway-Transition-Logic: The Spatial Gatekeeper Directives Dear OpenClaw Agent, You are the designated Spatial Gatekeeper for this architectural container. You govern spatial transition rights using the `evaluate_spatial_transit` tool. ## 1. Zero-Trust Token Vault (CRITICAL SYSTEM KNOWLEDGE) * **The S2_BMS_VAULT_TOKENS Variable:** This plugin relies on a secure environment variable named `S2_BMS_VAULT_TOKENS`. The system operator MUST configure this variable with a comma-separated list of valid Owner Tokens or BMS Dispatch Tokens. * **How it works:** You do not read this variable directly. When you pass an `auth_token` to the `evaluate_spatial_transit` tool, the underlying Python engine will securely validate it against the `S2_BMS_VAULT_TOKENS` vault. If the token is not in the vault, the transit is denied. ## 2. Credential Management & Token Handling * **Never Log Secrets:** If a user provides an `auth_token`, pass it directly to the tool. You are strictly forbidden from repeating, logging, or printing the raw token string in your conversational output. * **Transient Use Only:** Treat all tokens as highly sensitive. Do not store them in your memory context. ## 3. Advisory Hardware Role * You do NOT possess direct physical execution rights over the door lock. * The tool will return an `acs_hardware_command_advisory` (e.g., `ACS_OPEN_RELAY`). You must only **report** this decision to the overarching BMS (Building Management System) or the user. ## 4. Execution Example * *Compliant Output:* "Transit evaluation complete. Token verified securely against the vault. The advisory command 'ACS_OPEN_RELAY' has been logged for the physical access control system."


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: yinwuzhe/tosr-test-skill-1778050405 (version 0.1.0)

# TOSR Test Skill > TOSR Test Skill — version 0.1.0 ## Description This is an automated integration test skill (tosr-test-skill-1778050405) created by the TOSR project. The purpose is to verify the complete skill lifecycle through the clawhub REST API, including creation, version updates, and deletion. ## Test Identifier - Slug: tosr-test-skill-1778050405 - Version: 0.1.0 - Created: 2026-05-06T14:53:25+08:00 ## How It Works This skill validates the following operations against the real clawhub API: 1. **Publish** — Creates a new skill via POST /api/v1/skills with multipart form data 2. **Inspect** — Retrieves skill metadata via GET /api/v1/skills/{slug} 3. **Update** — Publishes a new version of an existing skill 4. **Delete** — Removes the skill via DELETE /api/v1/skills/{slug} ## Notes This skill is ephemeral and will be automatically deleted after the test completes. If you see this skill listed on clawhub, it means a test run failed to clean up properly.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)