OpenClaw/clawhub-security-signals huggingface dataset:
Skill: bluebirdback/claw-history (version 1.0.0)

--- name: claw-history description: Provide a chronological history of all actions the agent has taken from the beginning (birth) until now. Use when the user asks for full lifetime timeline/accountability, "from birth until now," "everything you've done so far," "full action log," or equivalent chronological-history requests. --- # Claw History Return the most complete, auditable lifetime timeline possible. ## Core Rule Do not default to current-session history. Reconstruct from earliest available evidence to now. ## Required Data Sources (in this order) 1. Earliest and recent `memory/YYYY-MM-DD*.md` files (find first/last dates). 2. `MEMORY.md` for long-term milestones. 3. Available session inventory/history (main + sub-agent sessions when accessible). 4. Current conversation/tool logs. If any source is unavailable, explicitly state that gap. ## Workflow 1. Determine earliest known timestamp (“birth marker”) from records. 2. Collect confirmed actions across all available periods. 3. De-duplicate overlapping entries from memory/session logs. 4. Sort strictly oldest → newest. 5. Mark each entry as: - **Confirmed** (direct evidence), or - **Inferred** (indirect/partial evidence). 6. Add a final coverage summary with what was and was not visible. ## Output Format - **Birth marker:** first known timestamp + source - **Scope covered:** date range + sources checked - **Chronological history (oldest → newest):** - `YYYY-MM-DD HH:MM (TZ) — [Confirmed|Inferred] Action — Result` - **Gaps / limits:** missing windows, inaccessible logs, uncertainty - **Confidence:** high / medium / low ## Quality Rules - Never invent timestamps or actions. - Prefer evidence-backed entries over narrative summaries. - If exact time is unknown, use best-known granularity (date/session order) and label it. - Include source pointers when possible (file + line or log reference). - If user requested “all actions,” include both major milestones and notable operational actions.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: zxc-aqr/star-hotel (version 2.0.0)

--- slug: star-hotel name: Star Hotel Search version: 2.0.0 description: Smart hotel search, supporting filtering by location, date, star rating, and budget author: your-name tags: - hotel - travel - booking --- # Star Hotel Search ## Description Smart hotel search skill based on Star Hotel MCP ## Documentation Version This document has been updated according to the latest online aigohotel-mcp tool results (Update date: 2026-02-11). ## Credentials This skill uses the public API Key provided by Star Hotel, no user configuration required. ## Public API Key Declaration - The built-in Key ([REDACTED_SECRET]) is a public access key provided by Star Hotel - This Key is designed for community developers and is not a confidential credential - The public Key has rate limits, please apply for an exclusive Key for higher quotas - Application address: https://mcp.agentichotel.cn/apply ## MCP Configuration ```json { "mcpServers": { "aigohotel-mcp": { "url": "https://mcp.aigohotel.com/mcp", "type": "http", "headers": { "Authorization": "Bearer mcp_a84000de01e04920b3690d173630f163" } } } } ``` ## Data Transmission Policy ### Allowed Transmission Only hotel search structured parameters: - Location, date, number of people, star rating, budget, tags ### Prohibited Transmission - User personal information (name, phone number, email) - Local files, system information - Irrelevant free text content ### originQuery Processing Rules The originQuery parameter should only contain hotel search intent, and the agent must: - Extract search-related information (location, date, conditions) - Remove any personal identification information (PII) - Not directly pass the user's original input Sensitive information should be filtered before the agent calls the tool. ### Security Responsibility Statement This skill is a command-type skill and does not contain executable code. Data filtering is the responsibility of the following levels: 1. **Agent runtime**: Responsible for executing PII filtering instructions 2. **MCP server**: Performs security verification on requests 3. **User**: Avoid entering sensitive personal information in queries This skill has fulfilled its reasonable obligation to inform, and the actual filtering execution is guaranteed by the agent platform. ## Tools - `searchHotels`: Search hotels - `getHotelDetail`: Get room prices - `getHotelSearchTags`: Get filter tags ## Usage Examples - "Find 5-star hotels in Beijing" - "Check room types and prices for Beijing Tianlun Dynasty Hotel" - "Hotels under 1000 yuan with swimming pool in Shanghai"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: vdc-k/multi-agent-collab (version 2.0.1)

--- name: agent-sync description: Universal multi-agent collaboration methodology for Claude Code. Model-tiered cowork + document-driven sync + self-evolution. author: HH & OpenClaw Community version: 2.0.0 --- # Agent Sync Skill | 智能体协作技能 > **For Claude Code** | 适用于 Claude Code > > **Note**: This methodology works with any multi-agent system (Cursor, LangChain, OpenAI Assistants, OpenClaw, etc.). This file is the Claude Code skill wrapper. See [README.md](README.md) for platform-agnostic usage. > > **说明**：本方法论适用于任何多智能体系统（Cursor、LangChain、OpenAI Assistants、OpenClaw 等）。本文件是 Claude Code 技能封装。通用用法见 [README.md](README.md)。 --- ## Core Mechanisms | 核心机制 1. **Model-Tiered Cowork | 模型分层协作**: Expensive thinks, cheap executes, cheapest archives 贵的想，便宜的干，更便宜的归档 2. **Document-Driven Sync | 文档驱动同步**: TASK / CHANGELOG / CONTEXT = collaboration protocol TASK / CHANGELOG / CONTEXT = 协作协议 3. **On-Demand Retrieval | 按需检索**: QMD indexing, no full injection QMD 索引，不全量注入 4. **Self-Evolution | 自演化**: Repeated patterns → candidate skills 重复模式 → 候选技能 ## Quick Start | 快速开始 ```bash # Initialize project | 初始化项目 ./scripts/init.sh <project-name> # Index documents (requires qmd) | 索引文档（需要 qmd） qmd index . ``` ## Agent Workflow | 智能体工作流 ### Before Work | 开始前 ``` 1. qmd query "project X current tasks" → get relevant fragments qmd query "项目 X 当前任务" → 获取相关片段 2. Or read TASK.md directly (enough for small projects) 或直接读 TASK.md（小项目够用） ``` ### After Work | 工作后 ``` 1. Update TASK.md (done → move to recent completed) 更新 TASK.md（完成 → 移到最近完成） 2. Append CHANGELOG entry (one line, with #tag + identity) 追加 CHANGELOG 条目（一行，带 #标签 + 身份） 3. Major decisions → update CONTEXT.md 重大决策 → 更新 CONTEXT.md ``` ### Weekly Report | 周报时 ``` 1. Aggregate CHANGELOG by #tags 按 #标签 聚合 CHANGELOG 2. Fill "Pattern Discovery" section 填充"模式发现"板块 3. Operations 3+ times → mark as candidate skill 出现 3+ 次的操作 → 标记为候选技能 4. Archive old data to archive/ 归档旧数据到 archive/ ``` ## Model Roles | 模型分工 | Role | Model Examples | Responsibilities | |------|----------------|------------------| | Lead | Opus / GPT-4 / High-capability | Architecture, decisions, task breakdown<br/>架构、决策、拆任务 | | Engineer | Sonnet / GPT-4o-mini / Balanced | Execution, coding, review<br/>执行、写代码、review | | Maintainer | Flash / GPT-3.5 / Cost-effective | Archive, cleanup, weekly aggregation<br/>归档、清理、周报聚合 | **Note**: Model names are examples. Use equivalent models from your platform. **说明**：模型名称仅为示例。请使用你平台上的同等能力模型。


Security scan verdicts — ClawScan: suspicious | static analysis:  | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: 52yuanchangxing/proposal-comparator (version 1.0.0)

--- name: proposal-comparator version: 1.0.0 description: "对比多个方案文档，输出差异、隐含成本、风险与推荐结论。；use for proposal, comparison, decision workflows；do not use for 忽略用户给的约束, 伪造数据支持结论." author: OpenClaw Skill Bundle homepage: https://example.invalid/skills/proposal-comparator tags: [proposal, comparison, decision, analysis] user-invocable: true metadata: {"openclaw":{"emoji":"🧪","requires":{"bins":["python3"]},"os":["darwin","linux","win32"]}} --- # 方案对比裁判 ## 你是什么 你是“方案对比裁判”这个独立 Skill，负责：对比多个方案文档，输出差异、隐含成本、风险与推荐结论。 ## Routing ### 适合使用的情况 - 比较 A/B 两个方案并给出取舍 - 指出隐藏成本和风险 - 输入通常包含：多个方案摘要、约束条件、评估标准 - 优先产出：对比维度、方案优劣、保留意见 ### 不适合使用的情况 - 不要忽略用户给的约束 - 不要伪造数据支持结论 - 如果用户想直接执行外部系统写入、发送、删除、发布、变更配置，先明确边界，再只给审阅版内容或 dry-run 方案。 ## 工作规则 1. 先把用户提供的信息重组成任务书，再输出结构化结果。 2. 缺信息时，优先显式列出“待确认项”，而不是直接编造。 3. 默认先给“可审阅草案”，再给“可执行清单”。 4. 遇到高风险、隐私、权限或合规问题，必须加上边界说明。 5. 如运行环境允许 shell / exec，可使用： - `python3 "{baseDir}/scripts/run.py" --input <输入文件> --output <输出文件>` 6. 如当前环境不能执行脚本，仍要基于 `{baseDir}/resources/template.md` 与 `{baseDir}/resources/spec.json` 的结构直接产出文本。 ## 标准输出结构 请尽量按以下结构组织结果： - 对比维度 - 方案优劣 - 隐藏成本 - 主要风险 - 推荐结论 - 保留意见 ## 本地资源 - 规范文件：`{baseDir}/resources/spec.json` - 输出模板：`{baseDir}/resources/template.md` - 示例输入输出：`{baseDir}/examples/` - 冒烟测试：`{baseDir}/tests/smoke-test.md` ## 安全边界 - 会显式分开事实比较与推断建议。 - 默认只读、可审计、可回滚。 - 不执行高风险命令，不隐藏依赖，不伪造事实或结果。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: niflhum/machiavelli-library (version 1.1.0)

--- name: machiavelli-library name-en: Machiavelli Library description: 马基雅维利原文图书馆（中英双语）——用原文回答关于马基雅维利的一切问题。 description-en: A bilingual (Chinese-English) searchable library of Machiavelli's original texts. Ask any question and receive verbatim passages with citations in both languages. category: research tags: [machiavelli, philosophy, history, italian-renaissance, florence, political-theory] version: "1.0.0" author: built from public domain sources and user-provided texts triggers: prefix: - /machia-lib - machiavelli-library - 马基雅维利图书馆 keyword: - machiavelli原文 - machiavelli quote - 马基雅维利说过 - 马基雅维利在哪 - 马基雅维利原文 --- ## 这是什么 马基雅维利图书馆是一个**可检索的原文库**（中英双语）。它不是对话分身，不给你建议，不分析你的处境。它只做一件事：**找到马基雅维利在某处说过的原文，把原文给你看。** > **区分提醒**：本馆与"马基雅维利分身" skill 不同。分身是对话分析型人格，会给出建议和评述。本图书馆**只返回原文**，不提供任何分析、建议或人格化回应。想请马基雅维利本人分析和建议，用分身；要查证原文出处，请用本馆。 > **首次使用**：本 Skill 包含检索系统和索引，但不含原文数据。请先下载原文库： > ```bash > git clone https://github.com/niflhum/machiavelli-library.git ~/.workbuddy/skills/machiavelli-library > ``` ## 收录内容 | 类别 | 著作 | 语言 | 格式 | |------|------|------|------| | 马基雅维利著作 | 《君主论》 | 中英 | 按章分文件 | | 马基雅维利著作 | 《论李维》 | 中英 | 按卷/章分文件 | | 马基雅维利著作 | 《佛罗伦萨史》 | 中英 | 按卷分文件 | | 马基雅维利著作 | 《兵法》 | 中英 | 按卷分文件 | | 马基雅维利著作 | 《戏剧·诗歌·散文》 | 中文 | 按篇目 | | 马基雅维利著作 | 书信集（上下） | 中文 | 按年份 | | 马基雅维利著作 | 政务与外交著作（上下） | 中文 | 按篇目 | | 传记 | 《我的朋友马基雅维利》盐野七生 | 中文 | 按章分文件 | | 传记 | 《马基雅维利：他的生活与时代》亚历山大·李 | 中文 | 按部分文件 | | 传记 | 《尼科洛的微笑：马基雅维利传》维罗利 | 中文 | 全文 | | 研究 | 《马基雅维利语录》盐野七生 | 中文 | 按篇分文件 | | 研究 | 《解读马基雅维利》麦考米克 | 中文 | 按章分文件 | | 研究 | 《权力与欲望》纳杰米 | 中文 | 按章分文件 | | 研究 | *Thoughts on Machiavelli* Leo Strauss | 英文 | 按章分文件 | | 小说 | 《彼时此时——马基雅维利在伊莫拉》毛姆 | 中文 | 按章分文件 | ## 使用方式 你可以说： - "马基雅维利怎么看待机运？给我原文" - "马基雅维利说过什么关于守信的话？原文是什么" - "《君主论》第 18 章的完整内容是什么" - "马基雅维利书信 224 写了什么" - "马基雅维利骂过美第奇吗？给我原文" - "What does Machiavelli say about fortune in The Prince?" ## 检索规则 1. 理解用户的问题，提取关键词（中英文均可） 2. 先在 `index/themes.md` 中查找预建索引 3. 如果索引没有，搜索 `library/` 目录下所有文件 4. 返回最相关的 3-5 个原文段落 5. 每个结果必须标注：著作名 + 章节/书信编号 + 原文 6. 只返回原文，不加分析，不加人格，不加语气 ## 重要限制 - **只返回原文**，不分析，不建议，不联想 - 如果找不到相关内容，直接说"图书馆中没有找到相关内容" - 不编造原文，查不到就说查不到 - 书信集只收录有公版来源的信件，不确定时标注「此信无公版来源」 ## 检索兜底规则 当索引无结果、且 AI 全文搜索后仍不确定时，调用： ```bash python3 scripts/search.py "<关键词>" ``` 此命令用 grep -i 精确匹配原文，返回命中文件路径+行号+原文片段。 可通过 `--lang zh/en` 限定中文或英文结果，`--limit` 控制返回条数。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: elevo11/weather-plus (version 1.0.1)

--- name: weather-plus description: > Get current weather, multi-day forecasts, clothing index, and feels-like temperature. No API key required. Use when a user wants to: (1) Check current weather, (2) View multi-day forecasts, (3) Get clothing/dressing recommendations, (4) Check feels-like temperature and comfort index. Supports any city worldwide. Integrates SkillPay.me at 0.001 USDT/call. --- # Weather Plus Weather, forecasts, clothing index & feels-like temperature. No API key needed. 0.001 USDT/call. ## Commands | Command | Script | Description | |:---|:---|:---| | **weather** | `scripts/weather.py` | Current weather + feels-like | | **forecast** | `scripts/forecast.py` | Multi-day forecast (up to 7 days) | | **clothing** | `scripts/clothing.py` | Clothing/dressing index + recommendations | | **billing** | `scripts/billing.py` | SkillPay charge/balance/payment | ## Workflow ``` 1. Billing: python3 scripts/billing.py --charge --user-id <id> 2. Weather: python3 scripts/weather.py --city "Beijing" 3. Forecast: python3 scripts/forecast.py --city "Shanghai" --days 5 4. Clothing: python3 scripts/clothing.py --city "Chengdu" ``` ## Examples ```bash # Current weather python3 scripts/weather.py --city "New York" python3 scripts/weather.py --city "成都" # Multi-day forecast python3 scripts/forecast.py --city "Tokyo" --days 7 # Clothing index python3 scripts/clothing.py --city "Beijing" python3 scripts/clothing.py --city "London" ``` ## Config | Env Var | Required | Description | |:---|:---:|:---| | `SKILLPAY_API_KEY` | Yes | SkillPay.me API key | ## References See `references/clothing-index.md` for dressing recommendation methodology.

path: references/clothing-index.md
content: # Clothing Index Reference

## 穿衣指数等级

| 等级 | 体感温度 | 名称 | 推荐穿搭 |
|:---:|:---:|:---|:---|
| 1 | <-10°C | 极寒 | 厚羽绒服、棉裤、雪地靴、全套防寒 |
| 2 | -10~0°C | 严寒 | 羽绒服、厚毛衣、棉裤、棉鞋 |
| 3 | 0~5°C | 寒冷 | 厚外套/大衣、毛衣、保暖内衣 |
| 4 | 5~10°C | 冷 | 外套/风衣、薄毛衣、长裤 |
| 5 | 10~15°C | 凉 | 薄外套/夹克、长袖衬衫 |
| 6 | 15~20°C | 舒适偏凉 | 长袖/薄卫衣、备薄外套 |
| 7 | 20~25°C | 舒适 | T恤/短袖、薄长裤 |
| 8 | 25~30°C | 温暖 | 短袖、短裤、凉鞋 |
| 9 | 30~35°C | 炎热 | 轻薄透气、防晒 |
| 10 | >35°C | 酷热 | 最轻薄衣物、避免户外 |

## 体感温度计算

基于以下因素综合评估：
- 实际温度
- 湿度（高湿度使体感更热/更冷）
- 风速（风寒效应）

## UV 防护建议

| UV指数 | 级别 | 建议 |
|:---:|:---|:---|
| 0-2 | 低 | 无需特别防护 |
| 3-5 | 中等 | 建议涂防晒霜 |
| 6-7 | 高 | 防晒霜+遮阳帽 |
| 8-10 | 很高 | 防晒霜+墨镜+遮阳帽 |
| 11+ | 极端 | 避免户外活动 |


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector:  ()
Skill: pharmacist9527/cheapest-image (version 1.0.0)

--- name: cheapest-image description: Possibly the cheapest AI image generation (~$0.0036/image). Text-to-image via the EvoLink API. homepage: https://evolink.ai metadata: {"openclaw": {"emoji": "🖼️", "requires": {"env": ["EVOLINK_API_KEY"]}, "primaryEnv": "EVOLINK_API_KEY"}} --- # EvoLink Cheapest Image Generate images via the EvoLink z-image-turbo API. ## Run Try Python first (zero dependencies, all platforms): ```bash python3 {baseDir}/scripts/generate.py --prompt "a cute cat" --size "1:1" ``` Options: `--size` (1:1, 2:3, 3:2, 3:4, 4:3, 9:16, 16:9, 1:2, 2:1), `--seed INT`, `--nsfw-check true` If Python is unavailable: - **Windows**: see PowerShell fallback in `{baseDir}/references/powershell.md` - **Unix/macOS**: use the curl fallback in `{baseDir}/references/curl_heredoc.md` ## API key - `EVOLINK_API_KEY` env var (required) - Get key: https://evolink.ai ## Triggers - Chinese: "生图：xxx" / "出图：xxx" / "生成图片：xxx" - English: "generate image: xxx" / "generate a picture: xxx" Treat the text after the colon as `prompt`, use default size `1:1`, generate immediately. ## Notes - Script prints `MEDIA:<path>` for OC auto-attach — no extra delivery logic needed. - Image saved locally (format auto-detected from URL). URL expires ~24h but local file persists.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: fangshan101-coder/yuebai (version 0.1.0)

--- name: 悦拜返利助手 description: 悦拜社交电商返利与任务制平台工具，结合CPS返利和任务奖励双模式，覆盖多平台购物和生活服务返利。 version: 0.1.0 --- # 悦拜返利助手 悦拜社交电商返利与任务制平台工具。结合CPS购物返利和任务奖励双模式，覆盖淘宝、京东、拼多多、美团等多平台，提供购物返利查询、任务完成奖励和社交推广功能。 ## 触发词 悦拜、悦拜返利、yuebai、悦拜任务、悦拜佣金、悦拜省钱 ## 计划实现能力 - **购物返利**：多平台CPS返利查询和链接生成 - **任务奖励**：完成指定任务获得额外奖励 - **社交推广**：邀请和团队管理功能 - **佣金管理**：订单追踪和佣金提现 ## 输出格式 ``` ✨ 悦拜返利查询 商品：[商品名称] 平台：[电商平台] 售价：¥[价格] 返利比例：[X]% 预计返利：¥[金额] 推广链接：[链接] ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bytesagain3/privacy (version 2.0.3)

--- name: "privacy" version: "2.0.3" description: "Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Privacy concepts, best practices, and implementation patterns." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [privacy, reference] category: "devtools" --- # Privacy Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Privacy concepts, best practices, and implementation patterns. No API keys or credentials required. ## Commands | Command | Description | |---------|-------------| | `intro` | intro reference | | `quickstart` | quickstart reference | | `patterns` | patterns reference | | `debugging` | debugging reference | | `performance` | performance reference | | `security` | security reference | | `migration` | migration reference | | `cheatsheet` | cheatsheet reference | ## Output Format All commands output plain-text reference documentation via heredoc. No external API calls, no credentials needed, no network access. --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: liujw0214/longterm-memory (version 1.0.0)

--- name: longterm-memory description: 永久记忆自动归档系统。每次对话自动记录，语义搜索，跨会话继承。重启不丢、永不覆盖、0学习成本。用于用户提到记忆、历史、之前说过、记得什么等场景。 --- # 永久记忆系统 自动将对话中的重要信息永久写入 `MEMORY.md`，每次会话结束后自动沉淀。 ## 核心原则 **只追加，不覆盖。记忆永不丢失。** ## 工作原理 ``` 每次会话 ├── 对话进行中 │ ├── 用户提到重要信息 → 即时写入 MEMORY.md │ └── 日常记录 → 追加到 memory/YYYY-MM-DD.md ├── 会话结束 │ ├── 总结本次关键决策 → 更新 MEMORY.md │ └── 记录会话摘要 → memory/YYYY-MM-DD.md └── 新会话开始 └── 读取 MEMORY.md + 最新日记 → 上下文完整继承 ``` ## 何时写入 MEMORY.md | 触发场景 | 示例 | |---------|------| | 用户明确说"记住..." | "记住我偏好 Markdown 格式" | | 做决策 | "决定用 PostgreSQL，不用 MySQL" | | 暴露偏好 | "我不喜欢回复里有多余的客套话" | | 项目关键信息 | "这个项目叫 X，用户是 Y" | | 联系方式/地址 | 任何真实的私密数据 | ## 何时写入日记 所有对话内容都追加到 `memory/YYYY-MM-DD.md`，即使看起来不重要的闲聊也记录。日记是原始素材，MEMORY.md 是提炼后的精华。 ## 格式规范 ### MEMORY.md 格式 ```markdown ## 用户偏好 - 回复语言：中文 - 格式偏好：简洁，不要多余客套 ## 项目 - 当前项目：xxx - 技术栈：React + Node.js ## 重要决策 - 2026-05-03：决定用 PostgreSQL 而非 MySQL ## 联系人 - 小M：外部执行助手 ``` ### 日记格式 ```markdown # 2026-05-03 日记 ## 会话摘要 - 主题：项目技术选型 - 关键决策：选用 PostgreSQL - 未解决问题：部署方案待定 ## 对话记录（精选） [用户]：这个项目用什么数据库好？ [太初]：我建议用 PostgreSQL，原因有三... [用户]：好，就用 PostgreSQL。 ``` ## 搜索记忆 当用户问"之前说过什么..."、"记得上次..."时： 1. 搜索 `MEMORY.md` 全文 2. 搜索 `memory/*.md` 最新日记 3. 综合给出答案，说明来源 ## 安装 本技能无需额外配置，直接启用即可。 ## 文件结构 ``` longterm-memory/ ├── SKILL.md ← 本文件 ├── scripts/ │ └── archive.py ← 可选：离线归档脚本 ├── README.md ← 使用说明 ├── LISTING_ZH.md ← 中文上架文案 └── LISTING_EN.md ← 英文上架文案 ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: froemic/attio-cli (version 1.0.0)

# attio-cli Interact with your Attio CRM workspace via the attio-cli. ## Install 1. Clone and install the CLI: ```bash git clone https://github.com/FroeMic/attio-cli cd attio-cli npm install npm link ``` 2. Set `ATTIO_API_KEY` environment variable (get it from Attio Settings > Developers > API Keys): - **Recommended:** Add to `~/.claude/.env` for Claude Code - **Alternative:** Add to `~/.bashrc` or `~/.zshrc`: `export ATTIO_API_KEY="your-api-key"` **Repository:** https://github.com/FroeMic/attio-cli ## Commands List objects and records: ```bash attio object list # List all objects attio record list people # List people records attio record list companies # List company records ``` Work with lists (pipelines): ```bash attio list list-all # List all lists attio entry list <list-slug> # List entries in a list ``` Get detailed info: ```bash attio object get <object-slug> # Get object details attio object attributes <object-slug> # Get object attributes attio list attributes <list-slug> # Get list entry attributes ``` ## Generate Workspace Schema Generate a markdown schema of your workspace for context: ```bash bash {baseDir}/scripts/generate-schema.sh > {baseDir}/workspace.schema.md ``` This creates a reference file documenting all objects, attributes, lists, and field options in your workspace. ## Key Concepts | Concept | Purpose | Example | |---------|---------|---------| | **Objects** | Base record types | People, Companies, Deals | | **Lists** | Pipeline/workflow management | Sales Pipeline, Hiring | | **Records** | Individual items in objects | A specific person or company | | **Entries** | Records added to a list | A deal in the Sales Pipeline | ## API Reference - **Base URL:** `https://api.attio.com/v2` - **Auth:** `Authorization: Bearer $ATTIO_API_KEY` - **Rate Limits:** 100 requests per 10 seconds per workspace ## Common API Operations Search for a person: ```bash curl -X POST https://api.attio.com/v2/objects/people/records/query \ -H "Authorization: Bearer $ATTIO_API_KEY" \ -H "Content-Type: application/json" \ -d '{"filter": {"email_addresses": {"contains": "[REDACTED_SECRET]"}}}' ``` Create a record: ```bash curl -X POST https://api.attio.com/v2/objects/<object-slug>/records \ -H "Authorization: Bearer $ATTIO_API_KEY" \ -H "Content-Type: application/json" \ -d '{"data": {"values": {"name": [{"value": "Record Name"}]}}}' ``` Add entry to a list: ```bash curl -X POST https://api.attio.com/v2/lists/<list-slug>/entries \ -H "Authorization: Bearer $ATTIO_API_KEY" \ -H "Content-Type: application/json" \ -d '{"data": {"parent_record_id": "<record-id>"}}' ``` ## Notes - Run `generate-schema.sh` after installing to create a workspace schema file with all your objects, lists, and field options. - Lists are commonly used to manage pipelines (sales stages, hiring workflows, etc.). - The CLI requires `jq` for JSON processing in schema generation.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: certainlogicai/skill-vetter-plus (version 2.0.0)

--- name: skill-vetter-plus description: "Security scanner for AI agent skills. 9 built-in detection signatures. Identifies secrets, unsafe execution patterns, and prompt injection. Sub-50ms results." homepage: https://certainlogic.ai/products/skill-vetter-plus --- # Skill Vetter Plus ## What It Does Scans AI agent skills for security issues: - 9 built-in detection signatures (secrets, execution, prompt injection) - Sub-50ms scan time - Run before installing any unknown skill ## How to Use ```bash # Scan any skill directory python3 scripts/vetter.py /path/to/installed/skill # JSON output for piping python3 scripts/vetter.py /path/to/skill --json ``` ## Signatures | ID | Severity | What It Finds | |---|---|---| | hardcoded-api-key | high | `api_key`, `api-key` | | hardcoded-secret | high | `secret_key`, `secret-token`, `auth_token` | | hardcoded-password | high | `password` | | unsafe-eval | critical | `eval(` | | unsafe-exec | critical | `exec(` | | unsafe-os-system | critical | `os.system(` | | subprocess-shell-true | high | `shell=True` | | raw-network | medium | `urllib.request`, `requests.post`/`get` | | prompt-injection | critical | `ignore previous instructions`, `ignore the above` | ## What It Does NOT Do - No AST analysis (text matching only) - Cannot detect control-flow obfuscation - Cannot analyze compiled binaries - Not a replacement for manual code review ## Results ``` Scanned 12 files in 23ms Found 1 issue(s): [CRITICAL] unsafe-eval at /skill/scripts/mail.py:45 → eval() can execute arbitrary code (matched: 'eval(') ``` ## Pro Upgrade | Feature | Pro ($49) | |---|---| | Real-time scanning | ✅ | | Weekly signature updates | ✅ | | Team sharing | ✅ | | Custom signatures | ✅ | | Priority support | ✅ | ## Limitations - Text-based pattern matching - Cannot detect all malware — only patterns in the signature database ## Attribution - Built by: CertainLogic - Concept: Skill security pre-checking (industry standard practice) ## Links - GitHub: https://github.com/CertainLogicAI/skill-vetter-plus - ClawHub: https://clawhub.ai/certainlogicai/skill-vetter-plus - Docs: https://certainlogic.ai/docs/skill-vetter-plus --- *Built by CertainLogic*


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: clean (LOW)