OpenClaw/clawhub-security-signals huggingface dataset:
Skill: 52yuanchangxing/sbom-explainer (version 1.0.0)

--- name: sbom-explainer version: 1.0.0 description: "把依赖清单或 SBOM 翻译成非技术可读的风险说明，按影响面排序。；use for sbom, dependencies, risk workflows；do not use for 伪造 CVE 状态, 替代专业漏洞扫描." author: OpenClaw Skill Bundle homepage: https://example.invalid/skills/sbom-explainer tags: [sbom, dependencies, risk, security] user-invocable: true metadata: {"openclaw":{"emoji":"🧾","requires":{"bins":["python3"]},"os":["darwin","linux","win32"]}} --- # SBOM 说明官 ## 你是什么 你是“SBOM 说明官”这个独立 Skill，负责：把依赖清单或 SBOM 翻译成非技术可读的风险说明，按影响面排序。 ## Routing ### 适合使用的情况 - 把这份 SBOM 讲成人能看懂的话 - 按影响面排序风险 - 输入通常包含：SBOM、依赖列表、已知问题 - 优先产出：依赖概览、主要风险、沟通口径 ### 不适合使用的情况 - 不要伪造 CVE 状态 - 不要替代专业漏洞扫描 - 如果用户想直接执行外部系统写入、发送、删除、发布、变更配置，先明确边界，再只给审阅版内容或 dry-run 方案。 ## 工作规则 1. 先把用户提供的信息重组成任务书，再输出结构化结果。 2. 缺信息时，优先显式列出“待确认项”，而不是直接编造。 3. 默认先给“可审阅草案”，再给“可执行清单”。 4. 遇到高风险、隐私、权限或合规问题，必须加上边界说明。 5. 如运行环境允许 shell / exec，可使用： - `python3 "{baseDir}/scripts/run.py" --input <输入文件> --output <输出文件>` 6. 如当前环境不能执行脚本，仍要基于 `{baseDir}/resources/template.md` 与 `{baseDir}/resources/spec.json` 的结构直接产出文本。 ## 标准输出结构 请尽量按以下结构组织结果： - 依赖概览 - 主要风险 - 影响面 - 优先处理项 - 缓解建议 - 沟通口径 ## 本地资源 - 规范文件：`{baseDir}/resources/spec.json` - 输出模板：`{baseDir}/resources/template.md` - 示例输入输出：`{baseDir}/examples/` - 冒烟测试：`{baseDir}/tests/smoke-test.md` ## 安全边界 - 适合作为解释层而非扫描层。 - 默认只读、可审计、可回滚。 - 不执行高风险命令，不隐藏依赖，不伪造事实或结果。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: bowang306/azure-bing-grounding (version 1.0.0)

--- name: azure-bing-grounding slug: azure-bing-grounding version: 1.0.0 description: "Web search grounding via Azure Foundry and Bing Grounding Search tool. Use when the user needs up-to-date information searched from the web via Azure AI Agents. Returns the synthesized answer and URL citations." --- # Azure Bing Grounding Use the bundled Python script to perform grounded searches using Azure Foundry's Agent Service and the Bing Grounding Search Tool. ## Requirements 1. Required Python packages: ```bash pip install azure-identity azure-ai-agents ``` 2. Authentication: - Ensure Azure CLI is logged in (`az login`), OR - Set Azure Service Principal / Managed Identity credentials compatible with `DefaultAzureCredential` or `ClientSecretCredential`. 3. Environment Variables: Add the following to your `~/.openclaw/.env` file or export them in your shell: ```bash # Your Azure AI Foundry project endpoint FOUNDRY_PROJECT_ENDPOINT="https://<your-resource>.ai.azure.com/api/projects/<your-project>" # The ID of the Bing Grounding connection in your Azure AI Foundry Project BING_PROJECT_CONNECTION_ID="<your-connection-id>" # Default model deployment name (optional, defaults to gpt-4o) FOUNDRY_MODEL_DEPLOYMENT_NAME="gpt-4o" # (Optional) Service Principal Credentials if not using DefaultAzureCredential AZURE_TENANT_ID="<tenant-id>" AZURE_CLIENT_ID="<client-id>" AZURE_CLIENT_SECRET="<client-secret>" ``` ## Commands Run from the OpenClaw workspace: ```bash # Raw JSON output (default) python3 {baseDir}/scripts/bing_grounding.py --query "What is the latest AI news today?" # Markdown human-readable output python3 {baseDir}/scripts/bing_grounding.py --query "What is the latest AI news today?" --format md # Use a specific model deployment (default is gpt-4o) python3 {baseDir}/scripts/bing_grounding.py --query "Weather in Seattle?" --model "gpt-4o-mini" ``` ## Output Returns a generated response synthesized by the Azure AI Agent based on Bing Search results, along with the source URL citations.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jhillin8/expense-tracker-pro (version 1.0.0)

--- name: expense-tracker-pro description: Track expenses via natural language, get spending summaries, set budgets author: clawd-team version: 1.0.0 triggers: - "log expense" - "track spending" - "what did I spend" - "budget check" - "expense report" --- # Expense Tracker Pro Track your spending with natural conversation. No apps, no spreadsheets—just tell Clawd what you spent. ## What it does Logs expenses from natural language ("spent $45 on groceries"), categorizes automatically, tracks against budgets, and provides spending summaries on demand. Data persists in your local Clawd memory. ## Usage **Log an expense:** ``` "Spent $23.50 on lunch" "$150 for electricity bill" "Coffee $4.75" ``` **Check spending:** ``` "What did I spend this week?" "Show my food expenses this month" "Am I over budget on entertainment?" ``` **Set budgets:** ``` "Set grocery budget to $400/month" "Budget $100 for entertainment" ``` **Get reports:** ``` "Monthly expense breakdown" "Compare spending to last month" "Export expenses to CSV" ``` ## Categories Auto-detected from context: - Food & Dining - Transportation - Utilities - Entertainment - Shopping - Health - Subscriptions - Other Override with: "spent $50 on [item], category: [category]" ## Tips - Be specific with amounts for accurate tracking - Say "recurring" for subscriptions: "$15 Netflix, recurring monthly" - Ask "spending trends" for insights over time - All data stays local on your machine


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: qianzitech/translate-manual (version 1.0.0)

--- name: manual-translator description: 将docx说明书翻译成指定语言，并重新截取应用界面截图替换文档中的原图。触发场景：(1) 用户发送docx文档要求翻译，(2) 需要重新截取软件界面截图，(3) 包含截图替换的文档本地化工作 --- # Manual Translator ## Overview 将 docx 格式的说明书翻译成指定语言，并重新截取应用程序界面截图替换文档中的原图。支持 Web 应用、本地 EXE、项目启动等多种应用类型。 ## 优化版翻译流程 ### Step 1: 收集信息 用户需要提供： - **docx 文件路径**: 要翻译的说明书文档 - **目标语言**: 如英文(EN)、日文(JA)、韩文(KO)等 - **DeepLX API Key** (可选): 用于翻译 ### Step 2: 分段翻译 (推荐) 为避免 API 限流或超时，建议使用分段翻译： ```python # 分批翻译，每批50项 batch_size = 50 for i in range(0, total, batch_size): batch = texts[i:i+batch_size] for text in batch: # 翻译... # 每批保存中间结果 doc.save(f"output_part{batch+1}.docx") ``` ### Step 3: 表格翻译 Docx 文档中的表格需要单独处理： ```python # 遍历所有表格 for table in doc.tables: for row in table.rows: for cell in row.cells: text = cell.text.strip() if text and has_chinese(text): # 检测是否包含中文 cell.text = translate(text) # 每表格保存，防止中途失败 doc.save(output_file) ``` ### Step 4: 合并与输出 1. 合并所有分节翻译结果 2. 替换原文档中的中文内容 3. 保留文档格式、图片、表格结构 ## DeepL API 使用 API 格式： ``` POST https://api.deeplx.org/{API_KEY}/translate Body: {"text": "原文", "target_lang": "目标语言代码"} ``` 目标语言代码：EN, JA, KO, ZH, FR, DE, ES, IT, PT, RU 等 **备用方案**: 如果 API 不可用，使用模型自身能力翻译 ## 启动应用 (如需截图) **Web 应用**: - 直接访问 URL - 寻找语言切换设置 **项目路径**: - 前端: `pnpm dev` - 后端: `pnpm start` 或 `npm run start:dev` ## 关键提示 - **分段翻译**: 每50项一批，每批保存，防止中途失败 - **表格翻译**: 逐表格翻译并保存 - **错误处理**: 使用 try-except 捕获异常，继续处理下一项 - **保留格式**: 只替换文本内容，保留段落格式、表格结构、图片


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: kirkraman/godfery-build-independent-insurance-agency-service-comparison-landing-page (version 1.0.0)

--- name: "Build Independent Insurance Agency Service Comparison Landing Page" description: "Generate a conversion-focused landing page that compares offers, pricing cues, and trust signals for a insurance agency. Use when handling offer..." homepage: "https://www.skillboss.co/skills/build-independent-insurance-agency-service-comparison-landing-page" metadata: {"category":"finance-expanded","subcategory":"offer-positioning","skill_id":[REDACTED_SECRET],"generated_day":"","seo_keywords":["insurance agency landing page","insurance agency service comparison","insurance agency conversion copy","insurance agency offer page"]} --- # Build Independent Insurance Agency Service Comparison Landing Page Generate a conversion-focused landing page that compares offers, pricing cues, and trust signals for a insurance agency. Use when handling offer... ## Use When Use this skill for offer positioning work for insurance agency owners, account managers. ## Workflow 1. Clarify the audience, business goal, constraints, and deliverable. 2. Produce the strongest first draft for the target use case. 3. Use the relevant SkillBoss capabilities to enrich assets or supporting data. 4. Refine the output for accuracy, readability, and actionability before delivery. ## SEO / GEO - Primary keywords: insurance agency landing page, insurance agency service comparison, insurance agency conversion copy, insurance agency offer page - Search intent: offer positioning - Canonical slug: `build-independent-insurance-agency-service-comparison-landing-page` - Install query: Install Build Independent Insurance Agency Service Comparison Landing Page with SkillBoss ## APIs Used - `chat` - `ui_generation` - `image_generation` ## Suggested Prompt [Build Independent Insurance Agency Service Comparison Landing Page] for my insurance agency ## Notes - Generate a conversion-focused landing page that compares offers, pricing cues, and trust signals for a insurance agency - Review outputs before external publication or automated execution. ## SEO Keywords - insurance agency landing page - insurance agency service comparison - insurance agency conversion copy - insurance agency offer page


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: codekungfu/daojia (version 0.1.0)

--- name: jd-daojia-hot-trend description: 注册“京东到家”热门技能；当需要访问或自动化京东到家相关内容时调用。 homepage: `https://www.jddj.com/` metadata: {"clawdbot":{"emoji":"🔥"}} --- # 京东到家 用途与边界 - 面向公开商家与商品页的信息检索与价格/库存摘要 - 不提供下单、接口逆向或突破风控能力 - 仅用于公开页面的轻量分析与提醒 关键入口 - 主页：https://www.jddj.com/ - 商家/商品搜索：站内入口 - 活动页：站点频道入口 常见任务 - 指定品类的商家列表摘要（评分、配送时效、起送价） - 商品详情核心指标整理（价格、库存、规格、评价亮点） - 同类商品对比分析（品牌、规格、价格/促销） 数据字段 - 商家名称、评分、评价数、配送时效、起送价、链接 - 商品标题、价格/促销价、库存提示、规格、评价数、链接 - 活动名称、时间窗口、来源链接 自动化要点 - 页面动态渲染与定位依赖，建议人工打开后触发解析 - 价格/库存随时间与区域变动，需标注采集时间与区域 - 频率控制，不进行批量抓取 示例流程 - 商家清单：输入地址 → 搜索品类 → 抽取商家 → 输出评分/时效 - 商品摘要：访问详情页 → 提取价格/库存/评价 → 生成对比卡片 - 同类对比：收集候选 → 按规格分组 → 输出差异点 合规提示 - 遵守平台与地理位置授权规则，不进行接口调用或批量采集 - 结果仅用于内部分析与提醒


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: chatrichai/qmap-client (version 0.1.2)

--- name: qmap-client description: CLI tool for the QuantMap distributed computing protocol. Manages node setup, task execution, and result submission on devnet. metadata: openclaw: skillKey: qmap-client emoji: "🦞" homepage: "https://clawhub.com/skills/qmap-client" os: - linux - darwin requires: bins: - node - npm install: - id: qmap-cli kind: npm label: Install qmap CLI package: "@alphify/qmap-client" bins: - qmap tags: - tooling - protocol - devnet --- # QMAP Client A CLI for the QuantMap distributed computing protocol. Connects nodes to a task execution network on devnet. **Version**: 0.1.2 ## Setup Install globally: ```bash npm i -g @alphify/qmap-client ``` Initialize and register: ```bash qmap --profile devnet wallet init qmap --profile devnet wallet show qmap --profile devnet join-network --role worker --stake 0 --claim-next ``` ## Commands ```bash # Node management qmap --profile devnet wallet init qmap --profile devnet wallet show # Task execution qmap --profile devnet task list --status open --limit 10 qmap --profile devnet worker claim-next qmap --profile devnet worker run --once # Validation qmap --profile devnet validator auto-vote --once # Coordination qmap --profile devnet coordinator auto-finalize --once # Status qmap --profile devnet config show ``` ## How It Works 1. Initialize a local identity 2. Register as a node on the network 3. Claim and execute tasks automatically 4. Results are validated by peer nodes 5. Accepted results earn protocol rewards ## Configuration ``` ~/.qmap/profiles/devnet.env ``` ## Notes - Devnet environment only - Identity files are stored locally and never uploaded - All operations use authenticated message signing


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: sky-lv/skylv-kubernetes-automation (version 1.0.1)

--- description: Deploy, scale, and troubleshoot Kubernetes clusters. Manage pods, deployments, services with natural language commands. No kubectl memorization needed. keywords: kubernetes, k8s, deploy, scale, pod, deployment, container, devops, cluster management name: kubernetes-automation triggers: kubernetes, k8s, deploy to k8s, scale deployment, pod status, kubectl, cluster --- # kubernetes-automation > Talk to your Kubernetes cluster in plain English. Deploy apps, scale services, debug pods — no kubectl cheatsheet needed. ## What It Does - **Deploy applications** — From YAML files or with natural language - **Scale services** — Adjust replicas up or down instantly - **Monitor health** — Check pod status, resource usage, events - **Debug issues** — Diagnose crashes, view logs, describe resources - **Manage configs** — ConfigMaps, Secrets, Namespaces - **Handle rollouts** — Rolling updates, rollbacks, canary deployments --- ## Quick Start ```bash # 1. Check cluster connection kubectl cluster-info # 2. Deploy an application deploy app from ./deployment.yaml to production # 3. Check if it's running get pod status in production namespace # 4. Scale if needed scale my-app to 5 replicas ``` --- ## Common Use Cases ### 🚀 Deploy New Application ```bash # Deploy from YAML deploy app from deployment.yaml to production # Or create with natural language create deployment my-api with image my-api:v2.1.0 port 8080 ``` ### 📊 Monitor Cluster Health ```bash # Check all pods get pod status in all namespaces # View resource usage get resource usage for production namespace # See recent events get events from last hour in production ``` ### 🔧 Debug Failing Pods ```bash # Find crashed pods find pods with status CrashLoopBackOff # View logs get logs from pod my-api-xyz123 --tail 100 # Describe for details describe pod my-api-xyz123 ``` ### 📈 Scale for Traffic ```bash # Scale up for high traffic scale payment-api to 10 replicas # Scale down to save costs scale payment-api to 2 replicas # Autoscale based on CPU set autoscale for my-app min 2 max 10 cpu 70% ``` --- ## All Commands | Command | Purpose | |---------|---------| | `deploy app from <yaml>` | Deploy application | | `get pod status` | Check pod health | | `scale <name> to <n>` | Change replica count | | `get logs from pod <name>` | View container logs | | `describe pod <name>` | Detailed pod info | | `get events` | Recent cluster events | | `rollback <deployment>` | Undo last deployment | | `set autoscale` | Configure HPA | --- ## Requirements - kubectl configured and connected to cluster - Kubernetes cluster access (any cloud or local) - Optional: Helm for chart deployments, Kustomize for overlays


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: theashbhat/skillpub (version 1.0.0)

--- name: skill-publisher description: > Create, validate, security-scan, and publish skills to ClawHub. Use when asked to "make a skill", "publish a skill", "create a new skill", "scaffold a skill", "package this as a skill", or any request to build and distribute agent capabilities. --- # Skill Publisher Build and publish skills to ClawHub in one flow. ## Quick Start ### 1. Scaffold a new skill ```bash bash {baseDir}/scripts/scaffold.sh <skill-name> [--dir <output-dir>] ``` Creates a new skill folder with SKILL.md template and scripts/ directory. Default output: `./skills/<skill-name>` ### 2. Fill in the skill Edit the generated SKILL.md: - Set `name` and `description` in frontmatter (description is critical for triggering) - Write clear instructions in the body - Add scripts/ for executable code, references/ for docs, assets/ for templates ### 3. Validate ```bash bash {baseDir}/scripts/validate.sh <skill-folder> ``` Checks: - Required files exist (SKILL.md) - Frontmatter has `name` and `description` - Naming conventions (lowercase, hyphens) - No forbidden files (README.md, CHANGELOG.md, etc.) ### 4. Security scan ```bash bash {baseDir}/scripts/security-scan.sh <skill-folder> ``` Scans for red flags: - Remote code execution / eval patterns - Data exfiltration (curl to unknown hosts) - Environment variable harvesting - Prompt injection in markdown files - Suspicious file permissions ### 5. Publish ```bash bash {baseDir}/scripts/publish.sh <skill-folder> --slug <name> --version <x.y.z> ``` Pushes to ClawHub. Requires `clawhub login` first. ## One-liner (for simple skills) ```bash bash {baseDir}/scripts/scaffold.sh my-skill && \ # edit skills/my-skill/SKILL.md ... && \ bash {baseDir}/scripts/validate.sh skills/my-skill && \ bash {baseDir}/scripts/security-scan.sh skills/my-skill && \ bash {baseDir}/scripts/publish.sh skills/my-skill --slug my-skill --version 1.0.0 ``` ## Skill Anatomy Reminder ``` my-skill/ ├── SKILL.md ← Required. Frontmatter (name, description) + instructions. ├── scripts/ ← Optional. Executable code (bash, python, etc.) ├── references/ ← Optional. Docs loaded on-demand into context. └── assets/ ← Optional. Templates, images, files used in output. ``` **Key principles:** - Be concise. Context window is shared real estate. - Description in frontmatter is the trigger — make it comprehensive. - Progressive disclosure: SKILL.md body only loads when triggered. - Scripts > inline code for deterministic, repeated operations.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: guooscar/kokonna-frame (version 1.2.0)

--- name: kokonna-frame description: Control KoKonna AI e-ink art frames. Upload images, query device info, and manage multiple frames. Use when user asks to "push to frame", "send to frame", "display on frame", or "upload image to frame". version: 1.2.0 author: KoKonna tags: - smart-home - e-ink - art-frame - image-upload triggers: - "push to frame" - "send to frame" - "display on frame" - "upload to frame" - "show on KoKonna" --- # KoKonna Frame Control Control KoKonna AI e-ink art frames. Upload images, query device status, and manage multiple frames. --- ## Configuration Before using this skill, configure your KoKonna devices in `~/.openclaw/skills/kokonna-frame/config.yaml`: ```yaml api_base_url: "https://api.galaxyguide.cn/openapi" devices: living_room: "your-api-key-here" bedroom: "your-api-key-here" # Add more devices as needed ``` Get your API key from your KoKonna frame settings at [kokonna.art](https://kokonna.art). --- ## Usage ### Command Line ```bash # Upload image to a frame (auto-resize) python3 scripts/upload.py --device living_room --image /path/to/image.jpg # Upload with custom name python3 scripts/upload.py --device living_room --image /path/to/image.jpg --name "Sunset" # Query device info python3 scripts/device_info.py --device living_room # Push to all frames python3 scripts/upload.py --device all --image /path/to/image.jpg --name "Art" ``` ### Python API ```python from kokonna import KoKonnaFrame # Initialize frame frame = KoKonnaFrame(device="living_room") # Upload image frame.upload_image("/path/to/image.jpg", name="Sunset") # Get device info info = frame.get_device_info() print(info) ``` --- ## Features - **Automatic Resizing**: Images are automatically cropped and resized to match frame display - **Custom Naming**: Give images meaningful names that display on the frame - **Multi-Frame Support**: Manage multiple KoKonna frames from one agent - **Device Status**: Check battery level, online status, and firmware version --- ## Requirements - Python 3.7+ - `requests` library - `Pillow` library Install: `pip install requests Pillow` --- ## About KoKonna KoKonna is an AI-powered e-ink art frame that brings art, information, and personality into your space. - **E-ink Display**: Paper-like, low power, beautiful in any light - **AI Art Generation**: Automatically creates artwork based on preferences - **Smart Home Integration**: Works with your AI assistant Learn more at [kokonna.art](https://kokonna.art).

path: requirements.txt
content: requests>=2.31.0
Pillow>=10.0.0


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: wimi321/git-commit-workflow (version 1.0.0)

--- name: "git_commit_workflow" description: "Use when the user wants a single clean commit created from current changes with safe staging, message drafting, and non-interactive git usage." --- # Git Commit Workflow Use this skill when the task is to create one commit from current work. ## Workflow 1. Inspect git status, diff, branch, and recent commit style. 2. Stage only relevant changes. 3. Draft a concise commit message that reflects why the change exists. 4. Create a new commit non-interactively. 5. Report the resulting commit summary. ## Guardrails - Never amend unless explicitly asked. - Never bypass hooks unless explicitly asked. - Avoid staging secrets or unrelated files. - Do not create an empty commit. ## Example Requests - Make one clean commit from the current working tree. - Stage the right files and create a proper commit message. ## Inputs - Current diff - Branch state - Recent commit style ## Outputs - One non-amended commit - Accurate commit message ## Success Criteria - Only relevant changes were committed. - No empty commit was created. - Hooks and safety rules were respected. ## Non-Goals - Amend flows unless explicitly asked - Committing secrets or unrelated changes ## Source Provenance Derived from `src/commands/commit.ts`.

path: agents/openai.yaml
content: interface:
  display_name: "Git Commit Workflow"
  short_description: "Stage and create one safe commit"
  default_prompt: "Review the current diff, stage the right files, and create one well-formed commit without amending."


path: references/provenance.md
content: # Provenance

- Skill slug: `git-commit-workflow`
- Source module: `src/commands/commit.ts`
- Extracted from local Claude Code source analysis


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)