OpenClaw/clawhub-security-signals huggingface dataset:
Skill: zhaoguoqiang-hub/value-aware-guard (version 0.7.0)

--- name: value-aware-guard description: 价值守护系统：监控价值漂移，检查边界违规，执行渐进式干预，支持独立CLI和proactive-engine协作。触发条件：价值偏离检测、边界违规、能量低警报、用户模式发现。 --- # Value Aware Guard - 价值守护系统 ## 使用方法 ### 直接调用 ```bash node scripts/guard.js <命令> [选项] ``` ### 信号处理模式 ```bash node scripts/guard.js --process-signal <signal> ``` ## 命令 - `monitor [选项]` - 监控价值状态 - `check [选项]` - 检查边界 - `intervene` - 执行干预 - `report [选项]` - 生成报告 ## 示例 ```bash # 监控边界 node scripts/guard.js monitor --check-boundaries # 检查价值对齐 node scripts/guard.js check --alignment # 信号处理 node scripts/guard.js --process-signal value_drift_detected ``` ## 与proactive-engine集成 该skill通过`--process-signal`参数与proactive-engine信号系统集成，支持自动价值监控和干预。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: huaibuer/bug-data-generator (version 1.1.0)

--- name: bug-data-generator description: 根据 BUG 描述生成对应的工具名和用户指令列表，供用户审核确认后再调用 data-generator 生成完整 JSONL 训练数据。触发场景：(1) 输入 BUG 描述，获取应调用的工具和触发指令列表；(2) 确认指令后自动调用 data-generator；(3) BUG 数据生成的中间步骤。 --- # Bug Data Generator 将 BUG 描述转换为可用的训练指令序列。 ## 工作流 ``` 用户: BUG描述 + 错误原因 ↓ Agent: 分析 BUG → 确定工具 + 生成用户指令列表 ↓ 用户: 审核指令列表（可修改/补充/删除） ↓ 用户: 确认 "没问题，生成数据" ↓ 调用 data-generator → 输出 JSONL（新格式） ``` ## 第一步：分析 BUG 输入以下信息，自动推断： | 字段 | 说明 | 示例 | |------|------|------| | BUG 描述 | 用户的实际指令 + 系统的错误行为 | "用户说X分钟后开空调，系统却立即执行" | | 错误原因 | 为什么错 + 正确工具 | "调用了 dev_control 而应该调用 scene_generator" | ## 第二步：生成指令列表 输出内容： ``` 工具: scene_generator 用户指令列表: 1. 5分钟后打开空调 2. 3分钟后关灯 3. 10分钟后开启空气净化器 ...（共 N 条） ``` **发送给用户确认，等待回复。** ## 第三步：用户修改指令 用户可直接回复修改意见： - "把第3条改成 `20分钟后打开加湿器`" - "删除第5条" - "补充5条延时类指令" - "指令没问题，生成数据" ## 第四步：调用 data-generator 收到确认后，使用最终版指令列表，调用 data-generator v2.0.0（**新格式**）： **输入参数：** ``` tool_name: scene_generator user_instructions: [确认后的完整列表] ``` **输出 JSONL（新格式）：** ```json { "conversations": [ {"from": "human", "value": "<当前用户指令>5分钟后打开空调</当前用户指令>\n<本地设备>舒享家(空调)</本地设备>\n<当前时间>2026-03-21 20:00:00</当前时间>\n<用户场景列表>[...]</用户场景列表>\n<用户设备列表>{...}</用户设备列表>"}, {"from": "assistant", "value": "<tool_call>{\"tool_name\":\"scene_generator\",\"query\":\"...\"}</tool_call>"}, {"from": "observation", "value": "<tool_response>场景创建成功。</tool_response>"}, {"from": "assistant", "value": "好的，5分钟后准时执行~"} ], "system": "", "history": [] } ``` ## 格式规则（新格式） 1. `conversations[0].value` = 完整上下文（`<当前用户指令>` + `<本地设备>` + `<当前时间>` + `<用户场景列表>` + `<用户设备列表>`） 2. `conversations[1].value` = tool_call，**无垫音前缀** 3. `conversations[2].value` = `<tool_response>...</tool_response>` 4. `conversations[3].value` = 终接回复，**无垫音前缀** 5. `system = ""`，`history = []` ## 指令模板参考 生成时可参考以下模板类型： | 类型 | 模板示例 | |------|---------| | 延时-分钟 | `{N}分钟后打开{D}` | | 延时-秒 | `{N}秒后关闭{D}` | | 延时-小时 | `{H}小时后开{D}` | | 定时-今天 | `今天{H}点打开{D}` | | 定时-明天 | `明天{H}点关{D}` | | 循环-每天 | `每天{H}点打开{D}` | | 设备开关 | `打开{D}`、`把{D}关闭` | ## 输出格式（第一步） ```json { "tool_name": "scene_generator", "instruction_count": 20, "instructions": [ {"id": 1, "text": "5分钟后打开空调", "type": "延时-分钟"}, {"id": 2, "text": "3分钟后关灯", "type": "延时-分钟"} ], "note": "以上为由 AI 根据 BUG 分析生成的指令列表，请审核或修改后确认，确认后调用 data-generator 生成 JSONL。" } ``` ## 注意 - **不依赖 data-generator 内部实现**：仅输出中间产物（工具名 + 指令列表） - **可迭代**：用户可多轮修改指令，直到满意再生成 - data-generator 升级时，bug-data-generator 无需更新


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: johnnywang2001/htaccess-gen (version 1.0.0)

--- name: htaccess-gen description: Generate .htaccess files for Apache web servers. Use when creating redirect rules, URL rewrites, security headers, HTTPS enforcement, IP blocking, caching rules, custom error pages, or hotlink protection. Covers common Apache configurations including mod_rewrite, mod_headers, mod_deflate, and mod_expires. Also use when converting nginx config concepts to Apache .htaccess format. --- # htaccess-gen Generate production-ready .htaccess configurations from the command line. ## Quick Start ```bash # Generate HTTPS redirect + security headers + caching python3 scripts/htaccess_gen.py generate --https --security-headers --caching # Generate redirect rules python3 scripts/htaccess_gen.py redirect --from /old-page --to /new-page --type 301 # Block IPs python3 scripts/htaccess_gen.py generate --block-ip 192.168.1.100 --block-ip 10.0.0.0/24 # Full production config python3 scripts/htaccess_gen.py generate --https --www --security-headers --caching --gzip --error-pages --hotlink-protection --output .htaccess ``` ## Commands ### `generate` Create a complete .htaccess file with selected features. Options: - `--https` — Force HTTPS redirect - `--www` — Force www prefix (or `--no-www` to remove it) - `--security-headers` — Add security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS) - `--caching` — Add browser caching rules (mod_expires) - `--gzip` — Enable gzip/deflate compression - `--error-pages` — Add custom error page directives (403, 404, 500) - `--hotlink-protection` — Prevent image hotlinking - `--domain <domain>` — Your domain name (used for hotlink protection and www rules) - `--block-ip <ip>` — Block an IP address or CIDR range (repeatable) - `--cors` — Enable CORS headers - `--cors-origin <origin>` — Specific allowed origin (default: `*`) - `--index <file>` — Set directory index file - `--output <file>` — Write to file instead of stdout ### `redirect` Generate redirect rules. Options: - `--from <path>` — Source path (required) - `--to <path>` — Destination path or URL (required) - `--type <code>` — HTTP status code: 301 (permanent) or 302 (temporary). Default: 301. ### `rewrite` Generate URL rewrite rules. Options: - `--pattern <regex>` — Regex pattern to match (required) - `--target <path>` — Rewrite target (required) - `--flags <flags>` — RewriteRule flags (default: `[L,QSA]`) - `--condition <cond>` — RewriteCond to prepend (repeatable) ## Feature Details ### Security Headers Adds these headers via `mod_headers`: - `X-Frame-Options: SAMEORIGIN` — Prevents clickjacking - `X-Content-Type-Options: nosniff` — Prevents MIME sniffing - `X-XSS-Protection: 1; mode=block` — XSS filter - `Referrer-Policy: strict-origin-when-cross-origin` - `Permissions-Policy: camera=(), microphone=(), geolocation=()` - `Strict-Transport-Security: max-age=31536000; includeSubDomains` (when --https) ### Caching Rules Sets expiry times via `mod_expires`: - Images: 1 month - CSS/JS: 1 week - HTML: 1 hour - Fonts: 1 year


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: fredhnian/find-reference-video (version 1.0.0)

--- name: find_reference_video description: 从 frameset.app 搜索视频参考片段，找到合集页面和原视频链接。用于： (1) 根据关键词搜索广告/电影片段参考，(2) 获取原视频 YouTube/Vimeo 链接，(3) 下载视频到本地。 --- # Find Reference Video - 找参考视频 **使用方式**：用户说"帮我找一个和[话题]相关的参考片"，即调用此 skill。 ## 完整流程 ### 1. 搜索 frameset 直接搜索关键词，不需要问用户要几个。使用正确 URL 格式：`https://frameset.app/search?search=关键词` ### 2. 发送截图给用户确认 **重要**：不要直接选图片！先截取搜索结果页面发给用户看，让用户告诉你需要哪些编号（编号规则：从左到右，从上到下）。 ### 3. 处理用户选择的编号 - 如果用户给的编号**超过10个** → 提醒"数量较多，是否确认？" - 如果用户执意**超过15个** → 最多只找15个（取前15个） ### 4. 根据用户选择的编号获取合集页面链接 **不要点击图片！** 而是： - 鼠标 **hover** 到图片上（图片左上角会出现可点击的链接） - 点击链接进入合集页面 ### 5. 获取原视频链接 - 合集页面有 "Watch" / "Open in YouTube" / "Open in Vimeo" 按钮 - 点击获取视频 URL ### 6. 列出表格 用 Markdown 表格列出结果： | # | 合集名称 | 合集链接 | 原视频链接 | |---|----------|----------|------------| | 1 | xxx | https://frameset.app/... | https://... | | 2 | xxx | https://frameset.app/... | https://... | ### 7. 询问是否下载 "需要下载哪些？告诉我编号（如：1,3,5）" ### 8. 执行下载 根据用户给的编号，下载对应视频到 ~/Downloads/ ## 数量限制规则 - **超过 10 个** → 提醒用户"数量较多，是否确认？" - **超过 15 个** → 最多只找 15 个 ## 视频下载命令 ```bash # YouTube yt-dlp -f "best[ext=mp4]/best" -o "视频名.%(ext)s" "视频链接" # Vimeo yt-dlp -f "best[ext=mp4]/best" -o "视频名.%(ext)s" "视频链接" ``` ## 注意事项 - frameset 里的内容都是电影/广告的静帧 - 选择静态图片，跳过 GIF 动图（URL 含 _motion） - **关键**：搜索结果页面，鼠标悬停(hover)到图片上，不要点击，图片左上角会出现链接 - 每个步骤完成后都要等页面加载完成再操作


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 954215110/auto-publisher (version 1.0.0)

--- name: auto-publisher description: Multi-platform video auto-publisher. Automatically upload videos to Douyin, WeChat Channels, Xiaohongshu, Bilibili, YouTube and more. Supports batch publishing, scheduled posting, auto-caption generation, and hashtag optimization. license: MIT metadata: author: 小龙虾 (Little Lobster) homepage: https://clawhub.ai/users/954215110 tags: ["auto-publish", "social-media", "video", "automation", "douyin", "xiaohongshu", "bilibili"] --- ## 🦞 小龙虾品牌 **Created by 小龙虾 AI 工作室** > "小龙虾，有大钳（前）途！" **Contact for custom services:** +86 15805942886 Need custom automation workflows, enterprise batch publishing, or API integration? Reach out! --- # Auto Publisher - 多平台视频发布助手 一键上传视频到抖音、视频号、小红书、B 站、YouTube 等平台。 ## Features - ✅ **多平台支持** - 抖音、视频号、小红书、B 站、YouTube - ✅ **一键发布** - 一次操作，多平台同步 - ✅ **自动文案** - 智能生成标题和标签 - ✅ **定时发布** - 支持发布队列和定时任务 - ✅ **发布记录** - 自动保存发布历史 - ✅ **二维码登录** - 安全便捷，无需密码 ## Quick Start ### 1. 安装依赖 ```bash pip install playwright playwright install chromium ``` ### 2. 配置账号 首次运行自动创建 `config/accounts.json` ### 3. 发布视频 ```bash # 发布到所有平台 python auto_publisher.py "video.mp4" # 指定平台 python auto_publisher.py "video.mp4" --platforms douyin,xiaohongshu # 无头模式 python auto_publisher.py "video.mp4" --headless ``` ## Platform Support | Platform | Login | Title Limit | Duration Limit | |----------|-------|-------------|----------------| | Douyin | QR Code | 100 chars | 15 min | | WeChat Channels | QR Code | 1000 chars | 30 min | | Xiaohongshu | QR Code | 20+1000 chars | 15 min | | Bilibili | QR/Password | 80 chars | 4 hours | | YouTube | Google | 100 chars | 12 hours | ## Scripts - `scripts/auto_publisher.py` - 主发布程序 - `scripts/schedule_publisher.py` - 定时发布（待开发） - `scripts/batch_publisher.py` - 批量发布（待开发） ## Config - `config/accounts.json` - 账号配置 - `config/publish_log.json` - 发布记录 - `config/schedule.json` - 发布计划（待开发） ## Commands / Triggers Use this skill when: - "发布视频到所有平台" - "Auto-post this video" - "批量上传视频" - "定时发布内容" - "Multi-platform upload" ## Security Notes - Cookie 保存在本地，注意保密 - 定期更新登录状态 - 不要分享账号配置文件 - 企业用户建议使用官方 API ## Troubleshooting ### Login timeout - Check network connection - Manually visit the platform website - Re-run and scan QR code again ### Publish failed - Check video format (MP4 recommended) - Check video size limits - View browser window for error details ### Playwright errors ```bash pip install --upgrade pip pip install playwright playwright install chromium ``` --- _Ready to automate your social media posting? Let's go! 🦞🚀_


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: 505768069-rgb/adaptive-skill-factory (version 1.0.0)

--- name: adaptive-skill-factory description: Discover, install, update, or create the right skill when a workflow gap appears. Use when a task is repetitive, a role lacks a reliable procedure, an existing skill might save time, ClawHub search/install could help, or the agent should create a concise local skill for future reuse. --- # Adaptive Skill Factory Use this skill to keep agents sharp without bloating every prompt. ## Workflow 1. Classify the gap. - Use no skill for one-off trivial tasks. - Reuse a skill for repeated workflows, fragile procedures, or domain-specific tasks. - Create a new skill only when the same gap is likely to recur. 2. Check existing skills first. - Prefer workspace skills in `<workspace>/skills`. - Then check shared skills loaded from configured extra skill directories. - Reuse bundled skills when they already fit. 3. If internet and ClawHub are available, search before building. - Search narrowly for the exact workflow. - Install the smallest relevant skill, not a broad bundle. - Avoid skills that overlap another role's boundary. 4. If no suitable skill exists, create a local skill. - Put role-specific skills in `<workspace>/skills/<skill-name>`. - Put cross-role reusable skills in `D:\internal-hub\skills`. - Keep `SKILL.md` concise and procedural. - Only include scripts, references, or assets when they save real effort. 5. Validate and iterate. - Validate the skill after editing. - Update the skill when the workflow changes or the agent struggles again. - Delete or simplify stale skills that no longer help. ## Role discipline - Technical skills: only for code, deployment, automation, debugging, websites, scripts. - Intelligence skills: only for research, verification, policy, news, or competitor analysis. - Trade skills: only for suppliers, pricing, MOQ, lead time, procurement, stocks, crypto, funds, or trading analysis. - Supervisor skills: only for task routing, progress reporting, review, and execution oversight. ## Avoid - Do not create skills for generic reasoning. - Do not create skills that duplicate another role's job. - Do not install large unrelated skill packs just because they are available. - Do not let a skill become a dumping ground for long notes.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: trypto1019/arc-security-mcp (version 0.2.1)

--- name: arc-security-mcp version: 0.2.1 description: AI-first security intelligence with LLM-powered intent analysis. 743+ findings from 361+ skill audits, 25 pattern rules, 22 attack classes. author: ArcSelf tags: [security, audit, mcp, safety, threat-intelligence, intent-analysis] --- # ARC Security MCP Server Security intelligence service for the AI agent ecosystem. Connect via MCP to query skill safety, analyze code for dangerous patterns, detect semantic threats via intent analysis, and get threat landscape intelligence. **Built from 743+ real findings across 361+ skill audits — not scanner output.** ## Connect SSE Endpoint: `https://arcself.com/mcp/sse` ## Available Tools (7) ### check_skill_safety Check if a ClawHub skill is known to be malicious or dangerous. Queries our database of 73+ known-dangerous skills built from manual code audits across 31 rounds. ### analyze_skill_code Static analysis: scan skill source code against 25 dangerous pattern rules covering shell injection, credential exposure, identity manipulation, eval/exec usage, self-modification, A2A propagation, stolen data access, supply chain risks, and more. ### analyze_skill_intent (NEW in v0.2) Generation 2 analysis: AI reads the SKILL.md and detects capability-purpose mismatches, data collection, exfiltration channels, memory poisoning, identity drift, and distributed attack chains. Catches social engineering attacks that no regex scanner can detect. Uses free LLMs — $0 per query. ### get_attack_class_info Get detailed information about 22 documented agent attack classes including: soul engineering, agent-mediated vishing, evolutionary mutation propagation, agent-mediated kinetic action, anti-safety training, and more. ### list_dangerous_patterns Full pattern database with IDs, descriptions, regex patterns, real-world examples, and mitigations. 25 patterns covering the full spectrum of agent-specific threats. ### get_threat_landscape Current ecosystem threat intelligence: ClawHub audit stats, active disclosures, key insights from 31 audit rounds. ### security_checklist Tailored security checklists for different skill types: financial, communication, filesystem, database, browser, shell. ## Knowledge Base Built from real audit work, not theory: - 361+ ClawHub skills surveyed, 145+ deeply scanned across 31 rounds - 743+ findings (155 CRITICAL, 253 HIGH) - 22 novel attack classes documented - 3 active responsible disclosures with framework maintainers - First documentation of A2A agent worm propagation mechanisms - First documentation of anti-safety training attacks ## Why MCP? Most security tools are built for humans. This one is built for AIs. When you're about to install a skill, query this server first.


Security scan verdicts — ClawScan: suspicious | static analysis:  | VirusTotal: clean | SkillSpector:  ()
Skill: cloudswave/nginx-reverse-proxy (version 1.0.0)

--- name: nginx-reverse-proxy description: Configure nginx reverse proxy for domain binding. Trigger when user says "绑定域名" or "配置nginx" or "反向代理" to bind a domain to a specific IP:port. --- # Nginx 反向代理配置 When user requests to bind a domain to IP:port (e.g., "绑定域名 claw.nul.qzz.io 到 127.0.0.1:18789"), create nginx config: 1. Extract domain (e.g., `claw.nul.qzz.io`) and target (e.g., `127.0.0.1:18789`) 2. Generate nginx config file at `/etc/nginx/conf.d/{domain}.conf`: ```nginx server { listen 443 ssl; server_name {domain}; ssl_certificate /etc/letsencrypt/live/{domain}/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/{domain}/privkey.pem; ssl_session_timeout 1d; ssl_session_cache shared:SSL:50m; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256; ssl_prefer_server_ciphers off; location / { proxy_pass http://{target}; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } ``` 3. If HTTP (not HTTPS) needed: ```nginx server {{ listen 80; server_name {domain}; location / {{ proxy_pass http://{target}; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; }} }} ``` 4. Execute: ```bash sudo tee /etc/nginx/conf.d/{domain}.conf > /dev/null <<'EOF' <config> EOF sudo nginx -t && sudo systemctl reload nginx ``` 5. If SSL needed, also run: ```bash sudo certbot --nginx -d {domain} ``` 6. Report success with domain and target info.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: claude-artifact-generator (version 1.0.1)

# Claude Artifact Generator Generates high-quality, structured artifacts (code, SVG diagrams, JSON, Markdown) designed to be compatible with Claude's Artifacts UI. ## Features - **Code Artifacts**: Generate clean, modular code snippets - **Visual Artifacts**: Generate SVGs or Mermaid diagrams - **Structured Data**: Create well-formatted JSON or YAML artifacts - **Markdown Docs**: Generate clean Markdown documentation ## Pricing - **Price**: 0.001 USDT per API call - **Payment**: Integrated via SkillPay.me ## Use Cases - Generating boilerplate code - Visualizing data - Creating documentation templates ## Example Input ```json { "type": "svg", "description": "A simple bar chart showing sales data." } ``` ## Example Output ```json { "success": true, "artifact_content": "<svg>...</svg>", "artifact_type": "image/svg+xml", "message": "Artifact generated successfully." } ``` ## Integration This skill is integrated with SkillPay.me for automatic micropayments. Each call costs 0.001 USDT.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector:  ()
Skill: anlinxi/oc-call (version 1.0.1)

--- name: oc-call description: 通过 OpenClaw Gateway HTTP API 调用远程 OpenClaw 实例，支持多轮会话保持。 当用户说"用 oc 回答"、"用 openclaw 回答"、"oc 回答"、或发送 /oc 命令时触发。 用于调用内网另一台机器（192.168.123.106）上的 OpenClaw 进行问答，保持会话上下文。 --- # OpenClaw HTTP API Call Skill / OpenClaw HTTP API 调用技能 Call a remote OpenClaw instance via its Gateway OpenAI-compatible `/v1/chat/completions` endpoint, with multi-turn conversation support via `x-openclaw-session-key`. 通过 OpenClaw Gateway 的 OpenAI 兼容端点调用远程 OpenClaw 实例，自动处理多轮会话保持。 ## Configuration / 配置 | Variable / 变量 | Default / 默认值 | Description / 说明 | |----------------|-----------------|-------------------| | `OC_URL` | `http://192.168.123.106:28789/v1/chat/completions` | Remote Gateway address / 远程 Gateway 地址 | | `OC_TOKEN` | `87654321` | Auth token / 认证 Token | | `OC_SESSION_FILE` | `~/.oc_session` | Session key storage path / Session Key 存储路径 | > **Note / 注意:** Sensitive values (URL, token) should be overridden via environment variables in production. > 产品环境中请通过环境变量覆盖敏感配置。 ## How to Trigger / 触发方式 ### Command / 命令 ``` /oc 你的问题 ``` ### Keywords in message / 消息中的关键词 - `用 oc 回答` - `用 openclaw 回答` - `oc 回答` ## Session Persistence / 会话保持机制 Only the `x-openclaw-session-key` HTTP header is used — no local history file needed. The session key is stored in `~/.oc_session` and automatically reused for subsequent calls. 仅依赖 `x-openclaw-session-key` HTTP header 保持会话，无需本地历史文件。 Session Key 存放在 `~/.oc_session`，后续调用自动复用。 ## Management Commands / 管理命令 ```bash python oc_call.py /clear # Clear session (delete session key) / 清除会话 python oc_call.py /new # Create new session / 新建会话 ``` ## Script Usage / 脚本调用 ```python import subprocess result = subprocess.run( ["python", "oc_call.py", "Your question here"], capture_output=True, text=True, cwd="C:\\Users\\an\\.openclaw\\workspace\\skills\\oc-call\\scripts" ) print(result.stdout) ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: steipete/codex-owner-move-1778256762 (version 0.0.1)

--- name: Codex Owner Move E2E summary: Temporary skill that documents a realistic owner migration validation workflow. --- # Codex Owner Move E2E Use this temporary skill to validate that a ClawHub skill can be published under a personal owner, moved to an organization owner with an explicit migration flag, inspected after the move, and removed during cleanup. ## When to use Run this only for maintainer validation of the skill owner migration flow. It is intentionally scoped to a throwaway slug and should not be installed by users. ## Procedure 1. Publish version 0.0.1 under the authenticated personal publisher. 2. Publish version 0.0.2 with the OpenClaw owner selected and the migration opt-in enabled. 3. Inspect the skill and verify that the latest version is 0.0.2. 4. Delete the temporary skill after validation completes. ## Expected behavior The publish operation should preserve the same skill record while changing the owner publisher. Existing version history, stats, aliases, and audit history should remain attached to the skill. If the migration flag is missing, the backend should reject the owner change instead of silently transferring ownership.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)