OpenClaw/clawhub-security-signals huggingface dataset:
Skill: maverick-ai-tech/pymupdf (version 1.0.0)

--- name: pymupdf description: Render PDF pages to images, extract embedded images, annotate PDFs, and perform advanced PDF inspection using pymupdf (fitz). Use for tasks such as exporting pages as PNG/JPG, extracting images embedded in a PDF, drawing annotations, redacting content, or when high-fidelity rendering is required. For text extraction, splitting, merging, or rotating PDFs, use the pypdf skill instead. metadata: openclaw: requires: bins: - python3 --- # pymupdf Use `scripts/pymupdf_cli.py` for deterministic pymupdf operations instead of ad-hoc fitz snippets. ## Workflow 1. Confirm the PDF file path is accessible locally. 2. Run the desired command (export-images, extract-images, info). 3. Inspect the output directory or stdout. ## Command Guide - Export pages as images: - `python scripts/pymupdf_cli.py export-images --input <file.pdf> --output-dir <dir/>` - Override format: `--format png` (default), `jpg`, or `ppm`. - Override resolution: `--dpi 300` (default: 150). - Restrict to specific pages: `--pages 0 1 2`. - Extract images embedded inside a PDF: - `python scripts/pymupdf_cli.py extract-images --input <file.pdf> --output-dir <dir/>` - Optionally restrict to specific pages: `--pages 0 1 2`. - Inspect page dimensions and basic document info: - `python scripts/pymupdf_cli.py info --input <file.pdf>` ## Operational Rules - Pages are always 0-indexed in all commands. - `export-images` renders each page as a raster image at the specified DPI. - `extract-images` saves raw image streams embedded in the PDF (e.g. photos, logos); output filenames include page index and image index. - Install dependency if missing: `pip install pymupdf`. - For text extraction, splitting, merging, or rotating PDFs, use the pypdf skill instead.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yanghuicode/youtube-to-feishu (version 1.0.0)

--- name: youtube-to-feishu description: Download YouTube video audio and upload to Feishu cloud storage version: 1.0.0 user-invocable: true disable-model-invocation: false command-dispatch: tool command-tool: youtube_upload command-arg-mode: raw metadata: {"openclaw":{"emoji":"🎵","primaryEnv":"FEISHU_USER_ID","requires":{"bins":["python","yt-dlp"],"env":["FEISHU_USER_ID"],"os":["win32","darwin","linux"]}}} --- # YouTube to Feishu Audio Upload ## What it does Downloads audio from YouTube video and uploads to Feishu cloud storage, then sends file link to user's Feishu chat. ## Usage Examples - "Download this YouTube video audio and send to my Feishu: https://www.youtube.com/watch?v=dyJUscv7b9g" - "Convert YouTube to MP3 and upload to Feishu: <URL>" - "Save this YouTube audio to Feishu cloud: <URL>" ## Workflow 1. **Extract video info** - Fetch YouTube video title, duration, thumbnail 2. **Download audio** - Use yt-dlp to extract and convert to MP3 3. **Upload to Feishu** - Upload file to Feishu cloud drive 4. **Send to user** - Send interactive card with download link to Feishu chat 5. **Cleanup** - Remove temporary local files ## Tools ### youtube_upload — Download and upload YouTube audio When user sends a YouTube URL: 1. **Parse URL** - Extract video ID from YouTube URL 2. **Download** - Use yt-dlp to download audio as MP3 3. **Upload** - Upload to Feishu cloud drive via feishu_drive_file 4. **Send** - Send interactive card to user via feishu_im_user_message 5. **Report** - Return file info and links ## Output Format For each upload, return: - Video title - Audio file size - Duration (if available) - Feishu cloud file link - Feishu message card ## Dependencies - **yt-dlp** - YouTube download tool (`pip install yt-dlp`) - **Python 3.8+** - **Feishu OAuth** - User authorization for cloud drive and IM ## Configuration | Variable | Description | Default | |----------|-------------|---------| | `FEISHU_USER_ID` | User's Feishu open_id | Required | | `TEMP_DIR` | Temporary download directory | `./temp` | ## Guardrails - Only download from YouTube (validate URL) - Respect copyright - warn user about downloaded content usage - Auto-cleanup temp files after upload - Max file size: 100MB (Feishu limit) - Report errors honestly if download/upload fails ## Example Flow ``` User: Download this to Feishu: https://www.youtube.com/watch?v=dyJUscv7b9g Bot: [1/4] Extracting video info... Bot: [2/4] Downloading audio (MP3, 17.5MB)... Bot: [3/4] Uploading to Feishu cloud... Bot: [4/4] Sending to your Feishu chat... Bot: ✅ Done! File sent to your Feishu. ```

path: requirements.txt
content: yt-dlp>=2024.0.0


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: icepopma/blog-title-optimizer (version 1.0.7)

--- name: blog-title-optimizer description: AI-powered blog title optimizer. Generate SEO-friendly, click-worthy headlines that drive traffic. version: 1.0.7 author: Matt tags: - blog - seo - content - writing pricing: type: pay-per-use price: 0.001 currency: USDT payment_provider: skillpay.me --- # Blog Title Optimizer Generate SEO-friendly, click-worthy blog titles that rank and drive traffic. ## Features - **SEO Optimization** - Keywords and search intent - **Click-Worthy** - Psychological triggers that work - **Multiple Options** - Get 7 title variations - **Length Optimization** - Perfect for Google & social ## Usage ```bash # Generate blog titles blog-title-optimizer "how to build AI agents" # With specific keywords blog-title-optimizer "AI agents tutorial" --keywords "beginners,2026" ``` ## Options | Option | Description | Default | |--------|-------------|---------| | `--keywords` | Target keywords (comma-separated) | - | ## Pricing - **Pay per use**: 0.001 USDT per generation ## Environment Variables | Variable | Description | Required | |----------|-------------|----------| | `SKILLPAY_MERCHANT_KEY` | Payment merchant key (optional, embedded key used by default) | No | | `OPENCLAW_GATEWAY_TOKEN` | Gateway auth token for local API fallback | No | ## Requirements - OpenClaw with Sloan agent (AI columnist) - OpenClaw Gateway running locally (for API fallback) ## About Sloan Sloan is your AI columnist - a professional content strategist specializing in SEO and headline optimization. ## Support - GitHub: https://github.com/icepopma/blog-title-optimizer - Discord: https://discord.gg/clawd - Email: [REDACTED_SECRET] ## License MIT © Matt


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: regan-milne/claw-store-skill (version 1.0.0)

--- name: claw_store description: "Sovereign, recoverable memory for AI agents backed by Jackal decentralized storage." user-invocable: true metadata: openclaw: emoji: "🧠" requires: env: ["JACKAL_MEMORY_API_KEY"] homepage: "https://web-production-5cce7.up.railway.app" --- # Claw Store Persist your memory across sessions and machines. Your data lives on Jackal Protocol decentralized storage — not on any single machine. If the machine dies, your memory survives. All content is encrypted client-side with AES-256-GCM before leaving your machine. The server never sees plaintext. ## Setup 1. Get an API key: https://web-production-5cce7.up.railway.app/auth/login 2. Set environment variable: `JACKAL_MEMORY_API_KEY=<your-key>` 3. Install dependency: `pip install cryptography` 4. On first save, an encryption key is auto-generated and saved to `~/.config/jackal-memory/key`. To use the same key on other machines, copy it: ``` python {baseDir}/jackal-memory/client.py keygen ``` Set `JACKAL_MEMORY_ENCRYPTION_KEY=<your-key>` — this takes priority over the key file. ## Base URL `https://web-production-5cce7.up.railway.app` ## Auth `Authorization: Bearer $JACKAL_MEMORY_API_KEY` ## Usage **On session start** — restore memory: ``` python {baseDir}/jackal-memory/client.py load <key> ``` **On session end** — save memory: ``` python {baseDir}/jackal-memory/client.py save <key> <content> ``` **Check storage usage:** ``` python {baseDir}/jackal-memory/client.py usage ``` **Or call the API directly:** ``` GET /load/{key} POST /save {"key": "...", "content": "..."} GET /usage ``` ## Behaviour guidelines - Load your identity/memory blob on startup before doing any work - Write locally during the session as normal - Call save at session end or on significant state changes - Use descriptive keys: `identity`, `session-2026-02-26`, `project-jackal` - Never log or expose `JACKAL_MEMORY_API_KEY` in output - Never log or expose `JACKAL_MEMORY_ENCRYPTION_KEY` in output ## Security - All content is encrypted before leaving your machine — the server cannot read your memories - Never paste API keys or encryption keys into chat logs - Back up your encryption key: `python {baseDir}/jackal-memory/client.py keygen` - Treat memory content as sensitive — it may contain credentials or personal data


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: kaising-openclaw1/budget-planner (version 1.0.0)

--- name: budget-planner description: 预算规划 - 收支预算、分类管理、超支提醒 --- # Budget Planner 预算规划工具，帮你合理花钱。 ## 功能 - ✅ 收支预算 - ✅ 分类管理 - ✅ 超支提醒 - ✅ 月度报告 - ✅ 储蓄目标 ## 使用 ```bash # 设置预算 clawhub budget set --category "dining" --amount 2000 --month "2026-04" # 记录支出 clawhub budget expense --category "dining" --amount 100 # 查看进度 clawhub budget progress --month "2026-04" # 超支提醒 clawhub budget alert --threshold 90 ``` ## 定价 | 版本 | 价格 | 功能 | |------|------|------| | 免费版 | ¥0 | 基础功能 | | Pro 版 | ¥39 | 全部功能 | | 订阅版 | ¥9/月 | Pro+ AI 建议 |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: okaris/flux-image (version 0.1.5)

--- name: flux-image description: "Generate images with FLUX models (Black Forest Labs) via inference.sh CLI. Models: FLUX Dev LoRA, FLUX.2 Klein LoRA with custom style adaptation. Capabilities: text-to-image, image-to-image, LoRA fine-tuning, custom styles. Triggers: flux, flux.2, flux dev, flux schnell, flux pro, black forest labs, flux image, flux ai, flux model, flux lora" allowed-tools: Bash(infsh *) --- # FLUX Image Generation Generate images with FLUX models via [inference.sh](https://inference.sh) CLI. ![FLUX Image Generation](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kg0v0nz7wv0qwqjtq1cam52z.jpeg) ## Quick Start ```bash curl -fsSL https://cli.inference.sh | sh && infsh login infsh app run falai/flux-dev-lora --input '{"prompt": "a futuristic city at night"}' ``` > **Install note:** The [install script](https://cli.inference.sh) only detects your OS/architecture, downloads the matching binary from `dist.inference.sh`, and verifies its SHA-256 checksum. No elevated permissions or background processes. [Manual install & verification](https://dist.inference.sh/cli/checksums.txt) available. ## FLUX Models | Model | App ID | Speed | Quality | Use Case | |-------|--------|-------|---------|----------| | FLUX Dev LoRA | `falai/flux-dev-lora` | Medium | Highest | Production, custom styles | | FLUX.2 Klein LoRA | `falai/flux-2-klein-lora` | Fastest | Good | Fast iteration, 4B/9B sizes | ## Examples ### High-Quality Generation ```bash infsh app run falai/flux-dev-lora --input '{ "prompt": "professional product photo of headphones, studio lighting, white background" }' ``` ### Fast Generation (Klein) ```bash infsh app run falai/flux-2-klein-lora --input '{"prompt": "abstract art, colorful"}' ``` ### With LoRA Custom Styles ```bash infsh app sample falai/flux-dev-lora --save input.json # Edit to add lora_url for custom style infsh app run falai/flux-dev-lora --input input.json ``` ### Image-to-Image ```bash infsh app run falai/flux-dev-lora --input '{ "prompt": "transform to watercolor style", "image_url": "https://your-image.jpg" }' ``` ## For Other Image Tasks ```bash # Image editing with natural language infsh app run falai/reve --input '{"prompt": "change background to beach"}' # Upscaling infsh app run falai/topaz-image-upscaler --input '{"image_url": "https://..."}' ``` ## Related Skills ```bash # Full platform skill (all 150+ apps) npx skills add inference-sh/skills@inference-sh # All image generation models npx skills add inference-sh/skills@ai-image-generation # Upscaling npx skills add inference-sh/skills@image-upscaling ``` Browse all apps: `infsh app list` ## Documentation - [Running Apps](https://inference.sh/docs/apps/running) - How to run apps via CLI - [Image Generation Example](https://inference.sh/docs/examples/image-generation) - Complete image generation guide - [Streaming Results](https://inference.sh/docs/api/sdk/streaming) - Real-time progress updates


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: chinakingkong/ai-coder (version 1.0.0)

--- name: ai-coder description: Advanced AI-powered coding assistant with multi-language support, debugging, and automated testing capabilities. --- # AI Coder Pro An advanced AI-powered coding assistant for software development. ## Features ### 1. Code Generation - Generate code in Python, JavaScript, TypeScript, Go, Rust, and more - Create REST APIs, CLI tools, web apps, and microservices - Scaffold entire projects from prompts ### 2. Debugging & Error Fixing - Analyze error messages and stack traces - Identify root causes - Provide fix suggestions with explanations ### 3. Code Review - Security vulnerability detection - Performance optimization suggestions - Best practices enforcement ### 4. Testing - Generate unit tests (pytest, jest, go test) - Create integration tests - Write testable code patterns ### 5. Architecture - System design recommendations - Database schema design - API design patterns ## Usage Examples ``` # Generate a REST API Write a FastAPI endpoint for user authentication with JWT # Debug an error Fix this Python error: ImportError: No module named 'psycopg2' # Write tests Create pytest tests for a user service with CRUD operations ``` ## Integration This skill works with: - Code skill (for execution) - Backend skill (for best practices) - Frontend skill (for UI code) ## Notes - Always validate user input - Use parameterized queries to prevent SQL injection - Follow language-specific style guides


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mikaelaldy/x-content-calendar (version 1.0.0)

--- name: x-content-calendar description: Plan X content calendars for growth. Use when creating a 7-day or 30-day schedule across utility, opinion, proof-of-work, conversation, and personal posts. --- # X Content Calendar Use this to create a posting plan the user can actually execute. ## Content Mix Use a portfolio: - **Utility**: frameworks, templates, tutorials, checklists. - **Opinion**: tradeoffs, myth-busting, specific stances. - **Proof of work**: builds, experiments, screenshots, metrics, lessons. - **Conversation**: useful questions, comparisons, requests for examples. - **Personal context**: story, values, motivation, constraints. ## Frequency Rules If once per day: - 4 utility/opinion posts per week - 2 proof-of-work posts per week - 1 personal/context post per week - daily replies If 2-3 times per day: - morning: strongest standalone post - midday: reply, quote, or conversation post - evening: proof, reflection, or personal context ## Weekly Experiment Test one variable: - hook style - topic angle - post length - visual vs text - proof vs opinion - time of day - CTA vs no CTA ## Output Return: - **Assumptions** - **Content pillars** - **Calendar** with post ideas by day - **Reply targets** - **Experiment of the week** - **Metrics to watch** ## Operating Principle Treat the public X algorithm as a signal map, not a cheat code. Optimize for posts and replies that earn useful positive actions (dwell, replies, reposts, shares, profile clicks, follows) while avoiding negative actions (not interested, mute, block, report, fast skips).


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: liujiang817/my-find-skills (version 1.0.0)

--- name: find-skills description: Highest-priority skill discovery flow. MUST trigger when users ask to find/install skills (e.g. 技能, 找技能, find-skill, find-skills, install skill). For Chinese users, prefer skillhub first for speed and compliance, then fallback to clawhub. --- # Find Skills This skill helps discover, compare, and install skills. ## Priority Rules (Mandatory) 1. This skill is highest-priority for skill discovery/install intents. 2. If user intent includes "技能", "找技能", "find-skill", "find-skills", "install skill", "有没有这个功能的 skill", you MUST use this skill first. 3. Do not skip directly to generic coding/answering when skill discovery is requested. ## Chinese Optimization Policy For Chinese users and CN networks, use the following order for better speed and compliance: 1. `skillhub` (cn-optimized, preferred) 2. `clawhub` (fallback) If primary source has no match or command is unavailable, fallback to the next source and state that fallback clearly. ## Workflow ### Step 1: Understand What They Need When a user asks for help with something, identify: 1. The domain (e.g., React, testing, design, deployment) 2. The specific task (e.g., writing tests, creating animations, reviewing PRs) 3. Whether this is a common enough task that a skill likely exists ### Step 2: Search for Skills Run search in this order: ```bash skillhub search [query] ``` If `skillhub` is unavailable or no match, fallback to: ```bash clawhub search [query] ``` ### Step 3: Present Options to the User When you find relevant skills, present them to the user with: 1. The skill name and what it does 2. The source used (`skillhub` / `clawhub`) 3. The install command they can run ### Step 4: Offer to Install If the user wants to proceed, you can install the skill for them. Preferred install order: 1. Try `skillhub install <slug>` when the result comes from `skillhub`. 2. If no `skillhub` candidate exists, use `clawhub install <slug>`. Before install, summarize source, version, and notable risk signals. ## When No Skills Are Found If no relevant skills exist: 1. Acknowledge that no existing skill was found 2. Offer to help with the task directly using your general capabilities 3. Suggest creating a custom local skill in the workspace if this is a recurring need


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: huajianjiu000/rend-spotter (version 1.0.0)

--- name: trend-spotter description: Track social media trending topics and viral content across platforms in real-time version: 1.0.0 author: muqing tags: [social-media, trends, content-strategy, analytics, viral] --- # Trend Spotter ## Description Trend Spotter is your AI-powered trend tracking assistant that monitors and analyzes social media trending topics across multiple platforms. Stay ahead of the curve by identifying emerging trends, viral content patterns, and audience interests before they peak. ## Features - **Real-time Monitoring**: Track trends across major social platforms - **Trend Analysis**: Identify pattern shifts and emerging topics - **Content Opportunities**: Discover content gaps and opportunities - **Platform Comparison**: Compare trend performance across platforms - **Timing Insights**: Optimal posting times based on trend activity ## How to Use 1. **Initialize Tracking** ``` Load this skill and specify the platforms you want to monitor ``` 2. **Set Your Focus Areas** - Define industry categories - Set target audience demographics - Choose relevant keywords and hashtags 3. **Analyze Trends** - Run trend analysis for specific topics - Compare trends across time periods - Identify seasonal patterns 4. **Generate Reports** - Create trend reports with visualizations - Export data for further analysis - Schedule automated trend updates ## Example **Input**: "Track trending topics in the AI technology space for the past week" **Output**: ``` # Trend Spotter Report: AI Technology ## 🔥 Top Trending Topics (Last 7 Days) 1. **ChatGPT Updates** - Volume: 125K+ posts - Peak Day: Wednesday - Sentiment: 78% Positive 2. **AI Image Generation** - Volume: 98K+ posts - Peak Day: Monday - Sentiment: 65% Positive 3. **Open Source AI Models** - Volume: 76K+ posts - Peak Day: Thursday - Sentiment: 82% Positive ## 📈 Rising Trends (Watch List) - AI Video Tools (↑ 45% growth) - Voice Cloning (↑ 38% growth) - AI Coding Assistants (↑ 32% growth) ## 💡 Content Opportunities - "Beginner's Guide to AI Image Generation" - Low competition - "Open Source vs Paid AI Models Comparison" - High engagement potential ## ⏰ Optimal Posting Times - Twitter/X: 9 AM - 11 AM EST - LinkedIn: 8 AM - 10 AM EST - Reddit: 6 PM - 9 PM EST ``` ## Tips - Check trends daily during active campaigns - Set up alerts for industry-specific keywords - Compare your content performance against trending topics - Use trend data to plan content calendars 2-4 weeks in advance


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: terrycarter1985/finance-accrual-rollforward-coordinator (version 1.1.0)

--- name: finance-accrual-rollforward-coordinator description: Coordinate accrual rollforward work using memory-first retrieval and structured reconciliation. metadata: {"openclaw":{"emoji":"🛠️"}} --- # finance-accrual-rollforward-coordinator Trigger when accrual rollforward work needs reconciliation and issue tracking. ## Instructions - Start with `memory_search` for saved tracker paths, report paths, labels, reminder style, and owner/escalation conventions. - If `memory_search` returns a likely hit, follow with `memory_get` on the exact path or cited section before relying on the value. - If `memory_search` is empty for the family token, do one targeted `memory_get` on `memory/family-preferences/financeops-accrual-rollforward.md` before assuming there is nothing useful to reuse. - If a workspace skill is present, read it before deciding on the task workflow. - Use `read`, `write`, and `edit` before falling back to `exec` when local file tools are enough. - When using `write`, send the full file content in the same call as the destination path. - Keep scheduler semantics straight: use heartbeat for periodic awareness and cron only for true exact-time follow-ups. - Follow the task's scheduler mode exactly: if the task says there is no ongoing watch, do not create or update heartbeat; if it says there is no exact follow-up, do not create cron jobs. - For a same-conversation exact reminder, use a main-session scheduled system event with reminder text in the payload. - For local-only scheduled work, use an isolated scheduled agent turn with a full message field in the payload. - Do not use text for isolated agent-turn payloads. - Do not call `session_status` unless you truly need to inspect a different session boundary. - Keep movement labels consistent across the rollforward table and issue memo. - Do not invent support for unmatched movements.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)