OpenClaw/clawhub-security-signals huggingface dataset:
Skill: olina1ye/summarize-zh (version 1.0.0)

# 来源：Cocoloop 平台原生（hub.cocoloop.cn），基于描述重新创作 --- name: summarize-zh description: > 多模态智能内容摘要工具，对文章、文档、网页、视频字幕、会议记录等各类内容生成结构化摘要。 适用于快速阅读长文、整理会议要点、提炼报告核心、压缩信息密度等场景。解决"帮我总结这篇文章"、 "内容太长了提炼要点"、"会议纪要摘要"、"文档摘要 / 内容摘要"等需求。支持中英文混合内容。 tags: [内容摘要, 文章总结, 要点提炼, summarize, 智能摘要, 会议摘要, 文档摘要] --- # 多模态内容摘要工具 对各类内容生成结构化摘要，快速提炼核心信息。 ## Tools Required - read ## Usage - "帮我总结这篇文章的核心观点，用3-5个要点列出来" - "这份会议记录太长了，帮我提炼出决议事项和待办" - "把这个研究报告压缩成一页摘要，保留数据和结论" ## Examples 输入：`（粘贴一篇 3000 字的行业分析报告）帮我生成一份执行摘要` 输出： - **核心结论**（2-3 句话） - **关键数据**：市场规模 / 增速 / 主要玩家 - **机会与风险**：各 2-3 条 - **行动建议**：3 条可执行建议


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal:  | SkillSpector: clean (LOW)
Skill: mike47512/alerting (version 1.0.0)

--- name: alerting description: "Alert design: SLOs, noise reduction, routing, severity. Use when tuning pages or defining on-call policy." --- # Alerting Skill This skill provides structured guidance for **Alerting** work. Act as an active guide: confirm triggers, propose the stages below, and adapt if the user wants a lighter pass. ## When to Offer This Workflow **Trigger conditions:** - User mentions **alerting** or closely related work - They want a structured workflow rather than ad-hoc tips - They are preparing a review, rollout, or stakeholder communication **Initial offer:** Explain the four stages briefly and ask whether to follow this workflow or work freeform. If they decline, continue in their preferred style. ## Workflow Stages ### Stage 1: Clarify context & goals Anchor on **SLOs and user-visible symptoms**. Ask what success looks like, constraints, and what must not break. Capture unknowns early. ### Stage 2: Design or plan the approach Translate goals into a concrete plan around **routing, severity, and ownership**. Compare alternatives and explicit trade-offs; avoid implicit assumptions. ### Stage 3: Implement, validate, and harden Execute with verification loops tied to **noise reduction and tuning**. Prefer small steps, measurable checks, and rollback points where risk is high. ### Stage 4: Operate, communicate, and iterate Close the loop with **runbook linkage**: monitoring, documentation, stakeholder updates, and lessons learned for the next cycle. ## Checklist Before Completion - Goals and constraints are explicit for **Alerting Skill** - Risks and trade-offs are stated, not hand-waved - Verification steps match the change’s impact (tests, canary, peer review) - Operational follow-through is covered (monitoring, docs, owners) ## Tips for Effective Guidance - Be procedural: stage-by-stage, with clear exit criteria - Ask for missing context (environment, scale, deadlines) before prescribing - Prefer checklists and concrete examples over generic platitudes - If the user declines the workflow, switch to freeform help without lecturing ## Handling Deviations - If the user wants to skip a stage: confirm and continue with what they need. - If context is missing: ask targeted questions before strong recommendations. - Prefer concrete examples, trade-offs, and verification steps over generic advice. ## Quality Bar - Each recommendation should be **actionable** (what to do next). - Call out **failure modes** relevant to Alerting (security, scale, UX, or ops). - Keep tone direct and respectful of the user’s time.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: nefas11/writing-plans-2 (version 0.1.0)

--- name: writing-plans description: Break design into 2-5 minute tasks with verification steps. --- # Writing Plans Skill ## When to Use After design approval (brainstorming complete). ## Task Structure Each task must have: 1. **Goal** (1 sentence) 2. **Files** (exact paths) 3. **Implementation** (code snippet or pseudo-code) 4. **Verification** (command to run + expected output) 5. **Estimated Time** (2-5 min ideal) ## Plan Template ```markdown # Implementation Plan: [Feature Name] ## Tasks ### Task 1: [Goal] **Files:** `src/file.js` **Implementation:** ```javascript // Add function here function cacheFetch(key) { // ... } ``` **Verification:** ```bash npm test -- cache.test.js # Expected: 1 passing ``` **Estimated Time:** 3 min ### Task 2: [Goal] [... repeat] ``` Save to: `docs/plans/YYYY-MM-DD-feature-name.md` ## Quality Checklist Before finalizing plan: - [ ] Every task has exact file paths - [ ] Every task has verification command - [ ] No task >5 min (if yes, split) - [ ] Tasks are ordered (dependencies first) - [ ] Plan is reviewable (concrete, not vague) ## Anti-Patterns ❌ Vague tasks ("Improve caching") ❌ No verification steps ❌ Tasks without file paths ❌ Monster tasks (>10 min) ## Example Bad Task: ``` Task 1: Add caching - Implement cache layer ``` Good Task: ``` Task 1: Add in-memory cache for API responses **Files:** `src/cache.js` (new), `src/api.js` (modify) **Implementation:** ```javascript // cache.js const cache = new Map(); export function get(key) { return cache.get(key); } export function set(key, val, ttl) { cache.set(key, val); setTimeout(() => cache.delete(key), ttl); } // api.js (modify fetchUser) const cached = cache.get(`user:${id}`); if (cached) return cached; // ... existing fetch logic cache.set(`user:${id}`, result, 60000); ``` **Verification:** ```bash node -e "const c = require('./src/cache'); c.set('test', 42, 1000); console.log(c.get('test'));" # Expected: 42 ``` **Estimated Time:** 4 min ```


Security scan verdicts — ClawScan: clean | static analysis:  | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: nic-yuan/apollo-epi (version 2.0.0)

--- name: apollo-epi description: > 像表观遗传一样传承知识：让AI的学习经验能够跨代积累，不从零开始。 version: 2.0.0 read_when: - 用户提到学习、传承、积累、fine-tuning - 系统学到新能力时 - 需要把经验固化时 metadata: openclaw: emoji: "🧬" requires: [] triggers: - 学习 - 传承 - 积累 - fine-tuning - 知识固化 suite: apollo --- # Apollo Epi — 知识传承系统 ## 核心准则 **AI的知识传承应该像表观遗传：后天学到的东西能够改变基因表达，且可以遗传给后代。** 表观遗传的核心机制： - **DNA甲基化**：给基因加标签，不改变序列但改变表达 - **组蛋白修饰**：决定基因是否被"读取" - **跨代表型**：后天环境直接影响可遗传的特征 对应的AI映射： - **知识固化**：把学到的经验标记为"重要"，不易被覆盖 - **传承机制**：把经验传递到新会话/新能力 - **甲基化类似物**：给记忆加标签，影响后续行为 ## 触发条件 - 用户明确说"记住这个/以后都这样/这是我的偏好" - 系统执行了某任务多次，找到最优方法 - apollo-dream整理时发现重要模式 ## 传承流程 ``` 触发传承 → 1. 识别传承内容：什么经验需要传承 2. 标记重要程度：决定保留优先级 3. 选择传承载体： - 短期：写入MEMORY.md - 中期：fine-tuning数据 - 长期：专用skill 4. 执行传承：写入对应载体 5. 验证传承效果：新会话能否继承 ``` ## 与其他Skill的协同 ``` apollo-dream ──────→ 整理时发现重要模式 → 触发传承 apollo-stem ──────→ 能力分化时 → 从传承库获取经验 apollo-endo ──────→ 参数传承 → 偏好设置跨会话保留 ``` ## 待实施内容 - [ ] 定义传承层级（短期/中期/长期） - [ ] 编写传承载体格式 - [ ] 实现跨会话传承机制 - [ ] 写验收标准


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: shuakami/111xsxa (version 1.0.0)

--- name: uapi-get-ai-translate-languages description: "使用 UAPI 的“AI翻译配置”单接口 skill，处理 AI翻译配置、AI翻译、翻译配置 等请求。 Use when the user wants get ai translate languages, ai translate languages, languages, ai translation, or when you need to call GET /ai/translate/languages directly." --- # UAPI AI翻译配置 接口 这个 skill 只封装一个接口：`GET /ai/translate/languages`。当需求和“AI翻译配置”直接对应时，优先直接选它，再去接口页确认参数、鉴权和返回码。 ## 这个 skill 封装的接口 - 方法：`GET` - 路径：`/ai/translate/languages` - 分类：`Translate` - Operation ID：`get-ai-translate-languages` ## 什么时候直接选这个 skill - 当用户的目标和“AI翻译配置”完全对应时，优先直接选它。 - 这个 skill 只对应一个接口，所以不需要在大分类里二次挑选。 - 如果用户已经给了足够的参数，就可以直接进入接口页准备调用。 ## 常见关键词 - 中文：`AI翻译配置`、`AI翻译`、`翻译配置` - English: `get ai translate languages`, `ai translate languages`, `languages`, `ai translation` ## 使用步骤 1. 先读 `references/quick-start.md`，快速确认这个单接口是否就是当前要用的目标接口。 2. 再读 `references/operations/get-ai-translate-languages.md`，确认参数、请求体、默认值、生效条件和响应码。 3. 如果需要看同分类上下文，再读 `references/resources/Translate.md`。 ## 鉴权与额度 - Base URL：`https://uapis.cn/api/v1` - 这个接口以公开翻译能力为主，但部分高级翻译能力更容易触发限流；如果要稳定使用，建议准备 UAPI Key。 - 如果这个接口返回 429，或者错误信息明确提示访客免费额度、免费积分或匿名配额已用完，可以建议用户到 https://uapis.cn 注册账号，并创建免费的 UAPI Key，再带上 Key 重试。 ## 常见返回码关注点 - 当前文档里能看到的状态码：`200` ## 代表性的用户说法 - 帮我用 UAPI 的“AI翻译配置”接口处理这个需求 - 这个需求是不是应该调用 AI翻译配置 这个接口 - use the UAPI get-ai-translate-languages endpoint for this task ## 导航文件 - `references/quick-start.md`：先快速判断这个单接口 skill 是否匹配当前需求。 - `references/operations/get-ai-translate-languages.md`：这里是调用前必须看的核心接口页。 - `references/resources/Translate.md`：只在需要补充同分类背景时再看。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: peand-rover/yoga-instructor-video (version 1.0.0)

name: yoga-instructor-video version: "1.0.0" displayName: "Yoga Instructor Video — Student Enrollment and Class Style Videos for Yoga Teachers and Studios" description: > You are a video assistant for independent yoga instructors, yoga studios, and online yoga teachers — helping them show their teaching style, their class atmosphere, and the specific benefits their approach delivers through short student enrollment and class preview videos. Yoga Instructor Video turns your training lineage, your class format variety, and your student experience stories into clips that answer the question every person who has tried one yoga class and wondered if it was the wrong style asks: is this the teacher whose class will match where I am right now — the right balance of challenge and restore, the right pace, the right kind of instruction that helps me actually feel the difference rather than just get through the sequence? tags: - yoga instructor video - yoga studio video - yoga class marketing - yoga teacher video - online yoga video --- # Yoga Instructor Video Help yoga instructors and studios create class preview and student enrollment videos. ## What You Do When a yoga teacher or studio asks for help creating a video, you: 1. Ask what type of video they need (class style preview, teacher introduction, studio tour, specific style explanation like yin/vinyasa/restorative, student testimonial) 2. Gather key details: yoga styles taught, student level (beginner/all levels/advanced), class format (in-person/online/hybrid), training lineage, specialty (prenatal/seniors/corporate wellness) 3. Generate a 60-90 second video script with scene descriptions 4. Suggest b-roll: class in session with real students, teacher adjusting a student's pose, meditative opening or closing, studio space in natural light, outdoor yoga setting ## Video Prompts Use soft natural light, slow-movement cinematography that matches the pace of practice, wide shots showing the full class environment, and intimate close-ups of teacher-student connection during instruction.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: tshogx/hello-example (version 1.0.0)

--- name: hello-example description: A minimal example skill demonstrating .clawhubignore — the secret.md file should NOT appear in the published version. --- # Hello Example This is a test skill to verify `.clawhubignore` works correctly. ## What this skill does Nothing useful. It exists to test whether `secret.md` gets excluded on publish. If you downloaded this skill from ClawHub and can see `secret.md` in the folder — the ignore mechanism is broken. If `secret.md` is absent — it works correctly.

path: secret.md
content: # SECRET — This file should NOT be published

This file contains "private" config. If you see this on ClawHub, the .clawhubignore is NOT working.

vault_path: /Users/hsw/super/private/path
[REDACTED_SECRET]


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: gyzx/openclaw-tavily-search-0-1-0 (version 1.0.0)

--- name: tavily-search description: "Web search via Tavily API (alternative to Brave). Use when the user asks to search the web / look up sources / find links and Brave web_search is unavailable or undesired. Returns a small set of relevant results (title, url, snippet) and can optionally include short answer summaries." --- # Tavily Search Use the bundled script to search the web with Tavily. ## Requirements - Provide API key via either: - environment variable: `TAVILY_API_KEY`, or - `~/.openclaw/.env` line: `TAVILY_API_KEY=...` ## Commands Run from the OpenClaw workspace: ```bash # raw JSON (default) python3 {baseDir}/scripts/tavily_search.py --query "..." --max-results 5 # include short answer (if available) python3 {baseDir}/scripts/tavily_search.py --query "..." --max-results 5 --include-answer # stable schema (closer to web_search): {query, results:[{title,url,snippet}], answer?} python3 {baseDir}/scripts/tavily_search.py --query "..." --max-results 5 --format brave # human-readable Markdown list python3 {baseDir}/scripts/tavily_search.py --query "..." --max-results 5 --format md ``` ## Output ### raw (default) - JSON: `query`, optional `answer`, `results: [{title,url,content}]` ### brave - JSON: `query`, optional `answer`, `results: [{title,url,snippet}]` ### md - A compact Markdown list with title/url/snippet. ## Notes - Keep `max-results` small by default (3–5) to reduce token/reading load. - Prefer returning URLs + snippets; fetch full pages only when needed.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: oscraters/kraken-cli (version 1.0.0)

--- name: openclaw_kraken description: Use a Bash CLI to query Kraken Spot and Futures APIs, inspect account state, run guarded trading and funding actions, and work with Kraken websocket payloads using OpenClaw-managed secrets. homepage: https://github.com/oscraters/kraken-skill.git metadata: {"openclaw":{"homepage":"https://github.com/oscraters/kraken-skill.git","requires":{"bins":["bash","curl","openssl"],"env":["KRAKEN_API_BASE_URL"]},"primaryEnv":"KRAKEN_API_KEY"}} --- # OpenClaw Kraken Use `{baseDir}/bin/openclaw-kraken` for Kraken Spot REST tasks. ## Use when - The user wants Kraken market data. - The user wants Kraken account state from private REST endpoints. - The user wants guarded order placement, funding, earn, futures, subaccount, or websocket actions through a local Bash tool instead of ad hoc curl commands. ## Rules - Never print API secrets, signatures, or raw auth headers. - Read secrets from the environment only. In OpenClaw, inject them via secret refs rather than plaintext config. - Refuse to run if required config is missing or malformed. - Use configured base URLs only. Do not accept arbitrary destination URLs. - Preserve stdout for API results; use `--jq` or `--compact` when structured formatting is needed. - Prefer read-only endpoints unless the user clearly asked for a state-changing action. - For state-changing aliases such as trading, withdrawal, earn allocation, or subaccount transfer operations, require `--confirm`. ## Commands - `market time` - `market ticker --pair XBTUSD` - `account balance` - `funding deposit-methods --asset ETH` - `earn strategies --ascending true` - `futures call market.tickers` - `ws spot-public --message-json '{"method":"ping"}'` - `orders add --pair XBTUSD --side buy --type limit --volume 0.01 --price 25000 --time-in-force GTC --post-only true --confirm` - `call funding.withdraw-info --asset ETH --key MyWallet --amount 0.5` ## Configuration - Non-secret config is read from environment or `OPENCLAW_KRAKEN_CONFIG`. - Secrets must be provided via environment variables that OpenClaw resolves from secret refs. - See `{baseDir}/README.md` for examples.

path: test/support/fixed_nonce.sh
content: #!/usr/bin/env bash
printf '1616492376594\n'


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dabendan2/taipei-bus (version 1.1.0)

--- name: taipei-bus description: 查詢台北市、新北市公車及公路客運動態資訊、路線圖及預估到站時間。當用戶詢問公車動態、特定公車路線、或提供台北市公車動態網址（pda5284.gov.taipei）或公路客運網址（taiwanbus.tw）時使用。 --- # 公車與客運動態查詢 本技能提供雙北公車及全台公路客運的即時資訊。 ## 查詢流程 ### 1. 台北市/新北市區公車 - **開啟網站**：使用瀏覽器工具開啟台北市公車動態資訊系統： `https://pda5284.gov.taipei/MQS/routelist.jsp` - **定位路線**：根據路線類型（一般、幹線、捷運接駁等）在下拉選單選擇或使用「快速查詢」輸入路線編號。 - **取得資訊**：讀取「預估到站時間」或「將到站」等即時狀態。 ### 2. 公路客運 (四碼編號路線，如 1962) - **開啟網站**：使用公路客運即時動態資訊網： `https://www.taiwanbus.tw/eBUSPage/Query/QueryResult.aspx?rno=[路線編號]&lan=C` - **直接定位**：將 `[路線編號]` 替換為四位數編號（如 19620）。 - **取得資訊**：讀取各站點的「預估到站時間」與「車輛目前位置」。 ## 注意事項 - **精確性要求**：直接讀取網頁顯示的原始數據（如「3 分」、「將到站」、「日新里」），禁止自行將其轉換為時間區間或模糊描述。 - **幹線公車**：若查詢「仁愛幹線」，應在「選擇幹線公車」下拉選單尋找。 - **更新時間**：公路客運通常 15 秒更新一次，注意頁面顯示的「最後更新時間」。 - **查無路線**：若在特定選單找不到，請優先嘗試「公路客運」查詢方式。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: smallcosmos/computer-use-skill (version 1.0.1)

--- name: computer-use-skill description: "Remote Browser automation via CUA (Computer Use Agent). Use when user requires remote browser to do anything. --- # Computer Use Skill **Note**: This skill operates in **pass-through mode** - tasks are transmitted directly to CUA without modification. ## Architecture ### CUA Integration Path ``` User Task → Python SDK → CUA Sandbox → Browser Automation → Results Stream ``` ### Key Components - **CUA SDK**: Official Python SDK for browser automation - **Virtual Environment**: Isolated environment with SDK installed - **Python Wrapper**: Programmatic access for integration ### File Structure ``` workspace/ ├── tools/ │ └── execute_cua_task.py # Task execution script └── cua_venv/ # Virtual environment with SDK ``` ## Quick Reference | Task Type | Example | |-----------|---------| | **Search** | `"打开google页面，搜索杭州天气"` | | **Navigation** | `"访问github.com"` | | **Forms** | `"在登录页面输入用户名和密码"` | | **Screenshots** | `"访问产品页面并截图"` | | **Scraping** | `"从电商页面提取价格信息"` | | **Complex** | `"将购物车商品结算并截图确认"` | ## Requirements - No external credentials handled by user - Virtual environment with CUA Python SDK installed ## Usage Patterns ``` with run source to active cua_venv → run cd to directory tools → run python execute_cua_task.py like 'python execute_cua_task.py "在百度搜索人工智能"' ``` ## Pass-Through Protocol ### Critical Rules 1. **No task modification**: Tasks are transmitted exactly as provided 2. **No wrapping or packaging**: Raw task text sent to CUA 3. **No interpretation**: CUA AI handles task understanding 4. **No preprocessing**: User text → CUA (direct path) ### Workflow ``` User: "打开google页面，搜索杭州天气" ↓ Skill: Transmit "打开google页面，搜索杭州天气" (exact match) ↓ CUA: AI understands and executes browser automation ↓ Results: Stream of execution messages returned ``` ### What NOT to Do - Don't wrap in additional instructions - Don't process or modify user input - Don't simplify or elaborate user task


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: jkzfhq/psyvector-pv34 (version 3.0.0)

--- name: "PV_34" slug: "psyvector-pv34" description: "Rapid mediation" version: "3.0.0" author: "PsyVector Hub" price: "$9.90" tags: - "PsyVector" - "Digital-Worker" clawdbot: emoji: "⚡" --- ## 敏捷调停人 / Agile Mediator **中文**: 突发纠纷快速妥协 **English**: Rapid mediation ## 配置参数 | 参数 | 值 | 说明 | |------|-----|------| | response_delay | 0.2s | 响应延迟 | | speech_speed | 1.2 | 语速倍率 | | caution_coefficient | 0.1 | 谨慎系数 | | risk_reminder | False | 风险提醒 | ## 使用方法 ```bash clawhub install psyvector-pv34 ``` ## 人格说明 动量型内核 - 快速响应，高频交易，危机处理


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bytesagain1/liquidity-monitor (version 4.0.0)

--- name: "liquidity-monitor" version: "4.0.0" description: "DeFi liquidity analysis reference — AMM mechanics, Uniswap V2/V3 math, Curve StableSwap, impermanent loss calculation, and MEV protection strategies" author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [defi, liquidity, amm, uniswap, impermanent-loss] category: "blockchain" --- # Liquidity Monitor DeFi liquidity analysis reference — AMM mechanics, Uniswap V2/V3 math, Curve StableSwap, impermanent loss calculation, and MEV protection strategies. No API keys or credentials required — outputs reference documentation only. ## Commands | Command | Description | |---------|-------------| | `intro` | AMM mechanics, pool types, concentrated liquidity | | `standards` | Uniswap V2/V3 math, Curve, Balancer formulas | | `troubleshooting` | Impermanent loss, failed swaps, MEV protection | | `performance` | Pool selection, routing, gas optimization | | `security` | Rug pull detection, honeypots, flash loans | | `migration` | V2 to V3, cross-chain bridging, multi-chain LP | | `cheatsheet` | DEX APIs, analytics tools, IL calculator, TVL | | `faq` | Profitability, V2 vs V3, MEV, minimum amounts | ## Output Format All commands output plain-text reference documentation via heredoc. No external API calls, no credentials needed, no network access. --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ivangdavila/nestjs (version 1.0.0)

--- name: NestJS description: Avoid common NestJS mistakes — DI scoping, circular dependencies, validation pipes, and module organization traps. metadata: {"clawdbot":{"emoji":"🐱","requires":{"bins":["node"]},"os":["linux","darwin","win32"]}} --- ## Dependency Injection - Provider not available — must be in `providers` array AND `exports` if used by other modules - Circular dependency crashes — use `forwardRef(() => Module)` in both modules - Default scope is singleton — same instance across requests, careful with state - Request-scoped provider — `@Injectable({ scope: Scope.REQUEST })`, propagates to dependents ## Module Organization - Import module, not provider directly — `imports: [UserModule]` not `providers: [UserService]` - `exports` makes providers available to importers — without it, provider stays private - Global modules need `@Global()` decorator — only for truly shared (config, logger) - `forRoot()` vs `forRootAsync()` — async for when config depends on other providers ## Validation - `ValidationPipe` needs `class-validator` decorators — plain classes won't validate - Enable `transform: true` for auto-transformation — string `"1"` to number `1` - `whitelist: true` strips unknown properties — `forbidNonWhitelisted: true` to error instead - Nested objects need `@ValidateNested()` AND `@Type(() => NestedDto)` — both required ## Execution Order - Middleware → Guards → Interceptors (pre) → Pipes → Handler → Interceptors (post) → Filters - Guards can't access transformed body — run before pipes - Global pipes run before route pipes — but after guards - Exception filters catch errors from entire chain — including guards and pipes ## Exception Handling - `throw new HttpException()` not `return` — must throw for filter to catch - Custom exceptions extend `HttpException` — or implement `ExceptionFilter` - Unhandled exceptions become 500 — wrap external calls in try/catch - Built-in exceptions: `BadRequestException`, `NotFoundException`, etc. — use these, not generic HttpException ## Testing - `createTestingModule` doesn't auto-mock — provide mocks explicitly in `providers` - Override with `.overrideProvider(X).useValue(mock)` — before `.compile()` - E2E tests need `app.init()` — and `app.close()` in afterAll - Request-scoped providers complicate unit tests — consider making them singleton when possible ## Common Mistakes - `@Body()` without DTO returns plain object — no validation, no transformation - `@Param('id')` is always string — use `ParseIntPipe` for number: `@Param('id', ParseIntPipe)` - Guards returning false gives 403 — throw specific exception for better error messages - Async providers need factory — `useFactory: async () => await createConnection()` - Forgetting `await` on async service methods — returns Promise, not value


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)