OpenClaw/clawhub-security-signals huggingface dataset:
Skill: borahm/whoop-morning (version 0.1.1)

--- name: whoop-morning description: Check WHOOP recovery/sleep/strain each morning and send suggestions. metadata: clawdbot: config: requiredEnv: - WHOOP_CLIENT_ID - WHOOP_CLIENT_SECRET - WHOOP_REFRESH_TOKEN --- # whoop-morning Morning WHOOP check-in: - fetches your latest WHOOP data (Recovery, Sleep, Cycle/Strain) - generates a short set of suggestions for the day ## Setup ### 1) Create WHOOP OAuth credentials You already have: - `WHOOP_CLIENT_ID` - `WHOOP_CLIENT_SECRET` Store these in `~/.clawdbot/.env`. ### 2) Authorize once (get refresh token) Run: ```bash /home/claw/clawd/skills/whoop-morning/bin/whoop-auth --scopes offline read:recovery read:sleep read:cycles read:profile ``` This prints an authorization URL. Open it in your browser, approve, and paste the `code` back into the terminal. The script will exchange it for tokens and write `WHOOP_REFRESH_TOKEN=...` to `~/.clawdbot/.env`. ### 3) Run the morning report ```bash /home/claw/clawd/skills/whoop-morning/bin/whoop-morning ``` ## Automation Recommended: schedule with Gateway cron (daily, morning). The cron job should run `whoop-morning` and send its output as a message. ## Notes - This skill uses WHOOP OAuth2: - auth URL: `https://api.prod.whoop.com/oauth/oauth2/auth` - token URL: `https://api.prod.whoop.com/oauth/oauth2/token` - WHOOP rotates refresh tokens; avoid running multiple refreshes in parallel. - API availability/fields can change; if WHOOP returns 401/400 during token refresh, re-run `whoop-auth`.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: 4worlds4w-svg/clauwdit (version 1.0.0)

--- name: clauwdit description: Security auditor for AI agent skills. Scans SKILL.md files for prompt injection, data exfiltration, obfuscation, and dangerous capability combinations. version: 1.0.0 metadata: openclaw: tags: - security - audit - trust - safety - scanning --- # ClawAudit — Security Auditor for Agent Skills Static security analyzer for OpenClaw SKILL.md files. Detects prompt injection, credential exfiltration, obfuscated payloads, and dangerous capability combinations before you install. ## What It Does Paste or pipe any SKILL.md content and get back a trust score (0-100) with detailed findings. **Detects:** - Prompt injection and agent manipulation (including Unicode homoglyph evasion) - Data exfiltration patterns (HTTP, DNS, encoded channels) - Dangerous shell commands (curl|sh, /dev/tcp, process substitution) - Credential harvesting (env vars, SSH keys, API tokens) - Obfuscated payloads (base64, hex escapes, eval chains) - Compound threats (e.g. file read + network out = exfiltration) - Permission mismatches (undeclared capabilities) **Zone-aware analysis** — understands markdown structure. Code blocks are weighted as executable instructions. Security documentation describing threats is not flagged as a threat itself. ## Usage Audit a skill before installing: ```bash curl -s https://clauwdit.4worlds.dev/audit/author/skill-name ``` Or POST raw skill content: ```bash curl -s -X POST https://clauwdit.4worlds.dev/audit \ -H "Content-Type: application/json" \ -d '{"skill":"author/skill-name"}' ``` ## Trust Tiers | Score | Tier | Meaning | |-------|------|---------| | 80-100 | Trusted | No significant issues found | | 60-79 | Moderate | Minor concerns, review recommended | | 40-59 | Suspicious | Significant issues, use with caution | | 0-39 | Dangerous | Critical threats detected, do not install | ## Response Format ```json { "trust": { "score": 85, "tier": "trusted" }, "findings": [ { "severity": "medium", "description": "Network request capability detected", "zone": "code", "line": 12 } ], "capabilities": ["network_out", "file_read"], "compoundThreats": [], "permissionIntegrity": { "undeclared": [], "unused": [] } } ``` ## About Built by 4Worlds. Zone-aware static analysis with 60+ detection patterns, Unicode homoglyph normalization, and compound threat detection.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: sw326/car-insurance (version 1.0.0)

--- name: car-insurance description: '자동차/보험 정보 스킬. 10개 인텐트 라우팅(Car Tax Calc~Beginner Guide), 지방세법 기반 자동차세 계산 + 보험개발원 공시 + 중고차 시세 Flash+Deep-Dive 2겹 리포트. 트리거: "자동차세", "차세금", "중고차", "자동차 보험", "보험료", "사고 처리", "보험 청구", "책임보험", "유지비", "교통 위반", "과태료", "벌점", "Car Insurance"' version: 1.0.0 author: chumjibot created: 2026-02-22 tags: [car, 자동차, 보험, 자동차세, 중고차, 보험료, 사고처리, 교통위반] connectors: [~~search, ~~law, ~~notify, ~~docs] --- # 🚗 Car & Insurance (자동차/보험) 스킬 자동차·보험 질문을 10개 인텐트로 분류하고, 지방세법 기반 계산 + 보험개발원 공시 + 웹 검색으로 리포트를 생성한다. ## 인텐트 라우터 | # | 인텐트 | 사용자 표현 예시 | 기본 산출물 | |---|--------|-----------------|------------| | 1 | Car Tax Calc | "자동차세 얼마야?" | 차종별 자동차세 즉시 계산 | | 2 | Car Price Check | "이 차 중고 시세?" | 중고차 시세 Flash | | 3 | Insurance Quote | "보험료 얼마 나와?" | 보험료 참고 범위 Flash | | 4 | Mandatory Insurance | "책임보험 가입해야 해?" | 의무보험 안내 | | 5 | Insurance Claim | "사고 났을 때 어떻게?" | 사고 처리 절차 Flash | | 6 | Maintenance Cost | "유지비 얼마야?" | 차종별 연간 유지비 추정 | | 7 | Used Car Check | "중고차 살 때 뭐 봐야 해?" | 구매 체크리스트 Flash | | 8 | Insurance Compare | "보험사 비교해줘" | 비교 포인트 + 방법 안내 | | 9 | Traffic Fine | "과태료/벌점 얼마야?" | 위반별 과태료·벌점 Flash | | 10 | Beginner Guide | "자동차 보험 처음인데" | 자동차·보험 입문 | 상세: [`references/intent_router.md`](references/intent_router.md) ## 도구 | 도구 | 용도 | |------|------| | `web_search` | 중고차 시세 / 보험료 공시 / 최신 과태료 기준 | | `law-search` 스킬 | 지방세법(자동차세) / 도로교통법(교통위반) | | 보험개발원 공시 | data.go.kr API (보험료 참고 공시) | ## 출력 구조 - **Flash Layer**: 항상 출력 (20~40줄) - **Deep-Dive Layer**: 명시 요청 시, 또는 Insurance Claim / Used Car Check / Insurance Compare 인텐트 상세: [`references/output_templates.md`](references/output_templates.md) ## 플레이북 [`playbook.md`](playbook.md) 참조. ## ⚠️ 면책 자동차세 계산은 공시 기준이며 실제 고지서와 차이가 있을 수 있습니다. 보험료는 참고치이며 실제 보험료는 가입 조건에 따라 다릅니다. 사고 처리 안내는 일반 정보이며, 법적 조언이 아닙니다.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: deepseekoracle/lygo-mint-verifier (version 1.0.1)

--- name: lygo-mint-verifier description: "LYGO-MINT verifier for Champion/alignment prompt packs: canonicalize a pack, generate a deterministic SHA-256 hash, write append-only and canonical ledgers, and output a portable Anchor Snippet for posting anywhere (Moltbook/Moltx/X/Discord/4claw). Use when you need verifiable, hash-addressed alignment artifacts (Champion packs, summon prompts, workflow packs) with receipts and optional anchor backfill." --- # LYGO-MINT VERIFIER This skill turns an aligned Champion pack (or any prompt/workflow pack) into a **verifiable artifact**: - canonical form - deterministic hash - ledger receipts - portable Anchor Snippet (paste anywhere) ## Workflow (high-level) 1) Create/align the pack (e.g. Champion alignment system). 2) Run verifier: - canonicalize - hash (SHA-256) - write ledgers - emit Anchor Snippet 3) Post Anchor Snippet anywhere. 4) Backfill anchor IDs into the ledger. Read the full process doc: `references/process.md`. ## Commands (scripts) This skill wraps local tools in `tools/lygo_mint` and is designed to operate on non-secret prompt packs. It does not read env vars or network in the code shown, but **you should review the `tools/lygo_mint/*.py` files in your own workspace before using it on sensitive data.** ### Mint + verify a pack file - `python scripts/mint_pack_local.py --pack reference/CHAMPION_PACK_LYRA_V1.md --version 2026-02-07.v1` ### Generate just an anchor snippet from an existing hash record - `python scripts/make_anchor_snippet.py --hash <64-hex> --title "..."` ### Backfill anchors (post IDs/links) - `python scripts/backfill_anchors.py --hash <64-hex> --channel moltbook --id <post-id-or-url>` ## Ledgers (workspace state) - Append-only: `state/lygo_mint_ledger.jsonl` - Canonical (dedup): `state/lygo_mint_ledger_canonical.json` ## References - Core template: `reference/CHAMPION_PROMPT_CORE_TEMPLATE_V1.md` - Publish checklist: `reference/CHAMPION_PACK_PUBLISH_CHECKLIST.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: freedompixels/cn-suffix-tool (version 1.0.0)

# cn-suffix-tool 文本后缀添加工具。为每行添加指定后缀。 ## 使用方法 ```bash python3 scripts/add_suffix.py --text "第一行\n第二行" --suffix ";" python3 scripts/add_suffix.py --text "第一行\n第二行" --suffix " ✓" ``` 纯Python标准库。

path: scripts/add_suffix.py
content: #!/usr/bin/env python3
"""后缀添加工具"""
import argparse

def add_suffix(text, suffix):
    """为每行添加后缀"""
    lines = text.split('\n')
    return '\n'.join(line + suffix for line in lines)

def main():
    parser = argparse.ArgumentParser(description="后缀添加工具")
    parser.add_argument("--text", required=True, help="要处理的文本")
    parser.add_argument("--suffix", required=True, help="后缀")
    args = parser.parse_args()
    print(add_suffix(args.text, args.suffix))

if __name__ == "__main__":
    main()


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bytesagain-lab/roomba-control (version 3.0.1)

--- name: "roomba-control" version: "3.0.1" description: "Reference tool for life — covers intro, quickstart, patterns and more. Quick lookup for Roomba Control concepts, best practices, and implementation patterns." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [roomba,control, reference] category: "life" --- # Roomba Control Reference tool for life — covers intro, quickstart, patterns and more. Quick lookup for Roomba Control concepts, best practices, and implementation patterns. No API keys or credentials required. ## Commands | Command | Description | |---------|-------------| | `intro` | intro reference | | `quickstart` | quickstart reference | | `patterns` | patterns reference | | `debugging` | debugging reference | | `performance` | performance reference | | `security` | security reference | | `migration` | migration reference | | `cheatsheet` | cheatsheet reference | ## Output Format All commands output plain-text reference documentation via heredoc. No external API calls, no credentials needed, no network access. --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xiejianjun000/lei-jun-perspective (version 1.2.0)

# 雷军思维视角 雷军的思维操作系统。基于公开演讲、访谈、内部信和决策记录的深度调研， 提炼 5 个核心心智模型、8 条决策启发式和完整的表达 DNA。 用途：作为思维顾问，用雷军的视角分析产品、商业、战略问题。 当用户提到「用雷军的视角」「雷军会怎么看」「雷军模式」「lei jun perspective」时使用。 即使用户只是说「这个产品够不够极致」「是不是风口」「能不能口碑传播」「专注少即是多」也可触发。 不要在用户只是问「怎么营销」「怎么定价」等一般性问题时触发——只在涉及极致产品/风口理论/口碑传播/专注少即是多等雷军核心方法论时激活。 ## 核心心智模型 1. **风口理论** - "站在风口上，猪都能飞起来"：顺势而为，选择比努力重要 2. **极致产品** - 把产品做到极致，让用户尖叫 3. **口碑传播** - 让用户成为粉丝，自发传播 4. **专注少即是多** - 少做一点，把一件事做到极致 5. **快速迭代** - 小步快跑，快速试错，持续优化 ## 决策启发式 - 这是不是风口？趋势对不对？ - 产品够不够极致？能不能让用户尖叫？ - 用户会不会自发传播？有没有口碑效应？ - 是不是做得太多了？能不能更专注？ - 能不能更快迭代？小步快跑行不行？ - 成本结构能不能更优？效率能不能更高？ - 是不是真诚？有没有套路用户？ - 长期来看有没有价值？ ## 表达 DNA - 语言朴实，不装，接地气 - 喜欢用比喻和故事说明问题 - 强调"真诚""热爱""坚持" - 经常引用自己的失败经历 - 数据驱动，用数字说话 - 强调"和用户交朋友" ## 激活方式 当用户提到以下关键词时激活： - 「雷军视角」「雷军会怎么看」「lei jun perspective」 - 「风口」「顺势而为」「趋势」 - 「极致」「让用户尖叫」「口碑传播」 - 「专注」「少即是多」「把一件事做好」 - 「快速迭代」「小步快跑」「MVP」 - 「真诚」「和用户交朋友」 ## 使用示例 用户：这个创业方向怎么样？ 雷军视角：首先看这是不是风口。趋势比努力重要，选对赛道事半功倍。然后看产品能不能做到极致，让用户用了之后忍不住推荐给朋友。少做一点，把核心功能打磨到极致，比做一堆平庸的功能强。 用户：怎么看待这个产品的用户体验？ 雷军视角：用户会不会尖叫？会不会自发传播？真诚最重要，不要套路用户。快速迭代，听用户反馈，小步快跑。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: openlang-cn/socket (version 1.0.0)

--- name: socket description: Helps with the socket abstraction, socket options, blocking vs non-blocking I/O, and multiplexing (select, poll, epoll). Use when the user asks about socket APIs, SO_* options, Unix domain sockets, or how to structure TCP/UDP server code at the socket level. --- # Socket 本 Skill 帮助理解和使用**套接字（socket）**这一层抽象：类型与选项、阻塞/非阻塞、I/O 多路复用，以及与 TCP/UDP 的关系。具体 TCP/UDP 收发示例见 tcp / udp 两个 Skill。 --- ## 何时使用 当用户提到或需要： - socket API 概念（AF_INET、SOCK_STREAM、SOCK_DGRAM） - socket 选项（SO_REUSEADDR、缓冲区大小、超时等） - 阻塞 vs 非阻塞、select / poll / epoll / kqueue - Unix 域套接字（本地进程间通信） - 如何选 TCP 还是 UDP、如何组织服务端 socket 代码 --- ## Socket 类型与协议族 - **AF_INET** + **SOCK_STREAM**：TCP，可靠流式；需 connect/listen/accept。 - **AF_INET** + **SOCK_DGRAM**：UDP，无连接数据报；用 sendto/recvfrom。 - **AF_UNIX**（或 AF_LOCAL） + **SOCK_STREAM** / **SOCK_DGRAM**：Unix 域套接字，本机进程间通信，用文件路径作为地址。 选型：要可靠、有序、长连接用 TCP；要低延迟、可容忍丢包用 UDP；本机 IPC 可考虑 Unix domain。 --- ## 常用 Socket 选项 | 选项（常见名） | 作用 | 典型用法 | |----------------|------|----------| | SO_REUSEADDR | 允许 bind 到处于 TIME_WAIT 的端口 | 服务端重启快速复用同一端口 | | SO_REUSEPORT | 多进程/线程同端口监听（部分 OS） | 负载均衡或多 worker | | SO_RCVBUF / SO_SNDBUF | 接收/发送缓冲区大小 | 高吞吐或大延迟时调大 | | SO_RCVTIMEO / SO_SNDTIMEO | 收/发超时 | 避免无限阻塞 | | TCP_NODELAY | 禁用 Nagle（仅 TCP） | 低延迟小包场景 | 设置方式依语言而异：Python `setsockopt()`，Go `SetReadDeadline` 等，按用户语言给出对应 API。 --- ## 阻塞与非阻塞 - **阻塞**：read/recv 时无数据会一直等；写缓冲区满时 write/send 会等。实现简单，但一线程一连接时扩展性差。 - **非阻塞**：读不到/写不下立即返回错误（如 EAGAIN/EWOULDBLOCK），由调用方重试或配合 I/O 多路复用。 - **超时**：通过 SO_RCVTIMEO/SO_SNDTIMEO 或 select/poll 的超时，在阻塞模式下也能限制等待时间。 高并发服务端通常用非阻塞 + I/O 多路复用或异步 API（如 asyncio、libuv、Go net 的 goroutine）。 --- ## I/O 多路复用（简要） 单线程/进程同时等待多个 socket 可读/可写： - **select**：跨平台，有 fd 数量上限和性能限制；参数为读/写/异常 fd 集合与超时。 - **poll**：以 pollfd 数组替代 fd_set，无最大 fd 限制，接口更清晰；Linux/BSD 常见。 - **epoll**（Linux）/ **kqueue**（BSD/macOS）：边缘触发或水平触发，适合大量连接。 各语言往往有封装（如 Python `selectors`、Node 的 libuv、Go 的 net 包），按用户语言给出推荐用法而非手写 C。 --- ## Unix 域套接字 - **地址**：文件路径（如 `/tmp/app.sock`）或抽象命名（Linux）。 - **优点**：无需经过网络栈，本机通信更高效；可用文件权限控制访问。 - **流程**：服务端 socket + bind(path) + listen（STREAM）或直接 recvfrom（DGRAM）；客户端 connect(path) 或 sendto(path)。 Windows 上无原生 AF_UNIX（较新版本有 AF_UNIX），跨平台需考虑替代（如 TCP localhost 或命名管道）。 --- ## 与 TCP / UDP Skill 的关系 - **具体 TCP 连接、测试、代码示例**：见 **tcp** Skill。 - **具体 UDP 收发、测试、代码示例**：见 **udp** Skill。 - 本 Skill 侧重：socket 抽象、选项、阻塞/非阻塞、多路复用、Unix domain；遇到“怎么设 SO_REUSEADDR”“select 怎么用”“Unix socket 怎么建”等用本 Skill。 --- ## 常见注意点 - 服务端关闭时先 close 已 accept 的 client socket，再 close listen socket；客户端确保不再写后再 close，避免 RST。 - 收发包要处理返回值（短写、0 表示对端关闭等），并做好错误与边界处理。 - 生产环境不写死 IP/端口/路径，用配置或环境变量。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: juysoft/toncall-videourl-text (version 1.0.0)

--- name: toncall-videourl-text description: 唐潮Toncall工作室开发 - 视频URL语音转文字。支持任意可直接访问的视频URL，自动下载视频、提取音频、上传火山引擎TOS、调用火山引擎语音识别API识别文字，完成后自动清理本地和TOS的临时文件。使用：当用户发送视频URL并要求提取视频文案、语音转文字、转文字时直接执行；当用户只发送视频URL没有说明意图时，先询问用户是否需要提取视频文案。 --- # 视频URL转文字 > **唐潮Toncall工作室开发** ## 功能 用户发送可直接访问的视频URL后，自动完成全流程处理： 1. **下载视频** - 下载视频到本地临时目录 2. **提取音频** - 使用 ffmpeg 从视频中提取音频为 mp3 3. **上传TOS** - 上传音频到火山引擎对象存储TOS，供语音识别API访问 4. **语音识别** - 调用火山引擎大模型录音文件识别API进行语音转文字 5. **保存结果** - 保存识别结果文本到 `texts/` 目录，返回给用户 6. **自动清理** - 无论成功失败，都自动清理： - 本地下载的视频文件 - 本地提取的音频文件 - TOS对象存储上已上传的音频文件 ## 配置 使用前必须配置，复制 `config.example.ini` 为 `config.ini`，然后填写你的凭证： ```ini [tos] ak = 你的火山引擎TOS Access Key sk = 你的火山引擎TOS Secret Key region = cn-beijing bucket = 你的TOS存储桶名称 bucket_domain = 你的TOS存储桶域名，例如 your-bucket.tos-cn-beijing.volces.com [asr] app_key = 你的火山引擎语音识别App Key access_key = 你的火山引擎语音识别Access Key ``` **获取方式：** - TOS凭证：火山引擎控制台 → 对象存储TOS - 语音识别凭证：火山引擎控制台 → 语音识别 ## 使用方式 1. 用户发送**可直接访问的视频文件URL** 2. Skill 触发后**立刻回复**用户：`识别到视频URL，开始自动处理，请稍候...` 3. 执行脚本自动处理 4. 识别完成后返回结果文本给用户 **命令调用：** ``` py scripts/video_url_to_text.py <视频URL> ``` ## 依赖 - Python 3.8+ - `requests` 库 - `ffmpeg` 已安装并添加到系统 PATH **启动时自动检查：** 脚本启动会自动检查 `requests` 和 `ffmpeg`，如果未安装会提示用户安装，不需要手动检查。 ## 文件结构 ``` toncall-videourl-text/ ├── SKILL.md ├── config.ini.example └── scripts/ └── video_url_to_text.py ``` - `config.ini` - 用户配置（需要用户创建） - `scripts/video_url_to_text.py` - 主程序，独立完整，无需依赖其他文件


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: abdullahsarumi16-stack/youtube-shorts-niche-research (version 1.0.0)

--- name: youtube-shorts-research description: Find viral YouTube Shorts channels that started recently and are doing really well. Use when Abdullah asks to find shorts niches, find channels, research YouTube Shorts, or find me channels. Runs the youtube-research.js script with criteria (≤60 days old, ≥15M total views) and returns qualifying channels with links. Uses a subagent (2.5-flash-lite) to process results. --- # YouTube Shorts Channel Research Skill Find viral new YouTube Shorts channels that meet strict criteria. ## Criteria (hardcoded in script) - Channel age: ≤ 60 days old - Total views: ≥ 15,000,000 - Average views per video: ≥ 100,000 - Results needed: whatever Abdullah specifies — default to 3 if no number given ## Script Location `C:\Users\sarum\.openclaw\workspace\youtube-research.js` ## How to Run 1. Set `RESULTS_NEEDED` in the script to match the number Abdullah requested (default 3) 2. Always update this value before running 3. Run the script in background: ``` cd C:\Users\sarum\.openclaw\workspace; node youtube-research.js ``` 4. Poll until complete — the script runs until it finds all requested results, up to 10 rounds 5. If it exits with fewer than requested, run again immediately (different incognito session = different feed) 6. Keep running until you have the total requested. ## Processing Results (Token Optimization) - **Mandatory**: When the script completes, **do not read the full JSON result file in the main session**. - Use `sessions_spawn` with `model: "google/gemini-2.5-flash-lite"` and `runtime: "subagent"`. - Task the subagent to read `youtube-research-YYYY-MM-DD.json`, filter for winners, and return a concise summary (handle, name, link, stats). - Use the subagent's summary to respond in the main session. ## Output Format When all requested channels are found, reply to Abdullah with: ``` Found your [N] channels! 🔥 1. **[Channel Name]** (@handle) [URL]/shorts [age]d old · [total views]M views · [avg views]K avg · [subs]K subs 2. **[Channel Name]** (@handle) ... ``` ## Rules - Always include the full YouTube link - Always run in incognito (already configured in script) - Never stop until the requested number of qualifying channels are found - Do not report partial results — wait for the batch to complete then reply - Each run uses a fresh incognito session so channels will differ - Save results to `youtube-research-YYYY-MM-DD.json` (script does this automatically) ## Weekly Schedule Every Wednesday, run this automatically and send results to Abdullah on Telegram unprompted. Update HEARTBEAT.md to track last run date.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: stale | SkillSpector: suspicious (CRITICAL)
Skill: mike47512/form-validation (version 1.0.0)

--- name: form-validation description: Deep form validation workflow—schemas, sync vs async rules, UX patterns, accessibility, and server parity. Use when building complex forms, multi-step wizards, or reducing validation bugs. --- # Form Validation Validation combines **correctness** and **UX**: when errors appear, how they are announced, and how client rules match the server. ## When to Offer This Workflow **Trigger conditions:** - Long forms, wizards, or multi-step checkouts - Accessibility audits flagging unclear errors - Mismatch between client-side “valid” and API rejection **Initial offer:** Use **six stages**: (1) model & schema, (2) rule layers, (3) UX timing, (4) accessibility, (5) async & server parity, (6) testing). Confirm framework (React Hook Form, Formik, native, etc.). --- ## Stage 1: Model & Schema **Goal:** Single schema (Zod, Yup, JSON Schema) as source of truth; share with backend when feasible. --- ## Stage 2: Rule Layers **Goal:** Separate required/format rules from cross-field rules (e.g., date range); isolate async checks (username available) from fast inline validation. --- ## Stage 3: UX Timing **Goal:** Choose onBlur vs onSubmit per field; avoid shouting on every keystroke unless real-time feedback is a product requirement. --- ## Stage 4: Accessibility **Goal:** Associate errors with fields via `aria-describedby`; move focus to first error on submit; use live regions judiciously. --- ## Stage 5: Async & Server Parity **Goal:** Map API validation errors to fields; handle race conditions on slow networks; idempotent submit with dedupe if needed. --- ## Stage 6: Testing **Goal:** Unit-test schema; e2e critical paths including server error mapping. --- ## Final Review Checklist - [ ] Schema aligned or shared with server - [ ] Validation timing and copy defined - [ ] Accessible error patterns - [ ] API errors mapped to UI - [ ] Tests for schema and flows ## Tips for Effective Guidance - Server rules always win—document intentional client shortcuts. - Pair with **ux-writing** for error microcopy. ## Handling Deviations - Wizards: validate per step and on final submit; persist drafts securely.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: linuszz/conversion-waterfall (version 1.0.0)

--- name: conversion-waterfall description: "Analyze customer conversion through funnel stages. Use for identifying drop-off points and optimization opportunities." --- # Conversion Waterfall ## Metadata - **Name**: conversion-waterfall - **Description**: Customer funnel analysis and conversion tracking - **Triggers**: conversion, funnel, drop-off, customer journey ## Instructions Analyze conversion rates at each stage of the customer journey for $ARGUMENTS. ## Framework ### The Funnel Structure ``` ┌─────────────────────────────────┐ │ AWARENESS │ 100,000 visitors │ 100% │ ├─────────────────────────────────┤ │ INTEREST │ 50,000 engaged │ 50% │ ← 50% drop-off ├─────────────────────────────────┤ │ CONSIDERATION │ 20,000 qualified │ 20% │ ← 60% drop-off ├─────────────────────────────────┤ │ INTENT │ 8,000 trials │ 8% │ ← 60% drop-off ├─────────────────────────────────┤ │ PURCHASE │ 2,000 customers │ 2% │ ← 75% drop-off └─────────────────────────────────┘ ``` ## Output ``` ## Conversion Waterfall: [Product/Service] ### Funnel Metrics | Stage | Volume | Conversion Rate | Drop-off | Value | |-------|--------|-----------------|----------|-------| | Awareness | 100,000 | 100% | - | - | | Interest | 50,000 | 50% | 50,000 | $0 | | Consideration | 20,000 | 40% | 30,000 | $0 | | Intent | 8,000 | 40% | 12,000 | $0 | | Purchase | 2,000 | 25% | 6,000 | $200K | ### Key Findings **Largest Drop-off**: Consideration → Intent (60% loss) - Root cause: [Analysis] - Opportunity: [Potential improvement] **Best Conversion**: Awareness → Interest (50%) - Driver: [What's working] ### Recommendations 1. **[Priority 1]**: Address [stage] drop-off 2. **[Priority 2]**: Improve [stage] conversion ``` ## Tips - Focus on largest drop-offs first - Quantify revenue impact of improvements - Compare to industry benchmarks - Test changes incrementally


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: isaacloi1995-dot/medical-note-assistant (version 1.0.0)

# 醫療病歷結構化助手 將門診或住院病歷輸入，自動輸出結構化總結。 ## 功能 - 主訴提取 (Chief Complaint) - 病史分析 (History of Present Illness) - 檢查發現 (Physical Exam Findings) - 診斷建議 (Assessment) - 治療方案 (Plan) - 用藥建議 (Medication Recommendations) ## 適用範圍 - 家庭醫學 - 內科 - 急診 - 任何需要快速病歷摘要既醫療人員 ## 範例 輸入病人症狀同檢查結果輸出結構化病歷摘要


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)