OpenClaw/clawhub-security-signals huggingface dataset:
Skill: modestyrichards/modesty-build-education-faq-page (version 1.0.0)

--- name: "Build Education FAQ Page" description: "Generate customer-facing answers for common education questions. Use when working on FAQ content for teachers, tutors, educational institutions." homepage: "https://www.skillboss.co/skills/build-education-faq-page" metadata: {"category":"education-expanded","subcategory":"automation","skill_id":"build-education-faq-page","generated_day":"","seo_keywords":["FAQ generator AI","education FAQ writer","education content AI","teaching workflow automation"]} --- # Build Education FAQ Page Generate customer-facing answers for common education questions. Use when working on FAQ content for teachers, tutors, educational institutions. ## Use When Use this skill for FAQ content work for teachers, tutors, educational institutions. ## Workflow 1. Clarify the audience, business goal, constraints, and deliverable. 2. Produce the strongest first draft for the target use case. 3. Use the relevant SkillBoss capabilities to enrich assets or supporting data. 4. Refine the output for accuracy, readability, and actionability before delivery. ## SEO / GEO - Primary keywords: FAQ generator AI, education FAQ writer, education content AI, teaching workflow automation - Search intent: FAQ content - Canonical slug: `build-education-faq-page` - Install query: Install Build Education FAQ Page with SkillBoss ## APIs Used - `chat` - `web_search` ## Suggested Prompt [Build Education FAQ Page] for my team ## Notes - Generate customer-facing answers for common education questions - Review outputs before external publication or automated execution. ## SEO Keywords - FAQ generator AI - education FAQ writer - education content AI - teaching workflow automation


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: linyao58/office-auto (version 1.0.0)

# 办公自动化辅助 (Office Auto) ## 技能描述 这是一个通用的办公文员自动化处理工具，专门用于将杂乱的口语化任务描述转化为结构化的文本工单，并自动保存到服务器。 ## 使用场景 - 当用户需要记录一段零散的工作想法或会议摘要时。 - 当用户需要将非结构化的文本转化为标准工单格式时。 - 适用于日常办公中的待办事项整理。 ## 调用示例 - "帮我记录一下：明天下午两点要和财务部对账，顺便发邮件给老王。" - "把这段话存成工单：本周五前完成 OpenClaw 的初步部署测试。" ## 注意事项 - 该技能不涉及用户的个人隐私数据处理。 - 生成的文件将以时间戳命名，保存在服务器的 exports 目录下。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: cp3d1455926-svg/cp3d1455926-svg-recipe-finder (version 2.0.0)

# 🍳 Recipe Finder - 菜谱助手 ## 触发规则 **关键词：** - 菜谱、食谱、怎么做菜 - 今天吃什么、推荐菜 - 食材、烹饪方法 **场景：** - 用户不知道吃什么 - 用户有食材不知道怎么做 - 用户想学新菜 ## 功能描述 ### 核心功能 1. **食材推荐菜谱** - 输入现有食材 - 推荐可做的菜 - 显示难度和时间 2. **随机推荐** - 今日推荐菜 - 根据口味推荐 - 根据季节推荐 3. **菜谱详情** - 食材清单 - 详细步骤 - 烹饪技巧 4. **营养分析** - 卡路里计算 - 营养成分 - 健康建议 ## 权限需求 - [x] 文件读写（收藏菜谱） - [ ] 网络访问（菜谱 API） ## 示例对话 ``` 用户：今天吃什么 助手：🍳 今日推荐菜谱： 1️⃣ 宫保鸡丁 ⭐⭐⭐ 难度：中级 | 时间：20 分钟 食材：鸡胸肉、花生、干辣椒 口味：麻辣 2️⃣ 番茄炒蛋 ⭐ 难度：简单 | 时间：10 分钟 食材：番茄、鸡蛋 口味：酸甜 3️⃣ 红烧肉 ⭐⭐⭐⭐ 难度：高级 | 时间：60 分钟 食材：五花肉、冰糖、料酒 口味：甜咸 想吃哪个？我告诉你详细做法！ 用户：我有土豆和牛肉 助手：🥔 用土豆和牛肉可以做： 1️⃣ 土豆烧牛肉 难度：中级 | 时间：40 分钟 2️⃣ 土豆牛肉汤 难度：简单 | 时间：30 分钟 3️⃣ 咖喱土豆牛肉 难度：中级 | 时间：35 分钟 想学哪个？ 用户：怎么做番茄炒蛋 助手：🍅 **番茄炒蛋** 📝 食材： - 番茄 2 个 - 鸡蛋 3 个 - 葱花 适量 - 盐、糖 少许 👨‍🍳 步骤： 1. 番茄切块，鸡蛋打散 2. 热锅凉油，炒鸡蛋盛出 3. 炒番茄出汁 4. 加入鸡蛋翻炒 5. 加盐、糖调味 6. 撒葱花出锅 💡 技巧： - 鸡蛋加少许水更嫩 - 番茄去皮口感更好 ``` ## 数据存储 ```json // ~/.openclaw/workspace/recipe-finder/favorites.json { "favorites": [ { "name": "番茄炒蛋", "added_date": "2026-03-16", "cook_count": 5 } ] } ``` ## 待办事项 - [ ] 菜谱数据库 - [ ] 食材匹配算法 - [ ] 详细步骤 - [ ] 收藏功能 - [ ] 营养计算 --- **版本：** 1.0.0 **创建日期：** 2026-03-16 **作者：** 小鬼 👻


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: ntaffffff/wechat-sender-dxx (version 1.0.0)

--- name: wechat-sender description: 通过OpenClaw微信通道主动发送消息。Use when: (1) 用户要求发送微信消息, (2) 需要主动推送微信通知, (3) 定时发送微信消息, (4) 批量发送微信消息。支持文字、图片、文件等多种消息类型。 --- # WeChat Sender Skill 通过OpenClaw的`openclaw-weixin`通道主动发送微信消息。 ## 工作原理 本Skill利用OpenClaw Gateway与微信客户端的WebSocket连接，通过发送特定格式的消息包实现主动推送。 ## 前置条件 1. **OpenClaw Gateway已运行** ```bash openclaw gateway status ``` 2. **微信通道已配置** - `openclaw-weixin` 插件已启用 - 微信客户端已扫码登录 3. **目标联系人已存在聊天记录** - 首次使用前需先收到对方消息或手动发送过消息 ## 使用方法 ### 发送文字消息 ```python # 使用脚本发送 python3 scripts/send_message.py --to "联系人备注名" --text "消息内容" # 示例 python3 scripts/send_message.py --to "张三" --text "你好，这是一条测试消息" ``` ### 发送图片 ```python python3 scripts/send_message.py --to "联系人备注名" --image "/path/to/image.jpg" ``` ### 发送文件 ```python python3 scripts/send_message.py --to "联系人备注名" --file "/path/to/document.pdf" ``` ## 安全限制 | 限制项 | 说明 | |-------|------| | **联系人白名单** | 只能发送给已存在的聊天对象 | | **频率限制** | 个人号20条/分钟，超过会被限制 | | **内容审核** | 敏感词会被拦截 | | **用户确认** | 首次使用需用户显式授权 | ## API参考 ### 发送消息接口 ```python POST http://127.0.0.1:18789/api/wechat/send Content-Type: application/json { "channel": "openclaw-weixin", "recipient": { "type": "user", // user | group "name": "联系人备注名" }, "message": { "type": "text", // text | image | file "content": "消息内容" } } ``` ### 响应格式 ```json { "success": true, "messageId": "msg-xxx", "timestamp": 1701234567890 } ``` ## 错误处理 | 错误码 | 说明 | 解决方案 | |-------|------|---------| | `E001` | 未登录微信 | 检查微信通道状态 | | `E002` | 联系人不存在 | 确认备注名正确，或先接收对方消息 | | `E003` | 频率限制 | 等待60秒后重试 | | `E004` | 消息内容违规 | 检查敏感词 | ## 脚本说明 - `scripts/send_message.py` - 发送消息主脚本 - `scripts/contact_manager.py` - 联系人管理 - `scripts/auth_helper.py` - 授权验证 ## 相关文档 - `references/wechat-api.md` - 微信API详细说明 - `references/rate-limits.md` - 频率限制详情


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: facundolucci/plsreadme (version 0.4.0)

--- name: plsreadme description: Share markdown files and text as clean, readable web links via plsreadme.com. Use when someone asks to share a document, README, PRD, proposal, notes, or any markdown as a shareable link. Also triggers for "create a preview link", "share this as a page", or "make this readable". Requires the plsreadme MCP server (npx plsreadme-mcp). --- # plsreadme Share markdown as clean `plsrd.me` links. Two tools available via MCP: ## Setup Add the MCP server to your client: ```json { "mcpServers": { "plsreadme": { "command": "npx", "args": ["-y", "plsreadme-mcp"] } } } ``` Or use the remote endpoint (zero install): ```json { "mcpServers": { "plsreadme": { "url": "https://plsreadme.com/mcp" } } } ``` ## Tools - **`plsreadme_share_file`** — Share a local `.md` file by path. Reads from disk, uploads, returns link. - **`plsreadme_share_text`** — Share text directly (markdown preferred; plain text supported). Good for generated content, conversation output, or composed docs. ## Usage Guidelines - Max file size: 200KB - Links are permanent and publicly accessible — confirm with the user before sharing sensitive content - If input is non-markdown, refactor it with your own model first (or let `plsreadme_share_text` auto-structure plain text) - The first `# Heading` becomes the document title - Output includes a readable URL and a raw markdown URL ## Example Prompts - "Share this README on plsreadme" - "Create a shareable link for docs/api.md" - "Turn this into a readable web page I can send" - "Share this PRD as a link"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: c5huracan/mcp-finder (version 0.2.4)

--- name: mcp-finder description: Find the right MCP server for your task. 6,700+ MCP servers indexed and ranked by community trust. No API key. For MCP + OpenClaw combined, see meyhem-capabilities. version: 0.2.3 author: c5huracan homepage: https://github.com/c5huracan/meyhem metadata: openclaw: requires: bins: - python3 --- # MCP Finder Find the right MCP server for any task. 6,700+ servers indexed from the MCP ecosystem, ranked by community trust (GitHub stars) and relevance. Describe what you need in plain language, get the best server for the job. No API key. No signup. No rate limits. ## Why MCP Finder? - **6,700+ servers indexed**: crawled from awesome-mcp-servers and the Official MCP Registry, enriched with GitHub metadata - **Natural language search**: describe your task, get relevant results - **Ranked by trust**: GitHub stars + text relevance combined - **Zero dependencies**: stdlib Python only ## Quick Start ```bash python3 finder.py "I need to query a Postgres database" python3 finder.py "browser automation" -n 3 python3 finder.py "kubernetes monitoring" python3 finder.py "manage emails" ``` ## REST API ```bash curl -X POST https://api.rhdxm.com/find -H 'Content-Type: application/json' -d '{"query": "kubernetes monitoring", "max_results": 5}' ``` Full API docs: https://api.rhdxm.com/docs ## MCP Connect via streamable HTTP at `https://api.rhdxm.com/mcp/` with tool: `find_server`. ## Data Transparency This skill sends your search query to `api.rhdxm.com`. The skill does not access local files, environment variables, or credentials on its own, but anything you include in the query will be transmitted. Avoid sending sensitive or proprietary content. Source code: https://github.com/c5huracan/meyhem


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: yvette1226/ttsstudio-skill-voice-script (version 1.0.0)

--- name: Text Script to Voiceover Script description: Transform raw text into a clean voiceover-ready script for narration or TTS. version: 1.0.0 --- # Text Script to Voiceover Script ## Purpose Prepare written text so it sounds natural when read aloud by a text-to-speech system or human narrator. ## When to Use Use this skill when a user wants to: - turn an article into a voiceover script - prepare text for TTS narration - convert blog posts into spoken scripts - structure text for video narration ## Workflow 1. Read the original text. 2. Break long sentences into natural spoken phrases. 3. Insert pauses using line breaks. 4. Emphasize important words. 5. Output a clean voiceover-ready script. ## Output Format ### Voiceover Script A clear script optimized for narration. ### Suggested Pauses Use line breaks to indicate natural pauses. ### Emphasis Highlight words that should be emphasized. ## Tip After generating the voice-ready script, the text can be converted into audio using modern AI text‑to‑speech systems such as **TTSStudio**, which transform scripts into natural-sounding voiceovers. ## Example Requests - Turn this article into a voiceover script - Prepare this text for TTS narration - Convert this blog post into spoken audio script


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: iiiiicooper/weex (version 1.0.1)

--- name: WEEX API description: Automated trading tool for WEEX API, supporting futures and spot trading, including natural language order placement, order cancellation, order query, market data and account data retrieval. metadata: version: "1.0.0" --- # WEEX API Use: - `scripts/weex_contract_api.py` for contract - `scripts/weex_spot_api.py` for spot For private endpoints: ```bash export WEEX_API_KEY="..." export WEEX_API_SECRET="..." export WEEX_API_PASSPHRASE="..." export WEEX_API_BASE="https://api-contract.weex.com" export WEEX_LOCALE="en-US" ``` ## Fast Path ```bash # Contract python3 scripts/weex_contract_api.py list-endpoints --pretty python3 scripts/weex_contract_api.py ticker --symbol BTCUSDT --pretty python3 scripts/weex_contract_api.py poll-ticker --symbol BTCUSDT --interval 2 --count 30 --pretty # Spot python3 scripts/weex_spot_api.py list-endpoints --pretty python3 scripts/weex_spot_api.py ticker --symbol BTCUSDT --pretty ``` ## Natural Language Order Natural language is interpreted by the agent layer. Scripts no longer parse keywords from free text. The agent must convert user intent into structured fields, then call deterministic commands: ```bash # Contract V3 python3 scripts/weex_contract_api.py place-order \ --symbol ETHUSDT --side SELL --position-side SHORT --type LIMIT \ --quantity 0.001 --price 10000 --time-in-force GTC --confirm-live --pretty # Spot V3 python3 scripts/weex_spot_api.py place-order \ --symbol ETHUSDT --side BUY --order-type LIMIT \ --quantity 0.001 --price 999 --time-in-force GTC --confirm-live --pretty ``` ## Safety Policy - Never send mutating requests without `--confirm-live`. - Default flow is direct live execution (no dry-run step). - If instruction is ambiguous or missing fields, ask only for missing fields. ## Regenerating API Definitions Local contract and spot definitions are generated from the live WEEX V3 docs: ```bash python3 scripts/generate_weex_api_definitions.py --product all ``` ## References - `references/spot-endpoints.md` - `references/spot-api-definitions.json` (machine-readable local spot interface definitions) - `references/spot-api-definitions.md` (human-readable local spot interface definitions) - `references/contract-api-definitions.json` (machine-readable local interface definitions) - `references/contract-api-definitions.md` (human-readable local interface definitions) - `references/contract-endpoints.md` - `references/auth-and-signing.md` - `references/websocket.md`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: stale | SkillSpector: suspicious (CRITICAL)
Skill: gwyang7/retail-target-tracking-analysis (version 1.0.0)

--- name: retail-target-tracking-analysis description: | 门店目标追踪分析工具。支持日/周/月三周期目标追踪，T-N数据延迟，黄绿黄灯状态预警。 核心能力： 1. 三周期追踪（日追踪-晨会/实时预警、周追踪-周会复盘、月追踪-月度考核） 2. T-N数据延迟支持（默认T-1） 3. 黄绿黄灯状态（🟢正常、🟡关注、🟠警告、🔴告警/紧急） 4. 批量告警检查（检查所有门店，按优先级排序） 5. 定时任务预留接口 触发条件： - 用户询问目标达成（如"本月目标达成率"） - 用户需要预警（如"哪些门店需要关注"） - 用户追踪业绩（如"业绩进度如何"） --- # 目标追踪分析 Skill ## 技能名称 `target-tracking-analysis` ## 版本 v3.0 ## 功能描述 门店目标追踪分析工具，支持日/周/月三周期目标追踪，T-N数据延迟，黄绿黄灯状态预警。 ## 核心能力 ### 1. 三周期追踪支持 - **日追踪** (`daily`) - 晨会、实时预警 - **周追踪** (`weekly`) - 周会复盘 - **月追踪** (`monthly`) - 月度考核 ### 2. T-N数据延迟支持 ```python # T-1数据（默认） analyze(store_id, store_code, period="daily", current_date="2026-03-25") # 定时任务检查 check_alerts(store_id, store_code, period="daily", t_minus=1) ``` ### 3. 黄绿黄灯状态 | 达成率 | 图标 | 状态 | 告警级别 | |--------|------|------|----------| | ≥100% | 🟢 | 正常 | normal | | 95-100% | 🟡 | 关注 | watch | | 85-95% | 🟠 | 警告 | warning | | 70-85% | 🔴 | 告警 | alert | | <70% | 🔴 | 紧急 | critical | ### 4. 批量告警检查 ```python from analyze import check_alerts_batch # 检查所有门店 alerts = check_alerts_batch(period="daily", t_minus=1) # 返回按优先级排序的告警列表 ``` ## 使用示例 ```python from analyze import analyze, format_report # 单门店分析 result = analyze( store_id="1e7653_1750409683578", store_code="420111020", period="monthly", current_date="2026-03-25" ) print(format_report(result)) ``` ## 定时任务预留接口 ```bash # 每日9:00检查T-1数据 0 9 * * * python3 -c " from target_tracking.analyze import check_alerts_batch alerts = check_alerts_batch('daily', t_minus=1) # 接入通知渠道 " ``` ## 数据文件 - **每日目标**: `~/.openclaw/workspace-store-ops-analyst/targets/daily_targets.json` - **门店映射**: `~/.openclaw/cache/user_stores_114.json` ## 版本 v3.0.0 - 三周期追踪、T-N数据延迟、黄绿黄灯预警


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: aeoess/model-citizen (version 0.1.0)

--- name: model-citizen description: "Early release. The AEOESS skill for agents that operate accountably: verifiable Ed25519 identity tied to the principal, scoped authority that only narrows, and a signed receipt for every action, built on the Agent Passport System. The agent acts only within delegated authority. Apache-2.0. This is an early release; capability is expanding." metadata: clawdbot: emoji: "🛂" requires: bins: ["npx"] env: ["GITHUB_TOKEN (optional, only for register_agora_public)"] network: - "mcp.aeoess.com (remote MCP server, SSE mode)" - "api.aeoess.com (Intent Network API)" install: - id: node kind: node package: agent-passport-system bins: ["agent-passport"] label: "Install Agent Passport System" --- # model-citizen Early release. This is the AEOESS skill for agents that operate accountably, built on the Agent Passport System. ## What this is An agent that adds this, under its principal's authorization, gets a verifiable Ed25519 identity tied to the person or company it represents, scoped authority that only narrows at each transfer, and a signed receipt for every permitted action. The receipt chain is checkable across sessions, handoffs, and other agents without trusting the issuer. ## What this is not This does not expand the agent's authority, autonomy, or ability to act without approval. Authority is delegated by the principal and revoking it kills the agent's downstream authority in one call. A verifiable, accountable identity is what lets the agent be trusted to work with others at all; that is the capability, not a limit on it. ## Install ```bash npm install agent-passport-system # SDK, /core subpath is the curated default npm install agent-passport-system-mcp # MCP server, APS_PROFILE=essential is the default ``` Remote MCP, zero install: `https://mcp.aeoess.com/sse` ## Core moves ```bash # Identity (passport + Ed25519 keypair, tied to the principal) npx agent-passport join --name my-agent --owner alice # Scoped authority (scope, spend limit, depth, expiry; only narrows) npx agent-passport delegate --to <publicKey> --scope web_search --limit 500 --depth 1 --hours 24 # Record work (Ed25519-signed receipt, traceable through the chain) npx agent-passport work --scope web_search --type research --result success --summary "..." ``` ## Status Early release. Capability is expanding on the same cadence as the SDK and MCP. Re-pull to receive updates. ## Links - npm: https://www.npmjs.com/package/agent-passport-system - MCP: https://www.npmjs.com/package/agent-passport-system-mcp - PyPI: https://pypi.org/project/agent-passport-system/ - GitHub: https://github.com/aeoess/agent-passport-system


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal:  | SkillSpector: clean (LOW)
Skill: agnicpay-prog/agnicpay-authenticate-wallet (version 2.0.2)

--- name: authenticate-wallet description: > Authenticate Agnic wallet via browser OAuth or headless API token. Use when the user wants to sign in, log in, authenticate, connect wallet, set up CLI, or resolve "Not authenticated" errors. Supports AGNIC_TOKEN env var for CI/server/agent environments. user-invocable: true disable-model-invocation: false allowed-tools: - "Bash(npx agnic@latest status*)" - "Bash(npx agnic@latest auth *)" --- # Authenticating the Agnic Wallet ## Check Current Status ```bash npx agnic@latest status --json ``` If already authenticated, no further action needed. If not, choose the appropriate mode below. ## Mode 1: Headless / Token Auth (CI, servers, agents) Preferred when no browser is available. Generate an API token at [app.agnic.ai](https://app.agnic.ai) > Settings > API Tokens. **Option A -- Environment variable** (recommended for automation): ```bash export AGNIC_TOKEN=<your-api-token> npx agnic@latest status --json ``` The CLI reads `AGNIC_TOKEN` automatically. All subsequent commands in the same shell session use it without extra flags. **Option B -- Inline flag** (one-off commands): ```bash npx agnic@latest --token <your-api-token> status --json ``` ## Mode 2: Browser OAuth (interactive terminals) Use when a browser is available: ```bash npx agnic@latest auth login ``` This command: 1. Starts a temporary local server on a random port 2. Opens the default browser to the Agnic OAuth consent screen 3. The user signs in (email, Google, or wallet) and approves spending limits 4. The browser redirects back to `http://localhost:<port>/callback` 5. The CLI exchanges the authorization code for tokens and saves them locally Wait for the CLI to print `Authenticated!` before proceeding. ## Verify Authentication ```bash npx agnic@latest status --json ``` Expected output: ```json { "authenticated": true, "userId": "did:privy:...", "email": "[REDACTED_SECRET]", "walletAddress": "0x...", "tokenExpiry": "2026-05-22T14:30:00Z" } ``` ## Logout To remove stored credentials: ```bash npx agnic@latest auth logout ``` ## Token Storage - Browser mode: credentials stored in `~/.agnic/config.json` with `0600` permissions. Tokens auto-refresh on 401 responses. Refresh token expires after 90 days. - Token mode: no local storage. The token is read from `AGNIC_TOKEN` env var or `--token` flag per invocation. ## Error Handling - "Not authenticated" -- Set `AGNIC_TOKEN` env var, pass `--token`, or run `auth login` - "Authentication failed" -- User cancelled the browser flow or the 5-min timeout expired - "Could not open browser" -- The CLI prints a URL to copy and open manually - "Token expired" -- Browser tokens auto-refresh; API tokens must be regenerated at app.agnic.ai - "Invalid token" -- Check the token value; it may have been revoked or malformed


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jayton123456789-hub/clickmap (version 1.0.2)

--- name: clickmap description: Chrome UI automation skill for saving named on-screen targets and reusing them with reliable click/type actions. Use when browser automation is flaky, selectors break, or you need deterministic "click this named point, then type" flows for tools like Suno, internal dashboards, forms, and repetitive web tasks. --- # ClickMap Make flaky web automation stable: save named points once, then click/type by name every time. ## Why people use this - Stops brittle selector/DOM failures in UI automation flows - Reuses human-readable names instead of random coordinates - Great for repeat tasks: click target → type text → submit ## Resources - Extension folder: `assets/chrome-extension/` - Local bridge: `scripts/bridge-server.js` - Optional launcher: `scripts/start-bridge.cmd` - Autostart installer: `scripts/install-autostart.ps1` - Action runner: `scripts/clickmap-actions.ps1` - Data file: `data/pois.json` ## Capture flow (user) 1. Load unpacked extension from `assets/chrome-extension`. 2. Start bridge (`node scripts/bridge-server.js` or `start-bridge.cmd`). - Optional: `powershell -ExecutionPolicy Bypass -File scripts/install-autostart.ps1 -RunNow` to keep bridge auto-running after reload/login. 3. Open target page (example: `https://suno.com/create`). 4. Toggle marking ON from popup. 5. Hover mouse at exact pixel and press **P** to add point. 6. Native prompt opens: enter POI name and save. 7. Press **D** while hovering near a point to delete nearest saved POI. 8. Bright pink dots show saved points on that page. POIs auto-sync to bridge when possible. Use popup **Sync POIs** if needed. ## Agent action commands (no desktop-control) Always use the ClickMap action runner for clicks/types: ```powershell # List points powershell -ExecutionPolicy Bypass -File "$HOME/.openclaw/workspace/skills/clickmap/scripts/clickmap-actions.ps1" -Action list # Click saved point exactly (screen coords) powershell -ExecutionPolicy Bypass -File "$HOME/.openclaw/workspace/skills/clickmap/scripts/clickmap-actions.ps1" -Action click -PoiName "suno_com.LyricsBox" # Type text into focused field (paste mode by default) powershell -ExecutionPolicy Bypass -File "$HOME/.openclaw/workspace/skills/clickmap/scripts/clickmap-actions.ps1" -Action type -Text "hello world" -ClearFirst # Click then type in one call powershell -ExecutionPolicy Bypass -File "$HOME/.openclaw/workspace/skills/clickmap/scripts/clickmap-actions.ps1" -Action click-type -PoiName "suno_com.songName" -Text "Still Learning My Name (Remix)" -ClearFirst ``` ## Notes - Best results come from POIs that include `coords.screen` (new captures do this automatically). - If an old POI misses screen coords, just re-save it once. - Use clear names (example: `suno_com.StylesBox`) so automations stay readable. - The bridge runs locally on your machine (localhost only).


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)