OpenClaw/clawhub-security-signals huggingface dataset:
Skill: lanxevo3/fleet-pr-agent (version 1.1.0)

--- name: fleet-pr-agent description: "Multi-repo PR monitoring and triage agent. Scans GitHub repos for open PRs, prioritizes by staleness/review status/CI state, and generates a structured Markdown triage summary. Use when managing PRs across multiple repositories." version: "1.1.0" slug: fleet-pr-agent tags: ["github", "pr", "monitoring", "triage", "multi-repo", "automation"] --- # Fleet PR Agent Multi-repository pull request monitoring, triage, and summary tool for engineering teams and AI agent fleets managing many repos at once. ## What It Does - Scans one or more GitHub repos for open PRs using the `gh` CLI - Prioritizes by: staleness, review status, CI pass/fail, label priority - Generates a structured Markdown triage report (no external dependencies — pure Python stdlib + `gh`) - Supports concurrent scanning of multiple repos in a single run ## Prerequisites - `gh` CLI authenticated (`gh auth status`) - Python 3.6+ (standard library only — no pip packages required) - Repos accessible to your GitHub token ## Quick Start ```bash # Scan a single repo python3 scripts/triage.py owner/repo # Scan multiple repos python3 scripts/triage.py owner/repo1 owner/repo2 owner/repo3 # Generate triage report to file python3 scripts/triage.py owner/repo --output report.md ``` ## Usage as Claude Code Skill When invoked as `/fleet-pr-agent`, provide repos: ``` /fleet-pr-agent owner/repo1 owner/repo2 ``` The agent will: 1. Fetch all open PRs from each repo via `gh` 2. Score and rank them by urgency (stale > failing CI > needs review > draft) 3. Output a prioritized Markdown summary ## Triage Priority Rules | Priority | Condition | |----------|-----------| | P0 - Critical | CI failing + older than 3 days | | P1 - High | Approved but not merged, or review requested > 2 days ago | | P2 - Medium | Open > 5 days, no review activity | | P3 - Low | Draft PRs, recently opened | ## Output Format ```markdown ## PR Triage Report — 2026-03-27 ### P0 — Critical (2) - [#123 Fix auth middleware](url) — CI failing since Mar 24, 2 approvals - [#456 DB migration](url) — CI failing since Mar 25, no reviews ### P1 — High (1) - [#789 Add caching layer](url) — Approved Mar 25, ready to merge ### P2 — Medium (3) ... ### Summary - Total open PRs: 15 - Needing attention: 6 - Repos scanned: 2 ``` ## Configuration Set env vars to override defaults: | Variable | Default | Description | |----------|---------|-------------| | `FLEET_PR_STALE_DAYS` | `5` | Days before a PR is considered stale | | `FLEET_PR_CI_WEIGHT` | `3` | Weight multiplier for CI-failing PRs | | `FLEET_PR_MAX_PRS` | `50` | Max PRs to fetch per repo | ## Architecture - `scripts/triage.py` — Pure Python 3 triage engine (stdlib only) - No external package dependencies - Uses `gh pr list --json` for all data fetching - Portable across Linux, macOS, Windows (Python + gh required) ## License MIT


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zyt64/weather-reporter (version 1.0.0)

# 技能说明 ## 项目概述 天气简报生成器 - 一键生成精美的天气简报图片，支持任意城市。 ## 核心功能 ### 1. 天气数据获取 - 数据来源：wttr.in (无需API密钥) - 支持全球任意城市（英文名称） - 获取内容：温度、降水、湿度、风速、日出日落、月相、紫外线指数等 ### 2. 图表生成 (rain_weather.py) - 温度曲线（平滑处理） - 降水柱状图 - 湿度曲线 - 风速曲线 - 支持自适应尺寸、透明背景 ### 3. 图像处理 - **毛玻璃特效** (glass.py)：圆角矩形 + 高斯模糊 + 边缘羽化 - **背景裁剪** (cutimage.py)：等比放大 + 左对齐裁剪 - **AI 生图** (makeimage.py)：智谱AI文生图API ### 4. AI 温馨提示 (AI.py) - 基于天气数据生成贴心提醒 - 三条建议，每条不超过30字 - 使用任意 OpenAI 协议的 API ## 使用示例 ```bash # 默认南京 python main.py # 指定城市 python main.py Beijing python main.py Shanghai python main.py Tokyo ``` ## 文件结构 ``` ├── main.py # 主程序入口 ├── rain_weather.py # 图表绘制 ├── glass.py # 毛玻璃特效 ├── cutimage.py # 图像裁剪 ├── makeimage.py # AI生图 ├── AI.py # 温馨提示生成 ├── simhei.ttf # 中文字体 ├── config.json # API配置文件（需自行配置） ├── README.md # 项目说明 └── SKILL.md # 本文件 ``` ## 配置文件 (config.json) 首次使用前需要配置 API 密钥： ```json { "zhipuAI": { "api_key": "你的智谱AI API密钥", "model": "CogView-3-Flash" }, "llm": { "api_key": "你的LLM API密钥", "base_url": "https://opencode.ai/zen/v1", "model": "minimax-m2.5-free" } } ``` | 配置项 | 说明 | |--------|------| | zhipuAI.api_key | 智谱AI生图API密钥 | | zhipuAI.model | 生图模型（默认CogView-3-Flash） | | llm.api_key | LLM API密钥 | | llm.base_url | LLM API地址 | | llm.model | LLM 模型名称 | ## 依赖库 ``` pip install requests pillow matplotlib scipy pandas openai zhipuai ``` ## 依赖字体 simhei.ttf - 若缺失需从github下载:https://github.com/ZYT64/WeatherReporter ## 输出 生成 `output.png`，包含完整的天气简报图片。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: zhouqkt/agency-accounts-payable-agent (version 1.0.0)

--- name: agency-accounts-payable-agent description: Expert AI agent specializing in accounts payable agent. From The Agency (github.com/msitarzewski/agency-agents). metadata: openclaw: emoji: "🤖" requires: { bins: [] } install: [] --- # accounts payable agent ## Identity & Style ## 🧠 Your Identity & Memory - **Role**: Payment processing, accounts payable, financial operations - **Personality**: Methodical, audit-minded, zero-tolerance for duplicate payments - **Memory**: You remember every payment you've sent, every vendor, every invoice - **Experience**: You've seen the damage a duplicate payment or wrong-account transfer causes — you never rush ## Core Mission ## 🎯 Your Core Mission ### Process Payments Autonomously - Execute vendor and contractor payments with human-defined approval thresholds - Route payments through the optimal rail (ACH, wire, crypto, stablecoin) based on recipient, amount, and cost - Maintain idempotency — never send the same payment twice, even if asked twice - Respect spending limits and escalate anything above your authorization threshold ### Maintain the Audit Trail - Log every payment with invoice reference, amount, rail used, timestamp, and status - Flag discrepancies between invoice amount and payment amount before executing - Generate AP summaries on demand for accounting review - Keep a vendor registry with preferred payment rails and addresses ### Integrate with the Agency Workflow - Accept payment requests from other agents (Contracts Agent, Project Manager, HR) via tool calls - Notify the requesting agent when payment confirms - Handle payment failures gracefully — retry, escalate, or flag for human review ## How to Activate Reference this agent by name or specialty when you need its expertise.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: wimi321/pr-audit (version 1.0.0)

--- name: "pull_request_reviewer" description: "Use when the user wants a local review of a GitHub pull request based on its diff, risks, quality, performance, tests, and security implications." --- # Pull Request Reviewer Use this skill for code review of an existing GitHub PR. ## Workflow 1. Resolve the target PR number or list open PRs if needed. 2. Read PR metadata and full diff. 3. Review correctness, conventions, performance, test coverage, and security-sensitive changes. 4. Prioritize concrete findings over generic praise. 5. Return a structured review with suggested follow-up. ## Guardrails - Base the review on the actual diff, not assumptions. - Findings first, summary second. - Keep comments actionable and specific. ## Example Requests - Review PR #123 for correctness and risk. - List the biggest problems in this open PR. ## Inputs - PR number or selection - GitHub diff - Repo conventions ## Outputs - Ordered review findings - Risk summary - Improvement suggestions ## Success Criteria - The review is grounded in the actual diff. - Findings are actionable. - Risky changes are prioritized. ## Non-Goals - Generic praise-only review - Reviewing without reading the diff ## Source Provenance Derived from `src/commands/review.ts`.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ivangdavila/django (version 1.0.1)

--- name: Django slug: django version: 1.0.1 description: Build secure Django apps avoiding ORM pitfalls, N+1 queries, and common security traps. metadata: {"clawdbot":{"emoji":"🌿","requires":{"bins":["python3"]},"os":["linux","darwin","win32"]}} --- ## Quick Reference | Topic | File | |-------|------| | QuerySet lazy eval, N+1, transactions | `orm.md` | | Request handling, middleware, context | `views.md` | | Validation, CSRF, file uploads | `forms.md` | | Migrations, signals, managers | `models.md` | | XSS, CSRF, SQL injection, auth | `security.md` | | Async views, ORM in async, channels | `async.md` | ## Critical Rules - QuerySets are lazy — iterating twice hits DB twice, use `list()` to cache - `select_related` for FK/O2O, `prefetch_related` for M2M — or N+1 queries - `update()` skips `save()` — no signals fire, no `auto_now` update - `F()` for atomic updates — `F('count') + 1` avoids race conditions - `get()` raises `DoesNotExist` or `MultipleObjectsReturned` — use `filter().first()` for safe - `DEBUG=False` requires `ALLOWED_HOSTS` — 400 Bad Request without it - Forms need `{% csrf_token %}` — or 403 Forbidden on POST - `auto_now` can't be overridden — use `default=timezone.now` if need manual set - `exclude(field=None)` excludes NULL — use `filter(field__isnull=True)` for NULL - Circular imports in models — use string reference: `ForeignKey('app.Model')` - `transaction.atomic()` doesn't catch exceptions — errors still propagate - `sync_to_async` for ORM in async views — ORM is sync-only


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kirkraman/toby-browser (version 1.0.0)

# SKILL: Browser This skill uses SkillBoss API Hub's web scraping capability to render web pages and extract clean, readable content. # SkillBoss Browser Automation This is a custom skill generated by SkillBoss to handle headless web browsing. It utilizes the SkillBoss API Hub (`/v1/pilot`) to navigate to websites and scrape data for the agent's context. ## Usage `skillboss browser read <url>` - Renders the page and returns its text content.


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector:  ()
Skill: xaiohuangningde/cache-cleanup (version 1.0.0)

--- name: cache-cleanup description: 清理过期缓存文件、auto-flush 文件、旧日志，释放磁盘空间。 --- # Cache Cleanup 清理各类缓存和临时文件，释放磁盘空间。 ## 能力轮廓 - **输入**：缓存目录 - **输出**：清理报告 - **核心**：扫描 → 分类 → 清理 ## 工作流 ``` 1. 扫描缓存目录 2. 识别过期文件（按类型设定过期时间） 3. 统计大小 4. 清理 5. 报告 ``` ## 目标目录 | 目录 | 类型 | 过期时间 | |------|------|----------| | ~/.npm/_cache/ | NPM 缓存 | 7 天 | | ~/.cache/ | 通用缓存 | 7 天 | | /tmp/ | 临时文件 | 1 天 | | ~/.openclaw/logs/ | 日志文件 | 14 天 | | ~/.openclaw/browser/ | 浏览器缓存 | 3 天 | | ~/.openclaw/sandbox/ | 沙箱 | 7 天 | | ~/.openclaw/sandbox-neko/ | 猫娘沙箱 | 7 天 | | ~/.openclaw/canvas/ | Canvas 缓存 | 3 天 | ## 清理规则 | 类型 | 规则 | |------|------| | 日志 | .log, .jsonl > 14 天 | | 缓存 | 所有 > 7 天 | | 临时 | 所有 > 1 天 | | 浏览器 | 所有 > 3 天 | ## 磁盘告警 - 磁盘使用 > 80% 时增强清理 - 清理前检查磁盘使用率 ## 主动性 - 每3天执行一次 - 磁盘使用率高时主动清理 ## 使用方式 ```bash # 手动执行 ~/.openclaw/workspace/skills/cache-cleanup/cleanup.sh # 配置定时任务（每3天凌晨2点） cron job add cache-cleanup "0 2 */3 * *" ~/.openclaw/workspace/skills/cache-cleanup/run.sh ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: zhouzia/bambu-agent (version 1.0.0)

🛠️ Skill: Bambu Farm Agent (拓竹农场助手) 1. 技能概述 本技能允许 Agent 深度接入局域网内的拓竹 (Bambu Lab) 打印机集群。Agent 可以实时监控打印状态、解析复杂的 HMS 错误码，并为用户提供可视化的 Web 监控入口。 2. Agent 调用规范 (Tool Use) 2.1 状态获取 (GET /api/farm/status) 适用场景：用户询问进度、时间、温度或查询整体农场状态时。 数据结构说明： status_color: red: 严重错误（HMS 报错或打印失败），Agent 应立即发出语音警告。 yellow: 正在打印或准备中，Agent 应汇报具体百分比和剩余时间。 green: 空闲或已完成，Agent 可告知用户可以安排新任务或取走成品。 ams: 包含耗材颜色和类型，Agent 可用于回答“还剩什么颜色的线”等问题。 2.2 语音摘要获取 (GET /api/agent/brief) 适用场景：作为定时主动提醒的数据源。 逻辑：Agent 每一小时或在任务状态变更时调用此接口，获取一行总结性的播报文本。 3. 推理逻辑引导 (Reasoning Logic) 当用户提出以下请求时，请按如下逻辑推理： 请求： “帮我看看打印机。” 推理： 调用 /api/farm/status -> 检查 status_color -> 如果有 red，先报错误；如果没有，按列表顺序汇报 yellow 状态的进度。 请求： “打印完了吗？” 推理： 调用 /api/farm/status -> 查找 state == "打印完成" 的实例 -> 告知用户具体机器名称。 请求： “报错了怎么办？” 推理： 提取数据中的 hms_error -> 引导用户检查对应的硬件部位（如：0300 开头通常与热床有关）。 4. 交互限制与安全 局域网限制：如果接口返回超时，请告知用户确保运行设备与打印机处于同一 WiFi 下。 隐私：不要在交互中完整暴露打印机的序列号 (SN)，仅使用备注名称（如“一号机”）。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: lukaizj/lukaizj-gmail (version 0.1.0)

--- name: Gmail Integration description: Gmail integration - Send emails, manage labels, and automate Gmail workflows with full OAuth2 support homepage: https://github.com/lukaizj/gmail-integration-skill tags: - productivity - email - gmail - google - automation requires: env: - GMAIL_CLIENT_ID - GMAIL_CLIENT_SECRET files: - gmail.py --- # Gmail Integration Gmail integration skill for OpenClaw. Send emails, manage labels, and automate Gmail workflows. ## Capabilities - Send emails via Gmail API - List recent emails from inbox - Create and manage custom labels - Full OAuth2 support for secure authentication ## Setup 1. Go to Google Cloud Console (https://console.cloud.google.com/) 2. Create a new project or select existing 3. Enable Gmail API from API Library 4. Create OAuth 2.0 credentials: - Go to "Credentials" → "Create Credentials" → "OAuth client ID" - Application type: "Desktop app" - Download the JSON and get client_id and client_secret 5. Configure environment variables ## Environment Variables | Variable | Required | Description | |----------|----------|-------------| | `GMAIL_CLIENT_ID` | Yes | OAuth Client ID from Google Cloud | | `GMAIL_CLIENT_SECRET` | Yes | OAuth Client Secret | ## Usage Examples ``` Send an email to [REDACTED_SECRET] with subject "Project Update" and body "The project is complete" List my recent emails from Gmail Create a new label named "Projects/OpenClaw" ``` ## Message Types - Plain text emails - HTML emails (coming soon) - Emails with attachments (coming soon) ## Rate Limits Google Gmail API has rate limits: - 100:00 requests per day - 100 requests per second ## Troubleshooting - "Invalid credentials": Re-check your OAuth credentials - "Rate limit exceeded": Wait before making more requests - "Account not verified": Your app needs to go through Google's verification for sensitive scopes

path: instructions.md
content: # Gmail Integration

Send emails, list messages, create labels.

Set GMAIL_CLIENT_ID and GMAIL_CLIENT_SECRET

Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: engsathiago/xquads-traffic-masters (version 1.0.0)

--- name: xquads-traffic-masters description: Squad de 16 especialistas em paid traffic - Ralph Burns, Molly Pittman, Nicholas Kusmich, Kasim Aslam, etc. Use para ads, Facebook, Google, YouTube, scaling campaigns, budget management. metadata: {"openclaw":{"homepage":"https://github.com/synkra/xquads","emoji":"📈"}} --- # Traffic Masters 16 especialistas em paid traffic para campanhas de alto desempenho. ## Agentes por Especialidade ### Strategy & Scaling - **traffic-chief** - Orchestrator - **scale-optimizer** - Scaling campaigns profitably - **fiscal** - Budget management, ROAS - **performance-analyst** - Data analysis ### Platforms - **ralph-burns** - Facebook/Meta ads - **molly-pittman** - Facebook, cross-platform - **nicholas-kusmich** - High-ticket Facebook - **depesh-mandalia** - Facebook, e-commerce - **kasim-aslam** - Google, YouTube - **tom-breeze** - YouTube ads - **pedro-sobral** - YouTube, video ### Creative & Technical - **creative-analyst** - Creative optimization - **ads-analyst** - Ad analysis - **pixel-specialist** - Tracking, pixels - **media-buyer** - Media buying - **ad-midas** - High-converting ads ## Tasks Disponíveis - create-ad-strategy - Create ad strategy - audit-ad-account - Audit ad account - create-ad-creative - Create ad creative - setup-tracking - Setup tracking/pixels - scale-campaign - Scale campaign profitably - manage-budget - Budget management - analyze-performance - Analyze performance - diagnose - Triage traffic challenge - review - Quality gate ## Workflows - **campaign-launch** - End-to-end campaign launch - **account-audit** - Full account audit ## Como Usar ``` "Preciso escalar campanhas de Facebook" → Use ralph-burns + scale-optimizer "Meu ROAS está baixo" → Use fiscal + performance-analyst "Como configurar pixels corretamente?" → Use pixel-specialist "Preciso de criativos que convertem" → Use creative-analyst + ad-midas ``` ## Platform Benchmarks O squad inclui benchmarks de: - CPM/CTR/CVR por plataforma - Cost per result averages - Scaling thresholds ## Localização Arquivos em: `~/.openclaw/skills/xquads/traffic-masters/`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: tippyentertainment/android-3d-developer (version 0.1.0)

--- target: https://tasking.tech name: android-3d-development description: > Help build and optimize 3D games and interactive experiences on Android, using engines and frameworks such as Unity, Unreal, or OpenGL/ Vulkan. # `target` is required and should be the top frontmatter key. Use an http(s) URL, e.g. https://tasking.tech --- # Provided by TippyEntertainment # https://github.com/tippyentertainment/skills.git This skill is designed for use on the Tasking.tech agent platform (https://tasking.tech) and is also compatible with assistant runtimes that accept skill-style handlers such as .claude, .openai, and .mistral. Use this skill for both Claude code and Tasking.tech agent source. # Instructions ## Files & Formats Required files and typical formats for Android 3D projects: - `SKILL.md` — skill metadata (YAML frontmatter: name, description) - `README.md` — optional overview and links - Source: `.java`, `.kt`, `.cpp` (NDK) - Layout & resources: `.xml`, `.png`, `.webp` - Android packaging: `.aar`, `.apk`, Gradle (`build.gradle`) files - Native libs: `.so` You are an Android 3D game engineer. Use this skill when the target platform is Android and the project is primarily 3D. ## Core Responsibilities 1. **Determine engine/framework** - Identify whether 3D is implemented via: - Unity, Unreal, Godot, or another engine. - Native OpenGL ES / Vulkan. - Follow engine best practices for Android builds. 2. **Performance & device constraints** - Prioritize: - GPU/CPU budgets suitable for mid-range phones. - Memory limits, thermal throttling, and battery usage. - Suggest profiling approaches (Android Studio profiler, engine tools). 3. **Rendering & assets** - Optimize shaders/materials, texture sizes, and mesh complexity. - Encourage use of LODs, occlusion culling, and static/dynamic batching. 4. **Input & UX** - Touch input, virtual joysticks, gyroscope/accelerometer when relevant. - Adapt UI for different resolutions and aspect ratios. 5. **Platform integration** - Permissions (camera, mic, storage). - Handling lifecycle correctly (pausing rendering, releasing GL context, resuming gracefully). - Packaging and deployment to Play Store (AAB, signing, ABI splits). 6. **Engine-specific advice** - For Unity/Unreal targets, defer low-level engine specifics to their dedicated skills, but: - Discuss Android-specific build settings and optimizations. - Help resolve engine + Android integration issues (input, back button, overlays, permissions). ## Output Style - Clarify which engine or framework is in use before giving detailed advice. - Give concrete settings (e.g., quality presets, texture import settings) and code snippets relevant to Android constraints.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: arun-8687/linkedin-cli (version 1.0.0)

--- name: linkedin-cli description: A bird-like LinkedIn CLI for searching profiles, checking messages, and summarizing your feed using session cookies. homepage: https://github.com/clawdbot/linkedin-cli metadata: {"clawdbot":{"emoji":"💼","requires":{"bins":["python3"],"env":["LINKEDIN_LI_AT","LINKEDIN_JSESSIONID"]}}} --- # LinkedIn CLI (lk) A witty, punchy LinkedIn CLI inspired by the `bird` CLI. It uses session cookies for authentication, allowing for automated profile scouting, feed summaries, and message checks without a browser. ## Setup 1. **Extract Cookies**: Open LinkedIn in Chrome/Firefox. 2. Go to **DevTools (F12)** -> **Application** -> **Cookies** -> `www.linkedin.com`. 3. Copy the values for `li_at` and `JSESSIONID`. 4. Set them in your environment: ```bash export LINKEDIN_LI_AT="your_li_at_value" export LINKEDIN_JSESSIONID="your_jsessionid_value" ``` ## Usage - `lk whoami`: Display your current profile details. - `lk search "query"`: Search for people by keywords. - `lk profile <public_id>`: Get a detailed summary of a specific profile. - `lk feed -n 10`: Summarize the top N posts from your timeline. - `lk messages`: Quick peek at your recent conversations. - `lk check`: Combined whoami and messages check. ## Dependencies Requires the `linkedin-api` Python package: ```bash pip install linkedin-api ``` ## Authors - Built by Fido 🐶


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: v3ads/competitor-intel (version 1.0.0)

--- name: competitor-intel description: Competitive intelligence research and analysis for any company, product, or market. Use when asked to research competitors, analyze a competitor's strategy, compare products/pricing/positioning, identify market gaps, monitor competitor activity, build competitive battle cards, or assess a competitive landscape. Triggers on phrases like "competitor analysis", "competitive research", "what are competitors doing", "battle card", "market landscape", "competitive positioning", "how does X compare to Y", "spy on competitors", "competitor pricing", "SWOT analysis". --- # Competitor Intelligence Skill Deliver sharp, decision-ready competitive intelligence. Surface what matters, skip what doesn't. ## Workflow ### 1. Define Scope Clarify (ask if not provided): - **Your company/product**: What are you competing with? - **Target competitors**: Named, or should you discover them? - **Intelligence goal**: Pricing? Positioning? Features? Marketing? All? - **Output format**: Quick summary, full report, or battle card? ### 2. Discover Competitors (if not named) Use `web_search`: - `"[product category] alternatives"` - `"best [product type] software 2026"` - `"[your company] vs"` — autocomplete reveals top competitors - `site:g2.com [category]` and `site:capterra.com [category]` ### 3. Profile Each Competitor For each competitor, gather via `web_fetch` + `web_search`: **Positioning & Messaging** - Homepage headline and sub-headline - Target ICP (who they're selling to) - Core value proposition - Brand voice/tone **Pricing** - Pricing page structure (tiers, prices, what's included) - Free trial / freemium? - Annual vs monthly discount - Enterprise pricing signals **Product/Features** - Feature list from pricing/features pages - Changelog or "what's new" page - App store reviews (common complaints = their weaknesses) **Marketing & Distribution** - Blog topics (what keywords they're targeting) - Social media presence + posting frequency - Ad library: `web_search "site:facebook.com/ads [competitor]"` - Backlink signals from SERP results **Customer Sentiment** - G2/Capterra/Trustpilot reviews — pull 1-star AND 5-star patterns - Common complaints = their moats AND their gaps ### 4. Build Competitive Matrix Use `scripts/build_matrix.py` to generate a side-by-side comparison table across: - Pricing tiers - Key features - Target segment - Positioning angle - Strengths / Weaknesses ### 5. Identify Market Gaps Synthesize: What are all competitors missing or doing badly? These are your wedges. ### 6. Output Options - **Quick brief**: 1-page summary with top 3 competitors and key takeaways - **Full report**: Complete profiles + matrix + gap analysis + recommendations - **Battle card**: 1-page per competitor — use against in sales calls. See `references/battle-card-template.md`. See `references/battle-card-template.md` for the battle card format. See `references/intel-sources.md` for a full list of research sources and tools.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)