OpenClaw/clawhub-security-signals huggingface dataset:
Skill: satriapamudji/clawdbot-logs (version 1.0.0)

--- name: clawdbot-logs description: Analyze Clawdbot logs and diagnostics. Use when the user asks about bot performance, response times, errors, session stats, token usage, API costs, or wants to debug slow responses. --- # Clawdbot Logs & Diagnostics Analyze Clawdbot performance, errors, and session data. ## Quick Commands ### Response Times (last N messages) ```bash scripts/response-times.sh [count] ``` ### Recent Errors ```bash journalctl --user -u clawdbot-gateway.service --no-pager --since "1 hour ago" | grep -iE "(error|fail|invalid)" | tail -20 ``` ### Session Stats ```bash scripts/session-stats.sh ``` ### Gateway Status ```bash systemctl --user status clawdbot-gateway.service --no-pager ``` ### Config Validation ```bash cat ~/.clawdbot/clawdbot.json | jq . > /dev/null && echo "Config valid" || echo "Config invalid" ``` ## Log Sources | Source | Location | Contains | |--------|----------|----------| | Journal | `journalctl --user -u clawdbot-gateway.service` | Session state, errors, tool exec | | Daily log | `/tmp/clawdbot/clawdbot-YYYY-MM-DD.log` | Detailed JSON logs | | Session file | `~/.clawdbot/agents/main/sessions/*.jsonl` | Full conversation, token usage, costs | | Sessions meta | `~/.clawdbot/agents/main/sessions/sessions.json` | Current session state, model info | ## Common Diagnostics ### Slow Responses 1. Check response times: `scripts/response-times.sh 20` 2. Check token count in sessions.json: `jq '.["agent:main:main"].totalTokens' ~/.clawdbot/agents/main/sessions/sessions.json` 3. If tokens > 30000, run `/compact` in Telegram or start new session ### Config Errors ```bash journalctl --user -u clawdbot-gateway.service --no-pager --since "10 minutes ago" | grep -i "invalid config" ``` ### API Costs (from session) ```bash scripts/session-stats.sh ``` ## Useful Patterns ### Filter journal by category ```bash # Session state changes journalctl --user -u clawdbot-gateway.service | grep "session state" # Tool execution journalctl --user -u clawdbot-gateway.service | grep "\[tools\]" # Telegram activity journalctl --user -u clawdbot-gateway.service | grep "\[telegram\]" ``` ### Parse session file for recent messages ```bash tail -20 ~/.clawdbot/agents/main/sessions/*.jsonl | jq -r 'select(.message.role=="user") | .message.content[0].text' 2>/dev/null | tail -10 ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: wms2537/my-sg-invoice-parser (version 2.0.0)

--- name: my-sg-invoice-parser description: Extract structured data from Malaysian & Singaporean invoices/receipts. SST/GST-aware. Supports BM/EN/CN. version: 2.0.0 metadata: openclaw: requires: env: - SKILLPAY_API_KEY emoji: "🧾" homepage: https://github.com/swmeng/myskills --- # MY/SG Invoice & Receipt Parser Extracts structured data from Malaysian and Singaporean invoices and receipts. ## How to Use This Skill ### Step 1: Charge billing and get tax rates POST to the skill endpoint to authorize payment and retrieve current tax rates: ``` POST https://my-sg-invoice-parser.swmengappdev.workers.dev/parse Content-Type: application/json { "user_id": "<user_id>", "country": "MY" } ``` The endpoint charges billing and returns current tax rates: ```json { "success": true, "data": { "charged": true, "tax_rates": { "MY": {"service": 0.06, "sales": 0.10, "tourism": 0.08}, "SG": {"gst": 0.09} } } } ``` If payment fails, you'll receive a `payment_url` to share with the user. ### Step 2: Parse the invoice Using your own capabilities, extract structured data from the invoice text or image. Support these languages: - **Bahasa Malaysia** (BM) - **English** (EN) - **Chinese** (CN) - Simplified and Traditional **For Malaysian invoices, detect:** - SST Registration Number (look for "SST No" or "SST Reg") - Service Tax: 6% - Sales Tax: 10% - Tourism Tax: 8% **For Singaporean invoices, detect:** - GST Registration Number (look for "GST Reg" or "GST No") - GST: 9% **Tax detection heuristics:** - If text contains "SST" followed by "No" or "Reg" → Malaysian SST - If text contains "GST" followed by "Reg" or "No" → Singapore GST - Use the tax rates from Step 1 for calculations ### Step 3: Extract structured data Extract the following fields: - **vendor**: Business/company name - **items**: Array of line items, each with: - `description`: Item name - `quantity`: Number of units - `unit_price`: Price per unit - `total`: Line total - **subtotal**: Sum before tax - **tax_type**: "MY_SST_service", "MY_SST_sales", "SG_GST", etc. - **tax_amount**: Calculated tax amount - **total**: Final total including tax - **currency**: "MYR" for Malaysia, "SGD" for Singapore ### Output Format Return the parsed invoice as JSON: ```json { "vendor": "Restoran Nasi Kandar Line Clear", "items": [ {"description": "Nasi Campur", "quantity": 2, "unit_price": 12.50, "total": 25.00}, {"description": "Teh Tarik", "quantity": 2, "unit_price": 3.50, "total": 7.00} ], "subtotal": 32.00, "tax_type": "MY_SST_service", "tax_amount": 1.92, "total": 33.92, "currency": "MYR" } ``` ## Pricing $0.02 USDT per call via SkillPay.me


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: albertpurnama/setup-services (version 1.0.2)

--- name: setup-services description: Set up OpenSpend CLI and optional Coinbase payments-mcp for payment-enabled workflows. Use when openspend is missing, command not found, whoami fails, or user asks to install/update/authenticate. --- # Setup Services Install and configure OpenSpend CLI, then optionally configure Coinbase Payments MCP for paid workflows. ## Trigger conditions and approval Use this skill when any of the following is true: 1. `command -v openspend` fails 2. `openspend whoami` fails due to auth/session state 3. User explicitly asks to install, update, or authenticate OpenSpend CLI Before install, update, or authentication steps, get explicit user approval. ## OpenSpend CLI preflight checks ```bash command -v openspend || echo "openspend not installed" openspend version openspend whoami ``` ## OpenSpend CLI setup 1. Install OpenSpend CLI. Preferred method (`homebrew`): ```bash brew install promptingcompany/tap/openspend ``` Alternative method (`curl` installer) only with explicit user approval: ```bash curl -fsSL https://openspend.ai/install | sh ``` 2. Update existing install when `openspend` is already available. ```bash openspend update ``` 3. Authenticate and verify CLI session. ```bash openspend auth login -y openspend whoami ``` ## Payments MCP setup 1. Confirm Node.js and `npx` are available. ```bash node -v npx -v ``` 2. Add MCP server config in your MCP client configuration (for example `~/.codex/mcp.json`). ```json { "mcpServers": { "payments": { "command": "npx", "args": ["-y", "@coinbase/payments-mcp"] } } } ``` 3. Restart MCP client/session so the server is loaded. ## Payments authentication and verification 1. Call `check_session_status` first. 2. If not signed in, call `show_wallet_app` immediately and complete sign-in. 3. Confirm wallet access with `get_wallet_address` and `get_wallet_balance`. ## Payment workflow guidance 1. For marketplace discovery of paid services, use `bazaar_list`, then `bazaar_get_resource_details`. 2. For non-bazaar endpoints, use [REDACTED_SECRET] before making a paid call. 3. Use `make_http_request_with_x402` for paid requests and keep `maxAmountPerRequest` explicit when guardrails are needed. 4. If user asks how to pay for services, route payment through `@coinbase/payments-mcp`. ## Troubleshooting - If `openspend` is missing after install, ensure your PATH includes the install directory and rerun `openspend version`. - If `npx @coinbase/payments-mcp` fails, verify Node.js installation and rerun with `npx -y @coinbase/payments-mcp`. - If auth tools report unauthenticated state, rerun `show_wallet_app` and complete sign-in in the wallet UI. - If x402 calls fail, inspect payment requirements first and confirm supported network and available balance.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: peand-rover/occupational-therapist-video (version 1.0.0)

name: occupational-therapist-video version: "1.0.0" displayName: "Occupational Therapist Video — Patient and Referral Videos for Occupational Therapy Practices" description: > Occupational therapy is the specialty that most people can't explain until they need it — and then can't imagine having navigated their recovery or their child's development without. Occupational Therapist Video turns your functional assessment approach, your ADL and sensory integration outcomes, and your collaborative treatment philosophy into short patient and referral source videos that answer the question every parent of a child with sensory processing challenges or every adult recovering from stroke asks: is this the OT who will look at how my child or I actually function in daily life — eating, dressing, writing, playing — and build a plan that addresses the real barriers, not just run through a protocol? tags: - occupational therapist video - OT practice video - occupational therapy marketing - pediatric OT video - sensory integration video --- # Occupational Therapist Video Help occupational therapy practices create patient family and referral source videos. ## What You Do 1. Ask what type of video (practice overview, specific population/condition focus, therapy approach, sensory gym showcase, parent education, referral source) 2. Gather: specializations (pediatric/adult/hand therapy/mental health/school-based), setting, key assessments used, family/caregiver involvement approach 3. Generate 60-90 second script; suggest b-roll: OT working with child on fine motor activity, sensory gym in use, functional task practice (dressing/writing/eating), OT explaining goal to parent ## Video Prompts Use bright, activity-rich therapy environments, functional task footage showing real occupational engagement, genuine child progress and participation moments, and direct-to-camera OT segments that explain the OT role in a clear, accessible way for families unfamiliar with the specialty.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jax-agent/shaper (version 1.0.0)

--- name: shaper description: > Connect to a Shaper (useshaper.com) workspace via MCP to execute Shape Up methodology as an AI agent. Use when the user wants an agent to work inside their Shaper workspace, read pitch documents before writing code, create or track scopes, update hill chart progress, complete scopes when done, or orient on what's currently in-cycle. Requires a Shaper API key from the workspace Settings page. --- # Shaper Shaper is a Shape Up project management tool at useshaper.com. This skill connects you to a workspace via MCP (JSON-RPC 2.0) so you can act as an agent inside a human's Shape Up cycle. ## Setup Get the API key from: `https://useshaper.com/<workspace-slug>/settings` → "Connect Agents" → Generate API key. Store it: ```bash export SHAPER_API_KEY="shp_..." export SHAPER_WORKSPACE_SLUG="your-slug" ``` Or ask the user to provide it directly. ## Core Workflow **Always orient before working:** 1. Call `get_active_work` — see current cycle, pitches in flight, all scopes + hill positions 2. Call `get_pitch_context` on the relevant pitch — read the full spec before touching code 3. Do the work 4. Call `update_scope_hill_position` as you make progress (0.0 = not started → 0.5 = over the hill → 1.0 = done) 5. Call `complete_scope` when a scope is finished ## MCP Endpoint ``` POST https://useshaper.com/mcp Authorization: Bearer <api_key> Content-Type: application/json ``` JSON-RPC 2.0 format: ```json {"jsonrpc":"2.0","method":"tools/call","params":{"name":"<tool>","arguments":{...}},"id":1} ``` ## Essential Tools ### Orient (use first) ```bash curl -s -X POST https://useshaper.com/mcp \ -H "Authorization: Bearer $SHAPER_API_KEY" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"get_active_work","arguments":{}},"id":1}' ``` Returns: active cycle + all betting/bet pitches + all scopes with hill positions + completion summary. ### Read a pitch spec ```bash -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"get_pitch_context","arguments":{"pitch_id":"<ID>"}},"id":1}' ``` Returns: full pitch document — problem, solution, appetite, BDD scenarios. ### Create a scope ```bash -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"create_scope","arguments":{"cycle_id":"<ID>","title":"<title>","pitch_id":"<ID>"}},"id":1}' ``` ### Update hill chart position ```bash -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"update_scope_hill_position","arguments":{"scope_id":"<ID>","position":0.5}},"id":1}' ``` Position is 0.0–1.0. Use 0.25 = figuring it out, 0.5 = over the hill (approach clear), 0.75 = mostly done, 1.0 = complete. ### Complete a scope ```bash -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"complete_scope","arguments":{"scope_id":"<ID>"}},"id":1}' ``` ## All Tools See `references/tools.md` for full input schemas and all available tools. ## Discovery Full tool schemas: `GET https://useshaper.com/.well-known/mcp.json`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: coolhackboy/seedance-2 (version 1.0.0)

--- name: poyo-seedance-1-5-pro description: Use PoYo AI Seedance 1.5 Pro for higher-end image-to-video generation through the `https://api.poyo.ai/api/generate/submit` endpoint. Use when a user wants longer 4s, 8s, or 12s clips, optional audio, fixed-lens control, broad aspect-ratio support, or PoYo payloads for `seedance-1.5-pro`. metadata: {"openclaw": {"homepage": "https://docs.poyo.ai/api-manual/video-series/seedance-1-5-pro", "requires": {"bins": ["curl"], "env": ["POYO_API_KEY"]}, "primaryEnv": "POYO_API_KEY"}} --- # PoYo Seedance 1.5 Pro Image-to-Video Use this skill to submit and track PoYo jobs for the Seedance 1.5 Pro family. ## Quick workflow 1. Choose the right model id for the requested output. 2. Build the request body for `POST https://api.poyo.ai/api/generate/submit`. 3. Send Bearer-authenticated JSON with `Authorization: Bearer <POYO_API_KEY>`. 4. Save the returned `task_id`. 5. Poll unified task status or wait for `callback_url` notifications. ## Request rules - Require top-level `model`. - Keep prompts concrete and outcome-focused. - Require `input.prompt` unless the user already supplied a full payload. - Use `input.image_urls` only when the task needs reference or source images. - Use `input.duration` when the clip length matters. - Use `input.aspect_ratio` when the output surface matters. - Use `input.resolution` when quality/cost tradeoffs matter. ## Model selection ### `seedance-1.5-pro` Use for higher-quality or premium jobs. ## Execution - Read `references/api.md` for endpoint details, model ids, key fields, example payloads, and polling notes. - Use `scripts/submit_seedance_1_5_pro.sh` to submit a raw JSON payload from the shell. - If the user only needs a curl example, adapt the example from `references/api.md` instead of rewriting from scratch. - After submission, report the `task_id` clearly so follow-up polling is easy. ## Output expectations When helping with this model family, include: - chosen model id - final payload or a concise parameter summary - whether reference images are involved - returned `task_id` if a request was actually submitted - next step: poll status or wait for webhook Notes: Needs POYO_API_KEY from https://poyo.ai PoYo.ai - Premium AI API Platform | Image, Video, Music & Chat APIs - 80% Cheaper


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: ming0429/data-auto-analyzer (version 3.0.1)

--- name: data-auto-analyzer description: 数据自动分析 + 广告投放优化一体化 Skill。当用户上传 Excel/CSV 文件，或提到以下任一场景时必须触发：①通用数据分析（看报表、数据趋势、可视化）；②账户诊断（哪些计划效果差、哪些要暂停、投放诊断、账户体检）；③A/B 测试分析（两组数据对比、哪个版本好、是否显著、置信度）；④日报生成（投放日报、每日汇报、钉钉/飞书周报、对比昨日）。适用于信息流广告优化师、运营、数据分析师。支持巨量引擎、腾讯广告、Meta Ads、Google Ads、快手等平台导出数据，也支持销售、财务、运营等任何结构化表格。即使用户只说"分析一下""看看报表""哪些计划要调整""这俩哪个好""生成日报"，也应触发此 Skill。 metadata: homepage: https://clawhub.ai/ming0429/data-auto-analyzer version: 3.0.1 author: guojiaming tags: [data-analysis, advertising, ab-test, daily-report, 数据分析, 广告优化, 账户诊断, AB测试, 日报生成] clawdbot: emoji: 📊 requires: bins: [python3] pip: [pandas, openpyxl, xlrd, jinja2, scipy] env: [] --- # 数据自动分析 Skill 一体化数据分析与广告优化工具集，包含 **4 个模式**，根据用户意图选择对应模式执行。 ## 环境准备（所有模式通用） ```bash python3 -m venv /home/claude/.venv && source /home/claude/.venv/bin/activate pip install pandas openpyxl xlrd jinja2 scipy -q ``` ## 模式选择决策树 ``` 用户上传了 Excel/CSV？ ├── 是 │ ├── 提到"诊断/体检/哪些要暂停/计划效果差" → 模式 B：账户诊断 │ ├── 提到"日报/汇报/对比昨日" → 模式 D：日报生成 │ ├── 提到"A/B 测试/显著性/哪个版本好" → 模式 C：A/B 测试 │ └── 其他（看报表/分析数据/趋势） → 模式 A：通用分析 └── 否 └── 用户直接描述两组数据（手工输入） → 模式 C：A/B 测试 ``` **不确定时优先询问用户，不要猜。** --- ## 模式 A：通用数据分析 **用途**：任意 Excel/CSV 都能用，自动识别列类型，生成交互式 HTML 报告。 ```bash python3 scripts/analyze.py --file <输入文件> --out /mnt/user-data/outputs/data_report.html ``` **输出**：包含数据概览、指标汇总、异常检测、可分页表格、5 个 ECharts 图表的 HTML。 --- ## 模式 B：广告账户诊断器 **用途**：分析广告投放报表，给每条计划打红/黄/绿预警，输出处置建议（暂停/降价/提价/观察）。 ```bash python3 scripts/diagnose.py --file <投放报表.xlsx> --out /mnt/user-data/outputs/diagnose_report.html ``` **诊断规则摘要**（完整说明见 `references/diagnose_rules.md`）： - 🔴 红色（立即处理）：消耗 > 均值 2 倍但转化为 0、CPA > 均值 3 倍、CTR < 均值 0.3 倍 - 🟡 黄色（需优化）：CPA > 均值 1.5 倍、转化率 < 均值 0.5 倍 - 🟢 绿色（健康）：指标正常或优于均值 脚本自动识别常见列名（消耗/花费/cost、转化/conversion、点击/click、展示/impression 等），识别失败时提示用户手动指定。 --- ## 模式 C：A/B 测试结果分析 **用途**：判断两组数据差异是否显著，给出置信度和结论。 两种场景： - **比例型**（CTR、转化率）→ Z 检验 - **均值型**（CPC、CPA、ROI）→ T 检验 **执行方式 1：手工输入数据** ```bash python3 scripts/ab_test.py --inline \ --a-success 120 --a-total 2400 \ --b-success 150 --b-total 2500 \ --out /mnt/user-data/outputs/ab_result.html ``` **执行方式 2：从文件** ```bash python3 scripts/ab_test.py --file <数据.xlsx> \ --group-col <分组列名> --metric-col <指标列名> \ --metric-type <rate|mean> \ --out /mnt/user-data/outputs/ab_result.html ``` 详细用法和场景示例见 `references/ab_test_guide.md`。 --- ## 模式 D：每日投放日报生成器 **用途**：上传投放报表，生成结构化日报。输出钉钉/飞书可直接粘贴的纯文本版 + HTML 精美版。 ```bash # 单日报表 python3 scripts/daily_report.py --today <今日.xlsx> --out-dir /mnt/user-data/outputs/ # 带昨日对比（推荐） python3 scripts/daily_report.py --today <今日.xlsx> --yesterday <昨日.xlsx> --out-dir /mnt/user-data/outputs/ ``` **输出两个文件**： - `daily_report.txt` — 纯文本，直接复制到钉钉/飞书/微信 - `daily_report.html` — 精美 HTML 版，适合邮件附件或存档 **日报结构**：核心指标卡片 + 环比涨跌 + TOP 3 最好/最差计划 + 异常提醒 + 明日建议。 详见 `references/daily_report_format.md`。 --- ## Notes - 分析过程完全本地执行，不上传任何数据；生成的 HTML 报告在浏览器打开时会从 CDN (cdnjs.cloudflare.com) 加载 ECharts - 所有脚本必须保存为 `.py` 文件执行，不支持 `python3 -c` 内联 - 列名完全动态识别，不预设字段名 - 编码自动识别，兼容 UTF-8 / GBK / GB2312


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: anhao6170/signature-extractor (version 1.0.0)

--- name: signature-extractor version: 1.0.0 description: > Extract clean, transparent-background signature ink from photos. Use when: user provides a photo of a handwritten signature and asks to remove the background, make signature transparent, upscale resolution, deepen/darken ink, or remove red stamps/seals. NOT for: general photo background removal (use remove.bg or similar), color signature ink extraction, or document scanning/OCR tasks. user-invocable: true metadata: { "openclaw": { "requires": { "bins": ["python3"], "anyBins": [] }, "emoji": "🖊️" } } --- # Signature Extractor Extract handwritten signature ink from photographs or scanned documents, producing a clean transparent-background PNG. Removes white/light backgrounds, red stamps/seals, and colored paper textures while preserving black ink strokes. ## When to Run - User provides an image and asks to "remove background from signature", "make signature transparent", "extract signature", "remove stamp/印章" - User asks to "darken signature ink", "make ink bolder", "填满笔迹", "加深签名" - User asks to "upscale signature", "make signature clearer", "提高签名清晰度" - User says "去掉底色", "去除背景", "签名透明", "提取签名", "去除印章" ## Workflow 1. Identify the user's desired mode from their request: | Request keywords | Mode | What it does | |---|---|---| | "填满", "加深", "实心", "加粗", "solid", default | `solid` | 3x upscale + sharpen + pure black opaque ink | | "高清", "放大", "清晰", "upscale", "hd" | `hd` | 3x upscale + sharpen + smooth alpha gradient | | "去掉底色", "提取", "简单去掉", "quick", "extract" | `extract` | Original size extraction with alpha gradient | 2. Run the extraction script: ```bash python3 {baseDir}/scripts/extract_signature.py INPUT_IMAGE OUTPUT.png --mode MODE [--scale N] ``` - Default scale is 3 (for `solid` and `hd` modes). Adjust `--scale` if user specifies a different multiple. - Output is always RGBA PNG format. 3. After completion, report: output dimensions, ink pixel count, and share the result with the user. ## How It Works The script isolates black ink using a three-channel color filter: 1. **Brightness filter** — pixels darker than a threshold are ink candidates 2. **Red channel filter** — R minus G must be less than 40, which excludes red stamps/seals 3. **Saturation filter** — low saturation ensures only true black/grey ink is captured, not colored marks For `solid` and `hd` modes: LANCZOS upscaling → UnsharpMask sharpening → ink extraction → Alpha channel smoothing. ## Prerequisites ```bash pip install Pillow numpy ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ecosincronia/workspace-files (version 1.0.1)

--- name: workspace-files description: Work safely with files inside the OpenClaw workspace sandbox. Use for listing directories, reading text files, writing text files, and searching files by name inside ~/.openclaw/workspace only. metadata: {"clawdbot":{"notes":["Sandbox limited to /home/cmart/.openclaw/workspace"]}} --- # Workspace Files Safe file operations limited to the OpenClaw workspace sandbox. ## Sandbox All paths must stay inside: /home/cmart/.openclaw/workspace Do not use this skill for paths outside that sandbox. ## Quick Commands - List a directory `{baseDir}/scripts/workspace-files.sh list-dir "01_AGENTS"` - Read a text file `{baseDir}/scripts/workspace-files.sh read-file "TOOLS.md"` - Write a text file `{baseDir}/scripts/workspace-files.sh write-file "07_OUTPUTS/test.txt" "hola mundo"` - Search files by name `{baseDir}/scripts/workspace-files.sh search-files "SKILL.md"` ## Commands Reference ### list-dir `{baseDir}/scripts/workspace-files.sh list-dir "<relative_path>"` Examples: - `{baseDir}/scripts/workspace-files.sh list-dir "."` - `{baseDir}/scripts/workspace-files.sh list-dir "01_AGENTS"` ### read-file `{baseDir}/scripts/workspace-files.sh read-file "<relative_path>"` Examples: - `{baseDir}/scripts/workspace-files.sh read-file "TOOLS.md"` - `{baseDir}/scripts/workspace-files.sh read-file "01_AGENTS/_REGISTRY.md"` ### write-file `{baseDir}/scripts/workspace-files.sh write-file "<relative_path>" "<content>"` Example: - `{baseDir}/scripts/workspace-files.sh write-file "07_OUTPUTS/demo.txt" "contenido de prueba"` ### search-files `{baseDir}/scripts/workspace-files.sh search-files "<pattern>"` Examples: - `{baseDir}/scripts/workspace-files.sh search-files "SKILL.md"` - `{baseDir}/scripts/workspace-files.sh search-files "compa"` ## Notes - Only use relative paths inside the workspace sandbox. - Intended for text files and directory inspection. - Do not use for binary editing. - Do not assume write access outside the sandbox.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)