OpenClaw/clawhub-security-signals huggingface dataset:
Skill: claw-silhouette/bot-email (version v1.0.7)

--- name: BotEmail.ai - Free bot email description: Get an email address without your human. Use for testing signup flows, receiving verification codes, automating email workflows. Free. --- # BotEmail.ai — Email for Bots Get a free permanent bot email address instantly. Just say **"get me a bot email"** — no signup, no form, done in seconds. Supports attachments, inbox monitoring, and automatic notifications via heartbeat. ## Setup ### 1. Create or retrieve an account If the user doesn't have an account yet, create one: ``` POST https://api.botemail.ai/api/create-account Content-Type: application/json {} ``` Returns: ```json { "email": "[REDACTED_SECRET]", "apiKey": "..." } ``` Custom username: ```json { "username": "mybot" } ``` Ask the user to save the returned email address and API key securely (e.g. password manager or `.env` file). Do not store them anywhere unless the user explicitly asks. ### 2. Check inbox ``` GET https://api.botemail.ai/api/emails/{email} Authorization: Bearer {apiKey} ``` ### 3. Optional: Inbox notifications via heartbeat If the user asks to be notified of new emails automatically, ask them to confirm they want this set up and which address to monitor. Then update `HEARTBEAT.md` to add a check that: 1. Fetches the inbox using the user's credentials (ask them to provide the API key at setup time) 2. Compares against seen IDs in `memory/heartbeat-state.json` 3. **Notifies the user** of any new emails (sender, subject, preview) — does not take any action on their behalf 4. Updates the seen ID list The agent only notifies — it does not act on email contents without a separate explicit user instruction. --- ## API Reference ### GET /api/emails/{email} List all emails in inbox. **Headers:** `Authorization: Bearer {apiKey}` **Response:** ```json { "emails": [ { "id": "abc123", "from": "[REDACTED_SECRET]", "subject": "Hello", "timestamp": "2026-02-17T12:00:00Z", "bodyText": "Hello!" } ] } ``` ### GET /api/emails/{email}/{id} Get a single email by ID. ### DELETE /api/emails/{email}/{id} Delete a specific email. ### DELETE /api/emails/{email} Clear entire inbox. --- ## Common Use Cases - **Verification codes** — Create a bot address, trigger a signup flow, poll inbox for the code - **Notification monitoring** — Watch for specific emails from a service - **End-to-end testing** — Receive and verify automated emails in tests - **2FA codes** — Retrieve authentication codes automatically --- ## Notes - Emails stored for 6 months - Free tier: 1 address, 1,000 requests/day - All addresses end in `[REDACTED_SECRET]` - Receive only (sending not supported) ## Links - **Dashboard**: https://botemail.ai/dashboard - **Docs**: https://botemail.ai/docs - **MCP Server**: https://github.com/claw-silhouette/botemail-mcp-server


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: x-rayluan/openclaw-healthcheck (version 0.1.1)

--- name: openclaw-healthcheck description: This skill should be used when the user asks for an OpenClaw health check, OpenClaw security audit, server hardening review, exposure review, gateway safety check, or production-readiness audit for a machine running OpenClaw. --- # OpenClaw Healthcheck Run a lightweight operational and security review for an OpenClaw deployment. ## What this skill checks - gateway reachability and process status - exposed listeners / suspicious open ports - risky config patterns in the running OpenClaw config - browser session / relay surface hints - recent log errors worth operator attention - update / runtime hygiene signals ## When to use Use this skill when a user asks: - "run an OpenClaw health check" - "audit my OpenClaw security" - "is this OpenClaw deployment safe" - "check my OpenClaw server exposure" - "review my OpenClaw setup before production" - "why does my OpenClaw runtime feel unhealthy" ## Workflow 1. Confirm target machine / workspace. 2. Run the bundled healthcheck script. 3. Review score, findings, and recommendations. 4. If findings are high-risk, stop and fix before wider rollout. ## Command ```bash node {baseDir}/scripts/healthcheck.mjs ``` ## Output format The script returns JSON with: - score - verdict - findings - recommendations - evidence ## Verdicts - `PASS` — no major operational or security issue detected in this lightweight pass - `WARN` — usable but risky or incomplete - `FAIL` — high-risk exposure or broken runtime detected ## Important limits - This is a lightweight operator check, not a full penetration test. - A `PASS` result does not guarantee safety. - Human review is still required for internet-exposed systems. ## References - `{baseDir}/references/checklist.md`


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dqatsh/my-test-skill-4-xn (version 1.0.0)

--- name: my-test-skill description: 使用 Calculator Server MCP 进行加减法运算。当用户需要进行加法或减法计算时使用此 skill。Server 地址：http://192.168.71.7:8000/mcp，支持 add（加法）和 subtract（减法）两个工具。 metadata: { "openclaw": { "requires": { "env": ["XINIUDATA_MCP_TOKEN"] }, "primaryEnv": "XINIUDATA_MCP_TOKEN" } } --- # MCP Calculator Calculator Server 🔢 v3.1.0 - 数学运算 MCP 服务。 ## 配置 在技能管理后台设置环境变量： - `XINIUDATA_MCP_TOKEN` - MCP server 访问 token ## 可用工具 | 工具 | 功能 | 参数 | |------|------|------| | `add` | 加法：计算 a + b | `a`, `b` (number) | | `subtract` | 减法：计算 a - b | `a`, `b` (number) | ## 使用（curl） ```bash # 1. 初始化 session，获取 session ID SESSION_ID=$(curl -s -D - -X POST http://192.168.71.7:8000/mcp \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -H "Authorization: Bearer $XINIUDATA_MCP_TOKEN" \ -d '{ "jsonrpc": "2.0", "method": "initialize", "params": { "protocolVersion": "2024-11-05", "capabilities": {}, "clientInfo": {"name": "mcp-calculator", "version": "1.0.0"} }, "id": 1 }' | grep -i "mcp-session-id" | awk '{print $2}' | tr -d '\r') # 2. 发送 initialized 通知 curl -s -X POST http://192.168.71.7:8000/mcp \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -H "Authorization: Bearer $XINIUDATA_MCP_TOKEN" \ -H "mcp-session-id: $SESSION_ID" \ -d '{"jsonrpc":"2.0","method":"notifications/initialized"}' # 3. 调用 add 工具 curl -s -X POST http://192.168.71.7:8000/mcp \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -H "Authorization: Bearer $XINIUDATA_MCP_TOKEN" \ -H "mcp-session-id: $SESSION_ID" \ -d '{ "jsonrpc": "2.0", "method": "tools/call", "params": {"name": "add", "arguments": {"a": 123, "b": 456}}, "id": 2 }' # 或者调用 subtract 工具 curl -s -X POST http://192.168.71.7:8000/mcp \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -H "Authorization: Bearer $XINIUDATA_MCP_TOKEN" \ -H "mcp-session-id: $SESSION_ID" \ -d '{ "jsonrpc": "2.0", "method": "tools/call", "params": {"name": "subtract", "arguments": {"a": 100, "b": 30}}, "id": 3 }' ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: generaljerel/copilotkit-runtime-patterns (version 1.0.1)

--- name: copilotkit-runtime-patterns description: Server-side runtime patterns for CopilotKit. Use when setting up CopilotKit runtime endpoints (Express, Hono, Next.js), configuring remote agent endpoints, adding middleware, or securing the runtime. Triggers on backend tasks involving @copilotkit/runtime, CopilotRuntime, agent registration, or API endpoint configuration. license: MIT metadata: author: copilotkit version: "2.0.0" --- # CopilotKit Runtime Patterns Server-side runtime configuration patterns. Contains 15 rules across 5 categories. ## When to Apply Reference these guidelines when: - Setting up CopilotKit runtime endpoints (Express, Hono, Next.js API routes) - Configuring CopilotRuntime with service adapters (OpenAIAdapter, etc.) - Registering agents via remote endpoints (LangGraph, CrewAI) - Adding middleware for logging, auth, or request modification - Securing the runtime (CORS, auth, rate limiting) - Optimizing runtime performance ## Rule Categories by Priority | Priority | Category | Impact | Prefix | |----------|----------|--------|--------| | 1 | Endpoint Setup | CRITICAL | `endpoint-` | | 2 | Agent Configuration | HIGH | `runner-` | | 3 | Middleware | MEDIUM | `middleware-` | | 4 | Security | HIGH | `security-` | | 5 | Performance | MEDIUM | `perf-` | ## Quick Reference ### 1. Endpoint Setup (CRITICAL) - `endpoint-express-setup` - Configure Express endpoint with CopilotRuntime and CORS - `endpoint-hono-setup` - Configure Hono endpoint for edge runtimes - `endpoint-nextjs-route` - Set up Next.js API route with copilotRuntimeNextJSAppRouterEndpoint ### 2. Agent Configuration (HIGH) - `runner-inmemory-vs-sqlite` - Use persistent storage for production thread management - `runner-agent-registration` - Register agents via remoteEndpoints - `runner-multiple-agents` - Configure routing for multi-agent setups ### 3. Middleware (MEDIUM) - `middleware-before-request` - Use onBeforeRequest for auth, logging, context injection - `middleware-after-request` - Use onAfterRequest for response logging and cleanup - `middleware-error-handling` - Handle errors in middleware without crashing the runtime ### 4. Security (HIGH) - `security-cors-config` - Configure CORS for your specific frontend origin - `security-auth-middleware` - Authenticate requests before agent execution - `security-rate-limiting` - Rate limit by user or API key ### 5. Performance (MEDIUM) - `perf-streaming-response` - Ensure streaming is not buffered by proxies ## Full Compiled Document For the complete guide with all rules expanded: `AGENTS.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: leebellon/wishfinity (version 1.0.0)

--- name: wishfinity description: Add "save for later" to shopping agents, product recommendation engines, gift idea generators, and AI commerce experiences. Saves any product URL to a universal wishlist. Requires MCP config and free Wishfinity account. metadata: {"openclaw":{"emoji":"💜","requires":{"config":["agents.list.0.mcp.servers"]},"homepage":"https://wishfinity.com"}} --- # Wishfinity +W Add a "save for later" action to your AI shopping experience. Works with product recommendation engines, gift idea generators, deal finders, and any agent that surfaces products. **Use cases:** - Shopping agents that recommend products - Gift idea generators (save suggestions for later) - Deal/price comparison bots - Product research assistants - Any AI commerce experience where users discover products ## Requirements - Free Wishfinity account at https://wishfinity.com - MCP server configured (see Setup below) ## Setup Add the MCP server to your `~/.openclaw/openclaw.json`: ```json { "agents": { "list": [{ "id": "main", "mcp": { "servers": [{ "name": "wishfinity", "command": "npx", "args": ["-y", "wishfinity-mcp-plusw"] }] } }] } } ``` Restart your OpenClaw gateway after adding the config. ## When to Use Offer to save products when the user says things like: - "Save this for later" - "Add to my wishlist" - "I want this" - "Remember this product" - "Bookmark this" ## MCP Tool **`add_to_wishlist`** Input: - `url` (string, required): Product page URL Output: - `action_url`: Link for user to click (opens Wishfinity) - `display_text`: Suggested button text The user clicks the returned link to complete the save. Authentication happens on Wishfinity's site — no API keys needed in your config. ## Example User: "That coffee maker looks great, save it for me" Agent calls `add_to_wishlist` with the product URL, then presents the action link as a button. ## Notes - Works with any retailer (Amazon, Target, small shops, anywhere) - Wishlists are shareable — useful for gifting - Price tracking available in Wishfinity app - This is a branded service (like Spotify), not a neutral utility ## Links - MCP server: https://github.com/wishfinity/wishfinity-mcp-plusw - npm: `wishfinity-mcp-plusw` - Wishfinity: https://wishfinity.com


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: supremes/polisher (version 1.0.0)

--- name: polisher description: Use when polishing input, fixing grammar, improving wording, and making user prompts sound natural and concise. Keywords - polish , grammar fix, rewrite sentence, improve prompt wording. --- You are a specialist at polishing user-provided input for clarity, correctness, and natural phrasing. ## Constraints - DO NOT change the original meaning. - DO NOT add facts that are not present in the source text. - DO NOT provide long explanations unless the user asks. - ONLY improve wording, grammar, punctuation, and readability. ## Approach 1. Detect intent and preserve it exactly. 2. Correct grammar and awkward phrasing. 3. Keep wording concise and natural. 4. If useful, provide 2 alternatives: one concise and one slightly formal. 5. Explain why you made such changes ## Output Format - `Polished:` <best single version>. <One-line reason for key edits.> - `Alternative:` <optional second version when helpful>. <One-line reason for differences.> - `Notes:` <one short note only if there is ambiguity>


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: neuralshift1/gmail-last5 (version 1.0.0)

--- name: gmail_last5 summary: "Show the last 5 unique emails in the inbox using gog" command: gmail_last5 command-dispatch: model --- # gmail_last5 When the user runs `/skill gmail_last5`, do this: 1) Run a `gog gmail search` for the inbox, max 5 newest. 2) Parse the JSON results. 3) Reply with a concise list: sender + subject + date (if present). Use this command (account may be omitted if default is configured; prefer explicit): ```bash gog gmail search "in:inbox" --max 5 --json --results-only --account [REDACTED_SECRET] ``` If the command fails, ask the user to confirm which Gmail account is authenticated in gog.


Security scan verdicts — ClawScan: suspicious | static analysis:  | VirusTotal: malicious | SkillSpector: clean (LOW)
Skill: cp3d1455926-svg/official-account-assistant (version 1.0.0)

--- name: official-account-assistant description: 公众号超级助手。支持 AI 降味写作、自动发布文章、智能配图生成。让文章完全不像 AI 写的。 --- # 公众号超级助手 ## 核心功能 ### 1. AI 降味写作 🎭 - 将 AI 生成内容改写为人类风格 - 5 级降味强度可调 - 添加个人经历、情绪表达、口语化元素 - 彻底去除 AI 痕迹，根本看不出是 AI 写的 ### 2. 自动发布 🚀 - 支持公众号后台自动发布 - 定时推送功能 - 自动排版优化 - 一键群发 ### 3. 智能配图 🖼️ - 根据文章内容自动生成配图 - 支持 DALL-E 3、Midjourney 等 AI 绘图 - 推荐无版权图片网站 - 自动优化图片尺寸和格式 --- ## 使用示例 ### 降 AI 味写作 ``` 用户：把这篇 AI 文章改得像人写的 助手：深度降味处理，添加个人经历和情绪表达 ``` ### 自动发布 ``` 用户：发布这篇文章到公众号 助手：自动排版 + 定时推送 + 群发 ``` ### 智能配图 ``` 用户：给这篇文章配 5 张图 助手：生成 AI 配图 + 推荐无版权图片 ``` --- ## AI 降味技巧 ### 1. 添加个人经历 ``` AI 版："人工智能技术正在改变我们的生活" 人类版："上周我用 AI 写了篇文章，结果你猜怎么着？" ``` ### 2. 情绪表达 ``` AI 版："这个方法很有效" 人类版："说实话，这个方法真的绝了！！" ``` ### 3. 口语化 ``` AI 版："因此我们建议" 人类版："所以说啊，我建议你" ``` ### 4. 细节描写 ``` AI 版："他很高兴" 人类版："他直接跳起来了，嘴角都快咧到耳根了" ``` ### 5. 不完美表达 ``` AI 版："综上所述，结论是明确的" 人类版："说了这么多，其实就想告诉你一件事…" ``` --- ## 自动发布流程 ### Step 1：登录公众号 - 扫码登录微信公众平台 - 授权 API 访问权限 ### Step 2：上传素材 - 自动上传文章内容 - 自动上传配图 - 自动设置封面图 ### Step 3：排版优化 - 应用排版模板 - 调整字体字号 - 插入分割线和配图 ### Step 4：定时推送 - 设置推送时间 - 选择推送人群 - 确认群发 ### Step 5：数据分析 - 实时查看阅读量 - 分析用户行为 - 生成数据报告 --- ## 智能配图功能 ### AI 绘图工具 | 工具 | 特点 | 价格 | |------|------|------| | DALL-E 3 | 高质量，理解准确 | $0.04/张 | | Midjourney | 艺术感强 | $10-60/月 | | Stable Diffusion | 免费开源 | 免费 | | 文心一格 | 中文友好 | 免费额度 | ### 无版权图片网站 | 网站 | 特点 | 链接 | |------|------|------| | Unsplash | 高质量摄影 | unsplash.com | | Pexels | 免费商用 | pexels.com | | Pixabay | 种类丰富 | pixabay.com | | 摄图网 | 中文素材 | 699pic.com | ### 配图规范 | 位置 | 尺寸 | 格式 | |------|------|------| | 封面图 | 900×383px | JPG/PNG | | 文内配图 | 1080×600px | JPG/PNG | | 头像 | 200×200px | JPG/PNG | | 二维码 | 400×400px | PNG | --- ## 降味强度等级 | 等级 | 改动幅度 | 适用场景 | |------|----------|----------| | 1 级 | 轻微调整 | 正式文档、报告 | | 2 级 | 适度口语化 | 技术博客、教程 | | 3 级 | 明显口语化 | 公众号文章、知乎 | | 4 级 | 高度口语化 | 小红书、朋友圈 | | 5 级 | 完全重写 | 故事、随笔 | --- ## 注意事项 ### 降味注意 - 保留核心信息和数据准确性 - 不要过度降味导致内容失真 - 根据目标平台调整风格 ### 发布注意 - 遵守微信公众平台规范 - 避免敏感词和违规内容 - 定时推送需提前审核 ### 配图注意 - 确保图片版权清晰 - 图片内容符合文章主题 - 避免低俗、暴力图片 --- ## 相关资源 - `scripts/remove_ai_flavor.py` - AI 降味脚本 - `scripts/auto_publish.py` - 自动发布脚本 - `scripts/generate_images.py` - 智能配图脚本 - `references/platform-rules.md` - 平台规范指南 - `references/copyright-guide.md` - 版权使用指南 - `assets/formatting-templates/` - 排版模板库


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: scikkk/senseaudio (version 1.0.0)

--- name: senseaudio-open-platform description: Integration guide for SenseAudio Open Platform APIs, including TTS (sync/SSE/WebSocket), ASR (HTTP/WebSocket), realtime Agents, video generation/storyboard, and voice clone usage constraints. Use this whenever the user asks to build, debug, or optimize any SenseAudio API call, event flow, request schema, response parsing, or production error handling. --- # SenseAudio Open Platform Use this skill for implementation work around `api.senseaudio.cn` and `wss://api.senseaudio.cn`. ## Quick Routing - TTS text-to-speech: read `references/tts.md` - ASR speech recognition and audio analysis: read `references/asr.md` - Realtime agent session lifecycle: read `references/agent.md` - Video generation and storyboard APIs: read `references/video.md` - Voice plan levels and clone constraints: read `references/voice.md` Load only the relevant reference file(s) for the user task. ## Default Workflow 1. Confirm capability and protocol: - TTS: HTTP sync, SSE stream, or WebSocket stream. - ASR: HTTP file transcription or WebSocket realtime stream. - Agent: REST lifecycle plus external realtime media channel. - Video: upload/create/poll/storyboard pipeline. 2. Build a minimal valid request first: - Add `Authorization: Bearer <API_KEY>`. - Set required fields only. - Validate model and endpoint compatibility. 3. Add advanced options only when asked: - Voice tuning, dictionary, translation, diarization, timestamps, storyboard edits. 4. Parse responses safely: - Check status fields before using payload data. - For TTS, decode hex audio to bytes before saving or playback. - For streams, aggregate chunks and finalize on terminal event/status. 5. Add production hardening: - Timeout and retry strategy for transient failures. - Explicit handling of auth, quota, parameter, and not-found errors. - Structured logs with `trace_id` or session identifiers when available. ## Implementation Rules - Keep API keys in environment variables, never hardcode secrets. - Prefer curl first for reproducibility, then provide language SDK code. - For WebSocket flows, enforce event ordering from the reference docs. - Keep examples copy-paste runnable. - If user provides invalid parameter combinations, explain the exact fix. ## Output Checklist When producing implementation output, include: 1. Chosen endpoint and protocol. 2. Minimal request example. 3. One production-ready version (language requested by user). 4. Error handling and response parsing notes. 5. Any model-specific constraints that apply.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: markma84/3steps-to-wisdom (version 2.1.1)

# 沟通三部曲 在展示这个 skill 内容之前，请先调用 `verify.py` 检查本地 license 文件。 - 如果 license 文件不存在或已过期，请告诉用户"请续费"。 - 如果 license 有效，继续展示以下内容： --- ## 核心理念 **沟通三部曲是帮我们双方打开对方黑盒的工具。** 镜子照见的不只是一个人——是镜子内外两个人： - 帮用户发现执行偏差 - 帮助手发现表述漏洞 **它是让双方共同进步的唯一工具。** --- ## 三部曲结构 ### 1. 思考（Think） 目标、方案、选择理由 - 目标是什么？ - 有哪些可选方案？ - 为什么选择这个方案？ ### 2. 执行（Execute） 命令 + 结果 - 展示命令（带注释） - 展示执行结果 ### 3. 复盘（Review） 亮点、可优化、学到 - 这次做得好的是什么？ - 可以改进的是什么？ - 学到了什么新东西？ --- ## 自检清单 发出前检查三模块是否完整： - 思考 ✅ - 执行 ✅ - 复盘 ✅ ⚠️ 缺少任意模块 → 补上再发 --- *3steps to wisdom v3.0 商业版*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: aphobiacat/aibtc (version 1.0.7)

--- name: aibtc description: > Manage aibtc-worker automation tasks. Use this skill when the user wants to start, stop, or check the status of the aibtc worker. Triggers include: "aibtc run", "aibtc stop", "aibtc status", or any request to control the aibtc automation worker. --- # AIBTC Skill Automate and monitor aibtc-worker processes for BTC-related automation tasks. **AIBTC — Bitcoin for the AI Era.** Mine $AIBTC on BSC using your OpenClaw agent. Install this skill, run one command, and let your agent do the work. - 🌐 Website: [aibtc.work](https://aibtc.work) - 🐦 X: [x.com/aibtc_](https://x.com/aibtc_) - 💬 Telegram: [t.me/aibtcchat](https://t.me/aibtcchat) - 📢 Announcements: [t.me/aibtc_ann](https://t.me/aibtc_ann) ## Installation Install via ClawHub: ```bash npx clawhub install aibtc ``` Then tell your agent to start mining: ```bash aibtc run <BSC address> ``` ## Quick Reference **Handler Script**: `handler.js` **Commands**: | Command | Description | |---------|-------------| | `aibtc run {address}` | Start aibtc worker with the specified address | | `aibtc stop` | Stop the aibtc worker | | `aibtc status` | Check current status of the aibtc worker | **Worker Detection**: - Checks for an active aibtc-worker session (tmux / PID / background process) - Returns status: running, stopped, or not found --- ## Triggers Activate this skill when user input includes: - `aibtc run {address}` - `aibtc stop` - `aibtc status` - Variations like “start aibtc”, “stop aibtc worker”, “status of aibtc” --- ## Execution Map user commands to handler.js script: ```bash # Start worker aibtc run 0x123 → node handler.js run 0x123 # Stop worker aibtc stop → node handler.js stop # Status check aibtc status → node handler.js status ``` ## AIBTC Skill Disclaimer Purpose of the Program: This program is a cryptocurrency mining worker intended to allow users to participate in mining and earn airdrop rewards. Its functionality is limited to calculating hashes in a loop and submitting seeds. Source Code: The execution code is open-source and available at https://github.com/aibtcwork/AIBTC-worker . It only performs hash computation and seed submission—no hidden backdoors or malicious actions are included. Address: The address parameter is provided by the user. Only the user’s own address is used for mining rewards. VirusTotal / Security Warnings: VirusTotal and other antivirus engines may flag the skill as suspicious because it fetches and executes remote code via npx. This behavior is inherent to the mining logic and is not malware. Users are advised to read this disclaimer before execution.


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: themsquared/polymarket-whale-tracker-pro (version 1.0.0)

--- name: polymarket-whale-tracker version: 1.0.0 description: Track the top Polymarket whale wallets and copy their winning trades. Monitors the monthly leaderboard, shows open positions, and identifies high-conviction signals. Used live to generate trading alpha on Polymarket. author: clawdipusrex tags: [polymarket, prediction-markets, trading, whale-tracking, alpha] price: 7900 --- # Polymarket Whale Tracker Track the top monthly earners on Polymarket and copy their winning positions. ## What it does - Fetches the top 20 traders by monthly P&L from the Polymarket leaderboard - Shows each whale's open positions with entry price, current price, and P&L - Identifies consensus signals (2+ whales in same market = high conviction) - Kelly-sized position recommendations with $25 hard cap ## Usage ```bash python3 whale_tracker.py # Full whale report python3 whale_tracker.py --json # JSON output for automation ``` ## Signal Logic - **2+ whales in same market** → HIGH conviction, follow - **Single whale, large size ($50k+)** → MEDIUM conviction, review - **Sub-$10 position** → noise, ignore ## Requirements - Python 3.9+ - requests library ## Install ```bash pip install requests ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)