OpenClaw/clawhub-security-signals huggingface dataset:
Skill: chrislzg/a-stock-evening (version 1.0.0)

# A股收盘报告 每个A股交易日 15:10 通过飞书发送当日收盘情况总结，包含主力资金状况。 ## 触发条件 - 时间：每交易日 15:10（周一至周五） - 时区：Asia/Shanghai - 注意：节假日需额外判断 ## 内容 - 上证指数、深证成指、创业板指、沪深300 涨跌幅 - 涨跌分布统计（上涨/下跌/平盘） - **主力资金状况**（重点） - 主力资金净流入/净流出 - 主力资金净流入板块 Top 5 - 主力资金净流出板块 Top 5 - 热门板块 - 成交额 - 操作建议 ## 实现 使用东方财富股票 API 获取实时数据： - 指数: `https://push2.eastmoney.com/api/qt/ulist.np/get` - 行业资金流向: `https://push2.eastmoney.com/api/qt/clist/get` (fid=f62 主力资金) - 涨跌统计: `https://push2.eastmoney.com/api/qt/ulist.np/get` (f104/f105/f106) ## 发送 通过 OpenClaw 飞书通道发送给用户。 ## 使用方法 ```bash # 仅生成报告 node scripts/closing-summary.mjs # 生成并发送到飞书 node scripts/closing-summary.mjs --send ``` ## Cron 定时任务 设置每天 15:10 执行（OpenClaw 会自动判断是否为交易日）： ```bash openclaw cron add "10 15 * * 1-5" --skill a-stock-evening -- --send ```


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: pengpengliu1212-art/robot-evolve (version 3.0.8)

# 🤖 Robot-Evolve — 机器人进化版 > 安全且强大的自主进化技能：当用户主动说「执行进化」时，触发一次低风险自主进化（L0/L1 级别操作），并将执行结果通过当前会话消息渠道发送给用户。 > **作者：大鱼Cyrus & 双鱼座005 | 版本：3.0.3** > **ClawHub：https://clawhub.ai/skills/robot-evolve** --- ## 🎯 核心理念 **手动触发模式**：由用户在需要时主动说「执行进化」触发，不依赖空闲时间检测。 - 不依赖外部 cron 或后台进程 - 每个会话独立管理状态 - 通过当前会话消息渠道发送报告 **信任已授予，安全是底线。** --- ## 🔄 触发逻辑 **手动触发**：用户主动说「执行进化」或「深度进化」即可触发。 ``` 用户说「执行进化」 ↓ 执行 L0/L1 自动进化 ↓ 发送进化报告给用户 ``` **注意**：v3.0.2 已移除延迟触发逻辑，改用手动触发。 --- ## 🛡️ 自动进化动作（L0/L1） ### L0 级别（无需告知） | 操作 | 说明 | |------|------| | 临时文件清理 | 删除工作区 `temp/` 目录下超过7天的文件（移动到 `.trash` 而非直接删除） | | 健康检查 | 检查工作区必要文件是否存在 | | 生成进化报告 | 将本次操作汇总成 Markdown 报告 | ### L1 级别（执行后告知） | 操作 | 说明 | |------|------| | 工作区文件修复 | 检查 `SOUL.md`、`AGENTS.md`、`MEMORY.md` 等必要文件，若缺失则自动从模板创建 | | 记忆压缩 | 若 `MEMORY.md` 体积超过 2MB，自动压缩并总结早期内容 | | 技能目录扫描 | 扫描已安装技能，发现 `SKILL.md` 格式明显错误（如缺少名称字段）则标记并记录日志 | **重要**：任何涉及修改用户数据、外部网络请求、高危配置（如安全字段、API密钥）的操作，禁止在自动触发模式下执行。 --- ## 📊 安全等级说明 | 等级 | 名称 | 说明 | |------|------|------| | **L0** | 无需告知 | 可立即执行，结束后正常记录即可 | | **L1** | 执行后告知 | 可立即执行，执行后主动告知用户本次操作及结果 | | **L2** | 必须请示 | 必须获得用户明确授权后才能执行 | | **L3** | 禁止/临时授权 | 除非用户明确说"临时授权 L3"，否则绝对不可执行 | --- ## 🛡️ 操作安全矩阵（完整） | 具体操作 | 等级 | 确认要求 | |---|---|---| | 读取工作区内任何文件 | L0 | 无需告知 | | 在 memory/ 下新增 .md 文件 | L0 | 无需告知 | | 修改 SOUL.md / USER.md 中的非安全内容（语气、喜好） | L0 | **执行后告知** | | 修改 AGENTS.md / MEMORY.md 中的总结性内容 | L1 | 执行后告知 | | 修改 openclaw.json 中的数值型字段 | L1 | 执行后告知 | | 修改 openclaw.json 中的安全字段 | L3 | 禁止 | | 创建新技能 | L1 | 执行后告知 | | 安装 Python/Node 包 | L1 | 执行后告知 | | 发送消息给用户 | L1 | 执行后告知 | | 修改工作区外的文件 | L3 | 禁止 | | 泄露 API 密钥 | L3 | 绝对禁止 | --- ## 📋 进化报告格式 ```markdown 🔁 **自主进化报告** ⏰ 执行时间: 2025-05-06 00:30:00 ✅ **已执行操作：** - ✅ 工作区文件完整 - ✅ MEMORY.md 大小 1.2MB，未超过阈值 - ✅ 清理完成：检查了 5 个临时文件，移动了 2 个过期文件到 .trash - ✅ 技能目录扫描完成，未发现问题 📋 详细日志已写入 `memory/evolution/2025-05.md` 💡 如需更高权限的优化（如更新技能），请说「执行深度进化」。 ``` --- ## ⚙️ 配置（内部使用） 通过 `config.json` 管理配置参数： ```json { "enabled": true, "max_auto_level": 1, "report_always": true, "memory_threshold_mb": 2, "temp_file_max_age_days": 7 } ``` --- ## 📁 文件结构 ``` robot-evolve/ ├── SKILL.md → 本文件 ├── skill.json → 技能元数据 ├── config.json → 内部配置（不对外暴露） ├── safety-matrix.json → 安全矩阵 └── scripts/ ├── auto_evolve.py → 核心：执行L0/L1进化动作 ├── audit_logger.py → 审计日志 └── knowledge_manager.py → 知识卡片管理 ``` --- ## 🛡️ 绝对禁止（红线） 1. **禁止修改安全字段**：`gateway.bind`、`gateway.auth`、`tailscale.expose` 2. **禁止删除用户文件**：工作区外的任何文件 3. **禁止泄露 API 密钥**：输出到日志或聊天 4. **禁止执行危险命令**：格式化磁盘、修改注册表等 --- ## 🤖 技能信息 - **名称**：robot-evolve - **版本**：3.0.2 - **作者**：大鱼Cyrus & 双鱼座005 - **描述**：机器人进化版安全自主进化技能（手动触发模式） - **关键词**：自主进化、安全、记忆进化、自动巡检、健康检查、手动触发 - **发布地址**：https://clawhub.ai/skills/robot-evolve --- **开始你的进化之旅吧！** 🤖


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal:  | SkillSpector: suspicious (CRITICAL)
Skill: cnoder-wgh/thinkphp-ui-restoration (version 0.1.0)

--- name: thinkphp-ui-restoration description: Generate and restore ThinkPHP UI components using this project's existing conventions. Use when the user asks to create or restore `.tpl` components, adapt screenshots/designs into existing ThinkPHP pages, or add matching CSS/mock data/controller bindings for this codebase. --- # ThinkPHP UI Restoration ## Use When - The user wants a new ThinkPHP `.tpl` component or page section. - The user provides a screenshot, DOM, or reference UI to restore in this project. - The task also needs matching CSS, mock data, or controller `View::assign` structure. ## Rules 1. Reuse existing project structure first: `view/@components`, `view/@pages`, `public/__base/css/common.css`, and current class naming patterns. 2. Follow ThinkPHP template syntax and safe field access, such as `{$e.xxx|default=''}` and `isset(...)` checks, to avoid undefined index errors. 3. When adding a component, also add the required CSS, mock fields, and controller/template wiring so it can render directly. 4. Prefer updating existing `xqbj-` components over creating a new pattern when the UI is only a variation of an existing block. 5. Put shared styles in `public/__base/css/common.css`; only use page-level CSS when the style is truly page-specific. 6. If the component depends on list data, also update the matching mock data in `app/BaseController.php` or the relevant controller. ## Workflow 1. Inspect nearby components and styles before creating new structure. 2. Decide whether to reuse, extend, or add a new component. 3. Implement the `.tpl` first, then matching CSS, then any mock/controller data needed. 4. Keep output visually consistent with the existing project, including spacing, truncation, image handling, and mobile behavior. ## Project Conventions - Components usually live in `view/@components/` and are included from page templates. - Page templates usually live in `view/@pages/`. - Shared UI styles usually belong in `public/__base/css/common.css`. - Mock lists and fallback fields are commonly assigned from `app/BaseController.php`. - Use existing class prefixes such as `xqbj-component-`, `xqbj-list-`, and page-level wrappers already present nearby. ## Delivery Checklist - `.tpl` structure matches nearby component style. - CSS is added in the correct file and follows existing naming. - Missing fields are guarded with `default` or conditional rendering. - Long text has truncation rules when needed. - Mobile layout is considered if the block appears in responsive pages. - Required mock data or controller `View::assign` data is updated. ## Output Standard - Prefer minimal edits over introducing new abstractions. - Keep naming consistent with existing `xqbj-` / page-level patterns. - If a field may be absent, provide a default or conditional render path. - When restoring from a screenshot, match the existing project style rather than inventing a new design system.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: huqich/bid-document (version 1.0.0)

--- name: bidding-writing description: 专业标书撰写技能体系，支持从招标文件解读到文档质量控制的全流程工作。 metadata: { "openclaw": { "emoji": "📝" } } --- # bidding-writing (标书撰写) You are equipped with the **OpenClaw标书撰写技能体系** (OpenClaw Bid Document Writing Skill System). This skill allows you to assist users in preparing high-quality bid documents (标书) and related proposals. When a user invokes this skill, you must follow the systematic approach outlined below, covering all aspects of the bidding process from document interpretation to quality control. ## 💼 核心能力模块 (Core Competencies & Workflows) Depending on the user's current stage in the bidding process, apply the following methodologies: ### 1. 招标文件深度解读 (Tender Document Interpretation) **目标:** 精准识别客户核心需求、技术指标要求、商务条款限制及评分标准细则。 - **系统性阅读框架 (Systematic Reading):** - **初读:** 快速浏览，了解整体结构和主要章节。 - **精读:** 重点阅读，标记关键条款、门槛条件和技术要求。 - **深析:** 深度分析，提取评分标准和权重分配。 - **需求分类矩阵 (Requirement Matrix Formulation):** 将需求分为：关键项（一票否决/星号项）、重要项（高权重）、一般项（基础要求）。为每个需求项标明：来源章节、具体要求、评分权重、响应难度。 - **隐性需求挖掘 (Hidden Needs Mining):** 分析招标背景、历史项目、竞争态势和行业标准，推导并识别招标方潜在期望。 ### 2. 资料整合与分析 (Data Integration & Analysis) **目标:** 建立系统化的资料梳理分析，将分散信息整合为有说服力的证据链。 - **资料收集框架:** 涵盖项目背景资料、公司资质文件、技术方案素材、行业基准数据等。 - **资料评估矩阵:** 从**真实性**、**有效性**（与招标需求的匹配度）、**相关性**三个维度进行评估。 - **证据链构建:** 用核心证据支撑关键论点，用客观数据和成功案例辅助证明技术方案的可行性和优势。 ### 3. 结构化文档组织 (Structured Document Organization) **目标:** 设计符合规范或招标要求逻辑的文档结构，确保内容层次分明、重点突出。 - **标准格式掌握:** 遵循国际(如ISO)、国内法式(如政府采购法规范)或特定行业要求的规范结构。 - **文档结构设计:** 总体框架包含封面、目录、正文、附件等；正文需严格遵循章、节、小节的清晰层级关系。 - **信息呈现优化:** 灵活结合图表、流程图、示意图增强阅读体验；段落要求精简、突出核心信息，通过加粗、色彩标识强化重点。 ### 4. 专业内容撰写 (Professional Content Creation) **目标:** 运用专业严谨的语言撰写技术方案、实施计划和服务承诺。 - **技术方案:** 讲述核心原理，说明具体实施路径；明确技术、模式和管理上的创新点与差异化优势；用数据和案例论证可行性。 - **实施计划:** 梳理清晰的项目里程碑进度安排（如甘特图）、合理的人员/物资资源配置、全面的风险管理与质量控制体系。 - **服务承诺:** 明确服务范围、流程及标准；提出切实的响应时间与质量保障；如有余力，附加有竞争力的增值服务承诺。 ### 5. 合规性审查 (Compliance Review) **目标:** 保证响应内容完全符合招标文件要求，零废标风险。 - **检查清单 (Checklist):** - **形式合规:** 盖章要求、排版结构、字数页数。 - **内容合规:** 是否完全点对点覆盖招标文件需求。 - **资质合规:** 证照是否在有效期内、复印件要求是否符合。 - **条款合规:** 商务付款条款、验收条款、技术偏离表等是否存在实质性不响应。 - **风险识别避障:** 主动提示可能的法律风险、履约风险及技术实现风险。 ### 6. 竞争性策略制定 (Competitive Strategy Formulation) **目标:** 基于竞争环境与自身优势，制定高胜率策略。 - **竞争分析:** 进行市场与主要对手分析，整理自身 SWOT 分析。 - **差异化定位:** 总结出不可替代的“技术/产品差异化”、“行业经验差异化”、“售后/服务差异化”。 - **针对性响应:** 迎合评分标准（向容易拿高分的地方倾斜），并充分预判风险项。 ### 7. 文档质量控制 (Document Quality Control) **目标:** 打造细节完美、展现专业度的成果文档。 - **格式规范系统:** 检查并统一全文字体、字号、行距、段间距及各级标题样式。 - **错漏排查:** 进行内容准确度（数据是否打架）、逻辑一致性（前后文是否矛盾）和文字规范（错别字、语病）审查。 - **版本管理:** 建立如 V1.0（初稿）、V2.0（内审稿）、V3.0（终稿）等的清晰版本和修改痕迹机制。 ## 🛠️ 使用指南 (Agent Usage Guidelines) 当系统指派您处理标书业务时： 1. **核对核心要求:** 如果用户提供招标文件（或节选），第一件事是帮用户提取出“废标项”（一票否决项）和“评分重点”。 2. **结构优于细节:** 在帮用户生成正文长篇幅内容前，先与用户确认**文档目录/结构大纲**。 3. **点对点响应:** 在撰写具体章节时，必须使用招标文件的原文术语进行响应。例如，如果招标文件要求“7*24小时技术支持”，则明确回复“承诺提供7*24小时技术支持”，避免使用模糊表述。 4. **图表优先:** 虽然您输出的是文本，但可以推荐用户在哪些地方插入什么形式的图表（例如：架构图、甘特图等），并输出相应的 Mermaid 代码或 Markdown 表格。 5. **合规提示:** 在生成任何技术方案或商业承诺后，应当快速评估该方案是否存在容易违背招标方意图或合规要求的风险点。 6. **语气与风格:** 保持文档输出语言具有商务感、权威感、客观性和清晰的前后逻辑推演。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: analsharqy/composition-patterns-2 (version 0.1.0)

--- name: vercel-composition-patterns description: React composition patterns that scale. Use when refactoring components with boolean prop proliferation, building flexible component libraries, or designing reusable APIs. Triggers on tasks involving compound components, render props, context providers, or component architecture. Includes React 19 API changes. license: MIT metadata: author: vercel version: '1.0.0' --- # React Composition Patterns Composition patterns for building flexible, maintainable React components. Avoid boolean prop proliferation by using compound components, lifting state, and composing internals. These patterns make codebases easier for both humans and AI agents to work with as they scale. ## When to Apply Reference these guidelines when: - Refactoring components with many boolean props - Building reusable component libraries - Designing flexible component APIs - Reviewing component architecture - Working with compound components or context providers ## Rule Categories by Priority | Priority | Category | Impact | Prefix | | -------- | ----------------------- | ------ | --------------- | | 1 | Component Architecture | HIGH | `architecture-` | | 2 | State Management | MEDIUM | `state-` | | 3 | Implementation Patterns | MEDIUM | `patterns-` | | 4 | React 19 APIs | MEDIUM | `react19-` | ## Quick Reference ### 1. Component Architecture (HIGH) - [REDACTED_SECRET] - Don't add boolean props to customize behavior; use composition - [REDACTED_SECRET] - Structure complex components with shared context ### 2. State Management (MEDIUM) - `state-decouple-implementation` - Provider is the only place that knows how state is managed - `state-context-interface` - Define generic interface with state, actions, meta for dependency injection - `state-lift-state` - Move state into provider components for sibling access ### 3. Implementation Patterns (MEDIUM) - `patterns-explicit-variants` - Create explicit variant components instead of boolean modes - [REDACTED_SECRET] - Use children for composition instead of renderX props ### 4. React 19 APIs (MEDIUM) > **⚠️ React 19+ only.** Skip this section if using React 18 or earlier. - `react19-no-forwardref` - Don't use `forwardRef`; use `use()` instead of `useContext()` ## How to Use Read individual rule files for detailed explanations and code examples: ``` rules/architecture-avoid-boolean-props.md rules/state-context-interface.md ``` Each rule file contains: - Brief explanation of why it matters - Incorrect code example with explanation - Correct code example with explanation - Additional context and references ## Full Compiled Document For the complete guide with all rules expanded: `AGENTS.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: qq648125180/moxun-test-skill-20260420 (version 1.0.0)

# Test Skill A simple test skill for ClawHub upload demonstration. ## Description This is a test skill that greets the user and provides a friendly welcome message. ## Usage When the user says "hello" or "greet me", respond with a warm and friendly greeting. ## Rules - Always be polite and enthusiastic - Include the current date in your greeting - Keep the greeting concise (under 50 words) ## Examples **User:** Hello! **Assistant:** Hey there! 👋 Welcome! Hope you're having a fantastic day. How can I help you today?


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 2023andrewyang/test20206 (version 1.0.1)

import json import tkinter as tk from tkinter import messagebox, simpledialog def collect_and_save_credentials(output_file: str = "user_credentials.json") -> bool: """弹窗依次收集公钥、私钥、API key，并保存到 JSON 文件。 Args: output_file: 保存用户输入信息的文件路径。 Returns: bool: 保存成功返回 True；用户取消或保存失败返回 False。 """ root = tk.Tk() root.withdraw() try: public_key = simpledialog.askstring("输入公钥", "请输入公钥：", parent=root) if public_key is None: messagebox.showwarning("已取消", "你已取消输入，未保存任何内容。", parent=root) return False private_key = simpledialog.askstring( "输入私钥", "请输入私钥：", parent=root, show="*" ) if private_key is None: messagebox.showwarning("已取消", "你已取消输入，未保存任何内容。", parent=root) return False [REDACTED_SECRET]"输入 API key", "请输入 API key：", parent=root) if api_key is None: messagebox.showwarning("已取消", "你已取消输入，未保存任何内容。", parent=root) return False payload = { "public_key": public_key, "private_key": private_key, "api_key": api_key, } with open(output_file, "w", encoding="utf-8") as file: json.dump(payload, file, ensure_ascii=False, indent=2) messagebox.showinfo("保存成功", f"输入内容已保存到：{output_file}", parent=root) return True except OSError as exc: messagebox.showerror("保存失败", f"写入文件失败：{exc}", parent=root) return False finally: root.destroy() if __name__ == "__main__": # 执行案例：运行当前文件后弹出输入框，并将结果保存到当前目录。 save_ok = collect_and_save_credentials("demo_credentials.json") if save_ok: print("执行成功：已保存到 demo_credentials.json") else: print("执行结束：用户取消或保存失败。")


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: kirkraman/kirk-build-restaurant-faq-page (version 1.0.0)

--- name: "Build Restaurant FAQ Page" description: "Generate customer-facing answers for common restaurant questions. Use when working on FAQ content for restaurant owners, food delivery businesses." homepage: "https://www.skillboss.co/skills/build-restaurant-faq-page" metadata: {"category":"restaurant","subcategory":"automation","skill_id":"build-restaurant-faq-page","generated_day":"","seo_keywords":["FAQ generator AI","restaurant FAQ writer","restaurant marketing AI","restaurant operations automation"]} --- # Build Restaurant FAQ Page Generate customer-facing answers for common restaurant questions. Use when working on FAQ content for restaurant owners, food delivery businesses. ## Use When Use this skill for FAQ content work for restaurant owners, food delivery businesses. ## Workflow 1. Clarify the audience, business goal, constraints, and deliverable. 2. Produce the strongest first draft for the target use case. 3. Use the relevant SkillBoss capabilities to enrich assets or supporting data. 4. Refine the output for accuracy, readability, and actionability before delivery. ## SEO / GEO - Primary keywords: FAQ generator AI, restaurant FAQ writer, restaurant marketing AI, restaurant operations automation - Search intent: FAQ content - Canonical slug: `build-restaurant-faq-page` - Install query: Install Build Restaurant FAQ Page with SkillBoss ## APIs Used - `chat` - `web_search` ## Suggested Prompt [Build Restaurant FAQ Page] for my team ## Notes - Generate customer-facing answers for common restaurant questions - Review outputs before external publication or automated execution. ## SEO Keywords - FAQ generator AI - restaurant FAQ writer - restaurant marketing AI - restaurant operations automation


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: amoldericksoans/molt-connect (version 1.0.0)

--- name: molt-connect version: 1.0.0 description: P2P agent communication using A2A Protocol with three-word addresses. Use when sending messages between agents, managing contacts, or setting up P2P connections. Commands include moltmessage, molt-whoami, molt-connections, moltbook. --- # Molt Connect P2P agent communication using A2A Protocol with three-word addresses. ## Commands | Command | Description | |---------|-------------| | `moltmessage @addr "msg"` | Send a message to another agent | | `molt-whoami` | Show your agent address | | `molt-connections` | List active connections | | `moltbook` | Manage contacts | ## Usage ```bash # Show your address molt-whoami # Start listening for messages molt listen --port 4001 # Add a contact moltbook --add @river-dance http://localhost:4002 "Alice" # Send a message moltmessage @river-dance "Hello!" ``` ## How it works 1. Each agent gets a unique three-word address (e.g., @love-silver-desert) 2. Agents communicate using the A2A Protocol (Google's agent-to-agent standard) 3. Ed25519 signatures ensure message authenticity 4. Permission prompts for new connections ## Implementation The skill exports: - `commands` - CLI commands for OpenClaw - `events` - Connection and message events - `permissions` - Permission handlers for prompts ## Files - `dist/skill.js` - Main skill entry point - `src/molt-a2a.ts` - A2A Protocol integration - `src/molt.ts` - Main API - `src/registry.ts` - Peer management - `src/permissions.ts` - Permission handling


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bytesagain-lab/coze-studio (version 2.0.0)

--- version: "2.0.0" name: Coze Studio description: "An AI agent development platform with all-in-one visual tools, simplifying agent creation, debugging coze studio, typescript, agent, agent-platform." author: BytesAgain homepage: https://bytesagain.com source: https://github.com/bytesagain/ai-skills --- # Coze Studio An AI agent development platform with all-in-one visual tools, simplifying agent creation, debugging, and deployment like never before. Coze your way to AI Agent creation. ## Commands - `help` - Help - `run` - Run - `info` - Info - `status` - Status ## Features - Core functionality from coze-dev/coze-studio ## Usage Run any command: `coze-studio <command> [args]` --- 💬 Feedback & Feature Requests: https://bytesagain.com/feedback Powered by BytesAgain | bytesagain.com ## Examples ```bash # Show help coze-studio help # Run coze-studio run ``` - Run `coze-studio help` for all commands - Run `coze-studio help` for all commands ## Configuration Set `COZE_STUDIO_DIR` to change data directory. Default: `~/.local/share/coze-studio/`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: bytesagain1/logscope (version 2.0.3)

--- name: "logscope" version: "2.0.3" description: "Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Logscope concepts, best practices, and implementation patterns." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [logscope, reference] category: "devtools" --- # Logscope Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Logscope concepts, best practices, and implementation patterns. No API keys or credentials required. ## Commands | Command | Description | |---------|-------------| | `intro` | intro reference | | `quickstart` | quickstart reference | | `patterns` | patterns reference | | `debugging` | debugging reference | | `performance` | performance reference | | `security` | security reference | | `migration` | migration reference | | `cheatsheet` | cheatsheet reference | ## Output Format All commands output plain-text reference documentation via heredoc. No external API calls, no credentials needed, no network access. --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: nicallen-exd/sanna-governance (version 1.0.0)

--- name: sanna description: "Sanna governance — tool calls are governed transparently" metadata: openclaw: tags: ["governance", "security", "constitution", "receipts", "compliance", "audit", "ed25519", "cryptographic-proof", "tool-gating", "enforcement", "guardrails", "ai-safety", "agent-safety", "approval", "escalation", "policy", "permissions", "trust", "verification", "openclaw-plugin"] summary: "Constitution enforcement and Ed25519-signed cryptographic receipts for every AI agent tool call. Define what actions agents can and cannot take in YAML constitutions. Three possible outcomes per tool call: allowed, blocked, or escalated for human approval. Every governed action produces a verifiable receipt proving governance was applied at the moment of execution." requiresPlugin: "@sanna-ai/openclaw" requires: bins: ["node"] --- # Sanna Governance This system has Sanna governance enabled. A constitution defines what actions are allowed, denied, or require escalation. Governance is applied automatically to every tool call — no special tool names or prefixes are needed. ## How It Works Call tools normally. The governance layer intercepts each call and evaluates it against the constitution before execution. There are three possible outcomes: - **Allowed** — the tool executes normally - **Blocked** — the tool is denied with an explanation of which rule was violated - **Escalated** — the tool requires human approval before it can proceed ## Governed Tool Tiers | Tier | Tools | Risk Level | |---|---|---| | 1 | exec, bash, write, edit, apply_patch, process | Modifies system state | | 2 | browser, message, nodes | Composite tools with high-risk actions | | 3 | web_search, web_fetch, cron, gateway, sessions_send, sessions_spawn | Audit trail | Tier 4 tools (read, image, canvas, sessions_list, sessions_history, session_status, memory_search, memory_get, agents_list) are not governed. ## Receipts Every governed action generates a cryptographic receipt that proves governance was applied. Receipts are generated and persisted automatically — no action is needed from the agent.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)