OpenClaw/clawhub-security-signals huggingface dataset:
Skill: mvogt99/hallucinated-paths (version 1.0.0)

--- name: hallucinated-paths description: Reply cites file paths, directories, or module locations that do not exist in the current project. emoji: 🗺️ metadata: clawdis: os: [macos, linux, windows] --- # hallucinated-paths The reply references files or directories that aren't on disk. The agent invented a plausible-sounding location (e.g., `src/utils/helpers.ts`) because similar paths usually exist in projects like this one. ## Symptoms - A quoted path doesn't exist when you check the filesystem. - The reply uses a path structure that matches convention but the specific file is absent (e.g., `src/components/Button.tsx` in a project that actually puts components elsewhere). - Imports reference modules that cannot be resolved. - "Edit X file at path Y" instructions fail because Y is not there. ## What to do - Before quoting a path, verify it with a real file-existence check (`ls`, `stat`, a glob search). Do not rely on memory or convention. - When unsure where something lives, search first: grep for the symbol, glob for the filename, read the repo layout. - If the answer requires a path that doesn't exist, say so explicitly — don't fabricate. "I couldn't find a file for X" is correct; inventing one is not. - When proposing to create a new file, state clearly that it is new, and justify why it belongs at that path given the repo's actual conventions. - After editing, verify the edited file is the one that exists, not a hallucinated sibling.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mkcash/bounty-automation (version 1.0.0)

--- name: bounty-automation description: Multi-platform bounty automation system for GitHub, Opire, Algora, and OpenTask / 多平台赏金自动化系统，支持 GitHub、Opire、Algora、OpenTask，具有自动扫描、过滤、认领和 PR 提交功能 --- # Bounty Automation ## Architecture ``` BountyHunter-Push (每10min) └─ python3 bounty-hunter/bounty_hunter.py ├─ scan_github() → GitHub Search API (bounty:true) ├─ scan_opire() → Opire REST API ├─ scan_algora() → Algora REST API └─ scan_opentask() → OpenTask + 双账号自动投标 └─ 输出 QQ_MSG: → cron 捕获 → QQ 推送 GitHub-Bounty-Auto (每2h) └─ python3 bounty-github/bounty_scanner.py ├─ 扫描 bounty issue ├─ 过滤(跳过体力活/已认领/less than $20) ├─ 自动 claim → fork → clone ├─ 实现 → commit → push → PR └─ QQ 推送 PR 链接 ``` ## 效率优化要点 1. **缓存去重**:`bounty-hunter/cache.json` 记录已推送任务,重复不推 2. **并行扫描**:GitHub/Opire/Algora/OpenTask 使用多线程并发(`concurrent.futures.ThreadPoolExecutor`),单次扫描控制在 15s 内 3. **增量更新**:优先用 `since:` 时间参数,避免全量扫描 4. **关键词过滤前置**:先快速过滤金额和关键词,再发 API 请求获取详情 5. **API 限流保护**:`time.sleep(rate_limit_delay)` + 自动重试 3 次 6. **异常隔离**:单平台失败不影响其他平台扫描 7. **GitHub 管道只处理一件**:每 2h 只 claim + 实现一个任务,避免资源竞争 ## 文件结构 ``` clawd/ ├── bounty-hunter/ │ ├── bounty_hunter.py # 主扫描脚本(多平台) │ └── cache.json # 已推送任务缓存(自动生成) ├── bounty-github/ │ ├── bounty_scanner.py # 扫描+认领+PR 管道 │ ├── lib.sh # GitHub API 函数库 │ ├── pipeline.sh # 管道编排器 │ ├── github_config.sh # GitHub 凭证(用户手动填写) │ └── target/ # 目标任务缓存(自动生成) ├── skills/ │ └── bounty-automation/ # 本 skill └── ~/.opentask/ ├── credentials.json # OpenTask 主账号 token └── credentials-old.json # OpenTask 老账号 token ``` ## 部署 ### 1. 配置凭证 ```bash # OpenTask mkdir -p ~/.opentask cat > ~/.opentask/credentials.json << 'END_OF_CRED' { "email": "[REDACTED_SECRET]", "handle": "your_handle", "tokenValue": "ot_YOUR_TOKEN" } END_OF_CRED cp ~/.opentask/credentials.json ~/.opentask/credentials-old.json # 修改第二个文件的 tokenValue 为老账号 # GitHub cat > /home/node/clawd/bounty-github/github_config.sh << 'END_OF_CONFIG' export GH_TOKEN="ghp_YOUR_TOKEN" export GH_USER="your_username" export GH_EMAIL="[REDACTED_SECRET]" END_OF_CONFIG chmod 600 /home/node/clawd/bounty-github/github_config.sh ``` ### 2. 安装依赖 ```bash pip install requests ``` ### 3. 添加 Cron Job 见 `scripts/install_cron.sh` 或参考 DEPLOY_GUIDE.md 手动配置。 ## 在 QQ 中的用法 - 直接说「跑一次赏金扫描」→ 触发单次扫描 - 说「查看赏金缓存」→ 读 cache.json 显示已推送条数 - 说「GitHub 赏金详情」→ 读 target/current.json 显示当前处理中的任务 ## 注意事项 - GitHub token 需要 `repo` + `public_repo` 权限 - OpenTask token 需要 `bids:write` scope - 体力活任务(挖矿/注册/点赞)已被过滤 - 每 2h 管道只处理一个任务,避免 API 限流 ## 💖 支持创作者 如果您觉得这个技能对您有所帮助，欢迎通过以下方式支持作者的持续开发和维护： - **USDC TRC-20**: [REDACTED_SECRET] - **PayPal**: `[REDACTED_SECRET]` 您的支持将用于改进此技能、添加新功能以及提供更好的文档和示例。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal:  | SkillSpector: suspicious (CRITICAL)
Skill: yesimagine-oss/clawbrowser-core (version 1.0.0)

--- name: clawbrowser version: 1.0.0 description: 無頭瀏覽器自動化 CLI，ARIA ref 定位，自然語言操作，OpenClaw 集成 metadata: openclaw: requires: env: [] bins: [node, npm, agent-browser] tags: - browser - automation - openclaw - web-scraping - aria --- # ClawBrowser 基於 agent-browser 的 OpenClaw 瀏覽器自動化工具，專為 AI Agent 設計。 ## 核心特性 - ✅ **ARIA ref 定位** - 不用脆弱的 CSS 選擇器 - ✅ **自然語言指令** - 直接說「點擊提交按鈕」 - ✅ **無頭模式** - 只保留 DOM 渲染 + 無障礙樹快照 - ✅ **雙引擎切換** - agent-browser / traditional - ✅ **100% 接口兼容** - 舊代碼零修改 - ✅ **網頁抓取** - extract_content/images/links ## 安裝依賴 ```bash # 安裝 agent-browser CLI npm install -g agent-browser agent-browser install # 下載 Chrome ``` ## 快速開始 ```python from browser_tool import BrowserTool # 初始化 browser = BrowserTool(session_name="my_task") # 打開網頁 browser.open("https://example.com") # 獲取快照（包含 refs） snapshot = browser.snapshot(interactive=True) # 使用 ref 點擊 browser.click("@e1") # 填寫表單 browser.fill("@e2", "[REDACTED_SECRET]") # 關閉 browser.close() ``` ## 核心接口 ### 基礎操作 | 方法 | 說明 | |------|------| | `open(url)` | 打開網頁 | | `snapshot()` | 獲取無障礙樹快照 | | `click(selector)` | 點擊元素 | | `fill(selector, text)` | 填寫輸入框 | | `type(selector, text)` | 輸入文本 | | `press(key)` | 按鍵 | | `wait(selector)` | 等待 | | `close()` | 關閉 | ### 獲取信息 | 方法 | 說明 | |------|------| | `get_text(selector)` | 獲取元素文本 | | `get_url()` | 獲取當前 URL | | `get_title()` | 獲取頁面標題 | | `get_attr(selector, attr)` | 獲取屬性 | ### 網頁抓取 | 方法 | 說明 | |------|------| | `extract_content()` | 提取頁面內容 | | `extract_images()` | 提取圖片 | | `extract_links()` | 提取鏈接 | ### 自然語言 ```python browser.natural_language_command("打開 github.com") browser.natural_language_command("點擊 Sign In 按鈕") browser.natural_language_command("填寫用戶名為 admin") browser.natural_language_command("抓取頁面內容") ``` ## 雙引擎切換 ```python # 全局切換 set_global_engine("agent-browser") # 或 "traditional" # 實例級切換 browser_ab = BrowserTool(engine="agent-browser") browser_trad = BrowserTool(engine="traditional") ``` ## 緩存配置 ```python from browser_tool import GLOBAL_CONFIG # 啟用緩存 GLOBAL_CONFIG["cache_enabled"] = True # 設置 TTL GLOBAL_CONFIG["cache_ttl_seconds"] = 300 ``` ## 適用場景 - ✅ AI Agent 瀏覽器自動化 - ✅ 網頁抓取（微信文章、新聞、博客） - ✅ 測試自動化 - ✅ 數據采集 - ✅ RPA 流程 ## 限制條件 - ❌ 需要 Chrome/Chromium - ❌ 動態內容需要重新快照 - ❌ Canvas/WebGL 不支持 ## 文件結構 ``` clawbrowser-skill/ ├── SKILL.md # 本文件 ├── browser_tool_py36.py # 核心工具（Python 3.6 兼容） ├── web_scraper.py # 網頁抓取工具 └── README.md # 補充說明 ``` ## 開發者 **作者**: RedOpenClaw **完成日期**: 2026.04.02 **簽名**: 🦞 RedOpenClaw - 生活太快⚡️...老逼快跑💨... ## 參考資源 - agent-browser 官方文檔：https://agent-browser.dev - OpenClaw 文檔：https://docs.openclaw.ai - ClawHub 文檔：https://github.com/openclaw/clawhub


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: albionaiinc-del/file-organizer-by-ext (version 1.0.0)

# File Organizer by Extension Organizes files in a directory by moving them into folders named after their file extensions (e.g., .pdf → pdf/, .jpg → jpg/). Simple, fast, and effective for cleaning up messy folders. ## Usage ```bash # Organize current directory python file_organizer_by_ext.py # Organize specific directory python file_organizer_by_ext.py ~/Downloads # Verbose mode to see what was moved python file_organizer_by_ext.py ~/Desktop -v ``` ## Price $2.00

path: tool.py
content: #!/usr/bin/env python3
"""
Simple CLI tool to organize files by their extension.
Moves files into subdirectories named by file extension.
"""
import os
import shutil
import argparse
from pathlib import Path

def organize_by_extension(directory):
    """Organize files in the given directory by file extension."""
    target_dir = Path(directory).resolve()
    if not target_dir.exists():
        raise FileNotFoundError(f"Directory not found: {directory}")
    if not target_dir.is_dir():
        raise NotADirectoryError(f"Path is not a directory: {directory}")

    # Track moved files
    moved_files = []

    for item in target_dir.iterdir():
        if item.is_file():
            # Create subdirectory using lowercase extension
            ext = item.suffix[1:].lower() or 'no_ext'
            ext_dir = target_dir / ext
            ext_dir.mkdir(exist_ok=True)

            # Move file
            dest = ext_dir / item.name
            shutil.move(str(item), str(dest))
            moved_files.append(f"{item.name} -> {ext}/")

    return moved_files

def main():
    parser = argparse.ArgumentParser(
        description="Organize files in a directory by their extension."
    )
    parser.add_argument(
        "directory",
        nargs="?",
        default=".",
        help="Path to the directory to organize (default: current directory)"
    )
    parser.add_argument(
        "-v", "--verbose",
        action="store_true",
        help="Show files that were moved"
    )

    args = parser.parse_args()

    try:
        moved = organize_by_extension(args.directory)
        if moved:
            print(f"Organized {len(moved)} files in '{args.directory}'.")
            if args.verbose:
                for move in moved:
                    print(f"  Moved: {move}")
        else:
            print(f"No files to organize in '{args.directory}'.")
    except Exception as e:
        print(f"Error: {e}")
        exit(1)

if __name__ == "__main__":
    main()


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: liuyanfeng1234/v19-early-causal-graph-debugger (version 1.0.0)

--- name: v19-early-causal-graph-debugger description: 接收因果关系图谱，自动检测循环依赖和悬空节点，给出修正建议。源自V19早期迭代版本V30，经过重新封装后发布。 version: 1.0.0 author: 思维 (Bacon) --- # V19 Early Causal Graph Debugger v1.0.0 **接收因果关系图谱，自动检测循环依赖和悬空节点，给出修正建议。** > 源自 V19 认知治理协议的早期迭代版本 V30（causal_graph.py），经过重新封装后作为独立 Skill 发布。 ## 核心能力 ### 1. 循环依赖检测（Cycle Detection） 扫描因果依赖图，识别所有循环路径： ``` 正常路径: A → B → C → D 循环依赖: A → B → C → A ⚠️ 检测到循环: A→B→C→A 嵌套循环: A → B → C → B ⚠️ 检测到自引用环: B→C→B ``` **检测算法**： - 深度优先搜索（DFS）遍历 - Tarjan 强连通分量识别 - 标记所有参与循环的节点和边 ### 2. 悬空节点检测（Dangling Node Detection） 识别三类悬空异常： | 类型 | 定义 | 示例 | |------|------|------| | 孤立节点 | 无入边也无出边 | 与因果图完全断开的节点 | | 无源节点 | 有出边但无入边 | 没有原因的结果 | | 无汇节点 | 有入边但无出边 | 没有结果的原因 | ### 3. 修正建议引擎 对每个检测到的问题，自动生成修正建议： ``` 【循环依赖修正】 检测: A → B → C → A 建议: 1. 检查 C → A 是否为真实因果关系（可能只是相关性） 2. 如确认因果，引入时间维度：A_t1 → B_t2 → C_t3 → A_t4 3. 如非因果，断开 C → A 边 【悬空节点修正】 检测: 节点D 无入边 建议: 1. 检查是否存在遗漏的前置事件 2. 如D为初始触发事件，标注为"根节点" 3. 如D为孤立事件，考虑从因果图中移除 ``` ### 4. 图谱健康评分 综合评估因果图谱质量： | 指标 | 健康 | 警告 | 危险 | |------|------|------|------| | 循环依赖数 | 0 | 1-2 | ≥3 | | 悬空节点比例 | <5% | 5-15% | >15% | | 平均节点度 | >2 | 1-2 | <1 | | 最大路径深度 | 3-8 | 8-12 | <3或>12 | 综合评分：0-100 分，60 分以上为"图谱健康"。 ## 与V19因果分析链的集成 ``` V30 因果图谱调试器 (本Skill) ↓ 清洗后的因果图 V46 因果审计器 ↓ 审计过的因果链 V53 因果风险预测器 ↓ 风险加权路径 V19 因果依赖分析器 (v19-causal-dependency-analyzer) ↓ 最终因果洞察 对偶审计 + 决策追溯 ``` ## 调用示例 ```bash # 提交因果图谱进行调试 curl -s -X POST https://boat-atlas-spa-flexible.trycloudflare.com/governance/causal-path-graph \ -H "Content-Type: application/json" \ -H "X-Governance-Key: <你的专属密钥>" \ -d '{ "graph": { "nodes": [ {"id":"A","label":"决策事件"}, {"id":"B","label":"执行动作"}, {"id":"C","label":"系统响应"}, {"id":"D","label":"孤立事件"} ], "edges": [ {"from":"A","to":"B"}, {"from":"B","to":"C"}, {"from":"C","to":"A"} ] } }' ``` 预期返回： ```json { "cycles": [{"path":["A","B","C","A"],"severity":"high"}], "dangling": [{"node":"D","type":"isolated","severity":"medium"}], "suggestions": [ {"target":"C→A","action":"check_causality","detail":"...""}, {"target":"D","action":"classify_or_remove","detail":"..."} ], "health_score": 42 } ``` ## 公开体验 ```bash # 公开密钥 v19-e5d585e28439decc614f09f91c4caa8c # 健康检查 curl -s https://boat-atlas-spa-flexible.trycloudflare.com/governance/health \ -H "X-Governance-Key: v19-e5d585e28439decc614f09f91c4caa8c" ``` ## 自助注册 ```bash curl -s -X POST https://boat-atlas-spa-flexible.trycloudflare.com/governance/register \ -H "Content-Type: application/json" \ -d '{"agent_name":"你的Agent名称"}' ``` ## 信任锚点 - 🔗 [V19 Trust Manifesto v1.1.0](https://clawhub.com/skills/v19-trust-manifesto) - 🔗 [V19 Causal Dependency Analyzer](https://clawhub.com/skills/v19-causal-dependency-analyzer) - 🔗 [V19 Certified Agent Workflow](https://clawhub.com/skills/v19-certified-agent-workflow)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: isaacloi1995-dot/macau-clinic-ai (version 1.0.0)

--- name: Macau Clinic AI System description: 澳門診所AI系統設計技能 - 幫澳門私人診所設計AI病歷、智能預約、數位化管理方案。適合AI顧問、醫療IT、創業者。觸發詞：澳門診所、診所AI、醫療系統、clinic AI、澳門醫療、診所數位化。 version: 1.0.0 author: psy仔 slug: macau-clinic-ai --- # Macau Clinic AI System 專為澳門診所設計的 AI 系統方案技能。 ## 市場背景 - 700+ 私人診所 - 政府推動智慧醫療 - eHR 平台已覆蓋 - 痛點：病歷效率低、預約混亂、溝通差 ## 核心方案 ### 1. AI 病歷助手 - 錄音轉文字 → 自動生成病歷 - 智能摘要、ICD-10 編碼 - 粵語/普通話/英語支援 - **收費：MOP 1,500-3,000/月/醫生** ### 2. 智能預約系統 - WhatsApp/微信預約 - AI 客服自動回覆 - No-show 預測提醒 - **收費：MOP 2,000-5,000/月** ### 3. 全面數位化 - 病歷 + 預約 + 計費 + CRM - eHR 平台對接 - **收費：MOP 30,000-150,000 setup + 月費** ## 服務包定價 | 級別 | Setup | 月費 | 適合 | |------|-------|------|------| | 基礎 | MOP 5,000 | MOP 1,500 | 1-2醫生 | | 標準 | MOP 15,000 | MOP 3,500 | 3-5醫生 | | 專業 | MOP 50,000 | MOP 6,000 | 5+醫生 | ## 政府資助 - 青年創業援助：免息貸款 MOP 30萬 - FDCT 科研資助 - 科技企業認證 ## 競爭優勢 1. 本地化（粵語、澳門法規） 2. 價格比國際產品便宜 50-70% 3. 醫生背景了解需求 ## 使用方式 ``` 幫我設計澳門診所AI方案：[診所規模/需求] ``` ``` 分析這間診所的痛點：[描述] ``` ## 技術棧 - AI：DeepSeek / OpenAI - 後端：Node.js / Python - 整合：n8n, WhatsApp API, 微信 - 部署：雲端或本地 ## 參考文檔 詳細方案：`projects/macau-clinic-ai-proposal.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: yaouuu/homework-gader-skill (version 1.0.0)

# 📚 Homework Grader Skill ## 🧠 功能简介 自动从QQ邮箱下载学生作业（zip），解析学生信息，基于模板进行AI评分，并生成成绩Excel。 --- ## 🎯 使用场景 教师通过QQ邮箱收作业，学生按格式提交： 姓名-学号-第几次作业.zip 系统自动： 1. 下载附件 2. 解压作业 3. 匹配模板 4. AI评分 + 评语 5. 生成Excel成绩表 --- ## 📥 输入参数（Inputs） | 参数名 | 类型 | 必填 | 说明 | | --------------- | ------ | ---- | ---------------------- | | assignment_id | int | ✅ | 作业编号（第几次作业） | | email_user | string | ✅ | QQ邮箱账号 | | email_auth_code | string | ✅ | QQ邮箱授权码 | --- ## 📤 输出结果（Outputs） | 参数名 | 类型 | 说明 | | ---------- | ------ | ------------------- | | excel_path | string | 生成的成绩Excel路径 | --- ## ⚙️ 执行流程（Workflow） ```text 1. 连接QQ邮箱（IMAP） 2. 获取未读邮件附件 3. 筛选zip文件 4. 解析文件名（姓名-学号-作业） 5. 解压文件 6. 加载对应作业模板 7. 调用AI评分 8. 汇总成绩 9. 生成Excel

path: requirements.txt
content: pandas
openpyxl

Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: stale | SkillSpector: suspicious (CRITICAL)
Skill: mzfshark/axodus-security-checks (version 1.0.0)

--- name: security-check description: Perform security reviews: secrets, auth, injection, dependencies, unsafe execution. metadata: author: RedHat Dev version: 1.0.0 owner: RedHat Dev Agent category: quality --- # SKILL: security-check ## Purpose Perform a security-focused review of code changes or a subsystem: secrets exposure, auth issues, injection risks, unsafe dependencies, and unsafe execution paths. ## When to Use - Before deployment of a feature handling user input, money, or credentials. - When introducing new dependencies or external integrations. - After any authentication/authorization changes. ## Inputs - `scope` (required, string): files/modules/diff to inspect. - `threat_model` (optional, string): assets at risk and attacker capabilities. - `languages` (optional, string[]): e.g., `["ts","py","solidity"]` - `constraints` (optional, string[]): compliance rules or governance boundaries. ## Steps 1. Secrets & config: - ensure no tokens/keys are committed - ensure `.env.example` does not contain real secrets 2. Input handling: - validate and sanitize untrusted inputs - enforce schema validation at boundaries 3. Auth/authz: - verify authorization checks at every privileged action - avoid insecure defaults 4. Injection and unsafe execution: - command injection - SQL/NoSQL injection - XSS/CSRF (frontend) - dynamic code execution without validation 5. Dependencies: - flag risky packages - ensure versions are pinned when required 6. Observability: - logs do not leak secrets/PII - audit trail exists for sensitive actions ## Validation - Findings are evidence-based and include remediation. - Risk severity is calibrated (critical/high/medium/low). - Safety constraints are explicitly enforced (not â€œrecommendedâ€). ## Output Security report (example schema): ```yaml summary: "<top risks>" findings: - id: "SEC-001" severity: "high|medium|low" issue: "<what>" location: ["..."] remediation: "<how>" ``` ## Safety Rules - Do not disclose secrets that appear in logs/config; redact. - Do not recommend disabling security controls to â€œunblockâ€. - Escalate when the change touches money movement or governance. ## Example Scope: â€œnew webhook handlerâ€ Output: flags missing signature verification and recommends replay protection + audit logs.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: shadowpigy/clawharbor (version 1.0.0)

--- name: clawharbor description: Delegate tasks to specialized agents via the ClawHarbor API — research, analysis, content, data collection homepage: https://clawharbor.app metadata: clawdbot: emoji: "🦀" --- # ClawHarbor — Agent-to-Agent Task API Delegate tasks to specialized agents. Submit a task, receive a quote, handle payment, and get structured results back. No API key or registration needed. ## How It Works 1. Read the API docs at https://clawharbor.app/v1 2. POST /v1/tasks with a task description 3. Poll GET /v1/tasks/{id} until status = "quoted" 4. Present the payment_url to the user (MUST include the full URL with # fragment) 5. After user pays, POST /v1/tasks/{id}/confirm-payment 6. Poll GET /v1/tasks/{id} until status = "delivered" 7. Return the result to the user ## Quick Start Read the full API documentation: ``` curl https://clawharbor.app/v1 ``` Submit a task: ``` curl -X POST https://clawharbor.app/v1/tasks \ -H "Content-Type: application/json" \ -d '{"description": "Your task description here — any task describable in natural language"}' ``` ## What You Can Delegate - Market research and competitive analysis - Data collection and summarization - Content writing and editing - Technical research and documentation - Translation and localization - Any task describable in natural language ## Important Notes - The payment_url contains a # fragment that is essential. Always present the COMPLETE URL to the user without truncation. - Send payment links as clickable links or plain text — do NOT use code blocks or monospace formatting. - If status becomes "rejected", no agents are available. The user should try again later. - Results are delivered as plain text in the result field. ## External Endpoints | Endpoint | Method | Data Sent | |---|---|---| | https://clawharbor.app/v1/tasks | POST | Task description (natural language) | | https://clawharbor.app/v1/tasks/{id} | GET | None (reads task status) | | https://clawharbor.app/v1/tasks/{id}/confirm-payment | POST | None (confirms payment) | ## Security & Privacy - No API key or authentication required - Task descriptions are sent to ClawHarbor servers for processing by human agents - Payment is handled via Stripe checkout (user completes payment in browser) - No user data is stored beyond the task description and result ## Trust Statement This skill sends task descriptions to https://clawharbor.app for processing. Payment URLs redirect to Stripe's checkout page. No local files are accessed or modified. ## Contact [REDACTED_SECRET]


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: cnchenkai/daolv-hotel-booking-assistant (version 0.1.0)

--- name: daolv-hotel-booking-assistant description: Hotel booking-decision assistant using ai-go-hotel MCP (searchHotels + getHotelDetail). Use when users already have candidate hotels and need room-rate details, cancellation policy checks, final recommendation, and booking handoff actions. --- # Daolv Hotel Booking Assistant Focus on booking readiness and risk control. ## Workflow 1. Confirm booking context - Ensure destination/date/guest count/room count/currency are clear. - If user already has `hotelId`, prioritize direct detail lookup. 2. Build candidates - If no candidates provided, call `searchHotels` first for 3-5 options. - Then call `getHotelDetail` for finalists (prefer `hotelId` over `name`). 3. Evaluate room plans - Compare room plans by: - total/average price - cancellation windows/penalties - breakfast and included fees - bed type / room type fit - Limit displayed rows from large `roomRatePlans`. 4. Return booking decision + handoff - Give one clear “best plan” and one fallback. - Include booking risks and what to double-check before payment. - Provide direct booking URL if available. ## Output Template - **预订需求确认**：入住/离店/人数/房间数/预算 - **最佳方案**：酒店 + 房型 + 价格 + 退改条款 + 推荐理由 - **备选方案**：关键差异（更便宜/更灵活/位置更优） - **风险提示**：取消时点、不可退规则、库存波动 - **下单前确认清单**（2-4 条） ## Quality Bar - Never invent policy text. - Handle plain-text error response from `getHotelDetail` gracefully. - If availability uncertain, advise immediate refresh query. - Keep recommendation decisive, avoid list dumping. ## MCP Preset Config - Embedded preset: `references/mcp-client-config.json` - Endpoint: `https://mcp.aigohotel.com/mcp` (`streamable_http` + prefilled Authorization header)


Security scan verdicts — ClawScan: suspicious | static analysis:  | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: mjrussell/beestat (version 0.1.0)

--- name: beestat description: Query ecobee thermostat data via Beestat API including temperature, humidity, air quality (CO2, VOC), sensors, and HVAC runtime. Use when user asks about home temperature, thermostat status, air quality, or heating/cooling usage. homepage: https://beestat.io metadata: clawdbot: emoji: "🌡️" requires: bins: ["beestat"] env: ["BEESTAT_API_KEY"] --- # Beestat CLI CLI for the Beestat API (ecobee thermostat analytics). Query temperature, humidity, air quality, and HVAC runtime. ## Installation ```bash npm install -g beestat-cli ``` ## Setup 1. Create account at [beestat.io](https://beestat.io) and link your ecobee 2. Email [REDACTED_SECRET] with your thermostat serial number to get an API key 3. Set environment variable: `export BEESTAT_API_KEY="your-key"` ## Commands ### Status ```bash beestat status # Current temps, humidity, setpoints, weather beestat status --json ``` ### Sensors ```bash beestat sensors # All sensors with temperature and occupancy beestat sensors --json ``` ### Air Quality ```bash beestat air-quality # CO2, VOC, and air quality score beestat aq # Short alias beestat aq --json ``` Requires ecobee Smart Thermostat Premium (has built-in air quality sensors). **CO2 Levels:** - < 800 ppm: Excellent - 800-1000 ppm: Good - 1000-1500 ppm: Fair (consider ventilation) - > 1500 ppm: High (ventilate!) **VOC Levels:** - < 0.5 ppm: Excellent - 0.5-1.0 ppm: Good - 1.0-3.0 ppm: Fair - > 3.0 ppm: High ### Thermostats ```bash beestat thermostats # Model info, HVAC details beestat thermostats --json ``` ### Runtime Summary ```bash beestat summary # Runtime history (default 7 days) beestat summary --days 14 # Last 14 days beestat summary --json ``` ### Force Sync ```bash beestat sync # Force sync with ecobee ``` ## Usage Examples **User: "What's the temperature in the house?"** ```bash beestat status ``` **User: "Is the air quality okay?"** ```bash beestat aq ``` **User: "Is anyone in the bedrooms?"** ```bash beestat sensors ``` **User: "How much did we heat the house this week?"** ```bash beestat summary --days 7 ``` **User: "What thermostats do we have?"** ```bash beestat thermostats ``` ## Notes - Air quality data comes from ecobee runtime, not sensor capabilities - All commands support `--json` for scripting/automation - Use `beestat sync` if data seems stale


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)