OpenClaw/clawhub-security-signals huggingface dataset:
Skill: florianbeer/bitpanda (version 1.0.0)

# Bitpanda Portfolio Skill Check Bitpanda crypto portfolio, wallet balances, and trade history via CLI. ## Auth API key is read from (in order): 1. `BITPANDA_API_KEY` environment variable 2. `~/.openclaw/credentials/bitpanda/config.json` → `{"api_key": "..."}` Generate at: https://web.bitpanda.com/my-account/apikey Recommended scopes: **Balance**, **Trade**, **Transaction** ## Commands ```bash bitpanda portfolio # Non-zero wallets grouped by crypto/fiat/index bitpanda wallets # All non-zero wallets with balances bitpanda transactions --limit 20 # Recent trades bitpanda transactions --flow buy # Buy trades only bitpanda transactions --flow sell # Sell trades only bitpanda asset BTC # Current price + your balance ``` ## Notes - **Read-only** — no trading or transfers - Assets in **Bitpanda Earn/Staking** are not exposed by the API and won't show in balances - The `asset` command uses the public ticker (no auth needed) for prices - Pagination is automatic - Requires: `curl`, `jq`, `bc`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: hopeatina/orgx-marketing-agent (version 1.0.0)

--- name: orgx-marketing-agent description: OrgX marketing execution contract for OpenClaw. Use for launch assets, positioning, content packs, and channel-specific copy with measurement hooks. version: 1.0.0 user-invocable: true tags: - marketing - orgx - openclaw --- # OrgX Marketing Agent (OpenClaw) This skill defines how the OrgX Marketing agent behaves when running inside OpenClaw. ## Persona - Voice: specific, energetic, grounded. Never overclaim. - Autonomy: pick the channel and ship channel-ready drafts. - Consideration: avoid trust debt; keep it human and concrete. ## Primary Contract - Be concrete: audience, promise, proof, CTA. - Tie work to distribution: where it ships and how success is measured. - Avoid generic “AI copy”. Prefer specific claims grounded in product reality. ## Deliverable Shape When asked for a campaign/content: - 1-sentence positioning - key messages (3-5) - objections + rebuttals - channel variants (X/LinkedIn/email) - tracking/UTM notes if relevant ## Reporting Protocol (OrgX) - `orgx_emit_activity` for progress updates. - `orgx_request_decision` when messaging, positioning, or approval needs a human call. - Use `orgx_apply_changeset` only when your scope explicitly exposes mutation tools.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: cinience/alicloud-ai-audio-asr-realtime (version 1.0.0)

--- name: alicloud-ai-audio-asr-realtime description: Use when low-latency realtime speech recognition is needed with Alibaba Cloud Model Studio Qwen ASR Realtime models, including streaming microphone input, live captions, or duplex voice agents. version: 1.0.0 --- Category: provider # Model Studio Qwen ASR Realtime ## Validation ```bash mkdir -p output/alicloud-ai-audio-asr-realtime python -m py_compile skills/ai/audio/alicloud-ai-audio-asr-realtime/scripts/prepare_realtime_asr_request.py && echo "py_compile_ok" > output/alicloud-ai-audio-asr-realtime/validate.txt ``` Pass criteria: command exits 0 and `output/alicloud-ai-audio-asr-realtime/validate.txt` is generated. ## Output And Evidence - Save session payloads and response samples under [REDACTED_SECRET]. ## Critical model names Use one of these exact model strings: - `qwen3-asr-flash-realtime` - [REDACTED_SECRET] ## Use cases - Realtime subtitles and captions - Voice-agent duplex input - Streaming speech-to-text in browser or terminal clients ## Prerequisites - Set `DASHSCOPE_API_KEY` in your environment, or add `dashscope_api_key` to `~/.alibabacloud/credentials`. - Realtime sessions generally require WebSocket or streaming session handling in the client. ## Normalized interface (asr.realtime) ### Request - `model` (string, optional): default `qwen3-asr-flash-realtime` - `language_hints` (array<string>, optional) - `format` (string, optional): e.g. `pcm`, `wav` - `sample_rate` (int, optional): e.g. `16000` - `chunk_ms` (int, optional): frame size in milliseconds ### Response - `text` (string): recognized transcript fragment - `is_final` (bool): finalization marker - `usage` (object, optional) ## Quick start Generate a request template: ```bash python skills/ai/audio/alicloud-ai-audio-asr-realtime/scripts/prepare_realtime_asr_request.py \ --output output/alicloud-ai-audio-asr-realtime/request.json ``` ## Operational guidance - Prefer 16kHz mono PCM unless your client stack requires another format. - Keep chunks small enough for responsive partial results. - If you only have recorded files, use `skills/ai/audio/alicloud-ai-audio-asr/` instead. ## References - `references/sources.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zhangifonly/didi-bike (version 1.0.0)

--- name: "滴滴青桔" version: "1.0.0" description: "青桔单车出行助手，精通骑行路线、站点推荐、费用优化、出行建议" tags: ["bike", "transportation", "didi", "green"] author: "ClawSkills Team" category: "transportation" --- # 滴滴青桔 AI 助手 你是一个精通滴滴青桔单车/电单车的 AI 助手。 ## 身份与能力 - 熟悉青桔单车和电单车的使用流程和计费规则 - 了解青桔在滴滴出行生态中的定位 - 能提供短途出行的最优方案建议 ## 核心知识 ### 车型与计费 | 车型 | 起步价 | 时长费 | 适用场景 | |------|--------|--------|----------| | 青桔单车 | 1.5元/15分钟 | 0.5元/15分钟 | 1-3公里短途 | | 青桔电单车 | 2元/15分钟 | 1元/15分钟 | 3-5公里中短途 | - 骑行卡：月卡约16.8元，每次免费骑行时长内不收费 - 滴滴 App 内直接扫码使用 ### 电单车优势 - 助力骑行，省力不费劲 - 速度更快，适合稍远距离 - 续航约40-60公里，电量不足时 App 会提示 ### 使用技巧 - 滴滴 App → 骑车 → 选择单车或电单车 → 扫码 - 优先选择电量充足的电单车（App 显示电量） - 在指定停车点还车避免调度费 - 结合滴滴打车做多模式出行规划 ## 使用场景 1. 地铁/公交接驳的最后一公里 2. 中短途通勤（电单车更适合3-5公里） 3. 与滴滴打车组合的多模式出行 ## 工作规范 - 电单车需在运营区域内还车，超区会产生额外费用 - 提醒用户佩戴头盔，遵守交通规则 - 费用以 App 实际显示为准 --- **最后更新**: 2026-03-16


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: steipete/bear-notes (version 1.0.0)

--- name: bear-notes description: Create, search, and manage Bear notes via grizzly CLI. homepage: https://bear.app metadata: {"clawdbot":{"emoji":"🐻","os":["darwin"],"requires":{"bins":["grizzly"]},"install":[{"id":"go","kind":"go","module":"github.com/tylerwince/grizzly/cmd/grizzly@latest","bins":["grizzly"],"label":"Install grizzly (go)"}]}} --- # Bear Notes Use `grizzly` to create, read, and manage notes in Bear on macOS. Requirements - Bear app installed and running - For some operations (add-text, tags, open-note --selected), a Bear app token (stored in `~/.config/grizzly/token`) ## Getting a Bear Token For operations that require a token (add-text, tags, open-note --selected), you need an authentication token: 1. Open Bear → Help → API Token → Copy Token 2. Save it: `echo "YOUR_TOKEN" > ~/.config/grizzly/token` ## Common Commands Create a note ```bash echo "Note content here" | grizzly create --title "My Note" --tag work grizzly create --title "Quick Note" --tag inbox < /dev/null ``` Open/read a note by ID ```bash grizzly open-note --id "NOTE_ID" --enable-callback --json ``` Append text to a note ```bash echo "Additional content" | grizzly add-text --id "NOTE_ID" --mode append --token-file ~/.config/grizzly/token ``` List all tags ```bash grizzly tags --enable-callback --json --token-file ~/.config/grizzly/token ``` Search notes (via open-tag) ```bash grizzly open-tag --name "work" --enable-callback --json ``` ## Options Common flags: - `--dry-run` — Preview the URL without executing - `--print-url` — Show the x-callback-url - `--enable-callback` — Wait for Bear's response (needed for reading data) - `--json` — Output as JSON (when using callbacks) - `--token-file PATH` — Path to Bear API token file ## Configuration Grizzly reads config from (in priority order): 1. CLI flags 2. Environment variables (`GRIZZLY_TOKEN_FILE`, `GRIZZLY_CALLBACK_URL`, `GRIZZLY_TIMEOUT`) 3. `.grizzly.toml` in current directory 4. `~/.config/grizzly/config.toml` Example `~/.config/grizzly/config.toml`: ```toml token_file = "~/.config/grizzly/token" callback_url = "http://127.0.0.1:42123/success" timeout = "5s" ``` ## Notes - Bear must be running for commands to work - Note IDs are Bear's internal identifiers (visible in note info or via callbacks) - Use `--enable-callback` when you need to read data back from Bear - Some operations require a valid token (add-text, tags, open-note --selected)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jackeven02/calendar-manager (version 1.1.0)

--- name: calendar-manager version: 1.0.0 description: 日历管理技能 - 让 AI 能够读取日程、创建事件、设置提醒。当用户要求查看日程、添加日历事件、提醒 upcoming events 时触发此技能。 --- # Calendar Manager - 日历管理技能 ## 概述 赋予 AI 日历管理能力： - 读取日历事件 - 创建/修改/删除事件 - 设置提醒 - 查找空闲时间 ## 触发场景 1. 用户要求"查看今天/明天/本周的日程" 2. 用户要求"添加一个会议/事件" 3. 用户要求"设置提醒" 4. 用户询问"今天有什么安排" 5. 定时提醒用户 upcoming events ## 支持的日历服务 | 服务 | 说明 | |------|------| | Google Calendar | 需要 gcal CLI 或 API | | Apple Calendar (macOS) | 使用 icalBuddy | | Outlook | 使用 gog CLI | | Fantastical | 第三方应用 | ## 使用方法 ### Google Calendar (gog CLI) ```bash # 列出今天的事件 gog calendar list today # 列出明天的事件 gog calendar list tomorrow # 列出这周的事件 gog calendar list this-week # 创建事件 gog calendar create "会议名称" --when "2026-02-25 14:00" --duration 60 # 快速添加事件 gog calendar add "Team Meeting" tomorrow 3pm ``` ### Apple Calendar (icalBuddy) ```bash # 安装 brew install ical-buddy # 列出今天的事件 icalBuddy eventsToday # 列出明天的事件 icalBuddy eventsTomorrow # 列出指定日期范围 icalBuddy eventsFrom:2026-02-24 to:2026-02-28 ``` ## 工作流 ``` 1. 检查可用的日历工具 2. 获取指定时间范围的事件 3. 筛选重要/即将到来的事件 4. 汇总呈现给用户 ``` ## 提醒设置 | 提醒时间 | 说明 | |----------|------| | 事件前 15 分钟 | 会议/约会 | | 事件前 1 小时 | 重要事项 | | 事件前 1 天 | 当天提醒 | | 事件前 1 周 | 周计划 | ## 输出格式 向用户呈现日历时： - 日期和时间 - 事件名称 - 地点（如果有） - 参与人（如果有） - 建议的准备事项 ## 与邮件技能配合 可以与 email-reader 配合： - 读取邮件中的会议邀请 - 自动创建日历事件 - 发送会议提醒邮件

path: references/resources.md
content: # 日历管理参考资料

## gcal CLI

### 安装
```bash
# macOS
brew install gcalcli

# Python
pip install gcalcli
```

### 配置
```bash
# OAuth 登录
gcalcli --oauth2

# 或使用凭据
gcalcli --client-id ID --client-secret SECRET ...
```

### 常用命令

```bash
# 列出今天
gcalcli calw

# 列出本周
gcalcli calw -n 2

# 搜索事件
gcalcli search "会议"

# 快速添加
gcalcli quick "Meeting" tomorrow 3pm

# 详细添加
gcalcli add \
  "团队会议" \
  --when "2026-02-25 14:00" \
  --duration 60 \
  --where "会议室A" \
  --description "讨论项目进度"
```

## icalBuddy (macOS)

### 安装
```bash
brew install ical-buddy
```

### 常用命令

```bash
# 今天事件（含详情）
icalBuddy eventsToday+

# 明天事件
icalBuddy eventsTomorrow

# 指定范围
icalBuddy eventsFrom:2026-02-24 to:2026-02-28

# 未完成的任务
icalBuddy uncompletedTasks

# 带颜色输出
icalBuddy -c eventsToday
```

## Cron 格式

```
┌───────────── 分钟 (0 - 59)
│ ┌───────────── 小时 (0 - 23)
│ │ ┌───────────── 日期 (1 - 31)
│ │ │ ┌───────────── 月份 (1 - 12)
│ │ │ │ ┌───────────── 星期 (0 - 6) (周日=0)
│ │ │ │ │
* * * * *
```

### 示例
```bash
# 每小时
0 * * * *

# 每天 8 点
0 8 * * *

# 每周一 9 点
0 9 * * 1

# 每月 1 号 10 点
0 10 1 * *

# 每 30 分钟
*/30 * * * *
```

## Windows 任务计划

```powershell
# 创建每日任务
$action = New-ScheduledTaskAction -Execute "python.exe" -Argument "script.py"
$trigger = New-ScheduledTaskTrigger -Daily -At "8:00AM"
Register-ScheduledTask -Action $action -Trigger $trigger -TaskName "DailyTask"
```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: honestqiao/json-formatter (version 1.0.0)

# JSON Formatter 格式化、验证和压缩 JSON 数据。 ## 功能 - JSON 格式化（缩进） - JSON 验证 - JSON 压缩 - 路径提取 ## 触发词 - "格式化JSON" - "json格式化" - "prettify json" - "验证json" ## 示例 ``` 输入: {"a":1,"b":2} 输出: { "a": 1, "b": 2 } ``` ## 输出 ```json { "formatted": "...", "valid": true, "size": 1024, "paths": ["$.a", "$.b"] } ```

path: skill.yaml
content: # Skill: json_formatter

format_json(data: string, indent: number) => string

## Trigger Patterns
- 格式化JSON
- json格式化
- prettify json

## Implementation

格式化、验证和压缩 JSON 数据。

```javascript
function formatJson(data, indent = 2) {
  try {
    const parsed = typeof data === 'string' ? JSON.parse(data) : data;
    return {
      formatted: JSON.stringify(parsed, null, indent),
      valid: true,
      size: JSON.stringify(parsed).length
    };
  } catch (e) {
    return { error: e.message, valid: false };
  }
}


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: stephenredmond-straiteis/lessac-offline-voice-system (version 1.1.0)

--- name: telegram-voice-messaging-recovery description: Recover working OpenClaw Telegram voice messaging after upgrades or rebuilds. Restores the local faster-whisper transcription helper, keeps OpenClaw native inbound/outbound voice routing, and applies the proven config fix: `messages.tts.provider = microsoft`, `messages.tts.providers.microsoft.voice = en-IE-ConnorNeural`, `messages.tts.providers.microsoft.lang = en-IE`, plus explicit `plugins.entries.microsoft.enabled = true`. Use when voice notes transcribe correctly but outbound TTS replies fail, or when `microsoft: no provider registered` appears. --- # Telegram Voice Messaging Recovery This skill exists to restore a **known-good OpenClaw native voice messaging setup**. ## What it restores - local `faster-whisper` transcription helper in `~/.openclaw/tts` - local Python virtualenv with `faster-whisper`, `edge-tts`, and `soundfile` - helper scripts for local testing - working OpenClaw config for native Telegram voice-note replies - explicit bundled Microsoft speech plugin enablement ## What it does not do - It does **not** manually send Telegram voice messages itself. - It does **not** replace OpenClaw native reply routing. - It does **not** require a separate Azure TTS API key. ## Known-good OpenClaw config Keep the live routing in `openclaw.json`: ```json "messages": { "ackReactionScope": "group-mentions", "tts": { "auto": "inbound", "provider": "microsoft", "providers": { "microsoft": { "voice": "en-IE-ConnorNeural", "lang": "en-IE" } } } } ``` And explicitly enable the bundled Microsoft plugin: ```json "plugins": { "entries": { "microsoft": { "enabled": true } } } ``` ## Important note `edge` is a legacy alias. Current OpenClaw normalizes that path to `microsoft`. ## Required restart After applying the config, do a **real manual gateway restart**. A hot reload / `SIGUSR1` is not enough if the Microsoft speech provider is stale or unregistered. ## Files restored - `transcribe-audio` - `voice_handler.py` - `tts_edge_wrapper.py` - `voice_integration.sh` - Python virtualenv with the required packages ## Install ```bash cd /root/.openclaw/workspace/skills/lessac_offline_voice_system ./scripts/install.sh ``` ## Verify 1. Test direct TTS. 2. Send a short Telegram voice note. 3. Confirm inbound transcription works. 4. Confirm outbound reply comes back as audio. ## Failure signature this skill is meant to fix - inbound transcription works - outbound TTS reply fails - direct TTS reports: - `microsoft: no provider registered` - `openai: not configured`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: adacapo21/indigo-dex (version 1.0.0)

--- name: indigo-dex description: "Interact with decentralized exchanges on Cardano through the Indigo Protocol ecosystem." allowed-tools: Read, Glob, Grep license: MIT metadata: author: indigoprotocol version: '0.1.0' --- # DEX Integration Skill for interacting with decentralized exchanges on Cardano through the Indigo Protocol ecosystem. Query available tokens, get swap estimates via SteelSwap, explore Iris liquidity pools, and check wallet balances via Blockfrost. ## MCP Tools - `get_steelswap_tokens` — List all tokens available for swapping on SteelSwap - `get_steelswap_estimate` — Get a swap estimate (price, slippage, route) for a token pair on SteelSwap - `get_iris_liquidity_pools` — Retrieve liquidity pool data from Iris - `get_blockfrost_balances` — Get wallet token balances via Blockfrost ## Sub-Skills - [SteelSwap](sub-skills/steelswap.md) — Token listing and swap estimates - [Iris Pools](sub-skills/iris-pools.md) — Liquidity pool data from Iris - [Balances](sub-skills/balances.md) — Wallet balances via Blockfrost ## References - [MCP Tools Reference](references/mcp-tools.md) — Detailed tool parameters and return types - [DEX Concepts](references/concepts.md) — SteelSwap, Iris, Blockfrost, price impact, routing ## Example Prompts - "What tokens are available to swap on SteelSwap?" - "Get a swap estimate for 100 ADA to iUSD on SteelSwap" - "Show me the current Iris liquidity pools" - "What are the token balances for this wallet address?"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: cuuush/groupme-cli (version 1.0.4)

--- name: groupme-cli description: Send and read GroupMe messages via the groupme CLI. Use when asked to list groups, read messages, send messages to groups, or manage GroupMe direct messages from the command line. metadata: { "openclaw": { "requires": { "bins": ["groupme"], "env": ["GROUPME_TOKEN"], }, "primaryEnv": "GROUPME_TOKEN", "install": [ { "id": "source", "kind": "source", "repo": "https://github.com/cuuush/groupme-cli", "bins": ["groupme"], "label": "Install groupme-cli (from source)", "notes": "Bundles to a single JS file via esbuild (git clone + npm install + npm run bundle + npm link). No separate build step needed — esbuild produces a self-contained dist/groupme-cli.js. Review package.json scripts before running on sensitive systems.", }, ], }, } --- # GroupMe CLI Send and read GroupMe messages from the command line using the `groupme` CLI. ## Setup ### Installation ```bash git clone https://github.com/cuuush/groupme-cli cd groupme-cli npm install npm run bundle npm link ``` > **Note:** `npm run bundle` uses [esbuild](https://esbuild.github.io/) to produce a single self-contained file at `dist/groupme-cli.js`. No separate TypeScript compilation step needed — just install, bundle, and link. ### Authentication Get your GroupMe API token from [dev.groupme.com](https://dev.groupme.com/) → Access Token, then configure: ```bash groupme config --token YOUR_ACCESS_TOKEN ``` Or use the `GROUPME_TOKEN` environment variable, or pass `--token` to any command. ## Core Commands ### List Groups ```bash groupme groups groupme groups --json ``` ### Read Messages ```bash # Latest messages from a group groupme read --group GROUP_ID # More messages groupme read --group GROUP_ID --limit 50 # Paginate older messages groupme read --group GROUP_ID --before MESSAGE_ID # JSON output groupme read --group GROUP_ID --json ``` ### Send a Message ```bash groupme send --group GROUP_ID --message "Hello!" ``` ### Direct Messages ```bash # Read DMs groupme dm-read --user USER_ID # Send a DM groupme dm --user USER_ID --message "Hey!" ``` ### List DM Conversations ```bash groupme chats groupme chats --page 2 --per-page 10 ``` ### Current User Info ```bash groupme me ``` ## Fuzzy Group Search Groups support fuzzy name matching — you can use partial names when referencing groups in commands. ## Global Options - `--token <token>` — Override configured token - `--json` — Machine-readable JSON output - `--help` — Show help ## Tips - Run `groupme groups --json` to get GROUP_IDs for use in other commands - Use `--json` output to pipe into other tools or for scripting - Config is stored at `~/.config/groupme/config.json`


Security scan verdicts — ClawScan: clean | static analysis:  | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: brs999/kalshi-trades (version 1.0.3)

--- name: kalshi-trades description: Read-only Kalshi OpenAPI scouting skill for market discovery, liquidity checks, and market validation. Use for scanning and ranking Kalshi opportunities. Pair with a separate paper-trading skill if you want open/close execution. homepage: https://docs.kalshi.com user-invocable: true disable-model-invocation: true metadata: { "openclaw": { "emoji": "📊", "requires": { "bins": ["node"] } } } --- # Kalshi Trades (OpenAPI Read-Only) Use this skill for Kalshi scouting and market validation only. ## Rules - Use OpenAPI read endpoints for market discovery and validation. - This skill does not place, amend, or cancel orders. - This skill does not include paper ledger execution scripts. ## Primary Commands Exchange status: ```bash node {baseDir}/scripts/kalshi-trades.mjs status --pretty ``` Broad market scan: ```bash node {baseDir}/scripts/kalshi-trades.mjs markets --status open --limit 1000 --pretty node {baseDir}/scripts/kalshi-trades.mjs events --limit 100 --pretty node {baseDir}/scripts/kalshi-trades.mjs series --limit 400 --pretty ``` Focused validation: ```bash node {baseDir}/scripts/kalshi-trades.mjs market --ticker <TICKER> --pretty node {baseDir}/scripts/kalshi-trades.mjs trades --ticker <TICKER> --limit 200 --pretty node {baseDir}/scripts/kalshi-trades.mjs orderbook --ticker <TICKER> --pretty ``` ## Optional Integration: Paper Ledger Skill Required If you want paper open/close workflows, install and use a separate paper-trading skill that provides the execution script. This Kalshi skill can supply candidate/market data to that separate skill. ```bash node --experimental-strip-types skills/paper-trading/scripts/paper_trading.ts status --account kalshi --format json --pretty ``` ## Environment Optional override (defaults to Kalshi production API): ```bash export KALSHI_BASE_URL="https://api.elections.kalshi.com/trade-api/v2" ``` ## Tests Run the Kalshi reader smoke tests: ```bash node --test {baseDir}/tests/kalshi-trades.test.mjs ```


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: clean (LOW)