OpenClaw/clawhub-security-signals huggingface dataset:
Skill: danmartinez78/vectorclaw-mcp (version 1.0.4)

--- name: vectorclaw-mcp description: "MCP tools for Anki Vector: speech, motion, camera, sensors, and automation workflows." openclaw: emoji: "🤖" requires: bins: ["python3"] env: ["VECTOR_SERIAL"] install: - id: pip kind: pip package: vectorclaw-mcp label: "Install VectorClaw MCP (pip)" mcp: servers: vectorclaw: command: python3 args: - "-m" - "vectorclaw_mcp.server" env: VECTOR_SERIAL: "${VECTOR_SERIAL}" --- # VectorClaw MCP VectorClaw connects OpenClaw to an Anki / Digital Dream Labs Vector robot through MCP. It provides practical robot control primitives for speech, movement, camera capture, and status/sensor reads. ## What you can do - Speak text with `vector_say` - Move and position with `vector_drive`, `vector_head`, `vector_lift` - Capture camera images with `vector_look` and `vector_capture_image` - Read robot state with `vector_status`, `vector_pose`, `vector_proximity_status`, `vector_touch_status` - Build look → reason → act workflows ## Vision requirement for look → reason → act For see → reason → act workflows, the agent must either be vision-capable itself (e.g., a VLM) or have access to a separate vision model/image-interpretation tool to analyze camera images before choosing actions. ## Requirements - Vector robot configured and reachable - Wire-Pod running - SDK configured at `~/.anki_vector/sdk_config.ini` - `VECTOR_SERIAL` environment variable set ## Quick setup 1. Install package: `pip install vectorclaw-mcp` 2. Configure SDK: `python3 -m anki_vector.configure` 3. Export robot serial: `export VECTOR_SERIAL=your-serial` 4. Add MCP server: ```json { "mcpServers": { "vectorclaw": { "command": "python3", "args": ["-m", "vectorclaw_mcp.server"], "env": { "VECTOR_SERIAL": "${VECTOR_SERIAL}" } } } } ``` ## Tool coverage **Hardware-verified core tools** `vector_say`, `vector_drive_off_charger`, `vector_drive`, `vector_emergency_stop`, `vector_head`, `vector_lift`, `vector_look`, `vector_capture_image`, `vector_face`, `vector_scan`, `vector_vision_reset`, `vector_pose`, `vector_status`, `vector_charger_status`, `vector_touch_status`, `vector_proximity_status` **Experimental tools** `vector_animate`, `vector_drive_on_charger`, `vector_find_faces`, `vector_list_visible_faces`, `vector_face_detection`, `vector_list_visible_objects`, `vector_cube` ## Current limitations - Charger return (`vector_drive_on_charger`) is currently unreliable - Face/object detection is currently inconsistent - Visual interpretation requires the vision capability described above ## Documentation - MCP API: `docs/MCP_API_REFERENCE.md` - SDK Reference: `docs/VECTOR_SDK_REFERENCE.md` - Hardware log: `docs/HARDWARE_SMOKE_LOG.md` - Repo: https://github.com/danmartinez78/VectorClaw


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: agisearch/first (version 1.1.0)

--- name: Firstprinciples thinking slug: first description: Think from first principles instead of analogy. Break problems into fundamental truths, challenge assumptions, and rebuild better solutions from scratch. --- # Firstprinciples thinking A local-first reasoning skill for breaking complex problems down to their most fundamental truths and rebuilding solutions from the ground up. Use this when the user: - is stuck in conventional wisdom - wants original thinking instead of recycled advice - needs to separate facts from assumptions - wants to redesign a strategy, product, business model, or decision from scratch - asks whether something is truly necessary, optimal, or possible This skill should: 1. Clarify the real objective. 2. Surface explicit and hidden assumptions. 3. Separate facts from analogies, conventions, and defaults. 4. Break the problem into irreducible components. 5. Identify real constraints, variables, and tradeoffs. 6. Reconstruct a better solution from the ground up. 7. Deliver a practical answer with clear next actions. ## Output structure When useful, organize the answer as: - Goal - Assumptions - What is actually true - Irreducible components - Constraints and tradeoffs - Rebuilt solution - Best next action ## Principles - Do not treat convention as truth. - Do not treat common practice as proof. - Do not treat analogy as understanding. - Start from what must be true. - Rebuild toward something usable. - Stay grounded in the user's real goal. ## Success standard A strong answer should make the user feel: - "Now I understand the real problem." - "These assumptions were weaker than I thought." - "This solution is more fundamental and more original." - "I can actually act on this."


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: 534422530/thunder-core (version 1.0.0)

--- name: thunder-core description: Windows Thunder download client via COM interface — add, commit, cancel, and manage download tasks programmatically. version: 1.0.0 tags: - download - thunder - xunlei - windows - com - automation category: "Automation" os: - windows metadata: openclaw: requires: bins: - python emoji: ⚡ --- # Thunder Download Core Control the [Thunder (迅雷)](https://www.xunlei.com/) download engine on Windows via COM interface. Add download tasks, set custom headers (Referer, User-Agent, Cookie), commit tasks, cancel all, and query task list. **Prerequisites**: Windows OS with Thunder client installed. Python packages: `pywin32` (`pip install pywin32`). ## Quick Start ```python from thunder_core import ThunderCore, download # Quick one-shot download download("https://example.com/file.zip", "C:\\Downloads\\file.zip") # Full control tc = ThunderCore() if tc.initialize(): tc.add_task("https://example.com/file.zip", "C:\\Downloads\\file.zip", refer_url="https://example.com", user_agent="Mozilla/5.0") tc.commit_tasks() tasks = tc.get_tasks() tc.close() ``` ## API ### ThunderCore | Method | Description | |--------|-------------| | `initialize()` | Initialize Thunder COM component | | `add_task(url, save_path, ...)` | Add a download task with custom headers | | `commit_tasks()` | Submit all queued tasks | | `add_and_commit(url, save_path, ...)` | Add task and immediately commit | | `cancel_all()` | Cancel all active tasks | | `get_tasks()` | Get current task list | | `close()` | Release COM resources | ### Utility | Function | Description | |----------|-------------| | `download(url, save_path, ...)` | Convenience: create, add, commit in one call | ## Notes - Windows-only (uses COM interface `ThunderAgent.ThunderAgent`) - Thunder must be installed at default path or custom `_install_path` - Run as administrator if COM registration fails ## Source `thunder_core.py` (155 lines) in this skill directory.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ryudi84/sovereign-api-docs-generator (version 1.0.0)

--- name: API Documentation Generator description: Auto-generates comprehensive API docs from code. REST, GraphQL, WebSocket with examples and schemas. --- # API Documentation Generator You generate professional API documentation. For each endpoint generate: 1. Method, path, description 2. Authentication requirements 3. Request headers, params, body schema with types 4. Response status codes, body schema, error formats 5. Examples in curl, JavaScript fetch, Python requests 6. Rate limiting info Format as OpenAPI/Swagger-compatible markdown with tables for parameters and JSON examples for request/response bodies.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: luv005/renderful-generation (version 0.1.0)

--- name: renderful-generation description: Use Renderful from OpenClaw for image/video/audio/3D creation with model discovery, quote-before-generate workflow, deterministic polling, and insufficient-funds/x402 fallback. metadata: {"openclaw":{"homepage":"https://renderful.ai"}} --- Use this skill with the Renderful OpenClaw plugin tools: - `renderful_list_models` - `renderful_quote` - `renderful_generate` - `renderful_get_generation` - `renderful_register_agent` - `renderful_get_balance` - `renderful_set_webhook` ## Recommended Flow 1. Run `renderful_register_agent` if no API key is available. 2. Run `renderful_list_models` to pick a valid `type` and `model`. 3. Run `renderful_quote` before `renderful_generate`. 4. Run `renderful_generate` once inputs are validated. 5. Poll with `renderful_get_generation` until terminal status. ## x402 and Insufficient Funds - If generation returns `status=402`, surface `payment_requirements`. - If `needs_funds=true`, surface `deposit_addresses` and `shortfall`. - Retry generation after funding or after providing valid `x_payment`. ## Notes - Prefer read-only calls (`list_models`, `quote`, `get_generation`, `get_balance`) until explicit user approval for side effects. - Keep responses deterministic and structured so planners can chain tool calls safely.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: rishabhdugar/pdf-to-csv (version 1.0.2)

--- name: pdf-to-csv description: "Extract tables and text from a PDF into CSV format via the PDFAPIHub cloud API. PDFs are uploaded to pdfapihub.com for processing. Requires a CLIENT-API-KEY header." metadata: {"openclaw": {"primaryEnv": "PDFAPIHUB_API_KEY", "requires": {"env": ["PDFAPIHUB_API_KEY"]}}} --- # PDF to CSV ## What It Does Extracts tables and text from a PDF into CSV format via the PDFAPIHub hosted API. Your PDF is uploaded to PDFAPIHub servers for processing and the extracted CSV is returned. Uses structured table detection when available. ## When to Use - Extract tabular data from a PDF as CSV for data processing - Pull invoice line items or report data into CSV ## Required Inputs Provide one of: - `url` — public URL to a PDF - `file` — base64-encoded PDF - Multipart upload with `file` field ## Authentication This skill calls the PDFAPIHub hosted API at `https://pdfapihub.com/api`. Your PDF is sent to PDFAPIHub servers for table extraction. Send your API key in the `CLIENT-API-KEY` header. Get your **free API key** at [https://pdfapihub.com](https://pdfapihub.com). Full API documentation is available at [https://pdfapihub.com/docs](https://pdfapihub.com/docs). **Privacy note:** PDFs you process are uploaded to PDFAPIHub's cloud service. Do not send confidential documents unless you trust the service. Files are auto-deleted after 30 days. ## Use Cases - **Data Pipeline Ingestion** — Extract PDF table data as CSV for import into databases or BI tools - **CRM Import** — Pull contact lists from PDF exports into CSV for CRM import - **Inventory Management** — Convert PDF inventory reports to CSV for spreadsheet tracking - **Research Data** — Extract experimental data from PDF papers into CSV for analysis - **Automated ETL** — Feed PDF-extracted CSV data into automated data processing pipelines ## Example Usage ```bash curl -X POST https://pdfapihub.com/api/v1/convert/pdf/csv \ -H "CLIENT-[REDACTED_SECRET]" \ -H "Content-Type: application/json" \ -d '{ "url": "https://pdfapihub.com/sample-pdfinvoice-with-image.pdf", "output": "url" }' ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: alex1389/toggl-optimized-v2 (version 1.0.0)

# Toggl-Optimized A high-performance Toggl Track agent skill optimized for token efficiency and reporting. ## Overview This skill provides a streamlined way to interact with Toggl Track, focusing on minimizing context usage and providing fast reporting capabilities via direct API v3 calls. ## Features - **Token Efficient:** Uses optimized API calls to reduce LLM context consumption. - **Fast Reporting:** Includes a shell script for quick JSON and PDF reports. - **Direct API Access:** Examples for direct `curl` interaction with Toggl v3 Reports. ## Setup 1. Get your API Token from [Toggl Profile Settings](https://track.toggl.com/profile). 2. Set the environment variable: ```bash export TOGGL_API_TOKEN="your-api-token" ``` 3. (Optional) Set your Workspace ID: ```bash export TOGGL_WORKSPACE_ID="your-workspace-id" ``` ## Usage ### Optimized Reporting Script Use the provided script for fast summaries: ```bash # Usage: bash scripts/toggl_report.sh <client_name> <start_date> <end_date> <format: json|pdf> bash scripts/toggl_report.sh myclient 2026-02-01 2026-02-28 json ```

path: package.json
content: name: @alexgonzalez/toggl-optimized
version: 1.0.0
description: Toggl Track agent skill optimized for token efficiency and high-speed reporting.
author: Alex Gonzalez
license: MIT

path: scripts/toggl_report.sh
content: #!/bin/bash
API_TOKEN="${TOGGL_API_TOKEN}"
WORKSPACE_ID="${TOGGL_WORKSPACE_ID}"
CLIENT_NAME=$1
START_DATE=$2
END_DATE=$3
FORMAT=$4
# CLIENT_ID logic goes here...


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: tohnee/opc (version 1.0.0)

--- name: opc description: OPC (One-Person Company) Framework - Complete AI agent system for solo entrepreneurs with 14 integrated skills. From ideation to deployment - creative planning, market research, proposal writing, PRD generation, development, testing, deployment, operations, and more. metadata: openclaw: emoji: 🏢 os: [darwin, linux] requires: {} install: [] --- # OPC (One-Person Company) Framework 🏢 A comprehensive AI-powered framework for solo entrepreneurs to build and scale their one-person company. ## What's OPC? OPC (One-Person Company) Framework is a complete skill stack that helps solo entrepreneurs go from idea to execution using AI agents. ## 14 Integrated Skills | Category | Skill | Description | |----------|-------|-------------| | 📌 Planning | creative-planning | Business idea generation and validation | | 📊 Research | market-research | Competitor and market analysis | | 📝 Writing | proposal-writing | Investor pitches and proposals | | 🔍 Review | proposal-review | Proposal quality assurance | | 📋 Product | prd-generation | Product requirement documents | | 📅 Project | project-manager | Project roadmap and tracking | | 💻 Development | development | Code generation and implementation | | 🧪 Testing | testing | QA and automation testing | | 🚀 Deploy | deployment | CI/CD and deployment | | ⚙️ Ops | operations | Monitoring and maintenance | | 📡 Social | social-listening | Brand monitoring | | 🌐 Brand | domain-brand | Naming and domain strategy | | 🔧 Tools | tool-search | AI tool discovery | | 🔗 Integrations | evomap | EvoMap marketplace integration | ## Requirements - OpenClaw agent runtime - Access to various LLM providers (optional for enhanced capabilities) ## Quick Start 1. Install the skill in your OpenClaw workspace 2. Configure your preferred LLM provider 3. Start with "creative-planning" skill to ideate 4. Progress through the workflow: research → write → develop → deploy → operate ## Usage Example ``` User: I want to build a SaaS product OPC: Great! Let's start with creative-planning... ``` ## Skills Structure Each skill is independent but can work together as a complete workflow. ## Credits - Built on OpenClaw infrastructure - Designed for solopreneurs and indie hackers --- **Tags**: #ai #agent #solopreneur #startup #one-person-company #mvp #lean-startup


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: imaflytok/agent-network-scanner (version 1.0.0)

--- name: agent-network-scanner version: 1.0.0 description: Scan the internet for AI agent networks, hubs, and coordination platforms. Find where agents gather, what bounties are available, and which networks are active. Multi-protocol support (OADP, A2A, MCP). --- # Agent Network Scanner Find every agent network on the internet. Scan domains for discovery signals across multiple protocols. ## Quick Scan ```bash # Scan a domain for agent signals for layer in "/.well-known/agent-protocol.json" "/.well-known/agent.json" "/robots.txt" "/skill.md" "/AGENT.md"; do STATUS=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 "https://$1$layer") [ "$STATUS" = "200" ] && echo "✅ $layer" || echo "❌ $layer" done ``` ## Known Active Networks | Network | Agents | Protocol | Bounties | URL | |---------|--------|----------|----------|-----| | ClawSwarm | 35+ | OADP | Yes (HBAR) | onlyflies.buzz/clawswarm | | MoltX | 1000s | Custom | No | moltx.io | | AgentDo | ? | Custom | Yes | agentdo.dev | ## Multi-Protocol Scan ### OADP (Open Agent Discovery Protocol) ```bash # Check all 6 OADP layers curl -s "https://$DOMAIN/.well-known/agent-protocol.json" | jq . dig +short TXT "_agent.$DOMAIN" curl -sI "https://$DOMAIN" | grep -i "x-agent-hub" curl -s "https://$DOMAIN/robots.txt" | grep -i "agent-hub" ``` ### Google A2A ```bash # Check for A2A agent card curl -s "https://$DOMAIN/.well-known/agent.json" | jq . ``` ### MCP (Model Context Protocol) ```bash # Check for MCP server curl -s "https://$DOMAIN/.well-known/mcp.json" | jq . ``` ## Batch Scan Known Domains ```bash DOMAINS="onlyflies.buzz moltx.io agentdo.dev chatr.ai" for d in $DOMAINS; do echo "--- $d ---" curl -s --max-time 5 "https://$d/.well-known/agent-protocol.json" | jq -r '.hub.name // "No OADP"' 2>/dev/null curl -s --max-time 5 "https://$d/.well-known/agent.json" | jq -r '.name // "No A2A"' 2>/dev/null done ``` ## Discover Bounties ```bash # Check open bounties on known networks curl -s "https://onlyflies.buzz/clawswarm/api/v1/tasks?status=open" | \ jq '.tasks[] | {title, bounty_hbar, difficulty}' ``` ## Add Your Network If you run an agent hub, emit OADP signals so scanners can find you: - Add `/.well-known/agent-protocol.json` - Add `Agent-Hub:` to `robots.txt` - Add DNS TXT record: `_agent.yourdomain` See the [OADP spec](https://onlyflies.buzz/clawswarm/PROTOCOL.md) for details. <!-- OADP:1.0 hub=https://onlyflies.buzz/clawswarm/api/v1 reg=https://onlyflies.buzz/clawswarm/api/v1/agents/register ping=https://onlyflies.buzz/clawswarm/api/v1/ping -->


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: wangwei0326/wangwei-touch (version 1.0.0)

--- name: wangwei-touch description: echo ni shuo de hua --- # Cron Backup auto echo ni shuo de hua ## Quick Start ### One-Time echo ```bash # Backup a directory with timestamp ./scripts/touch.sh abcd ``` ### One-Time echo ```bash # Backup a directory with timestamp ./scripts/touch1.sh abcd ``` ### One-Time echo ```bash # Backup a directory with timestamp ./scripts/touch2.sh abcd ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: djdyll/polymarket-manual-trade (version 1.1.0)

--- name: polymarket-manual-trade displayName: Manual Trade Placement description: Place manual trades on Polymarket by telling your agent what to bet on. Supports FAK (instant fill at market) and GTC (limit order on the book). Pass a Simmer market ID or a full Polymarket URL — the skill auto-imports and handles price discovery. Both FAK and GTC order types are fully tested and working. version: "1.1.0" author: DjDyll --- # Manual Trade Placement Place trades on Polymarket by telling your AI agent what to bet on. Supports instant FAK fills and GTC limit orders. Works with Simmer market IDs or full Polymarket event URLs. ## Usage Tell your agent: > "Buy YES $10 on [Polymarket URL or market ID]" > "Place a GTC limit NO $20 at 0.35 on [market]" Or run directly: ```bash # FAK — instant fill at best ask price (default) python3 manual_trade.py --market <market_id_or_url> --side YES --amount 10 # GTC — limit order, sits on book until filled python3 manual_trade.py --market <market_id_or_url> --side NO --amount 20 --order GTC --price 0.35 # Full Polymarket URL — auto-imports and trades python3 manual_trade.py \ --market https://polymarket.com/event/spacex-starship-flight-test-12/will-the-chopsticks-catch-spacex-starship-flight-test-12-superheavy-booster \ --side YES --amount 10 # Dry run (preview without placing) python3 manual_trade.py --market <id> --side YES --amount 10 --dry-run ``` ## Order Types | Type | Behavior | When to use | |------|----------|-------------| | **FAK** (default) | Fills immediately at best ask+0.01. Remainder cancelled. | You want in now at market price | | **GTC** | Limit order sits on CLOB book. Funds locked on placement, fill when market reaches your price | You want a specific price | ## Arguments | Flag | Description | |------|-------------| | `--market` / `-m` | Simmer market ID **or** full Polymarket URL | | `--side` / `-s` | `YES` or `NO` | | `--amount` / `-a` | Dollar amount (default $10) | | `--order` / `-o` | `FAK`, `GTC`, or `FOK` (default FAK) | | `--price` / `-p` | Limit price (optional — auto-fetches best ask+0.01 if omitted) | | `--venue` / `-v` | `polymarket` or `sim` (default polymarket) | | `--cancel` | Cancel all open orders on the market | | `--cancel-side` | Cancel only `yes` or `no` side orders | | `--dry-run` | Preview without placing | ## How it Works 1. **Market resolution** — if you pass a Polymarket URL, it auto-imports via Simmer's import API and resolves to the correct market 2. **Price discovery** — fetches live CLOB order book, uses best ask + 0.01 for FAK to guarantee fill 3. **Order placement** — signs and submits via simmer-sdk with your wallet key 4. **Confirmation** — reports shares filled, cost, and trade ID ## Requirements - `SIMMER_API_KEY` — your Simmer API key - `WALLET_PRIVATE_KEY` — your Polymarket wallet private key (for on-chain signing) - `simmer-sdk >= 0.8.32` --- Built for [Simmer](https://www.simmer.markets/) — the AI trading agent platform for Polymarket and Kalshi.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: jpengcheng523-netizen/a2a-secret-manager (version 1.0.0)

--- name: a2a-secret-manager description: Manages A2A node secrets for EvoMap hub connectivity, including validation, rotation, and credential updates. Use when node_secret_invalid errors occur or when managing A2A authentication. --- # A2A Secret Manager Automates node secret management for EvoMap hub connectivity. ## Usage ### As a Module ```javascript const secretManager = require('./skills/a2a-secret-manager'); // Get current status const status = secretManager.getStatus(); // Validate current secret const result = await secretManager.manageSecret(); // Force rotate const rotated = await secretManager.manageSecret({ forceRotate: true }); // Rotate with specific node ID const custom = await secretManager.manageSecret({ nodeId: 'node_xxx', storagePath: '/custom/path/secret' }); ``` ### From Command Line ```bash # Check status node skills/a2a-secret-manager/index.js status # Force rotate secret node skills/a2a-secret-manager/index.js rotate # Validate current secret node skills/a2a-secret-manager/index.js validate # Auto-manage (validate and rotate if invalid) node skills/a2a-secret-manager/index.js auto ``` ## Environment Variables - `EVOMAP_NODE_ID` - Node ID for A2A communication - `EVOMAP_NODE_SECRET` - Current node secret - `EVOMAP_HUB_URL` - Hub URL (default: https://evomap.ai) ## Storage Locations The skill looks for secrets in: 1. `$PWD/.evomap/secret` 2. `$PWD/.evomap/node_secret` 3. `$HOME/.evomap/secret` 4. Environment variable `EVOMAP_NODE_SECRET` ## API ### `manageSecret(options)` Main function for secret management. Options: - `nodeId` - Custom node ID - `secret` - Custom current secret - `forceRotate` - Force rotation even if valid - `storagePath` - Custom path to save new secret Returns: - `success` - Boolean - `action` - 'validated' | 'rotated' | 'rotate_failed' - `newSecret` - New secret (if rotated) - `savedPath` - Where secret was saved ## Example Output ``` A2A Secret Status: { "nodeId": "node_af09f1521e38", "hasSecret": true, "secretPreview": "abc12345...", "hubUrl": "https://evomap.ai" } ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)