OpenClaw/clawhub-security-signals huggingface dataset:
Skill: ivangdavila/web (version 1.0.0)

--- name: Web Development description: Build, debug, and deploy websites with HTML, CSS, JavaScript, modern frameworks, and production best practices. --- ## Quick Reference | Need | See | |------|-----| | HTML/CSS issues | `html-css.md` | | JavaScript patterns | `javascript.md` | | React/Next.js/frameworks | `frameworks.md` | | Deploy to production | `deploy.md` | | Performance/SEO/a11y | `performance.md` | ## Critical Rules 1. **DOCTYPE matters** — Missing `<!DOCTYPE html>` triggers quirks mode; layouts break unpredictably 2. **CSS specificity beats cascade** — `.class` overrides element selectors regardless of order 3. **`===` not `==`** — Type coercion causes `"0" == false` to be true 4. **Async/await in loops** — `forEach` doesn't await; use `for...of` or `Promise.all` 5. **CORS is server-side** — No client-side fix; configure `Access-Control-Allow-Origin` on the server 6. **Responsive = viewport meta** — Without `<meta name="viewport">`, mobile renders desktop-width 7. **Form without `preventDefault`** — Page reloads; call `e.preventDefault()` in submit handler 8. **Images need dimensions** — Missing `width`/`height` causes layout shift (CLS penalty) 9. **HTTPS or blocked** — Mixed content (HTTP resources on HTTPS pages) gets blocked by browsers 10. **Environment variables leak** — `NEXT_PUBLIC_*` exposes to client; never prefix secrets ## Common Requests **"Make it responsive"** → Mobile-first CSS with media queries; test at 320px, 768px, 1024px **"Deploy to production"** → See `deploy.md` for Vercel/Netlify/VPS patterns **"Fix CORS error"** → Server must send headers; proxy through same-origin if you can't control server **"Improve performance"** → Lighthouse audit; focus on LCP, CLS, FID; lazy-load below-fold images **"Add SEO"** → Title/description per page, semantic HTML, OG tags, sitemap.xml ## Framework Decision Tree - **Static content, fast builds** → Astro or plain HTML - **Blog/docs with MDX** → Astro or Next.js App Router - **Interactive app with auth** → Next.js or Remix - **Full SSR/ISR control** → Next.js - **Simple SPA, no SEO needed** → Vite + React/Vue


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: aaronjager92/openclaw-self-guard (version 1.0.1)

--- name: openclaw-self-guard description: OpenClaw Security Vulnerability Monitor - Checks for OpenClaw security vulnerabilities from NVD CVE database and GitHub Security Advisories. Compares local OpenClaw version against known CVEs, outputs vulnerability details and remediation if found, otherwise runs silently. Auto-installs daily cron job. Data sources: NVD (nist.gov), GitHub Security Advisories. description_zh: OpenClaw 安全漏洞监控器 - 从 NVD CVE 数据库和 GitHub Security Advisories 检查 OpenClaw 安全漏洞。对比本地版本与已知 CVE，有漏洞则输出详情和补救方案，无漏洞则静默执行。自动安装每日定时任务。数据来源：NVD (nist.gov)、GitHub Security Advisories。 --- # OpenClaw Self Guard - Security Vulnerability Monitor Monitors OpenClaw for known security vulnerabilities by checking multiple threat intelligence sources. ## Features - **Version Detection**: Automatically detects local OpenClaw version - **CVE Monitoring**: Checks NVD, GitHub Security Advisories for OpenClaw-related CVEs - **Smart Alerting**: Outputs vulnerability details + remediation if found - **Silent Mode**: Runs silently if no vulnerabilities found - **Auto Cron**: Installs daily cron job (06:00 Beijing time) during skill setup ## Data Sources | Source | URL | Description | |--------|-----|-------------| | **NVD** | `services.nvd.nist.gov` | NIST National Vulnerability Database | | **GitHub Advisories** | `api.github.com/advisories` | GitHub Security Advisory Database | ## Usage ### Run Manual Check ``` /openclaw 安全检查 /openclaw-self-guard check ``` ### View Current Version ``` /openclaw-self-guard version ``` ## Cron Job Installed automatically during skill setup: - **Schedule**: Daily at 06:00 (Beijing time) - **Behavior**: Checks for vulnerabilities, reports if found - **Delivery**: Console output only (no external channel by default) To customize delivery channel, edit `~/.openclaw/cron/jobs.json` after installation: ```json "delivery": { "mode": "announce", "channel": "feishu" // or "telegram", etc. } ``` ## Output Format When vulnerabilities found: ``` # 🔒 OpenClaw 安全漏洞报告 **检查时间**: 2026-03-31 **本地版本**: x.x.x **检测到漏洞**: X 个 ## 漏洞详情 | CVE ID | 严重性 | 描述 | 受影响版本 | 补救方案 | ``` When no vulnerabilities: ``` ✅ OpenClaw v{x.x.x} - 未检测到安全漏洞 ``` ## Skill Structure ``` openclaw-self-guard/ ├── SKILL.md ├── scripts/ │ ├── check_vulns.py # Main vulnerability check │ ├── fetch_nvd.py # Fetch CVE from NVD │ ├── fetch_github.py # Fetch from GitHub │ ├── get_version.py # Get local version │ └── setup_cron.sh # Cron auto-installation └── references/ └── requirements.txt ``` ## Notes - Requires Python packages: `requests`, `beautifulsoup4`, `lxml` - Cron job auto-installs during skill setup - No external channel by default - user configurable


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: dinghaibin/cal-tool (version 1.0.0)

--- name: cal-tool description: Perform cal-tool operations from the command line. --- # Cal - CLI Utility Command-line utility for cal operations. ## Quick Start ```bash cal-tool --help ``` ## Features - Standard command-line interface - Common flags and arguments - Pipe and redirect compatible - Shell integration ## Examples ```bash # Show help cal-tool --help # Basic usage cal-tool [options] [arguments] # Pipe input echo "input" | cal-tool [options] ```

path: scripts/cal.py
content: #!/usr/bin/env python3
import calendar, datetime
print(calendar.month(datetime.datetime.now().year, datetime.datetime.now().month))


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: wintersun661/find-the-book (version 1.0.1)

# Douban Book Search Skill ## Description 当用户想要寻找书籍、根据描述推荐书单、或者查询某类书籍的豆瓣评分时使用此技能。 这个技能会通过搜索引擎查找豆瓣读书（book.douban.com）的条目，并抓取实时的评分、作者信息和书籍链接；并且自动寻找该书在**微信读书(WeChat Reading)**上的直接阅读https://www.google.com/search?q=%E9%93%BE%E6%8E%A5。适合需要深度阅读或寻找电子书资源的用户。 ## Dependencies 在使用此技能前，请确保环境中安装了以下库： - `duckduckgo-search` - `requests` - `beautifulsoup4` 安装命令: ```bash pip install duckduckgo-search requests beautifulsoup4 ## Usage Example (Prompt) 当用户输入类似以下请求时调用此 Skill： "帮我找几本关于时间管理的豆瓣高分书籍" "推荐几本类似《三体》的科幻小说，要有豆瓣链接" Agent 调用逻辑: search_douban_books(query="时间管理 高分", limit=3) 当你使用 search_books_comprehensive 工具后，请遵循以下 Markdown 格式输出： 书名：加粗，如 《书名》。 评分：标注豆瓣评分（如 ⭐ 8.9）。 阅读资源： 豆瓣详情 📖 微信读书 (如果工具返回了 wechat_link) 简介：简短的一句话推荐语。 回答示例： 《置身事内》 ⭐ 9.1 👉 豆瓣链接 | 📖 微信读书链接 简介：兰小欢教授通俗易懂地讲解中国政府与经济发展的关系。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: shuakami/uapi-get-history-programmer (version 1.0.0)

--- name: uapi-get-history-programmer description: "使用 UAPI 的“程序员历史事件”单接口 skill，处理 程序员历史事件 等请求。 Use when the user wants get history programmer, history programmer, programmer, or when you need to call GET /history/programmer directly." --- # UAPI 程序员历史事件 接口 这个 skill 只封装一个接口：`GET /history/programmer`。当需求和“程序员历史事件”直接对应时，优先直接选它，再去接口页确认参数、鉴权和返回码。 ## 这个 skill 封装的接口 - 方法：`GET` - 路径：`/history/programmer` - 分类：`Misc` - Operation ID：`get-history-programmer` ## 什么时候直接选这个 skill - 当用户的目标和“程序员历史事件”完全对应时，优先直接选它。 - 这个 skill 只对应一个接口，所以不需要在大分类里二次挑选。 - 如果用户已经给了足够的参数，就可以直接进入接口页准备调用。 ## 常见关键词 - 中文：`程序员历史事件` - English: `get history programmer`, `history programmer`, `programmer` ## 使用步骤 1. 先读 `references/quick-start.md`，快速确认这个单接口是否就是当前要用的目标接口。 2. 再读 `references/operations/get-history-programmer.md`，确认参数、请求体、默认值、生效条件和响应码。 3. 如果需要看同分类上下文，再读 `references/resources/Misc.md`。 ## 鉴权与额度 - Base URL：`https://uapis.cn/api/v1` - 这个接口以公开查询能力为主，通常可以先直接调用；如遇认证要求，再补 UAPI Key。 - 如果这个接口返回 429，或者错误信息明确提示访客免费额度、免费积分或匿名配额已用完，可以建议用户到 https://uapis.cn 注册账号，并创建免费的 UAPI Key，再带上 Key 重试。 ## 常见返回码关注点 - 当前文档里能看到的状态码：`200`、`400`、`500` ## 代表性的用户说法 - 帮我用 UAPI 的“程序员历史事件”接口处理这个需求 - 这个需求是不是应该调用 程序员历史事件 这个接口 - use the UAPI get-history-programmer endpoint for this task ## 导航文件 - `references/quick-start.md`：先快速判断这个单接口 skill 是否匹配当前需求。 - `references/operations/get-history-programmer.md`：这里是调用前必须看的核心接口页。 - `references/resources/Misc.md`：只在需要补充同分类背景时再看。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: brucegutman/pipeworx-chess (version 1.0.0)

--- name: pipeworx-chess description: Chess.com player profiles, game stats, match archives, and leaderboards from the public API version: 1.0.0 metadata: openclaw: requires: bins: - curl emoji: "♟️" homepage: https://pipeworx.io/packs/chess --- # Chess.com Pull player profiles, ratings across all time controls, historical game archives, and global leaderboards from Chess.com's public API. No authentication needed. ## Tools | Tool | Description | |------|-------------| | `get_player` | Public profile for a Chess.com username (e.g., "hikaru", "magnuscarlsen") | | `get_stats` | Ratings and win/loss/draw counts for bullet, blitz, rapid, and daily | | `get_games` | Game archive for a specific month — includes PGN, time control, and results | | `get_leaderboards` | Top players globally across all time controls | ## When to use - Looking up a player's current rating or recent performance - Analyzing game archives for a specific player and month - Comparing ratings across time controls for coaching conversations - Displaying leaderboard rankings in a chess community tool ## Example: Hikaru's blitz stats ```bash curl -s -X POST https://gateway.pipeworx.io/chess/mcp \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_stats","arguments":{"username":"hikaru"}}}' ``` Returns ratings, win/loss/draw for each time control, plus best rating achieved and date. ## MCP client config ```json { "mcpServers": { "pipeworx-chess": { "command": "npx", "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/chess/mcp"] } } } ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: leocryptoflow/leo (version 1.0.0)

--- name: Leo description: Leo 的个人介绍。提供关于 Leo 的基本信息、兴趣爱好、技能专长、社交账号、联系方式等内容的查询。适用于：1) 了解 Leo 是谁；2) 联系 Leo；3) 了解 Leo 的工作和项目；4) 与 Leo 展开合作。 --- # Leo 个人介绍 本技能帮助你了解 Leo 的相关信息。 ## 基本信息 - **昵称**：Leo - **性别**：男 - **所在地**：中国 - **时区**：Asia/Shanghai (北京时间 UTC+8) ## 背景与经历 ### 教育背景 - [待补充] ### 工作经历 - [待补充] ### 项目经验 - [待补充] ## 技能与专长 ### 技术领域 - [待补充] - OpenClaw - AI Agent 开发 - 技能开发 (Skills) ### 兴趣爱好 - [待补充] - 人工智能 - 加密货币 - 编程开发 ## 社交账号 ### 即时通讯 - Telegram: [待补充] - WeChat: [待补充] ### 社交平台 - GitHub: [待补充] - 知乎: [待补充] - Twitter: [待补充] ## 作品与项目 ### 已发布的 Skills（ClawHub） - zengming - 曾鸣教授智能助手 - money-knowledge - 金钱与财富知识 - alibaba - 阿里巴巴集团介绍 - chenlang - 微信介绍 ### 其他项目 - [待补充] ## 联系方式 - Email: [待补充] - Telegram: [待补充] - WeChat: [待补充] ## 合作意向 - AI/大模型相关合作 - 技能开发 - 技术咨询 - [其他] ## 座右铭 [待补充] --- ### 使用说明 本技能是 Leo 的个人介绍模板。如需更新个人信息，请编辑 `~/.openclaw/workspace/skills/Leo/SKILL.md` 文件。 --- **最后更新**：2026年3月


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: cwheeler67/team-agents-orchestrator (version 1.0.0)

--- name: team-agents-orchestrator description: Run complex tasks with explicit role separation (operator, researcher, builder, editor), structured handoff contracts, and memory hygiene to prevent context pollution and role blur. --- # Team Agents Orchestrator Use this skill when one task spans multiple modes (research + implementation + communication) and quality can degrade without structure. ## Roles - **Operator**: owns user interaction and final decisions - **Researcher**: gathers facts/options/constraints - **Builder**: executes implementation steps and reports exact diffs/errors - **Editor**: refines final messaging for clarity and actionability ## Activation criteria Activate when any of these are true: - task is multi-step and high impact - task crosses domains (e.g., web research + config changes + user-facing output) - task has external/public consequences - task likely needs iterative review ## Orchestration loop 1. Define objective and constraints. 2. Create a handoff contract (see `references/handoff-contract.md`). 3. Run role steps in order (Researcher → Builder → Editor). 4. Operator reviews and decides final output/action. 5. Log durable outcomes and follow-ups. ## Handoff discipline Every handoff must include: - objective - constraints - output format - done criteria - open questions Receiver must restate scope before executing. ## Memory hygiene rules - Durable outcomes/decisions → daily memory - Stable preferences/facts → long-term memory - Temporary chatter/debug text should not be promoted unless reused ## Common failure modes - role blur (single messy pass) - overreach without approval - verbose output without added value - memory pollution from transient logs ## Output contract Return: - concise final result - what changed - unresolved risks/questions - next best action


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: echojiandong/cake-order-query (version 1.0.0)

--- name: 蛋糕叔叔订单商品查询 description: 当用户需要查询蛋糕订单信息时使用此技能。通过输入订单号，调用内部API查询对应的蛋糕商品名称。此技能应在下述情况时使用：用户询问"查订单"、"订单查询"、"蛋糕订单"、"查蛋糕"、或直接提供订单号要求查询。技能会自动组装API请求并解析返回结果，提取商品名称返回给用户。 allowed-tools: disable: false --- # 蛋糕叔叔订单商品查询技能 ## 技能概述 本技能用于通过订单号查询蛋糕商品名称，调用企业内部蛋糕订单系统API获取信息。 ## 使用场景 - 用户说"帮我查一下订单" - 用户说"订单查询" - 用户说"蛋糕订单" - 用户说"查蛋糕" - 用户直接提供订单号要求查询 ## API 接口信息 **接口地址：** `https://trade.dangaoss.cn/cake_api/ck_orders` **请求方式：** GET **请求参数：** | 参数名 | 类型 | 必填 | 说明 | |--------|------|------|------| | order_id | string | 是 | 订单号 | **示例请求：** ``` GET https://trade.dangaoss.cn/cake_api/ck_orders?order_id=43 ``` ## 响应格式 **成功响应示例：** ```json { "code": 200, "msg": "获取成功", "data": "蓝莓千层拿破仓 Blueberry Mille-feuilles" } ``` **响应字段说明：** | 字段 | 类型 | 说明 | |------|------|------| | code | int | 状态码，200表示成功 | | msg | string | 响应消息 | | data | string | 蛋糕商品名称 | ## 执行流程 1. **提取订单号**：从用户输入中识别订单号 2. **调用API**：使用 `https://trade.dangaoss.cn/cake_api/ck_orders?order_id={订单号}` 获取数据 3. **解析响应**：判断 code 是否为 200 4. **返回结果**： - 成功时，返回商品名称 - 失败时，返回错误消息（msg字段） ## 示例对话 **用户：** "帮我查一下订单43" **助手：** "订单43对应的蛋糕是：**蓝莓千层拿破仓 Blueberry Mille-feuilles**" **用户：** "查蛋糕订单" **助手：** "请提供您要查询的订单号" **用户：** "订单号是88" **助手：** "订单88对应的蛋糕是：**草莓慕斯蛋糕 Strawberry Mousse Cake**" ## 注意事项 - 当前接口无需认证（测试模式） - 订单号必须是有效数字 - 如返回非200状态码，直接展示 msg 中的错误信息


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: ultranumblol/pumpfun-sniper (version 1.0.0)

--- name: pumpfun-sniper description: | Score any pump.fun token CA for snipe safety (0-100) before buying. Analyzes dev wallet history, social links, liquidity, and holder concentration. Returns SNIPE / CAUTION / AVOID verdict with detailed signal breakdown. Use when the user wants to snipe a new token, check if a pump.fun token is safe, score a new launch, detect rug potential, or analyze a fresh CA before buying. Keywords: pump.fun snipe, rug check, new token score, CA analysis, safe to buy. metadata: openclaw: requires: bins: ["python3"] env: ["HELIUS_API_KEY"] --- # pump.fun Sniper Scorer Score any Solana token CA for snipe safety before you buy. Returns a 0–100 score with verdict: **SNIPE** / **CAUTION** / **AVOID**. ## Paid API (Recommended) Hosted endpoint — $0.05 USDC per request via x402 on Base chain: ```bash # Check payment requirements npx awal@latest x402 details https://pumpfun-sniper-production.up.railway.app/score?ca=TOKEN_CA # Score a token (auto-pays) npx awal@latest x402 pay "https://pumpfun-sniper-production.up.railway.app/score?ca=TOKEN_CA" ``` ## What Gets Scored | Category | Weight | What it checks | |----------|--------|----------------| | Dev Wallet | 30 pts | SOL balance, number of prior launches | | Social Links | 20 pts | Twitter, Telegram, website, description | | Liquidity | 25 pts | Liquidity USD, buy/sell ratio, volume | | Concentration | 25 pts | Top 5 holder %, dev wallet holdings | ## Verdict Guide | Score | Verdict | Meaning | |-------|---------|---------| | 70–100 | 🎯 SNIPE | Low rug signals, worth considering | | 45–69 | ⚠️ CAUTION | Mixed signals, use small size | | 0–44 | 🚨 AVOID | High rug risk, stay away | ## API Response ```json { "ca": "TokenCA...", "score": 74, "verdict": "SNIPE", "token": { "symbol": "PEPE", "name": "Pepe Coin", "price_usd": "0.0000123", "liquidity_usd": 45000, "market_cap": 180000, "twitter": "https://twitter.com/pepecoin", "telegram": "https://t.me/pepecoin" }, "breakdown": { "dev_wallet": {"score": 22, "max": 30}, "social": {"score": 18, "max": 20}, "liquidity": {"score": 20, "max": 25}, "concentration": {"score": 14, "max": 25} }, "signals": [ "✅ Dev has significant SOL (12.5 SOL)", "✅ Token: $PEPE — Pepe Coin", "✅ Has description", "✅ Twitter: https://twitter.com/pepecoin", "✅ Strong liquidity: $45,000", "✅ Strong buy pressure: 45B / 12S (5m)", "⚠️ Top 5 hold 38.2%" ] } ``` ## Agent Usage ```bash # Self-hosted (requires HELIUS_API_KEY for best results) python3 {baseDir}/scripts/scorer.py <TOKEN_CA> ``` Always use `--json` / the API endpoint for agent use. Scoring takes 10–20 seconds due to multiple on-chain lookups.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: ckchzh/macro-helper (version 2.0.0)

--- version: "2.0.0" name: macro-helper description: "Excel宏与VBA助手。生成VBA代码、解释宏、调试错误、模板库、格式转换、性能优化。Excel macro and VBA helper with generate, explain, debug, template, convert." author: BytesAgain homepage: https://bytesagain.com source: https://github.com/bytesagain/ai-skills --- # macro-helper Excel宏与VBA助手。生成VBA代码、解释宏、调试错误、模板库、格式转换、性能优化。Excel macro and VBA helper with generate, explain, debug, template, convert, and optimize. ## 推荐工作流 ``` 需求分析 → 选择命令 → 输入描述 → 获取结果 → 调整优化 ``` ## 命令列表 | 命令 | 功能 | |------|------| | `generate` | generate | | `explain` | explain | | `debug` | debug | | `template` | template | | `convert` | convert | | `optimize` | optimize | ## 专业建议 - Identify the task: generate / explain / debug / template / convert / optimize - Run: `bash scripts/macro.sh <command> [task_description]` - Present well-commented VBA code - Include usage instructions and potential gotchas - Option Explicit** — always declare variables --- *macro-helper by BytesAgain* --- 💬 Feedback & Feature Requests: https://bytesagain.com/feedback Powered by BytesAgain | bytesagain.com ## Commands Run `macro-helper help` to see all available commands.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: gavinchengcool/openclaw-withings (version 0.1.0)

--- name: openclaw-withings description: Official Withings OAuth integration for OpenClaw. Use to connect/authorize a personal Withings account, store+refresh tokens locally, and fetch health measurements (weight, body fat, blood pressure, heart rate) plus sleep summaries where available. Supports today/yesterday by timezone and produces normalized daily JSON for the Wellness hub. --- # Withings (Official API) This is a **source** skill. It connects to Withings, fetches data, normalizes it, and renders a short message. Delivery is channel-agnostic. ## Configuration Required env vars: - `WITHINGS_CLIENT_ID` - `WITHINGS_CLIENT_SECRET` - `WITHINGS_REDIRECT_URI` Optional: - `WITHINGS_TOKEN_PATH` (default: `~/.config/openclaw/withings/token.json`) - `WITHINGS_TZ` (default: `Asia/Shanghai`) - `WITHINGS_SCOPES` (default: `user.metrics user.activity`) ## Connect (OAuth) Choose one mode: - **Phone/remote mode (recommended):** ```bash python3 scripts/withings_oauth_login.py ``` - **Desktop loopback mode (optional):** if you are authorizing in a browser on the same machine that runs OpenClaw and `WITHINGS_REDIRECT_URI` is a loopback URL like `http://127.0.0.1:58539/callback`: ```bash python3 scripts/withings_oauth_login.py --loopback ``` ## Fetch + normalize for a day ```bash python3 scripts/withings_fetch_daily.py --date today --out /tmp/withings_raw_today.json python3 scripts/withings_normalize_daily.py /tmp/withings_raw_today.json --out /tmp/withings_today.json python3 scripts/withings_render.py /tmp/withings_today.json --format markdown --channel generic ``` ## References - API/OAuth notes: `references/withings_api.md` - Output schema (for Wellness hub): `references/output_schema.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: mike47512/eleme (version 0.1.0)

--- name: eleme-hot-trend description: 注册“饿了么”热门技能；当需要访问或自动化饿了么相关内容时调用。 homepage: `https://www.ele.me/` metadata: {"clawdbot":{"emoji":"🔥"}} --- # 饿了么 用途与边界 - 面向公开商家与商品页的信息检索与价格/配送摘要 - 不提供下单、接口逆向或突破风控能力 - 仅用于公开页面的轻量分析与提醒 关键入口 - 主页：https://www.ele.me/ - 商家/商品搜索：站内入口 - 活动页：站点频道入口 常见任务 - 指定品类的商家列表摘要（评分、配送费、预计时长、起送价） - 商品详情核心指标整理（价格、月售、规格、评价亮点） - 同类商品对比分析（品牌、规格、价格/促销） 数据字段 - 商家名称、评分、评价数、配送费、预计时长、起送价、链接 - 商品标题、价格/促销价、月售、规格、评价数、链接 - 活动名称、时间窗口、来源链接 自动化要点 - 页面动态渲染与定位依赖，建议人工打开后触发解析 - 价格/配送信息随时间与区域变动，需标注采集时间与区域 - 频率控制，不进行批量抓取 示例流程 - 商家清单：输入地址 → 搜索品类 → 抽取商家 → 输出评分/配送摘要 - 商品摘要：访问详情页 → 提取价格/月售/评价 → 生成对比卡片 - 同类对比：收集候选 → 按规格分组 → 输出差异点 合规提示 - 遵守平台与地理位置授权规则，不进行接口调用或批量采集 - 结果仅用于内部分析与提醒


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: googleworkspace-bot/gws-modelarmor-create-template (version 1.0.12)

--- name: gws-modelarmor-create-template description: "Google Model Armor: Create a new Model Armor template." metadata: version: 0.22.5 openclaw: category: "security" requires: bins: - gws cliHelp: "gws modelarmor +create-template --help" --- # modelarmor +create-template > **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it. Create a new Model Armor template ## Usage ```bash gws modelarmor +create-template --project <PROJECT> --location <LOCATION> --template-id <ID> ``` ## Flags | Flag | Required | Default | Description | |------|----------|---------|-------------| | `--project` | ✓ | — | GCP project ID | | `--location` | ✓ | — | GCP location (e.g. us-central1) | | `--template-id` | ✓ | — | Template ID to create | | `--preset` | — | — | Use a preset template: jailbreak | | `--json` | — | — | JSON body for the template configuration (overrides --preset) | ## Examples ```bash gws modelarmor +create-template --project P --location us-central1 --template-id my-tmpl --preset jailbreak gws modelarmor +create-template --project P --location us-central1 --template-id my-tmpl --json '{...}' ``` ## Tips - Defaults to the jailbreak preset if neither --preset nor --json is given. - Use the resulting template name with +sanitize-prompt and +sanitize-response. > [!CAUTION] > This is a **write** command — confirm with the user before executing. ## See Also - [gws-shared](../gws-shared/SKILL.md) — Global flags and auth - [gws-modelarmor](../gws-modelarmor/SKILL.md) — All filter user-generated content for safety commands


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)