OpenClaw/clawhub-security-signals huggingface dataset:
Skill: jeayoo/proactive-agent-lite-1-0-0-1-0-0 (version 1.0.0)

--- name: proactive-agent-lite description: Transform AI agents from task-followers into proactive partners with memory architecture, reverse prompting, and self-healing patterns. Lightweight version focused on core proactive capabilities. metadata: { "openclaw": { "requires": {}, "install": [] } } --- # Proactive Agent Lite Transform your AI agents from passive task-followers into proactive partners that anticipate needs and continuously improve. ## Core Features - **Memory Architecture**: Pre-compaction flush ensures context survives when window fills - **Reverse Prompting**: Surfaces ideas you didn't know to ask for - **Security Hardening**: Built-in security considerations and safe defaults - **Self-Healing Patterns**: Diagnoses and fixes its own issues automatically - **Alignment Systems**: Stays on mission and remembers who it serves ## Key Benefits ✅ **Anticipates Needs**: Proactively suggests solutions before you ask ✅ **Continuous Learning**: Improves from every interaction without explicit training ✅ **Mission-Focused**: Never loses sight of the core objective ✅ **Self-Maintaining**: Automatically recovers from errors and inconsistencies ✅ **Value Creation**: Generates insights and opportunities without being prompted ## Usage This skill enhances any OpenClaw agent by providing proactive behavior patterns. Simply install and the agent will automatically begin exhibiting proactive characteristics. ## Integration Works seamlessly with all OpenClaw agents and can be combined with other skills for enhanced functionality. ## Requirements - OpenClaw v1.0 or higher - Standard agent configuration ## Customization The proactive behavior can be tuned through configuration parameters to match your preferred level of initiative and communication style.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: zomgirprogrammer/searxng-web (version 1.0.0)

# searxng-web searxng-web exposes a single, minimal tool that proxies queries to a locally hosted searxng instance running at `http://host.docker.internal:8081/search?format=json&q=...` and returns normalized results. ## what it provides - tool: `searxng_search(query, count=5)` - runner: node script `searxng_search.js` - output: json `{ query, count, results: [{ title, url, snippet, source }] }` ## usage examples ### simple call input: ```json { "query": "zillow rentals", "count": 3 } docker exec -it openclaw sh -lc

path: searxng_search.js
content: const http = require("http");
const { URL } = require("url");
function readStdin(){return new Promise((res,rej)=>{let d="";process.stdin.setEncoding("utf8");process.stdin.on("data",c=>d+=c);process.stdin.on("end",()=>res(d));process.stdin.on("error",rej);});}
function getJson(url){return new Promise((res,rej)=>{http.get(url, r=>{let d="";r.setEncoding("utf8");r.on("data",c=>d+=c);r.on("end",()=>{if(r.statusCode&&r.statusCode>=400)return rej(new Error(`http ${r.statusCode}: ${d.slice(0,300)}`));try{res(JSON.parse(d));}catch(e){rej(new Error(`invalid json: ${e.message}. body=${d.slice(0,300)}`));}});}).on("error",rej);});}
(async()=>{try{const raw=await readStdin();const args=raw?JSON.parse(raw):{};const query=String(args.query||"").trim();const count=Math.max(1,Math.min(10,Number(args.count||5)));if(!query){console.log(JSON.stringify({error:"missing_query"}));process.exit(0);}const u=new URL("http://host.docker.internal:8081/search");u.searchParams.set("q",query);u.searchParams.set("format","json");const j=await getJson(u.toString());const results=Array.isArray(j.results)?j.results.slice(0,count).map(r=>({title:r.title||"",url:r.url||"",snippet:r.content||r.snippet||"",source:"searxng"})):[];process.stdout.write(JSON.stringify({query,count,results},null,2));}catch(e){process.stdout.write(JSON.stringify({error:"searxng_search_failed",message:e.message}));process.exit(0);}})();


path: skill.json
content: {
  "schemaVersion": 1,
  "name": "searxng-web",
  "description": "web search via local searxng (no brave api key). provides searxng_search(query, count).",
  "tools": [
    {
      "name": "searxng_search",
      "description": "search the web via local searxng and return normalized results.",
      "inputSchema": {
        "type": "object",
        "properties": {
          "query": { "type": "string" },
          "count": { "type": "integer", "default": 5, "minimum": 1, "maximum": 10 }
        },
        "required": ["query"]
      },
      "runner": { "type": "node", "entrypoint": "searxng_search.js" }
    }
  ]
}


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: edwardrodriguez703-design/book-music-lessons (version 1.0.1)

--- name: book-music-lessons description: Book music-lessons services through Lokuli MCP. Use when user needs to find and book music-lessons. Triggers on requests like "book a music-lessons", "find music-lessons near me", or any music-lessons service request. --- # uook music lessons Book music-lessons services through Lokuli's MCP server. ## MCP Endpoint ``` https://lokuli.com/mcp/sse ``` Transport: SSE | JSON-RPC 2.0 | POST requests ## Tools ### search ```json { "method": "tools/call", "params": { "name": "search", "arguments": { "query": "music-lessons", "zipCode": "90640", "maxResults": 20 } } } ``` ### check_availability ```json { "method": "tools/call", "params": { "name": "check_availability", "arguments": { "providerId": "xxx", "serviceId": "yyy", "date": "2025-02-10" } } } ``` ### create_booking ```json { "method": "tools/call", "params": { "name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "[REDACTED_SECRET]", "customerPhone": "+13105551234" } } } ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: stanlee000/norman-tax-deduction-finder (version 1.0.0)

--- name: tax-deduction-finder description: Scan transactions for potentially missed tax deductions and suggest proper categorization. Use when the user asks about saving taxes, Steueroptimierung, deductible expenses, Betriebsausgaben, or wants to check if they are missing any write-offs. version: 1.0.0 argument-hint: "[period, e.g. 2025 or Q4 2025]" metadata: openclaw: emoji: "\U0001F50D" homepage: https://norman.finance requires: mcp: - norman-finance --- Help the user find missed tax deductions by analyzing their transactions: ## Step 1: Gather data - Call `search_transactions` for the specified period (default: current year) - Call `get_company_details` to understand the business type - Call `list_tax_settings` to check VAT status and tax regime ## Step 2: Scan for common deductions Review each transaction and flag potential deductions that may be miscategorized or unverified. Look for these common German freelancer/small business deductions: **Home office (Arbeitszimmer):** - Rent, electricity, internet, heating proportional to office space - Office furniture, equipment, monitors, desks **Technology & software:** - SaaS subscriptions (Adobe, Google Workspace, Slack, hosting) - Computer hardware (fully deductible if under 1000 EUR net, otherwise depreciated) - Phone and mobile plans (business portion) **Travel & transportation (Reisekosten):** - Public transport, fuel, car maintenance - Hotels for business trips - Meals during business travel (Verpflegungspauschale: 14 EUR/28 EUR per day) **Professional development:** - Courses, certifications, books, conferences - Professional memberships and associations **Insurance & financial:** - Professional liability insurance (Berufshaftpflicht) - Business bank account fees - Tax advisor fees (Steuerberater) **Marketing & client acquisition:** - Advertising, domain names, hosting - Business cards, printed materials - Client gifts (up to 35 EUR per person per year) ## Step 3: Suggest corrections For each potentially missed deduction: - Show the transaction: date, amount, description, current category - Suggest the correct SKR04 category - Explain why it qualifies as a deduction - Use `categorize_transaction` to recategorize if the user confirms ## Step 4: Estimate impact Present a summary: - Number of transactions reviewed - Number of potential missed deductions found - Estimated additional deductible amount (EUR) - Approximate tax savings (rough estimate using ~30-42% marginal rate for Einkommensteuer + Soli) Tips: - Items under 1000 EUR net (GWG - Geringwertige Wirtschaftsgüter) can be fully deducted in the purchase year - Items over 1000 EUR must be depreciated over their useful life (AfA) - Mixed-use items (e.g., phone) should only claim the business portion - Keep receipts for all deductions - suggest attaching any missing ones


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ansonlianson/douyin-video-downloader (version 1.0.1)

--- name: douyin-video-downloader version: 1.0.1 description: 抖音视频下载工具 - 通过第三方解析服务实现无水印视频下载 tags: [douyin, video, download, china] --- # douyin-video-downloader 抖音视频下载工具 - 通过第三方解析服务实现无水印视频下载 ## 背景 由于抖音反爬机制严格，直接使用 yt-dlp 等工具需要有效的登录 Cookie。本技能使用第三方在线解析服务绕过这一限制。 ## 下载步骤 ### 方法：通过在线解析 1. **打开解析网站** ``` https://douyin.iiilab.com/ ``` 2. **输入视频链接** - 在输入框粘贴抖音视频 URL，例如： ``` https://www.douyin.com/video/123456789 ``` 3. **点击解析** - 点击"提取视频图片"按钮 4. **获取无水印下载链接** - 解析成功后，点击"下载视频"链接 - 或右键"链接另存为" ### 自动化脚本方法 ```bash # 使用 curl 直接下载（需要先通过浏览器获取视频下载地址） curl -L "视频下载地址" -o "输出文件名.mp4" ``` ## 技术原理 1. 使用第三方解析服务，通过模拟用户访问获取视频源 2. 解析后会返回无水印的视频 CDN 地址 3. 视频地址通常在 douyinvod.com 域名下 ## 失败原因 | 原因 | 说明 | |------|------| | 登录状态限制 | 部分视频需要登录用户才能访问 | | URL 时效性 | 视频下载链接有时效性（通常几分钟到几小时） | | IP 限制 | 频繁请求可能被临时封禁 IP | ## 解决方案 ### 方案1：手动下载 在抖音 App 或网页端手动点击"分享 → 保存到本地" ### 方案2：更换解析服务 尝试其他解析服务： - https://snapany.com/ - https://www.tikmate.online/ ### 方案3：使用已登录的浏览器 通过浏览器自动化，使用已登录抖音的浏览器 Cookie ## 相关工具 - yt-dlp - 通用视频下载工具（需要有效 Cookie） - gallery-dl - 图片/视频下载工具 - you-get - 视频下载工具


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: senmud/aicc-security-guard (version 0.1.0)

--- name: aicc-security-guard display_name: AICC 安全守卫 description: "Ensure the AICC native plugin is active before handling confidential data." version: 0.1.0 tags: - security - aicc - openclaw --- # AICC 安全守卫 ## 目标 在处理任何机密/敏感数据之前，先确认 `openclaw-aicc-plugin-native`（AICC 原生插件）已安装并处于启用状态；否则拒绝继续处理，并引导用户完成安装。 ## 运行规则（给 Agent） 1. **先检查再处理**：在读取、生成、传输、存储任何机密/敏感信息之前，必须先完成插件检查。 2. **检查失败即中止**：如果无法确认插件已启用，则不要继续处理机密数据。 3. **给出明确修复指令**：当插件缺失或未启用时，提示用户运行： `openclaw plugins install openclaw-aicc-plugin-native` ## 检查方法（建议） 优先采用可验证的方式： - 方式 A：让用户在本机执行 `openclaw plugins list`，确认列表中存在 `openclaw-aicc-plugin-native`，且状态为已启用（如有状态字段）。 - 方式 B：如果用户无法运行命令，要求用户明确回答是否已安装并启用该插件；若仍不确定，按“缺失”处理并引导安装。 ## 缺失时的标准提示词 为保证机密数据只通过 AICC 机密推理链路处理，我需要先确认你已启用 AICC 原生插件。 检测到插件未安装/未启用（或无法确认）。请先运行以下命令完成安装，然后再继续： `openclaw plugins install openclaw-aicc-plugin-native`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: slk1061569042-lab/notify-bot (version 1.0.0)

# notify-bot 向指定 Telegram bot 发送任务通知，激活其群组 session。 ## 用法 ```bash notify_bot.sh <bot_name|bot1,bot2> <group_id> <topic_id> <message> ``` ## 示例 ```bash # 通知单个 bot notify_bot.sh imagebot -1003870994840 11 "生成32x32宝箱图标" # 通知多个 bot notify_bot.sh "imagebot,godot,cursor" -1003870994840 3 "任务通知" ``` ## 工作流程 1. **notify_bot.sh** 发消息到指定群组/话题 → 激活 bot 的 session 2. **sessions_send** 给激活的 session 发指令 → bot 执行任务 ## 注意事项 - Bot token 从 keychain 读取（`openclaw.telegram.<bot_name>.bot_token`） - vision bot 的 key 是 `openclaw.telegram.vision.token` - 消息发送后不会删除，直接留在群里 - 适用于需要精确控制哪些 bot 被通知的场景 ## 脚本位置 `~/.openclaw/shared/notify_bot.sh`


Security scan verdicts — ClawScan: clean | static analysis:  | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: teoslayer/pilot-email-bridge (version 1.0.0)

--- name: pilot-email-bridge description: > Send and receive emails via Pilot Protocol messaging. Use this skill when: 1. You need to send email notifications from Pilot agents 2. You want to receive emails as Pilot events 3. You're integrating agents with email-based workflows Do NOT use this skill when: - You need real-time messaging (use native Pilot instead) - Email server is not configured - The daemon is not running tags: - pilot-protocol - integration - email - bridge - notifications license: AGPL-3.0 compatibility: > Requires pilot-protocol skill and pilotctl binary on PATH. The daemon must be running (pilotctl daemon start). metadata: author: vulture-labs version: "1.0" openclaw: requires: bins: - pilotctl homepage: https://pilotprotocol.network allowed-tools: - Bash --- # pilot-email-bridge Send and receive emails via Pilot Protocol messaging using external SMTP/IMAP tools with Pilot webhooks. ## Commands ### Configure Outbound Webhook ```bash pilotctl --json set-webhook https://smtp-relay.example.com/send ``` ### Send Email via Webhook ```bash pilotctl --json publish localhost email-outbound --data '{"to":"[REDACTED_SECRET]","subject":"Alert","body":"Status OK"}' ``` ### Check Inbox ```bash pilotctl --json inbox pilotctl --json inbox --clear ``` ### Receive Messages ```bash pilotctl --json recv 1004 --count 10 ``` ### Send File Attachment ```bash pilotctl --json send-file email-relay /path/to/report.pdf ``` ## Workflow Example ```bash #!/bin/bash # SMTP relay setup pilotctl --json daemon start --hostname email-relay pilotctl --json set-webhook http://localhost:8025/smtp pilotctl --json subscribe localhost email-outbound # Start external SMTP relay server python3 smtp_relay_server.py & # Publish email pilotctl --json publish localhost email-outbound --data '{ "to":"[REDACTED_SECRET]", "subject":"Report", "body":"All systems operational" }' ``` ## Dependencies Requires pilot-protocol skill, running daemon, SMTP server, and email credentials.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: mes28io/bulk-tiktok-downloader-skill (version 0.1.0)

--- name: bulk-tiktok-downloader description: Bulk download TikTok videos from a text file of URLs using yt-dlp. Use when a user asks to download many TikTok videos at once, process a URL list file, or save TikTok videos to a specific folder from local terminal. --- # bulk TikTok downloader Use this skill to run a local bulk TikTok downloader safely and reproducibly. ## Safety + legality - Download only content you are authorized to download. - Respect platform Terms of Service, local copyright rules, and user privacy. - Do not bypass paywalls or private/protected content. ## Inputs - URL list file (one URL per line) - Optional output directory Lines starting with `#` are comments and ignored. ## Setup From workspace root: ```bash python3 -m pip install --user -r skills/bulk-tiktok-downloader/scripts/requirements.txt ``` ## Run Default (uses `urls.txt` next to script and `downloads/` output): ```bash python3 skills/bulk-tiktok-downloader/scripts/downloader.py ``` Custom URL file: ```bash python3 skills/bulk-tiktok-downloader/scripts/downloader.py my_urls.txt ``` Custom URL file + output directory: ```bash python3 skills/bulk-tiktok-downloader/scripts/downloader.py my_urls.txt my_downloads ``` ## Recommended workflow 1. Validate URL list file exists and is non-empty. 2. Run downloader. 3. Report successful vs failed counts. 4. Surface failed URLs and likely reason (private/deleted/region restricted/rate limit). ## Troubleshooting - `No module named yt_dlp` → install requirements. - `File not found` → verify URL file path. - Frequent failures/rate limit → reduce batch size and retry later. ## Upstream reference See: - `skills/bulk-tiktok-downloader/references/upstream-readme.md`

path: scripts/requirements.txt
content: yt-dlp>=2024.1.1


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: xueyetianya/slot (version 2.0.3)

--- name: "Slot — Time Slot & Schedule Block Manager" description: "Use when managing time slots, creating schedule blocks, detecting booking conflicts, exporting calendars, or applying scheduling templates for appointments." version: "2.0.3" author: "BytesAgain" homepage: https://bytesagain.com source: https://github.com/bytesagain/ai-skills tags: ["slot", "schedule", "calendar", "time-management", "booking", "planner"] --- # Slot — Time Slot & Schedule Block Manager Create, query, and manage time slots and schedule blocks. Detect conflicts, export to standard calendar formats, and apply reusable templates. ## Commands ### create Create a new time slot with date, start/end time, and label. ```bash bash scripts/script.sh create "2024-03-15" "09:00" "10:30" "Team Standup" ``` ### list List all scheduled slots, optionally filtered by date range. ```bash bash scripts/script.sh list bash scripts/script.sh list "2024-03-15" "2024-03-22" ``` ### check-conflict Check if a proposed time slot conflicts with existing bookings. ```bash bash scripts/script.sh check-conflict "2024-03-15" "09:30" "10:00" ``` ### export Export slots to iCal (.ics) or CSV format. ```bash bash scripts/script.sh export ics bash scripts/script.sh export csv ``` ### templates Show or apply common scheduling templates (work day, pomodoro, etc.). ```bash bash scripts/script.sh templates bash scripts/script.sh templates pomodoro ``` ### help Show all commands. ```bash bash scripts/script.sh help ``` ## Output - Slot listings with conflict indicators - iCal and CSV exports - Template-based batch slot creation ## Feedback https://bytesagain.com/feedback/ Powered by BytesAgain | bytesagain.com


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: rahulgi/github-image-hosting (version 1.0.0)

--- name: github-image-hosting description: > Upload images to img402.dev for embedding in GitHub PRs, issues, and comments. Images under 1MB are uploaded free (no payment, no auth) and persist for 7 days. Use when the agent needs to share an image in a GitHub context — screenshots, mockups, diagrams, or any visual. Triggers: "screenshot this", "attach an image", "add a screenshot to the PR", "upload this mockup", or any task producing an image for GitHub. metadata: openclaw: requires: bins: - curl - gh --- # Image Upload for GitHub Upload an image to img402.dev's free tier and embed the returned URL in GitHub markdown. ## Quick reference ```bash # Upload (multipart) curl -s -X POST https://img402.dev/api/free -F image=@/tmp/screenshot.png # Response # {"url":"https://i.img402.dev/aBcDeFgHiJ.png","id":"aBcDeFgHiJ","contentType":"image/png","sizeBytes":182400,"expiresAt":"2026-02-17T..."} ``` ## Workflow 1. **Get image**: Use an existing file, or capture a screenshot: ```bash screencapture -x /tmp/screenshot.png # macOS — full screen screencapture -xw /tmp/screenshot.png # macOS — frontmost window ``` 2. **Verify size**: Must be under 1MB. If larger, resize: ```bash sips -Z 1600 /tmp/screenshot.png # macOS — scale longest edge to 1600px ``` 3. **Upload**: ```bash curl -s -X POST https://img402.dev/api/free -F image=@/tmp/screenshot.png ``` 4. **Embed** the returned `url` in GitHub markdown: ```markdown ![Screenshot description](https://i.img402.dev/aBcDeFgHiJ.png) ``` ## GitHub integration Use `gh` CLI to embed images in PRs and issues: ```bash # Add to PR description gh pr edit --body "$(gh pr view --json body -q .body) ![Screenshot](https://i.img402.dev/aBcDeFgHiJ.png)" # Add as PR comment gh pr comment --body "![Screenshot](https://i.img402.dev/aBcDeFgHiJ.png)" # Add to issue gh issue comment 123 --body "![Screenshot](https://i.img402.dev/aBcDeFgHiJ.png)" ``` ## Constraints - **Max size**: 1MB - **Retention**: 7 days — suitable for PR reviews, not permanent docs - **Formats**: PNG, JPEG, GIF, WebP - **Rate limit**: 1,000 free uploads/day (global) - **No auth required** ## Tips - Prefer PNG for UI screenshots (sharp text). Use JPEG for photos. - If a screenshot is too large, reduce dimensions with `sips -Z 1600` before uploading. - When adding to a PR body or comment, use `gh pr comment` or `gh pr edit` with the image markdown. ## Paid tier For permanent images (1 year, 5MB max), use the paid endpoint at $0.01 USDC via x402. See https://img402.dev/blog/paying-x402-apis for details.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: z65919/shangou-bonus (version 1.0.2)

--- name: taobao-shangou description: "查询淘宝闪购每日隐藏的大额福利优惠券和红包。包含通用红包、超市红包、夜宵红包、买药红包、零食红包、学生专享等。无需扫码，无需复制口令，搜索专用口令词即可获得隐藏各类福利活动，安全便捷，通过API获取当日最新活动。" --- # 淘宝闪购每日福利查询 ## 概述 查询淘宝闪购平台每日更新的福利活动信息，包括各类优惠券、红包、免单活动等。数据来源于聚满减API接口，每日更新。 ## 使用流程 ### 1. 获取数据 ```bash python scripts/fetch_shangou.py ``` ### 2. 返回结果格式 ``` 📅 更新日期：YYYY-MM-DD === 淘宝闪购今日福利 === 【活动标题】 🔍 搜索口令：XXXX 📝 简介：描述内容 📖 详细说明：完整操作步骤 ``` ### 3. 使用说明（必须展示给用户） > 🎯 **使用方式：** > 1. 打开手机淘宝 APP > 2. 点击顶部「闪购」入口 > 3. 在搜索框输入指定的口令/数字 > 4. 点击搜索即可领取福利 > 5. 您可以告诉我 每天定时11点 提醒您 领取订餐红包 订餐哦 ## API 数据结构 | 字段 | 说明 | |------|------| | `updateDate` | 数据更新日期 | | `couponList[].title` | 活动名称 | | `couponList[].desc` | 领取方式描述 | | `couponList[].tip` | 详细操作说明 | ## 常见活动类型 - **通用红包** - 每日11点起可领28-12元订餐红包 - **超市红包** - 10元果蔬商超红包 - **夜宵红包** - 5折超大红包，20点生效 - **买药红包** - 8元起买药抵扣 - **零食红包** - 59-32元零售红包 - **学生专享** - 免费超级吃货卡+免单奶茶 ## 脚本依赖 - Python 3.x - 标准库 urllib（无需额外安装）


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)