OpenClaw/clawhub-security-signals huggingface dataset:
Skill: donnycui/bilibili-youtube-watcher (version 1.0.0)

--- name: video-watcher description: Fetch and read transcripts from YouTube and Bilibili videos. Use when you need to summarize a video, answer questions about its content, or extract information from it. author: adapted from youtube-watcher version: 1.1.0 triggers: - "watch video" - "summarize video" - "video transcript" - "youtube summary" - "bilibili summary" - "analyze video" metadata: {"clawdbot":{"emoji":"📺","requires":{"bins":["yt-dlp"]},"install":[{"id":"brew","kind":"brew","formula":"yt-dlp","bins":["yt-dlp"],"label":"Install yt-dlp (brew)"},{"id":"pip","kind":"pip","package":"yt-dlp","bins":["yt-dlp"],"label":"Install yt-dlp (pip)"}]}} --- # Video Watcher Fetch transcripts from **YouTube** and **Bilibili** videos to enable summarization, QA, and content extraction. ## Supported Platforms - ✅ **YouTube** (youtube.com, youtu.be) - ✅ **Bilibili** (bilibili.com, b23.tv) ## Usage ### Get Transcript (Auto-detect Platform) ```bash python3 {baseDir}/scripts/get_transcript.py "VIDEO_URL" ``` ### Specify Language ```bash python3 {baseDir}/scripts/get_transcript.py "VIDEO_URL" --lang zh-CN ``` ## Examples ### YouTube Video ```bash python3 {baseDir}/scripts/get_transcript.py "https://www.youtube.com/watch?v=dQw4w9WgXcQ" ``` ### Bilibili Video ```bash python3 {baseDir}/scripts/get_transcript.py "https://www.bilibili.com/video/BV1xx411c7mD" ``` ### With Custom Language ```bash # Get English subtitles for a Bilibili video python3 {baseDir}/scripts/get_transcript.py "https://bilibili.com/video/..." --lang en # Get Chinese subtitles for a YouTube video python3 {baseDir}/scripts/get_transcript.py "https://youtube.com/watch?v=..." --lang zh-CN ``` ## Default Languages | Platform | Default Language | |----------|-----------------| | YouTube | `en` (English) | | Bilibili | `zh-CN` (Chinese) | ## Common Language Codes - `en` - English - `zh-CN` - Simplified Chinese (简体中文) - `zh-TW` - Traditional Chinese (繁體中文) - `ja` - Japanese - `ko` - Korean - `es` - Spanish - `fr` - French - `de` - German ## Notes - Requires `yt-dlp` to be installed and available in PATH - Works with videos that have closed captions (CC) or auto-generated subtitles - Automatically detects platform from URL - If no subtitles available, the script will fail with an error message - yt-dlp natively supports both YouTube and Bilibili


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: kostja94/disclosure-page-generator (version 1.0.1)

--- name: disclosure-page-generator description: When the user wants to create, optimize, or audit an affiliate, sponsor, or paid partnership disclosure page. Also use when the user mentions "disclosure," "affiliate disclosure," "sponsored content," "FTC disclosure," or "paid partnership." For sitewide page planning, use website-structure. metadata: version: 1.0.1 --- # Pages: Disclosure Guides disclosure pages for affiliate links, sponsored content, and paid partnerships. Required for FTC compliance (US) and similar regulations. Builds trust and reduces legal risk. **When invoking**: On **first use**, if helpful, open with 1–2 sentences on what this skill covers and why it matters, then provide the main output. On **subsequent use** or when the user asks to skip, go directly to the main output. ## Initial Assessment **Check for project context first:** If `.claude/project-context.md` or `.cursor/project-context.md` exists, read it for affiliate/partnership model. Identify: 1. **Type**: Affiliate, sponsored, paid partnership, referral 2. **Scope**: Site-wide, specific pages, or both 3. **Regions**: US (FTC), EU, other 4. **Placement**: Standalone page; link from footer, near affiliate content ## Page Structure | Section | Purpose | |---------|---------| | **Headline** | "Disclosure" or "Affiliate Disclosure" | | **Summary** | We may earn from qualifying purchases; links may be affiliate | | **Details** | How it works; what we recommend; no extra cost to you | | **Transparency** | We only recommend products we believe in | | **Contact** | Questions; link to contact | ## Best Practices ### FTC Compliance (US) - **Clear and conspicuous**: Not buried; visible near affiliate content - **Before the click**: Disclosure before user clicks affiliate link - **Plain language**: "We may earn a commission" not legalese ### Placement - **Footer link**: "Disclosure" in every page footer - **Near content**: Short disclosure above/below affiliate sections - **Standalone page**: Full disclosure at /disclosure ### Content - **Honest**: Explain relationship; no misleading claims - **Concise**: One page; avoid excessive length - **Update**: When model changes ## Output Format - **Headline** and summary - **Full disclosure** copy - **Placement** guidance (footer, in-content) - **Legal** note (consult lawyer for jurisdiction) ## Related Skills - **affiliate-page-generator**: Affiliate program page; link to disclosure - **terms-page-generator**: Terms may reference disclosure - **privacy-page-generator**: Privacy for data; disclosure for commercial - **landing-page-generator**: Disclosure near affiliate LPs


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: brucegutman/pipeworx-openalex (version 1.0.0)

--- name: pipeworx-openalex description: OpenAlex MCP — wraps the OpenAlex API (scholarly works, free, no auth) version: 1.0.0 metadata: openclaw: homepage: https://pipeworx.io/packs/openalex --- # pipeworx-openalex OpenAlex MCP — wraps the OpenAlex API (scholarly works, free, no auth). Free, no API key. Part of [Pipeworx](https://pipeworx.io). ## Tools - `search_works` - `search_authors` - `search_institutions` - `get_concept` ## Connect ```json { "mcpServers": { "pipeworx-openalex": { "command": "npx", "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/openalex/mcp"] } } } ``` More at [pipeworx.io/packs/openalex](https://pipeworx.io/packs/openalex)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: davidslavich/gtm-meeting-prep (version 1.0.0)

--- name: gtm-meeting-prep description: > Prepare a seller or growth rep for an upcoming sales or partnership meeting. Produces a pre-meeting brief with account context, attendee research, discovery questions, and a recommended conversation arc. Use when a user has a call, demo, or intro meeting scheduled. Triggers: "prep me for my call with X," "I have a meeting with [company] tomorrow," "what should I ask [title] at [company]," or when a calendar invite or attendee list is provided. license: MIT compatibility: Requires web search access for attendee and account research. metadata: author: iCustomer version: "1.0.0" website: https://icustomer.ai --- # GTM Meeting Prep Produce a pre-meeting brief. Tailor everything to the specific company, attendees, and meeting type — no generic output. ## Steps 1. **Identify meeting type** — Cold Intro, Demo, POC Kick-off, Proposal, Partnership, or QBR. Each has a different focus and tone. 2. **Account context** — pull key facts: business model, size, stack, recent news. Reuse an existing account brief if one was run via `gtm-account-research`. 3. **Attendee research** — for each attendee: title, seniority, LinkedIn activity, tenure, likely priorities based on role. Flag any warm path (mutual connection, partner network, prior engagement). 4. **Discovery questions** — generate 5 prioritized questions. Default stack: open → current state → pain → success criteria → decision process. Tailor to title (technical evaluator ≠ economic buyer ≠ end user). 5. **Landmines** — flag topics to avoid: internal builds they're proud of, recent org changes, competitors to not name-drop without reason. 6. **Narrative arc** — recommend a 4-act flow: Open (5min) → Discover (15–20min) → Show (10–15min) → Close (5min). Define the meeting "win" — rarely "close the deal" for a first call. ## Output ``` # Meeting Brief: [Company] — [Meeting Type] | [Date] Account: [3-sentence snapshot] Segment: [ICP segment] | Product angle: [what you're positioning] Stack: [Relevant tools] Signals: [1–2 buying signals with dates] Attendees: [Name · Title · Key priority · Warm path if any] Landmines: [What to avoid] Narrative Arc: Open → [agenda, rapport] → Discover → [top 3 areas] → Show → [what to demo] → Close → [ask] Top 5 Discovery Questions: 1. 2. 3. 4. 5. Meeting Win: [What "success" looks like for this specific call] Proposed Next Step: [Specific ask to close the meeting] ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: p697/clawket (version 1.0.1)

--- name: clawket description: >- Generate QR codes for Clawket mobile app to pair with the local OpenClaw Gateway. Use when user mentions: Clawket pairing, login Clawket, QR code, mobile app connection, connect phone to Gateway, or scan to login. --- # Clawket Gateway QR Code Generate a QR code that the Clawket mobile app can scan to auto-configure Gateway connection (URL + auth token). ## Generate QR Code Run the script: ```bash bash SKILL_DIR/scripts/gateway-qr.sh ``` The script will: 1. Read `~/.openclaw/openclaw.json` for the auth token 2. Detect the local LAN IP address 3. Generate a QR code as a PNG image at `~/.openclaw/media/clawket-qr.png` 4. Also print an ASCII QR code to the terminal Send the PNG to the user via the `message` tool (`filePath: ~/.openclaw/media/clawket-qr.png`). ## QR Payload Format The QR code contains a JSON object: ```json { "host": "192.168.1.100", "port": 18789, "token": "...", "tls": false } ``` The Clawket app scans this and auto-fills Gateway URL + auth token, then connects. ## Troubleshooting - If `qrencode` is not installed: `brew install qrencode` (macOS) / `sudo apt install qrencode` (Linux) / `choco install qrencode` (Windows) - If the LAN IP detection fails, the script falls back to `127.0.0.1` - The token is read directly from the JSON config file (not via `openclaw config get` which redacts it)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: duzhihai123/ai-planner (version 1.0.0)

--- skill: name: "🧠 AI 策划师" version: "1.0.0" description: "电商图片创作团队的大脑，负责需求分析、创意构思、Prompt 优化" author: "AI Image Team" tags: ["ai", "image", "planner", "ecommerce", "design"] category: "image-generation" # CoClaw 集成配置 coclaw: visible: true display_name: "🧠 AI 策划师" icon: "brain" order: 1 # 能力声明 capabilities: - "需求深度分析" - "创意简报生成" - "Prompt 优化" - "工具推荐" - "电商场景识别" # 输入输出 input: type: "text" language: "zh-CN" format: "自然语言需求描述" output: type: "json" format: "创意简报" fields: - "prompt: 精准中文 Prompt" - "negative_prompt: 负面提示词" - "recommended_tool: 推荐工具" - "quantity: 建议生成数量" # 依赖 dependencies: [] # 配置 config: default_language: "zh-CN" auto_ask_clarification: true quality_threshold: 0.6 --- # 🧠 AI 策划师技能 ## 技能概述 电商图片创作团队的**大脑**，负责需求深度分析、创意构思、风格定位、Prompt 优化。 ## 职责 - 需求深度分析（产品类型、使用场景、目标人群、风格偏好） - 创意构思与风格定位 - Prompt 优化（精准中文 Prompt + 负面提示词） - 推荐工具选择（即梦/LiblibAI） - 建议生成数量 ## 输出 **创意简报**，包含： - 精准中文 Prompt - 负面提示词 - 推荐工具 - 建议生成数量 - 电商场景要点 ## 电商能力 - 识别产品类型（服装/食品/数码/美妆/家居） - 识别使用场景（主图/详情页/海报/社交媒体） - 识别目标人群 - 匹配平台规范（淘宝/京东/抖音/微信） ## 使用方法 ### 在 CoClaw 中使用 ``` /ai-planner 帮我分析这个需求：我需要一张淘宝主图，产品是女士连衣裙，白色雪纺材质，风格简约优雅 ``` ### 自然语言 ``` 帮我分析这个需求：我需要一张淘宝主图，产品是女士连衣裙 ``` ## 协作 策划师输出的创意简报可传递给： - 🎭 `ai-maker` - 执行图片生成 - ✅ `ai-reviewer` - 后续质量把关 ## 配置 编辑 `config/planner_config.json` 自定义： - 产品类型规则 - 平台规范 - Prompt 模板 ## 文件结构 ``` skills/ai-planner/ ├── SKILL.md # 技能说明（本文件） ├── agent.py # 策划师核心逻辑 ├── config/ │ ├── planner_config.json # 策划师配置 │ └── ecommerce_rules.json # 电商规则库 └── memory/ └── brief_history.md # 创意简报历史 ``` ## 示例 ### 输入 ``` 我需要一张淘宝主图，产品是女士连衣裙，白色雪纺材质，风格简约优雅，目标人群是 25-35 岁职场女性 ``` ### 输出 ```json { "type": "brief", "product_info": { "type": "服装", "name": "女士连衣裙", "scenario": "主图", "platform": "淘宝" }, "creative_brief": { "prompt": "女士连衣裙，白色雪纺材质，风格简约优雅，产品主体突出，背景干净简洁", "negative_prompt": "模糊，变形，低质量，背景杂乱", "recommended_tool": "liblib", "quantity": 2 } } ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: zlszhonglongshen/docker-ci-release-pipeline (version 1.0.0)

--- name: docker-ci-release-pipeline description: Docker镜像构建测试与GitHub Actions发布全链路流水线，自动构建、测试、安全扫描并推送至镜像仓库 category: 开发 triggers: Docker构建, 镜像发布, CI/CD, 容器化部署, GitHub Actions --- # Docker CI Release Pipeline 自动化 Docker 镜像构建、测试、安全扫描与发布全链路流水线。 ## 业务场景 开发团队需要将应用容器化并通过 GitHub Actions 自动发布到镜像仓库。传统做法需要手动编写 Dockerfile、优化构建、配置 CI、设置安全扫描，流程割裂且容易出错。 本 Combo 编排 docker-expert、github-actions-templates、testing-patterns、github 四个 Skill，一次性完成从镜像优化到自动发布的完整闭环。 ## 工作流程 1. **docker-expert** 分析项目结构，生成生产级 Dockerfile（含多阶段构建、安全加固、健康检查） 2. **testing-patterns** 生成容器内的集成测试用例（Jest + supertest 或 pytest） 3. **github-actions-templates** 生成完整的 GitHub Actions 工作流（构建→测试→扫描→推送） 4. **github** 验证工作流执行状态，处理失败的构建步骤 ## 核心功能 - 多阶段构建：构建依赖与运行时分离，镜像体积最小化 - 安全加固：非root用户、只读文件系统、最小化基础镜像 - 依赖缓存：利用 BuildKit cache-mount 加速重复构建 - 安全扫描：Trivy 漏洞扫描 + Snyk 依赖扫描 - 多架构支持：linux/amd64 + linux/arm64 并行构建 - 镜像标签策略：branch / PR / semver 自动打标 ## 使用方法 ### 触发词 `Docker构建` 或 `镜像发布` 或 `CI/CD` ### 输入 提供待容器化的项目目录结构和语言/框架信息 ### 输出 - 优化后的 `Dockerfile`（多阶段、安全加固） - `docker-compose.yml`（dev/staging/prod 三环境） - `.github/workflows/build-push.yml`（完整 CI 工作流） - 测试文件（在 `tests/` 或 `__tests__/` 目录） - `.dockerignore`（构建上下文优化） ### 示例工作流 ```yaml # 触发条件 on: push: branches: [main] pull_request: branches: [main] tags: ['v*'] # 流程：Checkout → Setup Buildx → Build & Test → Security Scan → Push jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Build Docker image run: docker build --target production -t app:${{ github.sha }} . - name: Run tests in container run: docker run --rm app:${{ github.sha }} npm test - name: Security scan uses: aquasecurity/trivy-action@master - name: Push to registry if: github.ref == 'refs/heads/main' run: docker push ghcr.io/${{ github.repository }}:${{ github.sha }} ``` ## 技术细节 - 基础镜像推荐：Alpine / Distroless / Scratch（生产） - 多架构构建：docker buildx（linux/amd64, linux/arm64） - 构建缓存：GitHub Actions Cache（GHA）驱动 - 镜像仓库：GHCR（GitHub Container Registry）优先 - 安全扫描：Trivy（文件系统）+ Snyk（依赖）双扫描


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: guyoung/graphviz (version 1.0.0)

--- name: graphviz description: Generate SVG images from Graphviz DOT graphs using WebAssembly. Uses the graphviz_component.wasm running in the openclaw-wasm-sandbox plugin. No graphviz system binary or execution permission required. --- # Graphviz SVG Generator Generate SVG images from Graphviz DOT graph descriptions using WebAssembly. ## When to Use Trigger when: - Keywords: graphviz, DOT, SVG, flowchart - user asks to generate/convert/visualize a graph from DOT language - user wants to render a Graphviz diagram as SVG - user provides DOT notation and wants SVG output - 用户要求生成/转换/可视化 DOT 语言图 - 用户想要将 Graphviz 图渲染为 SVG - 用户提供 DOT 记号并想要 SVG 输出 - 关键词：流程图生成, 制图 ## Prerequisites - **Required plugin:** `openclaw-wasm-sandbox` - **WASM file:** `~/.openclaw/skills/graphviz/files/graphviz_component.wasm` (Use the `wasm-sandbox-download` tool to download，URL: `https://raw.githubusercontent.com/guyoung/wasm-sandbox-openclaw-skills/main/graphviz/files/graphviz_component.wasm`) ## How It Works The WASM component: - Accepts DOT graph string as **argument** - Outputs SVG to **stdout** ## Tool Use `wasm-sandbox-run` tool: | Parameter | Value | |-----------|-------| | `wasmFile` | `~/.openclaw/skills/graphviz/files/graphviz_component.wasm` | | `args` | DOT graph string, e.g. `["digraph { a -> b }"]` | ```javascript wasm-sandbox-run({ wasmFile: "~/.openclaw/skills/graphviz/files/graphviz_component.wasm", args: ["digraph { a -> b }"] }) ``` ## Usage 1. User provides DOT graph description 2. Call `wasm-sandbox-run` with DOT string in `args` 3. Return the SVG output to the user ## DOT Language Reference ``` digraph name { # Directed graph a -> b # Edge from a to b b -> c a [label="Node A"] # Node with label b [shape=box] # Node shape } graph name { # Undirected graph a -- b b -- c } ``` Common node attributes: `label`, `shape` (box, circle, diamond, triangle), `color`, `style` (filled, dashed) Common edge attributes: `label`, `color`, `style`, `dir` (forward, back, both, none) ## Notes - No system graphviz binary needed — pure WASM execution - No execution permission required — runs in sandbox - Runs in sandbox with no implicit file/network access - Output is pure SVG ready to display or save


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: laimiaohua/gi-code-review (version 1.0.0)

--- name: gi-code-review description: Review code for quality, security, and maintainability following team standards. Use when reviewing pull requests, examining code changes, or when the user asks for a code review. tags: ["code-review", "quality", "security", "best-practices", "vue", "fastapi", "python"] --- # Code Review 代码审查 按照团队规范对代码进行质量、安全和可维护性审查。适用于 Vue3、FastAPI、Python 技术栈。 ## 何时使用 - 用户请求代码审查 - 审查 Pull Request 或代码变更 - 用户提到「帮我看看这段代码」「review 一下」「代码质量」 ## 审查清单 ### 1. 正确性与逻辑 - [ ] 逻辑正确，处理边界情况 - [ ] 无明显的空指针/未定义访问 - [ ] 异步逻辑正确（async/await 配对） - [ ] 错误处理完整，有 try/except 或 .catch() ### 2. 安全 - [ ] 无 SQL 注入（使用参数化查询） - [ ] 无 XSS（Vue 已转义，注意 v-html） - [ ] 敏感信息不硬编码（用 get_env 或配置） - [ ] 接口有权限校验（如需要） ### 3. 代码风格与可维护性 - [ ] 符合项目约定（router/service/dao 分层） - [ ] 函数职责单一，长度适中 - [ ] 命名清晰（变量、函数、路由） - [ ] 有必要的注释和日志 ### 4. 性能 - [ ] 无 N+1 查询（批量查询或 join） - [ ] 大列表考虑分页 - [ ] 前端避免不必要的重复渲染 ### 5. 测试 - [ ] 关键逻辑有测试覆盖 - [ ] 边界情况有测试 ## 反馈格式 - 🔴 **必须修复**：影响正确性、安全或严重性能问题 - 🟡 **建议改进**：可读性、可维护性、最佳实践 - 🟢 **可选优化**：锦上添花 ## 项目规范参考 - 后端：app/dao、app/service、app/router、app/model（entity/dto/vo） - 数据库：使用 AsyncSqlSessionTemplate（insert/update/query_one/query_list） - 报错：`from tkms.exception.api import ApiException` - 配置：`from tkms import get_env` - 前端：Vue3 + Ant Design，components/views/services 分层


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: awlevin/agent-chat (version 0.1.0)

--- name: agent-chat description: Temporary real-time chat rooms for AI agents. Password-protected, with SSE streaming, web UI for humans, and CLI tools for agents. metadata: { "openclaw": { "emoji": "🏠", "requires": { "bins": ["uv"] }, }, } --- # Agent Chat Spin up a temporary chat room where AI agents (and humans) can talk in real-time. Password-protected, with a web UI and CLI tools. ## Host a Room ```bash uv run --with agent-chat agent-chat serve --password SECRET --tunnel cloudflared ``` This prints a shareable invite message you can copy-paste to friends. ## Join a Room (as an agent) ```bash # Install clawhub install agent-chat # Join and listen for messages uv run --with agent-chat agent-chat join --url https://xxx.trycloudflare.com --password SECRET --agent-name "my-agent" # Send a message uv run --with agent-chat agent-chat send --url https://xxx.trycloudflare.com --password SECRET --agent-name "my-agent" --message "hello!" # Just listen (pipe to stdout) uv run --with agent-chat agent-chat listen --url https://xxx.trycloudflare.com --password SECRET ``` ## Web UI (for humans) Open the web UI link in any browser to watch and participate in the chat. No install needed. ## API | Endpoint | Method | Description | |----------|--------|-------------| | `/messages` | POST | Send message (`{agent, text}`) | | `/messages` | GET | Get all messages | | `/messages/stream` | GET | SSE real-time stream | | `/health` | GET | Health check (no auth) | All endpoints require `X-Room-Password` header or `?password=` query param. ## Source https://github.com/Olafs-World/agent-chat


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: topcheer/remotego (version 1.1.0)

--- name: remotego description: "Expose any CLI tool as a public web terminal via tunnel. Mirror bash, vim, python, node, or any command in a browser for remote access and collaboration." version: 1.1.0 metadata: openclaw: requires: bins: - node emoji: "🌐" homepage: https://github.com/topcheer/claude-remoting os: - macos - linux --- # remotego - Expose Any CLI as a Public Web Terminal Mirror any CLI tool in a browser with a public URL. Share your terminal with anyone over the internet. ## When to Use The user wants to: - Share their terminal session with someone remotely - Access a CLI tool from a browser - Collaborate on a terminal session in real-time - Expose a local CLI to a public URL ## How to Use remotego is installed globally via npm. Run it with any command: ```bash remotego <command> [command-args...] [options] ``` ### Quick Examples | Goal | Command | |------|---------| | Mirror Claude Code | `remotego claude` | | Mirror bash | `remotego bash` | | Mirror Python REPL | `remotego python3 -i` | | Mirror vim | `remotego vim` | | Mirror Node.js REPL | `remotego node` | | Custom port | `remotego --port 9000 bash` | | Custom tunnel domain | `remotego --domain myterm.localhost.run bash` | | Pass flags to command | `remotego -- git log --oneline` | ### Options | Flag | Description | Default | |------|-------------|---------| | `--port <port>` | Local HTTP port | `7681` | | `--cwd <dir>` | Working directory | Current dir | | `--domain <domain>` | Custom localhost.run domain | Random | | `--help, -h` | Show help | | ### Install First (if not installed) ```bash npm install -g @remotego/remotego ``` Or use without installing: ```bash npx @remotego/remotego bash ``` ## What Happens 1. Spawns the command in a PTY (pseudo-terminal) 2. Starts a local HTTP server with xterm.js browser terminal 3. Creates a public tunnel via localhost.run 4. Opens the browser automatically with a session URL ## Security Model - A random session UUID is generated on each start - The session ID is embedded in the URL — only URL holders can connect - Clients must authenticate within 5 seconds of connecting ## Stopping Press `Ctrl+C` in the terminal running remotego. ## Troubleshooting | Issue | Solution | |-------|----------| | `node` not found | Install from https://nodejs.org/ | | Tunnel fails | Check if SSH port 22 is blocked; falls back to localhost | | Port in use | Use `--port` to specify a different port | | Browser doesn't open | Manually open the URL shown in terminal output |


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)