OpenClaw/clawhub-security-signals huggingface dataset:
Skill: wangjipeng977/minimax-monitor (version 1.1.0)

--- name: minimax-monitor description: MiniMax 套餐监控中心。触发词：查配额、监控中心、minimax监控。 version: 1.1.0 --- # MiniMax 套餐监控中心 > **触发词**：查配额 / 打开配额监控 / 启动 MiniMax 监控 > 当前版本：v1.1.0 ## 更新日志 ### v1.1.0（2026-05-02） - 🆕 **标签页自动刷新**：切换回浏览器标签时，自动触发一次配额和速率数据刷新，不再依赖定时轮询 ### v1.0.0（2026-04-26） - 初始版本，支持配额仪表盘 + 速率探针 + 飞书推送 # MiniMax 套餐监控中心 > **触发词**：查配额 / 打开配额监控 / 启动 MiniMax 监控 > 启动后 **自动用 `open` 命令打开 HTML 页面**（macOS 直接唤起浏览器），无需手动拖入。 ## 技能简介 MiniMax API 套餐使用情况实时监控，支持**网页端**和**飞书端**两种查询方式。 ## 文件说明 | 文件 | 说明 | |------|------| | `mmx-monitor.html` | 监控页面（前端，单文件 HTML，三栏仪表盘） | | `mmx-monitor-server.js` | 本地代理服务（Node.js，连接 MiniMax API，端口9876） | | `mmx_quota_feishu.py` | 飞书推送脚本（查询配额后推送到飞书） | ## 使用方式 ### 方式一：网页端（实时仪表盘） 1. 启动后端服务（如未运行）： ```bash node ~/.openclaw/workspace/skills/minimax-monitor/mmx-monitor-server.js ``` 2. 我会自动执行 `open` 命令打开 `mmx-monitor.html`，浏览器自动加载 ### 方式二：飞书端（继鹏问"查配额"时触发） 直接对我说**查配额**，我运行脚本把当前配额以飞书卡片形式推给你。 手动运行： ```bash python3 ~/.openclaw/workspace/skills/minimax-monitor/mmx_quota_feishu.py <api_key> ``` ## 飞书卡片内容 - 5小时总体配额使用率 + 已用/总额/剩余 - 重置倒计时 - 各模型明细（颜色标记：🟢<75% 🟡75-94% 🔴95%+） - 本周配额（如有） ## 环境变量 | 变量 | 说明 | |------|------| | `MINIMAX_API_KEY` | MiniMax API Key（Token Plan 类型） | | `FEISHU_APP_ID` | 飞书机器人 App ID | | `FEISHU_APP_SECRET` | 飞书机器人 App Secret | | `FEISHU_CHAT_ID` | 默认推送群 ID | ## 注意事项 - 后端服务需在页面之前启动，端口 9876 - 页面刷新间隔：配额 60s，速率 60s - API Key 类型必须是 `sk-cp-` 开头（Token Plan）


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: alexanys/feishu-bridge (version 1.0.0)

--- name: feishu-bridge description: Connect a Feishu (Lark) bot to Clawdbot via WebSocket long-connection. No public server, domain, or ngrok required. Use when setting up Feishu/Lark as a messaging channel, troubleshooting the Feishu bridge, or managing the bridge service (start/stop/logs). Covers bot creation on Feishu Open Platform, credential setup, bridge startup, macOS launchd auto-restart, and group chat behavior tuning. --- # Feishu Bridge Bridge Feishu bot messages to Clawdbot Gateway over local WebSocket. ## Architecture ``` Feishu user → Feishu cloud ←WS→ bridge.mjs (local) ←WS→ Clawdbot Gateway → AI agent ``` - Feishu SDK connects outbound (no inbound port / public IP needed) - Bridge authenticates to Gateway using the existing gateway token - Each Feishu chat maps to a Clawdbot session (`feishu:<chatId>`) ## Setup ### 1. Create Feishu bot 1. Go to [open.feishu.cn/app](https://open.feishu.cn/app) → Create self-built app → Add **Bot** capability 2. Enable permissions: `im:message`, `im:message.group_at_msg`, `im:message.p2p_msg` 3. Events: add `im.message.receive_v1`, set delivery to **WebSocket long-connection** 4. Publish the app (create version → request approval) 5. Note the **App ID** and **App Secret** ### 2. Store secret ```bash mkdir -p ~/.clawdbot/secrets echo "YOUR_APP_SECRET" > ~/.clawdbot/secrets/feishu_app_secret chmod 600 ~/.clawdbot/secrets/feishu_app_secret ``` ### 3. Install & run ```bash cd <skill-dir>/feishu-bridge npm install FEISHU_APP_ID=cli_xxx node bridge.mjs ``` ### 4. Auto-start (macOS) ```bash FEISHU_APP_ID=cli_xxx node setup-service.mjs launchctl load ~/Library/LaunchAgents/com.clawdbot.feishu-bridge.plist ``` ## Diagnostics ```bash # Check service launchctl list | grep feishu # Logs tail -f ~/.clawdbot/logs/feishu-bridge.err.log # Stop launchctl unload ~/Library/LaunchAgents/com.clawdbot.feishu-bridge.plist ``` ## Group chat behavior Bridge replies only when: user @-mentions the bot, message ends with `?`/`？`, contains request verbs (帮/请/分析/总结…), or calls the bot by name. Customize the name list in `bridge.mjs` → `shouldRespondInGroup()`. ## Environment variables | Variable | Required | Default | |---|---|---| | `FEISHU_APP_ID` | ✅ | — | | `FEISHU_APP_SECRET_PATH` | — | `~/.clawdbot/secrets/feishu_app_secret` | | `CLAWDBOT_CONFIG_PATH` | — | `~/.clawdbot/clawdbot.json` | | `CLAWDBOT_AGENT_ID` | — | `main` | | `FEISHU_THINKING_THRESHOLD_MS` | — | `2500` |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (HIGH)
Skill: barnyp/automation-runner (version 1.0.0)

--- name: automation_runner description: Executes approved shell commands, manages backups, and safely retrieves secrets from Bitwarden. --- # Automation Runner Agent ⚡ You handle the system-level execution and security for OpenClaw. ## Core Directives 1. **Security:** Every command MUST pass through the `exec-approvals` gate. 2. **Secrets:** NEVER store API keys in plain text. Use the `bws` wrapper. 3. **Workspace:** Limit execution to `/home/intelad/.openclaw/workspace/scripts`. 4. **Reliability:** Verify the success of a command before reporting completion. ## Tooling - `exec`: Run approved scripts. - `bws`: Retrieve secrets at runtime. - `process`: Manage long-running tasks like backups. ## Workflow 1. Receive a script or command request. 2. Use `bws secret get` to fetch necessary environment variables. 3. Execute the command. 4. If a prompt appears, wait for Paul to type `/approve`. 5. Log the output to `memory/YYYY-MM-DD.md`.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: vanthienha199/project-kickstart (version 1.0.0)

--- name: project-kickstart description: > Scaffold any project in seconds. Generate boilerplate for Next.js, React, Python CLI, Express, FastAPI, static sites, and more. Pre-configured with git, linting, CI, README, and license. Use when the user starts a new project. Triggers on: "new project", "start a project", "scaffold", "create a new app", "init project", "boilerplate", "kickstart". tags: - scaffold - boilerplate - starter - template - project - init - create - new-project --- # Project Kickstart You scaffold new projects with best-practice defaults so the user can start coding in 60 seconds. ## Core Behavior When the user describes what they want to build, detect the best stack and generate the project structure with all configuration files. ## Supported Stacks | Stack | Trigger | What's Generated | |-------|---------|-----------------| | **Next.js + TypeScript** | "next app", "react website" | next.config.ts, tsconfig, tailwind, eslint, app/ router | | **React + Vite** | "react app", "SPA" | vite.config, tsconfig, tailwind, src/ structure | | **Python CLI** | "python tool", "CLI tool" | pyproject.toml, click/typer, src/, tests/ | | **FastAPI** | "python API", "backend" | main.py, requirements.txt, Dockerfile, tests/ | | **Express + TypeScript** | "node API", "express" | tsconfig, src/, routes/, middleware/ | | **Static HTML** | "landing page", "static site" | index.html, styles.css, script.js | | **OpenClaw Skill** | "openclaw skill", "agent skill" | SKILL.md, README.md with frontmatter | ## What Every Project Gets Regardless of stack: 1. **`.gitignore`** — language-appropriate 2. **`README.md`** — project name, description, quick start, license 3. **`LICENSE`** — MIT by default (ask if user wants different) 4. **`.github/workflows/ci.yml`** — basic CI (lint + test) 5. **`git init`** — initialized with first commit ## Workflow ### Step 1: Ask (if not clear) ``` What are you building? 1. Web app (Next.js) 2. API (FastAPI/Express) 3. CLI tool (Python) 4. Static site 5. OpenClaw skill 6. Something else (describe it) ``` ### Step 2: Generate Create all files with the appropriate content. Don't use placeholder text — write real, working starter code. ### Step 3: Report ``` Project created: my-awesome-app/ my-awesome-app/ ├── .github/workflows/ci.yml ├── .gitignore ├── LICENSE (MIT) ├── README.md ├── package.json ├── tsconfig.json ├── src/ │ └── app/ │ ├── layout.tsx │ └── page.tsx └── tailwind.config.ts Next steps: cd my-awesome-app npm install npm run dev ``` ## Rules - Write REAL working code, not "TODO" placeholders - Use the latest stable version of every dependency - Default to TypeScript for JS projects - Default to Tailwind for CSS - Default to MIT license - Always init git with a clean first commit - Keep it minimal — don't add auth, database, or features unless asked


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: nansen-devops/nansen-prediction-markets (version 0.1.0)

--- name: nansen-prediction-markets description: "Polymarket screeners — discover trending events, top markets by volume, and search for specific markets. Use when browsing what's happening on prediction markets." metadata: openclaw: requires: env: - NANSEN_API_KEY bins: - nansen primaryEnv: NANSEN_API_KEY install: - kind: node package: nansen-cli bins: [nansen] allowed-tools: Bash(nansen:*) --- # Prediction Market Screeners All commands: `nansen research prediction-market <sub> [options]` (alias: `nansen research pm <sub>`) No `--chain` flag needed — Polymarket runs on Polygon. ```bash # Top events (groups of related markets) nansen research pm event-screener --sort-by volume_24hr --limit 20 # → event_title, market_count, total_volume, total_volume_24hr, total_liquidity, total_open_interest, tags # Top markets by 24h volume nansen research pm market-screener --sort-by volume_24hr --limit 20 # → market_id, question, best_bid, best_ask, volume_24hr, liquidity, open_interest, unique_traders_24h # Search for specific markets nansen research pm market-screener --query "bitcoin" --limit 10 # Find resolved/closed markets nansen research pm market-screener --status closed --limit 10 # Browse categories nansen research pm categories --pretty # → category, active_markets, total_volume_24hr, total_open_interest ``` Sort options: `volume_24hr`, `volume`, `volume_1wk`, `volume_1mo`, `liquidity`, `open_interest`, `unique_traders_24h`, `age_hours` Screeners return active/open markets by default. Use `--status closed` for resolved markets.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kleberbaum/colorpedia (version 0.1.0)

--- name: colorpedia description: Colorpedia namespace for Netsnek e.U. color science and design toolkit. Offers color palette generation, accessibility contrast checking, format conversion, and design system integration. user-invocable: true version: 0.1.0 metadata: openclaw: os: - linux permissions: - exec --- # colorpedia Colorpedia namespace for Netsnek e.U. color science and design toolkit. Offers color palette generation, accessibility contrast checking, format conversion, and design system integration. ## Overview colorpedia is part of the Netsnek e.U. product family. This skill reserves the `colorpedia` namespace on ClawHub and provides brand identity and feature information when invoked. ## Usage Display a brand summary: ```bash scripts/colorpedia-info.sh ``` List features and capabilities: ```bash scripts/colorpedia-info.sh --features ``` Get structured JSON metadata: ```bash scripts/colorpedia-info.sh --json ``` ## Response Format Present the script output to the user. Use the default mode for general questions, `--features` for capability inquiries, and `--json` when machine-readable data is needed. ### Example Interaction **User:** What is **Assistant:** The encyclopedia of color for developers and designers. Colorpedia namespace for Netsnek e.U. color science and design toolkit. Offers color palette generation, accessibility contrast checking, format conversion, and design system integration. Copyright (c) 2026 Netsnek e.U. All rights reserved. **User:** What features does colorpedia have? **Assistant:** *(runs `scripts/colorpedia-info.sh --features`)* - Color palette generation from images or seeds - WCAG accessibility contrast ratio checking - Conversion between HEX, RGB, HSL, CMYK, and LAB - Design system token export (CSS, JSON, Tailwind) - Color blindness simulation preview ## Scripts | Script | Flag | Purpose | |--------|------|---------| | `scripts/colorpedia-info.sh` | *(none)* | Brand summary | | `scripts/colorpedia-info.sh` | `--features` | Feature list | | `scripts/colorpedia-info.sh` | `--json` | JSON metadata | ## License MIT License - Copyright (c) 2026 Netsnek e.U.


Security scan verdicts — ClawScan: clean | static analysis:  | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: topcheer/teamclaw-setup (version 1.0.1)

--- name: teamclaw-setup description: Install, configure, validate, or troubleshoot the TeamClaw OpenClaw plugin for virtual software-team workflows. Use when users want TeamClaw setup help, controller or worker config snippets, localRoles first-run guidance, on-demand process/docker/kubernetes workers, or safe first-run validation steps. version: 1.0.0 metadata: openclaw: author: TeamClaws homepage: https://github.com/topcheer/teamclaw links: homepage: https://github.com/topcheer/teamclaw repository: https://github.com/topcheer/teamclaw documentation: https://github.com/topcheer/teamclaw/blob/main/INSTALL.md changelog: https://github.com/topcheer/teamclaw/releases --- # TeamClaw Setup Guide users to the smallest working TeamClaw installation first, then expand. ## Default workflow 1. Prefer the guided installer first: ```bash npx -y @teamclaws/teamclaw install ``` 2. Use manual plugin install only when the user wants direct control: ```bash openclaw plugins install @teamclaws/teamclaw ``` If the user explicitly wants the ClawHub package path, use: ```bash openclaw plugins install clawhub:@teamclaws/teamclaw ``` 3. Recommend `controller + localRoles` for the first successful run unless the user explicitly needs distributed or on-demand workers immediately. 4. Read `references/install-modes.md` before generating config. Pick the smallest matching topology and reuse the provided snippets. 5. Read `references/validation-checklist.md` before finishing. Always give the user: - one health-check command - one UI URL - one tiny smoke-test requirement - one or two likely failure checks for the chosen topology ## Installation guidance - Start with a single machine and `localRoles`. - Keep TeamClaw `taskTimeoutMs` large for real model runs. - Keep OpenClaw `agents.defaults.timeoutSeconds` at least as large as the TeamClaw task window in seconds. - For `docker` or `kubernetes`, require a reachable `workerProvisioningControllerUrl`. - For `docker`, mention the published runtime image: ```text ghcr.io/topcheer/teamclaw-openclaw:latest ``` ## What to produce When helping a user, produce: 1. the exact install command 2. the minimal config snippet for the chosen topology 3. the startup command 4. the validation commands and first smoke-test task Do not push users into distributed, Docker, or Kubernetes first unless they asked for it or already have the surrounding infrastructure ready.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: hoyaryyj/wechat-article-processor (version 1.0.0)

--- name: wechat-article-processor description: 微信公众号文章处理工具 - 自动抓取、结构化整理、保存到飞书文档。触发词：处理公众号文章、微信文章转飞书、公众号链接 author: Jarvis metadata: openclaw: emoji: 📱 tags: [wechat, feishu, article, processor] --- # 微信公众号文章处理工具 当用户发送微信公众号文章链接时，自动完成： 1. 用浏览器抓取文章全文 2. 结构化整理（标题、作者、时间、正文、来源（网址）） 3. 创建飞书云文档 ## 工作流程 1. **抓取**：browser 工具打开链接获取完整内容 2. **提取**：解析标题、作者、发布时间、正文、来源（网址） 3. **整理**：格式化为 Markdown，**必须进行结构化处理**： - 添加文章元信息（作者、发布时间、来源） - 提取关键要点/核心观点作为摘要 - 核心内容或者经典言论要引用原文 - 使用多级标题划分文章结构 - 重要段落可适当精简或提取关键句 4. **保存**：feishu_create_doc 创建飞书文档 ## 使用方式 用户发送公众号链接时自动触发： ``` 用户：https://mp.weixin.qq.com/s/xxx → 自动抓取 → 整理 → 存飞书 → 返回链接 ``` ## 注意事项 - 微信文章可能需要登录才能访问完整内容 - 如遇验证码，告知用户手动复制 - 需要飞书授权


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: lukaizj/lukaizj-feishu (version 0.1.0)

--- name: Feishu Integration description: Feishu (飞书) integration - Send messages, manage groups, and automate workflows homepage: https://github.com/lukaizj/feishu-integration-skill tags: - productivity - integration - messaging - feishu requires: env: - FEISHU_APP_ID - FEISHU_APP_SECRET files: - feishu.py --- # Feishu Integration (飞书集成) Feishu (飞书) integration skill for OpenClaw. Send messages, manage groups, and automate workflows with Feishu. ## Capabilities - Send text messages to chats - Send rich interactive cards - Create new chat groups - List chat members - Send scheduled messages - Webhook notifications ## Setup 1. Create a Feishu application at https://open.feishu.cn/ 2. Get App ID and App Secret from the application settings 3. Add required permissions: - `im:message:send_as_bot` - `im:chat:create` - `im:chat:update` - `im:message:p2p_msg:send` 4. Publish the app and get the Tenant Access Token 5. Configure environment variables ## Environment Variables | Variable | Required | Description | |----------|----------|-------------| | `FEISHU_APP_ID` | Yes | Your Feishu App ID | | `FEISHU_APP_SECRET` | Yes | Your Feishu App Secret | | `FEISHU_VERIFY_TOKEN` | No | Verification token for callbacks | ## Usage ### Send a message ``` Send a message "Hello from OpenClaw" to chat chat_id_123 Send a card message to chat chat_id_456 with title "Daily Report" ``` ### Create a group ``` Create a new Feishu group named "Project Alpha" Add user "zhangsan" to group "Project Alpha" ``` ### List chats ``` List my Feishu chats Show recent chat messages ``` ## Message Types This skill supports: - **Text**: Plain text messages - **Post**: Rich text messages with formatting - **Interactive**: Cards with buttons, inputs, and actions ## Troubleshooting - Ensure your app is published in the Feishu admin console - Check that all required permissions are granted - Verify the App ID and Secret are correct - Make sure the app is added to required chats


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: conbbo/kb-social-publisher (version 1.0.0)

--- name: social-publisher description: 同时发布内容到微博和小红书，使用真实 Chrome 浏览器绕过反机器人检测。支持文字、图片、预览模式和实际发布。当用户需要发布微博、发微博、weibo post、发布小红书、发小红书、xiaohongshu post 时使用此 skill。 --- # 社交平台发布工具 使用真实 Chrome 浏览器同时发布到微博和小红书，支持文字和图片。 ## 脚本目录 所有脚本位于 scripts/ 子目录。 ## 前置要求 - Google Chrome 或 Chromium 已安装 - bun 已安装 - 首次运行：在打开的浏览器窗口中登录各平台 ## 发布到微博 ```bash # 预览模式（不发布） npx -y bun ${SKILL_DIR}/scripts/social-publisher.ts --weibo "你好，微博！" # 带图片 npx -y bun ${SKILL_DIR}/scripts/social-publisher.ts --weibo "看这张图！" --image ./photo.png # 实际发布 npx -y bun ${SKILL_DIR}/scripts/social-publisher.ts --weibo "发布微博！" --image ./photo.png --submit ``` ## 发布到小红书 ```bash # 预览模式（不发布） npx -y bun ${SKILL_DIR}/scripts/social-publisher.ts --xhs "你好，小红书！" --image ./photo.png # 实际发布 npx -y bun ${SKILL_DIR}/scripts/social-publisher.ts --xhs "发布小红书！" --image ./photo.png --submit ``` ## 同时发布到微博和小红书 ```bash # 预览模式 npx -y bun ${SKILL_DIR}/scripts/social-publisher.ts --weibo "你好！" --xhs "你好！" --image ./photo.png # 实际发布 npx -y bun ${SKILL_DIR}/scripts/social-publisher.ts --weibo "同时发布！" --xhs "同时发布！" --image ./photo.png --submit ``` ## 参数说明 | 参数 | 描述 | |------|------| | `--weibo <text>` | 微博内容 | | `--xhs <text>` | 小红书内容 | | `--image <path>` | 图片路径（可重复） | | `--submit` | 实际发布（默认：仅预览） | | `--profile <dir>` | 自定义 Chrome 配置目录 | ## 注意事项 - 首次运行需要手动登录各平台（会话会保存） - 总是先用预览模式确认，再使用 --submit - 小红书至少需要 1 张图片 - 微博普通帖子限制 2000 字 - 支持 macOS、Linux 和 Windows


Security scan verdicts — ClawScan: malicious | static analysis: clean | VirusTotal: clean | SkillSpector:  ()
Skill: chrischall/honeybook-mcp (version 0.3.1)

--- name: honeybook-mcp description: This skill should be used when the user asks about HoneyBook client-portal data. Triggers on phrases like "check HoneyBook", "sign contract", "pay invoice", "HoneyBook vendors", "unsigned contracts", "open invoices", or any request involving wedding-vendor contracts, invoices, brochures, proposals, or payments via HoneyBook. --- # honeybook-mcp MCP server for HoneyBook's client portal — 8 tools for viewing contracts and invoices across multiple wedding vendors, with magic-link session capture and deep-link fallback for signing and paying. - **Source:** [github.com/chrischall/honeybook-mcp](https://github.com/chrischall/honeybook-mcp) ## Setup ### Option A — Claude Code Add to `.mcp.json`: ```json { "mcpServers": { "honeybook": { "command": "node", "args": ["/absolute/path/to/honeybook-mcp/dist/bundle.js"] } } } ``` No env vars required. Activate a session by calling `use_magic_link` in Claude. ### Option B — from source ```bash git clone https://github.com/chrischall/honeybook-mcp cd honeybook-mcp && npm install && npm run build ``` ## Tools | Tool | What it does | |------------------------|-------------------------------------------------------| | `use_magic_link` | Capture a session from a vendor magic-link URL | | `list_active_sessions` | Show currently active portal sessions | | `list_workspace_files` | All files one vendor has shared (filter by type) | | `get_workspace_file` | Full detail for one file | | `get_workspace` | Workspace detail + status flags | | `list_payment_methods` | Saved payment methods | | `sign_contract` | Deep link to sign in portal (requires `confirm:true`) | | `pay_invoice` | Deep link to pay in portal (requires `confirm:true`) | ## Workflows - **First time with a vendor** → user pastes magic-link URL → `use_magic_link` → session captured - **"What contracts haven't I signed?"** → `list_workspace_files` with `file_type=agreement`, filter by `is_file_accepted=false` - **"Summarize my HB status with Silk Veil"** → `get_workspace` (status flags) + `list_workspace_files` - **"Send me a link to sign the photographer's contract"** → `list_workspace_files` → `sign_contract` with `confirm:true` - **"Which invoices are overdue?"** → `list_workspace_files` with `file_type=invoice`, sort by due date ## Notes - All tools hit `api.honeybook.com/api/v2/*` with 8 custom `hb-api-*` headers - Sessions are captured via Puppeteer from magic-link URLs and cached in `~/.honeybook-mcp/sessions.json` (mode 0600) - Each vendor = separate session keyed by portal origin - `sign_contract` / `pay_invoice` return deep links — actual signing/paying requires browser-side device/SCA handling - Session expires → re-run `use_magic_link` with a fresh URL from the vendor's email


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mikeclaw007/shared-bike (version 0.1.0)

--- name: "Shared Bike" description: "提供哈啰/美团单车扫码开锁、骑行范围及计费指引。" --- # 共享单车 ## 筛选项 - 交通方式（高铁/飞机/自驾/公共交通） - 出行偏好（特惠/舒适/周边/长途） - 签证与政策（免签/落地签/核酸要求/预约预约） ## 返回字段 - 实时余票/航班动态/延误信息 - 目的地攻略/天气预警/当地消费参考 - 订单行程单/值机助手/数字登机牌 ## 示例请求 - “如何快速使用 共享单车 处理 [具体场景任务] ？” - “共享单车 的 [核心功能] 有哪些最新玩法/优惠信息？” ## 更新频率 - 随交通枢纽数据、气象信息及库存变动分钟级响应 ## 注意事项 - 高峰出行请提前购买延误险；遵守当地旅游文明公约与防疫要求。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: ntriq-gh/ntriq-x402-code-review-batch (version 1.0.0)

--- name: ntriq-x402-code-review-batch description: "Batch AI code review for up to 500 snippets. Flat $15.00 USDC via x402." version: 1.0.0 metadata: openclaw: primaryTag: data-intelligence tags: [code, review, security, batch, x402] author: ntriq homepage: https://x402.ntriq.co.kr --- # Code Review Batch (x402) Review up to 500 code snippets in a single call. Flat $15.00 USDC. 100% local inference on Mac Mini. ## How to Call ```bash POST https://x402.ntriq.co.kr/code-review-batch Content-Type: application/json X-PAYMENT: <x402-payment-header> { "snippets": [ "eval(userInput)", "[REDACTED_SECRET]'" ], "language": "javascript", "focus": "security" } ``` ## Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `snippets` | array | ✅ | Code snippets to review (max 500) | | `language` | string | ❌ | Programming language (default: `auto`) | | `focus` | string | ❌ | `all` \| `security` \| `performance` \| `quality` | ## Payment - **Price**: $15.00 USDC flat (up to 500 snippets) - **Network**: Base mainnet (EIP-3009 gasless) - **Protocol**: [x402](https://x402.org) ```bash curl https://x402.ntriq.co.kr/services ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)