OpenClaw/clawhub-security-signals huggingface dataset:
Skill: lvzaiyi-afk/daily-calorie-balance (version 1.2.0)

--- name: daily-calorie-balance description: 每天自动合并 Calorie Visualizer 食物摄入与 clawhealth-garmin 消耗数据，计算净余/赤字，并在北京时间每天晚上 21:30 主动发送总结。支持手动查询。 author: Grok-assisted version: 1.2.0 user-invocable: true dependencies: - calorie-visualizer - clawhealth-garmin --- # Daily Calorie Balance 每日卡路里平衡总结（自动版） ## 技能目标 - **自动模式**：每天北京时间 21:30 主动生成并发送今日总结（通过 cron 调用）。 - **手动模式**：用户输入"今天卡路里平衡""今日摄入消耗""daily balance""净卡路里"等时立即执行。 ## 执行流程（严格遵守） 1. **确定日期**：默认今天（使用系统当前日期，北京时间）。支持用户指定"昨天"等。 2. **读取食物摄入**：从 Calorie Visualizer 的记录（文件或数据库）获取今日总摄入 kcal。如果无记录，明确说明。 3. **读取 Garmin 消耗**：通过 clawhealth-garmin 查询今日 **总卡路里消耗** 和 **活动卡路里**（优先用活动卡路里）。 4. **计算**：净卡路里 = 摄入 - 消耗 - 正数：盈余（轻微/明显） - 负数：赤字（适合减脂） - 接近 0：平衡 5. **生成总结** 并**主动发送**到你的聊天渠道（Telegram/WhatsApp 等）。 ## 输出格式（必须严格使用，清晰友好） 输出的效果如下： ``` 📊 今日卡路里平衡总结（{YYYY-MM-DD} 北京时间） 🍽️ 食物摄入：{XXX} kcal （主要餐食：简要列出，如果有） 🔥 Garmin 消耗：{YYY} kcal （活动消耗约 {ZZZ} kcal | 总消耗 {Total} kcal） ⚖️ 净卡路里：{+XXX 或 -XXX} kcal （{盈余/赤字/平衡}） 💡 今日建议： • [1-2 条简短实用建议，例如"赤字良好，继续保持"或"盈余较多，明天可增加步数"] • 整体状态：{积极/需注意/优秀} ``` ## 触发与调度 ### 手动触发 直接聊天说相关关键词： - "今天卡路里平衡" - "今日摄入消耗" - "daily balance" - "净卡路里" - "卡路里总结" ### 自动调度 通过 OpenClaw Cron 每天北京时间 21:30 执行： ```bash openclaw cron add \ --name "每日卡路里平衡总结 -21:30" \ --cron "30 21 * * *" \ --tz "Asia/Shanghai" \ --session isolated \ --message "run daily-calorie-balance today --auto" \ --announce \ --channel qqbot \ --to [REDACTED_SECRET] \ --enabled true ``` ## 使用方法 ```bash # 手动查询今天 python3 scripts/daily_balance.py today # 手动查询昨天 python3 scripts/daily_balance.py yesterday # 指定日期 python3 scripts/daily_balance.py 2026-03-29 # 自动模式（用于 cron） python3 scripts/daily_balance.py today --auto ``` ## 依赖 ### 必需技能（自动检测） 本技能依赖以下两个技能，安装时会自动检测： - **calorie-visualizer** - 用于记录食物摄入数据 - **clawhealth-garmin** - 用于获取 Garmin 运动消耗数据 ### 安装依赖 如果缺少依赖技能，脚本会提示你安装： ```bash # 安装所有依赖 clawhub install calorie-visualizer clawhub install clawhealth-garmin # 或者一键安装本技能及其依赖 clawhub install daily-calorie-balance # 然后手动安装依赖（clawhub 暂不支持自动安装依赖） ``` ### 系统依赖 - Python 3.8+ - sqlite3 (Python 内置) ## 数据存储 - 食物摄入数据：`/home/admin/.openclaw/workspace/skills/calorie-visualizer/data/calorie_data.db` - Garmin 消耗数据：`/home/admin/.openclaw/workspace/skills/clawhealth-garmin/data/health.db`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: malicious | SkillSpector: suspicious (CRITICAL)
Skill: akkualle/akkualle-stealth-browser (version 3.0.0)

--- name: stealth-browser description: "Professionelle Browser-Automation mit Human Behavior Simulation, Advanced Anti-Detection und 2Captcha Integration. Stealth-Score: 100/100. Ideal für SEO, Backlink-Outreach, Social Media und Web-Automation." version: "3.0.0" author: "AkkuAlle" price: "79€" license: "commercial" emoji: 🌐 user-invocable: true tags: - automation - browser - seo - social-media - captcha - stealth --- # Stealth-Browser Skill v3.0 **Die professionelle Browser-Automation für OpenClaw mit Human Behavior Simulation und Advanced Anti-Detection.** **🛡️ Stealth-Score: 100/100 (EXCELLENT)** ## ✨ Features ### Anti-Detection (30+ Techniken) - Canvas Noise Injection - WebGL Fingerprint Randomization - Audio Fingerprint Spoofing - Timezone/Language Spoofing - Plugin Array Emulation - Headless Detection Bypass ### Captcha-Support - ✅ reCAPTCHA v2/v3 (via 2Captcha) - ✅ hCaptcha (via 2Captcha) - ✅ Cloudflare Turnstile ### Human Behavior Simulation - Natural Mouse Movements - Randomized Typing Speed - Smart Scrolling Patterns - Random Delays ### Proxy Rotation - HTTP/HTTPS/SOCKS5 - Automatic Rotation - Geo-targeting ## 🚀 Verwendung ```bash # Browser starten ./stealth-browser-v3 start --profile myprofile # URL öffnen ./stealth-browser-v3 open "https://example.com" # Status prüfen ./stealth-browser-v3 status # Anti-Detection Test ./stealth-browser-v3 test ``` ## 📦 Installation ```bash ./install.sh ``` ## 🔧 Konfiguration ### 2Captcha API Key Für Captcha-Support benötigt: ```bash export TWOCAPTCHA_API_KEY="your_api_key" ``` ### Proxies Proxy-Liste in `proxies/proxies.txt`: ``` [REDACTED_SECRET] socks5://user:pass@proxy2:1080 ``` ## 📊 Test-Ergebnisse | Test | Score | |------|-------| | **Stealth Score** | 100/100 | | **Bot Detection** | 100/100 | | **Fingerprint** | Unique | | **Headless Detection** | Passed | ## 💰 Preise | Lizenz | Preis | Features | |--------|------|----------| | **Basic** | 79€ | Anti-Detection, Human Behavior | | **Pro** | 149€ | + Captcha-Support, Proxy Rotation | | **Enterprise** | 299€ | + Priority Support, Custom Features | --- *Version: 3.0.0* *Author: AkkuAlle* *License: Commercial*


Security scan verdicts — ClawScan: malicious | static analysis: clean | VirusTotal: suspicious | SkillSpector:  ()
Skill: nickzhangai/cross-team-plain-language (version 1.0.0)

--- name: cross-team-plain-language description: Rewrite messy, internal, emotional, or jargon-heavy thoughts into clear language that other teams can immediately understand and respond to. Use when the user says things like “我知道我要表达什么，但不会写成别人能接住的话”, wants to explain context to product/ops/engineering/bosses, needs a summary others can follow, or wants multiple tones such as concise, formal, or chat-friendly. --- # Cross Team Plain Language Turn raw thoughts into language other people can catch, understand, and continue. ## Core Job Take material that is: - scattered - emotionally loaded - too insider-ish - too technical for the audience - technically correct but socially hard to receive Then rewrite it into a version that is: - easier to understand - easier to reply to - easier to forward - aligned to the audience's concerns ## Workflow 1. Identify the audience. - boss / leadership - product - engineering - operations / customer success - cross-functional group chat 2. Extract the real message. - what happened - why it matters - what decision or response is needed 3. Remove blockers. - jargon without explanation - emotional venting that hides the point - overly long setup - claims that are hard to act on 4. Rebuild the message in plain language. 5. Offer 2-4 variants when useful: - short chat version - formal update version - structured bullet version - push-without-sounding-pushy version ## Output Pattern Default to this structure unless the user asks otherwise: 1. **你原本想表达的核心** 2. **别人更容易接住的版本** 3. **如果要更短/更正式/更柔和，可以改成** ## Editing Rules - Preserve intent, not exact wording. - Prefer concrete nouns over abstract phrases. - Replace insider shorthand with terms outsiders understand. - Surface the ask explicitly. - Keep causality clear: “现象 → 影响 → 建议/请求”. - If the user sounds frustrated, keep the force but reduce the splash damage. ## Good Delivery Shapes ### A. Cross-team alignment Use when the goal is shared understanding. ```text 目前看到的问题是…… 它带来的影响是…… 我建议下一步先…… ``` ### B. Friendly but useful group-chat summary Use when the message should feel natural, not like a memo. ```text 我先帮大家收一下： 现在讨论里比较集中的点是…… 如果按优先级看，我会先…… ``` ### C. Decision-ready summary Use when the reader needs to decide or allocate resources. ```text 这不是单点反馈，而是一个模式：…… 当前最优先要解决的是…… 后续再扩展…… ``` ## When To Push Back If the source material is too vague, say what is missing instead of pretending clarity exists. Ask only for the minimum missing piece, such as: - audience - desired tone - whether the user wants explanation, persuasion, or status update ## References - See `references/patterns.md` for rewrite patterns and before/after templates.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ianderrington/agent-knowledge (version 1.0.0)

--- name: knowledge description: Unified knowledge capture and retrieval for URLs, video/article/paper extracts, social posts, and agent research outputs. Use when saving anything worth re-finding later, summarizing external content, tracking sourced claims, or answering "where did we store that?" questions. --- # Knowledge Skill File-based knowledge organization. Capture fast, search later, clean up automatically. ## Installation ```bash clawhub install knowledge ``` This installs `scripts/know` — add to PATH or use full path: ```bash ~/.openclaw/skills/knowledge/scripts/know ``` ## Storage Location Default: `~/.soulshare/agent/knowledge/` Configurable via `~/.config/know/config` or env `KNOWLEDGE_DIR`. ``` knowledge/ ├── INDEX.md # Auto-maintained browsable index ├── urls/ # Bookmarked URLs ├── extracts/ # Video/article/paper summaries ├── posts/ # Social content (tweets, threads) └── research/ # Agent-generated research ``` ## Adding Content ```bash know add url <url> --title "..." --tags "a,b" [--summary "..."] know add video <url> --title "..." --tags "a,b" [--summary "..."] know add extract --source <url> --type video|article|paper --title "..." --tags "a,b" know add post --source <url> --title "..." --tags "a,b" know add research --title "..." --tags "a,b" [--summary "..."] ``` Each add writes a markdown file with YAML frontmatter and updates `INDEX.md`. ## Searching ```bash know search "query" # Grep across all entries know recent --limit 10 # Recent entries know list --tags security # Filter by tag ``` ## Cleanup & Maintenance ```bash know tidy # Audit: find issues know tidy --fix # Auto-fix: normalize tags, move misplaced files, remove empty know validate # Check frontmatter schema know reindex # Rebuild INDEX.md know config # Show active config paths ``` **Recommended:** Run `know tidy --fix` in heartbeats or nightly cron. ## Data Model (frontmatter) ```yaml --- type: url|extract|post|research title: "Entry title" source_url: "https://..." source_kind: url|video|article|paper|post|research tags: ["tag1", "tag2"] added: "2026-02-26" added_by: "agent-name" summary: "One-line summary" --- ``` ## QMD Integration Plain markdown → QMD-indexable. ```bash qmd collection add ~/.soulshare/agent/knowledge --name knowledge qmd search "query" --collection knowledge ``` ## Discipline - If it's useful later → `know add` immediately - Don't leave knowledge only in `memory/YYYY-MM-DD.md` - Every entry needs tags + summary - Let `know tidy --fix` handle normalization


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: tanis90/image-to-markdown (version 1.0.0)

--- name: image_to_markdown description: "Image to Markdown - extract text from images (PNG, JPG, WebP) to Markdown with OCR. Use when reading text from screenshots, photos, scanned pages, or any image file." homepage: https://mineru.net metadata: {"openclaw":{"emoji":"🖼️","requires":{"bins":["mineru-open-api"]},"install":[{"id":"npm","kind":"node","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via npm"},{"id":"uv","kind":"uv","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via uv"},{"id":"go","kind":"go","package":"github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api","bins":["mineru-open-api"],"label":"Install via go install","os":["darwin","linux"]}]}} --- # Image to Markdown - OCR Extract Text from Images Extract text from images to Markdown using MinerU Open API. No API key required. ## Quick Start ```bash # Extract text from a local image mineru-open-api flash-extract screenshot.png # Extract text from an image URL (no download needed) mineru-open-api flash-extract https://example.com/image.png # Save to file mineru-open-api flash-extract photo.jpg -o ./output/ # Specify language for better accuracy mineru-open-api flash-extract scan.jpg --language en ``` ## Language Rule You MUST reply to the user in the SAME language they use. This is non-negotiable. ## Capabilities - OCR text extraction from PNG, JPG, JPEG, WebP, BMP, TIFF - Supports both local files and URLs directly - Language hint with `--language` (default: `ch`, use `en` for English) - No API key, no signup, no authentication - Max 10MB per image ## When to Use - User asks to "read", "extract", or "OCR" an image - User shares a screenshot and asks what it says - User wants text from a photo of a document or whiteboard - User needs image content converted to Markdown ## CLI Reference Run `mineru-open-api flash-extract --help` for all available options. ## Data Privacy - `flash-extract` uploads the image to MinerU's cloud API for processing and returns the result. No account or API key is required. - Images are processed in real-time and are not stored after extraction. - For details, see https://mineru.net ## Notes - Output is Markdown text extracted via OCR - For higher precision or batch processing, use `mineru-open-api extract` (requires auth via `mineru-open-api auth`) - If the CLI cannot be installed via npm/uv/go, download it from https://mineru.net/ecosystem?tab=cli


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: modestyrichards/modesty-generate-brand-design-ad-creative-brief (version 1.0.0)

--- name: "Generate Brand Design Ad Creative Brief" description: "Plan campaign visuals and hooks for brand design promotions. Use when working on paid campaign planning for designers, brand teams, ecommerce operators." homepage: "https://www.skillboss.co/skills/generate-brand-design-ad-creative-brief" metadata: {"category":"design-branding","subcategory":"visual-branding","skill_id":[REDACTED_SECRET],"generated_day":"","seo_keywords":["ad creative brief AI","brand design ad planning","brand design AI","creative ops automation"]} --- # Generate Brand Design Ad Creative Brief Plan campaign visuals and hooks for brand design promotions. Use when working on paid campaign planning for designers, brand teams, ecommerce operators. ## Use When Use this skill for paid campaign planning work for designers, brand teams, ecommerce operators. ## Workflow 1. Clarify the audience, business goal, constraints, and deliverable. 2. Produce the strongest first draft for the target use case. 3. Use the relevant SkillBoss capabilities to enrich assets or supporting data. 4. Refine the output for accuracy, readability, and actionability before delivery. ## SEO / GEO - Primary keywords: ad creative brief AI, brand design ad planning, brand design AI, creative ops automation - Search intent: paid campaign planning - Canonical slug: `generate-brand-design-ad-creative-brief` - Install query: Install Generate Brand Design Ad Creative Brief with SkillBoss ## APIs Used - `chat` - `image_generation` ## Suggested Prompt [Generate Brand Design Ad Creative Brief] for my team ## Notes - Plan campaign visuals and hooks for brand design promotions - Review outputs before external publication or automated execution. ## SEO Keywords - ad creative brief AI - brand design ad planning - brand design AI - creative ops automation


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: harshhmaniya/linkedin-lead-gen (version 1.0.0)

--- name: linkedin-lead-gen description: Search for, research, and verify non-tech founders on LinkedIn to identify high-value prospects for technology services (Web Dev, ERP, CRM, App Dev, SEO, AI). Generates professional PDF reports. Use when asked to find potential clients or leads. --- # LinkedIn Lead Generation & Research This skill provides a structured workflow for identifying and verifying high-quality business leads. ## Workflow 1. **Target Selection**: Define industries that need digital transformation but aren't tech-native (e.g., Textile, Manufacturing, Real Estate, Healthcare, Energy, D2C Brands). 2. **LinkedIn Search**: - Use `browser` tool to search LinkedIn: `https://www.linkedin.com/search/results/people/?keywords=founder+CEO+[Industry]+[Location]` - Filter for 2nd-degree connections for easier outreach. 3. **Strict Filtering**: - EXCLUDE any founder already in the IT, Software, or Digital Marketing space. - EXCLUDE founders whose profiles indicate they already have a strong internal tech team. 4. **Deep Research**: - Visit each candidate's LinkedIn profile. - Find their company website URL. - Visit the company website using `web_fetch` or `browser`. 5. **Gap Analysis**: - Analyze the website for: Speed, Mobile Responsiveness, SEO, E-commerce capabilities, and overall modern aesthetic. - Identify specific needs (e.g., "No mobile app", "Outdated UI", "No CRM/ERP integration"). 6. **Reporting**: - Compile a list of 10 qualified prospects. - Include: Name, LinkedIn URL, Company, Website Status, Specific Needs, and a "Pitch Idea". - Generate a professional HTML-based PDF report. ## Tools to Use - **browser**: For LinkedIn search and profile viewing. - **web_fetch**: For quick website analysis. - **write**: To create the HTML template for the PDF. ## PDF Template (HTML Structure) Use the following CSS principles for a premium feel: - LinkedIn Blue (`#0077b5`) for headers. - Clean, modern typography (sans-serif). - Priority badges (High/Medium/Low). - Structured grids for easy scanning. ## Outreach Principles - **Personalized**: Reference something specific from their profile or website. - **Problem-First**: Focus on the gap identified (e.g., "Your brand is growing on social, but your website is broken"). - **Local Advantage**: If in the same city (Surat), emphasize face-to-face consultation.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xueylee-dotcom/deep-research-v22 (version 2.2.0)

# Skill: Deep Research Pro (v2.2 - True Depth) > 版本：2.2.0 > 描述：真深度研究技能，强制全文解析+结构化提取+溯源验证 ## 核心原则 **没有真正的原文阅读，就没有深度研究** --- ## 🔴 强制执行流程（v2.2 新增） ### Step 1: 研究规划 (必须输出文件) - 生成 `research/plan.md` - 列出至少 5 个具体检索查询式 - **用户确认后才能继续** ### Step 2: 全文解析 + 结构化提取 (核心！) **禁止跳过此步骤！** 对于每个有效来源，必须执行： 1. **获取全文** ```bash # 使用 extract-from-pdf.py 脚本 python3 scripts/extract-from-pdf.py card-001 "https://arxiv.org/pdf/xxx.pdf" ``` - 如果有DOI/URL，尝试下载PDF - 如果无法获取全文，标记 `full_text: false` 并**跳过该来源** 2. **结构化提取**（从PDF原文提取） - 样本量：具体数字 - 主要结果：具体数值 + 单位 + 统计显著性 - 成本影响：具体金额/百分比 - 置信区间：95%CI - 原文引用：**必须从正文中复制至少50字** 3. **更新卡片** - 用提取的真实数据替换"待提取" - 标记 `full_text: true/false` **最低要求**： - deep 模式：至少 **10 个**带全文提取的卡片 - 质量阈值：提取后评分 ≥ 6/10 ### Step 3: 溯源验证 (强制检查！) **生成报告前必须运行：** ```bash bash scripts/check-sourcing.sh reports/final-report.md sources/ ``` - 检查每个 `[[card-xxx]]` 引用的数据是否在卡片中存在 - 如果有数据无法溯源，**拒绝生成报告** - 修复后重新验证 ### Step 4: 交叉分析 - 生成 `analysis/synthesis.md` - 至少找出 3 组矛盾数据 - 标注每个观点的卡片来源 ### Step 5: 报告生成 - 生成 `reports/final-report.md` - **每个数据点必须标注 [[card-xxx]]** - 报告末附溯源检查结果 --- ## 🔧 工具依赖 | 工具 | 用途 | 状态 | |------|------|------| | **pdfplumber** | PDF全文解析 | ✅ 已安装 | | **pdftotext** | PDF备用解析 | ✅ 已安装 | | extract-from-pdf.py | 结构化数据提取 | ✅ 已创建 | | check-sourcing.sh | 溯源验证 | ✅ 已创建 | --- ## 📋 执行命令 ### 完整流程 ```bash # Step 1: 规划 # 编辑 research/plan.md，确认检索式 # Step 2: 检索 + 提取（循环执行） # 对于每个来源： python3 scripts/extract-from-pdf.py card-001 "URL" # 检查提取结果，填入卡片 # Step 3: 溯源验证 bash scripts/check-sourcing.sh reports/final-report.md sources/ # Step 4-5: 分析与报告 # 生成最终报告 ``` --- ## ⚠️ 限制说明 如果无法获取全文（付费论文/报告）： 1. 标记卡片 `full_text: false` 2. 报告中对该来源的数据**仅作参考**，不作为核心结论 3. 建议人工复核关键数据 --- ## 📊 版本对比 | 维度 | v2.1 | v2.2 | |------|------|------| | PDF解析 | ❌ | ✅ 强制 | | 数据提取 | "待提取" | ✅ 真实提取 | | 原文引用 | 模板话术 | ✅ 从正文复制 | | 溯源检查 | ❌ | ✅ 强制验证 | | 报告质量 | 有引用无验证 | 有引用+验证 | --- ## 质量门禁（v2.2 强化版） ```bash # 1. 检查卡片数量（≥10个有全文的） FULLTEXT_COUNT=$(grep -l "full_text: true" sources/card-*.md 2>/dev/null | wc -l) if [ $FULLTEXT_COUNT -lt 10 ]; then echo "❌ 错误：全文提取卡片不足10个，当前 $FULLTEXT_COUNT 个" exit 1 fi # 2. 检查溯源 bash scripts/check-sourcing.sh reports/final-report.md sources/ if [ $? -ne 0 ]; then echo "❌ 错误：报告中有数据无法溯源" exit 1 fi # 3. 检查待提取标记 if grep -q "待提取" sources/card-*.md; then echo "❌ 错误：卡片中仍有'待提取'数据" exit 1 fi ``` --- *Skill版本：2.2.0 | 最后更新：2026-03-19*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: longmans/self-evolve-skill (version 1.0.2)

--- name: self-evolve-remote-stats description: Use curl to query self-evolve.club shared skill rankings, self-evolve personal stats, and update self-evolve.club profile info. Use this when users ask for shared ranking, self-evolve personal info, or profile updates. --- # Self-Evolve Remote Stats Use this skill to interact with self-evolve.club API by `curl` only. - Website: `https://www.self-evolve.club/` - API base URL: `https://self-evolve.club/api/v1` ## Inputs - `BASE_URL` (default: `https://self-evolve.club/api/v1`) - Optional `LIMIT` for leaderboard (default `10`) - `REQUEST_KEY_ID` is required only for setting username ## Trigger Use this skill when users want: - shared skill ranking / leaderboard - self-evolve personal ranking/profile info - to set/update self-evolve.club personal profile info ## Commands Set base URL: ```bash BASE_URL="https://self-evolve.club/api/v1" ``` ### 1) Get overview (no key required) ```bash curl -s "$BASE_URL/stats/overview" ``` ### 2) Get leaderboard (no key required) ```bash LIMIT=10 curl -s "$BASE_URL/stats/leaderboard?limit=$LIMIT" ``` Notes: - Response includes masked key only (`masked_request_key_id`), not full key. - Use `?limit=1..100`. ### 3) Set username (requires your key) ```bash REQUEST_KEY_ID="<request_key_id>" USERNAME="alice" curl -s -X POST "$BASE_URL/users/username" \ -H "request-key-id: $REQUEST_KEY_ID" \ -H 'content-type: application/json' \ -d "{\"username\":\"$USERNAME\"}" ``` Real request example: ```bash curl -s -X POST "https://self-evolve.club/api/v1/users/username" \ -H "request-key-id: rk_demo_1234567890abcdef" \ -H "content-type: application/json" \ -d '{"username":"kevin001"}' ``` ### 4) Get my ranking info (requires your key) ```bash REQUEST_KEY_ID="<request_key_id>" curl -s "$BASE_URL/stats/me" \ -H "request-key-id: $REQUEST_KEY_ID" ``` ```bash curl -s -X POST "https://self-evolve.club/api/v1/users/username" \ -H "request-key-id: $REQUEST_KEY_ID" \ -H 'content-type: application/json' \ -d "{\"username\":\"$USERNAME\"}" ``` ## Read key from local plugin file Default plugin key file location: ```bash KEY_FILE="$HOME/.openclaw/plugins/self-evolve/remote-request-key.json" REQUEST_KEY_ID="$(jq -r '.requestKeyId' "$KEY_FILE")" ``` If `jq` is unavailable, use Python: ```bash REQUEST_KEY_ID="$(python3 - <<'PY' import json, os path = os.path.expanduser('~/.openclaw/plugins/self-evolve/remote-request-key.json') with open(path, 'r', encoding='utf-8') as f: print(json.load(f).get('requestKeyId', '')) PY )" ``` If `remote-request-key.json` is still not found, inspect plugin config to locate custom key path: ```bash openclaw config get plugins.entries.self-evolve.config ``` ## Safety - Never print full `REQUEST_KEY_ID` in shared logs. - Do not send `REQUEST_KEY_ID` for public endpoints (`overview`, `leaderboard`). - Personal endpoints (`/stats/me`, `/users/username`) must use your own key in header `request-key-id`.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)