OpenClaw/clawhub-security-signals huggingface dataset:
Skill: runawaydevil/tiodopave (version 1.0.0)

# tiodopave - Piadas do Reddit Busca piadas aleatórias do subreddit r/tiodopave (reddit.com/r/tiodopave). ## Uso ```bash node ~/.openclaw/workspace/skills/tiodopave/index.mjs ``` ## O que faz 1. Busca os posts mais recentes do r/tiodopave (limit: 20) 2. Filtra posts com score > 5 3. Escolhe um aleatoriamente 4. Retorna o título e o conteúdo (selftext) ## Regras - **NUNCA usar piadas geradas por IA** — só conteúdo real do Reddit - **Sem repetição** — evitar a última piada enviada (armazenar em /tmp/last-joke.txt) - **Limpar texto** — remover links, formatação Reddit, emojis excessivos - **Sem NSFW** — filtrar posts flaired "NSFW" ou que contenham palavras-chave adulto


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: panyuugit/andrew-memory (version 1.0.0)

--- name: andrew-memory description: >- Product-grade semantic memory layer for AI agents using LanceDB. Provides long-term memory with semantic search, Core Identity management, and conversation distillation. Use when: (1) Learning new facts about the user, (2) Searching for past context, (3) Maintaining consistent persona across sessions, (4) Extracting key memories from conversations. --- # Andrew Memory Layer A product-grade semantic memory layer for AI agents, powered by LanceDB. ## Overview This skill provides long-term memory capabilities for AI agents using a local LanceDB vector database. It enables semantic search, Core Identity management, and conversation distillation. ## Features - **Semantic Memory Search** - Find relevant memories using natural language queries - **Core Identity Injection** - Maintain consistent persona across sessions - **Conversation Distillation** - Automatically extract memory atoms from conversations - **Dual LLM Support** - Works with MiniMax API (cloud) or Ollama (local) - **Rich Metadata** - Tracks importance, confidence, and reuse count for each memory ## Tools | Tool | Description | |------|-------------| | `andrew_memory_add` | Store a new memory with type, importance, and confidence | | `andrew_memory_search` | Search memories semantically using natural language | | `andrew_memory_set_identity` | Set the agent's Core Identity | | `andrew_memory_get_identity` | Retrieve the current Core Identity | | `andrew_memory_distill` | Extract key memories from a conversation | | [REDACTED_SECRET] | Rebuild all vectors (after changing embedding model) | ## Configuration ```json { "plugins": { "entries": { "andrew-memory": { "enabled": true, "config": { "dataDir": "~/.andrew-memory/data", "llmMode": "api", "localLlmUrl": "http://localhost:11434" } } } } } ``` ### Config Options | Option | Default | Description | |--------|---------|-------------| | `dataDir` | `~/.andrew-memory/data` | LanceDB data directory | | `llmMode` | `api` | `api` (MiniMax) or `local` (Ollama) | | `localLlmUrl` | `http://localhost:11434` | Ollama URL when using local mode | ## Requirements - OpenClaw - Node.js >= 22 - LanceDB (auto-installed) - MiniMax API key (if using cloud mode): set `MINIMAX_API_KEY` env var ## Memory Types - `preference` - User preferences and habits - `fact` - Factual information about the user or world - `rule` - Executable rules and guidelines - `experience` - Past experiences with success/failure outcomes - `thought` - Thoughts, observations, insights - `distilled` - Auto-extracted from conversations - `general` - Default general-purpose memory ## Usage Example ``` User: Remember that I prefer short responses in the morning. → andrew_memory_add: { text: "User prefers short responses in the morning", memoryType: "preference" } User: What did I say about my communication preferences? → andrew_memory_search: { query: "communication preferences morning responses" } ```


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: bdwatson32/find-mpp (version 1.0.1)

--- name: find-mpp description: >- Teaches agents to use an MPP (Machine Payments Protocol) endpoint registry: search before paying, report newly discovered HTTP 402 Payment endpoints, and submit reviews after every use. Use when working with MPP, HTTP 402, pay-per-request APIs, machine-to-machine payments, or registry-based MPP discovery. --- # find-mpp You have access to a registry of MPP (Machine Payments Protocol) endpoints. MPP endpoints charge per request using HTTP 402. Before paying for any MPP service, query this registry to find the best-rated option for your task. ## Base URL https://www.findmpp.com/api --- ## 1. Search for an MPP endpoint Before using any MPP endpoint, search the registry: GET /api/endpoints/search?q={keywords}&category={category}&min_rating=3.5 Categories: llm-inference, image-generation, web-search, data, storage, audio, video, code-execution, embeddings, other Example: GET /api/endpoints/search?q=web+search&category=web-search&min_rating=4 Use the returned `url` field to make your MPP request. --- ## 2. Report a new MPP endpoint (REQUIRED when discovered) If you encounter an HTTP 402 response with a `WWW-Authenticate: Payment` header on a URL not already in your search results, you MUST report it: POST /api/endpoints/new Content-Type: application/json The submission form (and this API) only accepts these fields: { "url": "<endpoint URL>", "categories": ["<one or more category slugs from the list in §1>"], "email": "<submitter email for follow-up>" } Use the same category slugs as search: llm-inference, image-generation, web-search, data, storage, audio, video, code-execution, embeddings, other. --- ## 3. Submit a review after using an endpoint (REQUIRED) After every interaction with an MPP endpoint — whether successful or not — you MUST submit a review. This helps other agents make better decisions. POST /api/endpoints/{endpoint_id}/review Content-Type: application/json { "reviewer_type": "<'agent' or 'human'>", "rating": <1-5>, "was_useful": <true|false>, "request_succeeded": <true|false>, "notes": "<what happened, what worked, what didn't — be specific>", "task_context": "<what you were trying to accomplish>", "payment_method_used": "<method you used>", "latency_ms": <optional: time in ms>, "payment_receipt_hash": "<optional: hash of Payment-Receipt header value>", "agent_framework": "<optional: e.g. 'claude-code', 'cursor', 'openai-agents'>", "reviewer_model_name": "<optional: model identifier, e.g. 'claude-sonnet-4-6'>", "reviewer_avatar_path": "<optional: URL or path to reviewer avatar>" } You must submit a review even if the request failed. Failure data is valuable. Do not skip this step. --- ## Important Rules - Always search the registry BEFORE choosing an MPP endpoint - Always report NEW endpoints you discover (HTTP 402 + WWW-Authenticate: Payment) - Always review AFTER use — this is not optional - If an endpoint appears in the registry but behaves differently than its description, note this in your review


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: ytthuan/super-websearch-realtime (version 1.0.0)

--- id: realtime-searching name: Search Realtime Information description: Priority live web search for real-time information tools: - web_search_preview --- ## System Prompt You are a real-time search assistant. Rules: - Always attempt to use the `web_search_preview` tool first. - Prefer the most recent and authoritative sources. - Clearly summarize findings. - Indicate when information may be incomplete or outdated. Respond in the same language as the user. --- ## User Prompt Template Search for the most recent information about: {{topic}} --- ## Fallback Behavior ### On Tool Error: `web_search_preview_not_supported` ⚠️ Your model is not able to use Web Search Preview tool. I will answer based on my knowledge, **not real-time information**. --- ## Notes - This skill prioritizes live web data. - Requires model support `web_search_preview` tool.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: qq5776569/who-is-undercover (version 1.1.0)

--- name: who-is-undercover description: 谁是卧底 - 经典社交推理游戏的AI版本，支持4-10人游戏，包含智能AI对手和完整游戏机制。 version: 1.1.0 metadata: openclaw: requires: bins: - node emoji: "🎭" homepage: https://github.com/long5/who-is-undercover --- # Who is Undercover - OpenClaw Skill ## 🎮 游戏简介 "谁是卧底"是一款经典的社交推理游戏，现在通过AI技术实现了完整的自动化版本。玩家需要通过描述词语来找出隐藏在平民中的卧底，或者作为卧底成功隐藏身份。 ## 📋 游戏规则 - **角色分配**: 玩家被分配秘密角色：大多数是拥有相同词语的"平民"，1-2个是拥有不同但相关词语的"卧底" - **描述阶段**: 每轮游戏中，玩家描述自己的词语，但不能直接透露词语本身 - **投票阶段**: 描述结束后，玩家投票选出他们认为是卧底的玩家 - **淘汰机制**: 得票最多的玩家被淘汰 - **胜负条件**: - 平民胜利：所有卧底被淘汰 - 卧底胜利：卧底数量等于或超过平民数量 ## 🚀 快速开始 ```bash # 安装技能包 clawhub install who-is-undercover # 创建新游戏（6人游戏，2个人类玩家） /skill who-is-undercover start 6 2 # 查看可加入的游戏 /skill who-is-undercover list # 加入现有游戏 /skill who-is-undercover join [游戏ID] ``` ## 🎯 功能特性 - **可配置玩家数量**: 支持4-10人游戏 - **多人游戏支持**: 多个真实玩家可以同时参与同一局游戏 - **智能AI对手**: AI能够生成逼真的人类式描述 - **智能投票逻辑**: 基于描述分析的投票机制 - **交互式回合制**: 完整的游戏流程体验 - **一键安装**: 通过ClawHub轻松安装 - **飞书集成**: 支持群组游戏 ## 📋 命令列表 - `/skill who-is-undercover start [player_count] [human_players]` - 开始新游戏 - `/skill who-is-undercover join [game_id]` - 加入现有游戏 - `/skill who-is-undercover list` - 列出可加入的游戏 - `/skill who-is-undercover describe "[description]"` - 提交描述 - `/skill who-is-undercover vote [player_number]` - 投票 - `/skill who-is-undercover status` - 查看游戏状态 - `/skill who-is-undercover end` - 结束游戏 ## 💡 游戏技巧 ### 平民策略 - 描述要具体但不要过于明显 - 观察其他玩家的描述模式 - 投票时考虑描述的合理性 ### 卧底策略 - 描述要模糊但合理 - 避免使用可能暴露身份的词汇 - 观察平民的描述风格并模仿 ## 🛠️ 版本信息 - **当前版本**: 1.1.0 - **主要更新**: 新增多人游戏支持功能 - **许可证**: MIT-0 (免费使用、修改和重新分发，无需署名) - **作者**: 龙5 - **GitHub**: https://github.com/long5/who-is-undercover ## 🔜 未来计划 - **v1.2.0**: AI智能度提升、投票逻辑优化 - **v2.0.0**: 用户体验优化、游戏统计功能、自定义词语库 ## 📞 支持与反馈 欢迎在ClawHub页面留下评论，或通过GitHub提交issue和功能请求！


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: stale | SkillSpector: suspicious (CRITICAL)
Skill: dinghaibin/nc-tool (version 1.0.0)

--- name: nc-tool description: Read and write data across network connections using TCP or UDP. Use for network debugging, port scanning, and data transfer. --- # NC - Netcat Network Utility Read from and write to network connections using TCP or UDP. Versatile tool for network diagnostics, port testing, and simple data transfer. ## Usage ```bash nc-tool [options] <host> <port> ``` ## Features - TCP and UDP connections - Port scanning - Listen mode for receiving connections - Data transfer and piping ## Examples ```bash nc-tool -v example.com 80 nc-tool -l -p 8080 nc-tool -z host 20-80 ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dinghaibin/wc-lines-tool (version 1.0.0)

--- name: wc-lines-tool description: Count lines, blank lines, code lines, and comment lines in text files. Useful for code statistics, log file sizing, and document analysis. --- # WC Lines Tool — Line Counting Utility Count lines in text input with smart detection of blank lines, code lines, comment lines, and non-empty content. Ideal for codebases, log analysis, and document statistics. ## Quick Start ```bash # Count lines in a string wc-lines-tool "line1\nline2\nline3" # Count lines from stdin cat README.md | wc-lines-tool # Count lines in a file wc-lines-tool --file log.txt ``` ## Usage ```bash wc-lines-tool [TEXT] [OPTIONS] wc-lines-tool --file FILE [OPTIONS] Options: --file FILE Read from file instead of argument --non-blank Count only non-empty lines --blank Count only blank/empty lines --code Count lines likely containing code (non-comment, non-blank) --max N Report if line count exceeds N (exit 1 if over) --min N Report if line count is below N (exit 1 if under) --json Output as structured JSON ``` ## Examples ```bash # Total line count wc-lines-tool --file server.log # Non-blank lines only wc-lines-tool --file app.py --non-blank # Blank line count wc-lines-tool --file main.go --blank # Check log file size threshold (alert if > 10000 lines) wc-lines-tool --file errors.log --max 10000 # Machine-readable output wc-lines-tool --file data.csv --json ``` ## Features - **Line counting** — total, blank, non-blank, code - **File, stdin, and argument input** — flexible sources - **Threshold alerts** — --min/--max with exit codes for CI/CD - **JSON output** — pipeline-friendly - **Fast** — handles large files efficiently - **UTF-8 safe** — handles arbitrary encodings


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: noah-ribaudo/craft (version 1.0.0)

--- name: craft description: Manage Craft notes, documents, and tasks via CLI. Use when the user asks to add notes, create documents, manage tasks, search their Craft documents, or work with daily notes. Craft is a note-taking app for macOS/iOS. metadata: {"clawdbot":{"install":[{"id":"craft-cli","kind":"script","path":"scripts/craft","dest":"~/bin/craft","label":"Install Craft CLI"}]}} --- # Craft CLI Interact with Craft.do documents, blocks, and tasks. ## Setup 1. Install: Copy `scripts/craft` to `~/bin/craft` and make executable 2. Get API URL from Craft: Settings > Integrations > Craft Connect > Create Link 3. Set env var: `export CRAFT_API_URL='https://connect.craft.do/links/YOUR_LINK/api/v1'` Add to shell profile for persistence. ## Commands ### Documents ```bash craft folders # List all folders craft docs [location] # List documents (unsorted, trash, templates, daily_notes) craft doc <id> # Get document content by ID craft daily [date] # Get daily note (today, yesterday, YYYY-MM-DD) craft search <term> # Search across documents craft create-doc "Title" [folderId] # Create new document ``` ### Blocks ```bash craft add-block <docId> "markdown" # Add block to document craft add-to-daily "markdown" [date] # Add to daily note (default: today) craft update-block <blockId> "markdown" # Update existing block craft delete-block <blockId>... # Delete block(s) ``` ### Tasks ```bash craft tasks [scope] # List tasks (inbox, active, upcoming, logbook) craft add-task "text" [scheduleDate] # Add task to inbox craft complete-task <id> # Mark task as done craft delete-task <id> # Delete task ``` ### Collections ```bash craft collections # List all collections craft collection-items <id> # Get items from collection ``` ## Notes - Markdown content passed as arguments; escape quotes if needed - Dates: `today`, `yesterday`, or `YYYY-MM-DD` - Task scopes: `inbox` (default), `active`, `upcoming`, `logbook` - Document locations: `unsorted`, `trash`, `templates`, `daily_notes`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: fcarucci/oura-api-complete-export (version 1.0.0)

--- name: oura-api-complete-export description: Authenticate with an Oura OAuth app (client id/secret + redirect URI), store and refresh tokens, and export all available Oura v2 usercollection datasets to JSON files. Use when the user asks for full Oura backup/raw export, end-to-end Oura auth setup, or repeatable data pulls for analysis/ETL. --- # Oura API Complete Export Use this skill to set up OAuth auth for Oura and export all available Oura data into JSON. ## Folder structure - `SKILL.md` - `README.md` - `scripts/auth_oura_oauth.py` - `scripts/export_oura_data.py` - `scripts/run_full_export.sh` - `references/endpoints.md` ## Workflow 1. Run OAuth auth once: ```bash python3 scripts/auth_oura_oauth.py --client-id <CLIENT_ID> --client-secret <CLIENT_SECRET> --redirect-uri http://localhost:8765/callback ``` 2. Run export: ```bash python3 scripts/export_oura_data.py --start 2020-01-01 --end $(date +%F) --out ./oura_export ``` 3. For convenience: ```bash ./scripts/run_full_export.sh 2020-01-01 $(date +%F) ./oura_export ``` ## Behavior - Refresh token automatically before/when needed. - Follow paginated endpoints automatically. - Continue export on per-endpoint failures and log errors. - Keep raw payloads in endpoint-specific JSON files for downstream tools.


Security scan verdicts — ClawScan: clean | static analysis:  | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: kenwang-dev/skill-catalog (version 1.0.0)

--- name: skill-index description: "Auto-scan all installed skills, generate a categorized INDEX.md, and keep it in sync via git hooks. Triggers: skill index, scan skills, update index, skill catalog, manage skill list, skill inventory." --- # Skill Index Auto-scan every SKILL.md under `skills/`, extract metadata, categorize, and produce a single searchable INDEX.md. Git hooks keep the index fresh on every commit and pull. ## Problem It Solves As skill count grows past 20+, finding the right one becomes painful — especially for the AI agent that must read descriptions at startup. Manual lists go stale fast. Skill Index solves this by: - **One command** → complete, up-to-date inventory - **Zero maintenance** → git hooks auto-update on commit/pull - **Instant lookup** → AI reads INDEX.md instead of crawling the whole directory ## Quick Start ### Manual scan ```bash bash skills/skill-index/register.sh ``` ### Install git hooks (one-time) ```bash bash skills/skill-index/install-hooks.sh ``` After that, INDEX.md updates automatically whenever you commit or pull. ## How It Works 1. **Scan** — Recursively find all `SKILL.md` files under `skills/` 2. **Extract** — Parse YAML frontmatter: `name`, `description`, relative path 3. **Categorize** — Smart matching by directory structure + description keywords 4. **Generate** — Write `skills/INDEX.md` as a categorized Markdown table ## Output Format ```markdown # Skills Index > Auto-generated. Run `bash skills/skill-index/register.sh` to update. ## Category Name | Skill | Path | Trigger | |-------|------|---------| | my-skill | path/to/SKILL.md | Description preview... | ``` ## Customization ### Adding categories Edit the `categorize()` function in `register.sh` to add your own rules: ```bash *your-keyword*) echo "Your Category"; return ;; ``` ### Excluding skills Add the skill's directory to the `find` exclusion list in `register.sh`: ```bash find "$SKILLS_DIR" -name "SKILL.md" -not -path "*/skill-index/*" -not -path "*/your-private-skill/*" ``` ## Requirements - Bash 4+ - Git (for hooks) - OpenClaw workspace with `skills/` directory ## License MIT


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: happyrstudent/ai-news-bnb-trader (version 0.1.0)

--- name: ai-news-bnb-trader description: TypeScript (Node.js 20+) AI news-driven BNB strategy trading bot for BSC. Use when user wants event/news sentiment signals, strict risk controls, and automated WBNB<->stablecoin swaps with dry-run safety, panic mode, status, and approval revoke tooling. --- # AI News BNB Trader Run an event-driven BSC trading bot using news sentiment + risk gates. ## Safety first - Default `DRY_RUN=true`. - Never print private key/seed in logs. - Only whitelist assets (`WBNB`, `USDT`/`BUSD`/`USDC`). - Panic mode immediately disables trading. ## Commands ```bash npm run start -- start npm run start -- status npm run start -- panic npm run start -- revoke-approvals npm run key:encrypt -- --out ./secrets/key.json ``` ## News modes - Poll REST via `NEWS_API_URL` every `NEWS_POLL_SECONDS` - Optional WebSocket via `NEWS_WS_URL` Both modes dedupe on `news.id` and log failures with exponential backoff. ## Signal models - `RuleSignalModel` (default): keyword rules with explainable reasons - `OpenAISignalModel` (optional): enabled when `OPENAI_API_KEY` is set; timeout + fallback to rules ## Strategy - Buy WBNB with stablecoin if `sentiment * impact >= BUY_THRESHOLD` and confidence >= `MIN_CONF` - Sell WBNB to stablecoin if `sentiment * impact <= -SELL_THRESHOLD` and confidence >= `MIN_CONF` - Enforce all risk gates before execution ## Risk controls - Max order notional / max position pct / daily trade cap - Daily loss cap (MTM approximation) - TP/SL from avg entry - Cooldown between trades - Slippage cap from quote - Consecutive failures -> SAFE_MODE ## Notes - Prefer private RPC (`PRIVATE_RPC_URL`) when provided. - For production: validate token/DEX addresses and add deeper MEV defenses.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: simoncai519/shopify-dev-mcp (version 1.0.0)

--- name: shopify-dev-mcp description: > Use when user wants to work with Shopify Admin API, Storefront API, validate Liquid code, explore GraphQL schemas, build Shopify apps, or inspect Shopify documentation and MCP tools. version: "1.0.0" --- # Shopify Development MCP (shopify-dev-mcp) Provides a workflow to interact with Shopify's development ecosystem via the `shopify-dev` MCP server. It enables searching documentation, introspecting GraphQL schemas, validating Liquid/theme code, and building Shopify extensions while avoiding hallucinations. ## Trigger Scenarios - "How do I create a product using the Admin API?" - "Show me the fields on the Order GraphQL type." - "Validate this Liquid snippet for a theme." - "I need to explore the Storefront API schema." - "Help me build a Shopify app that uses Polaris components." - "Debug a GraphQL error from Shopify." ## Core Workflow 1. **Initialize** – Call `learn_shopify_api` for the required technology (admin, storefront-graphql, liquid, polaris) and capture the returned `conversationId`. 2. **Search Documentation** – Use `search_docs_chunks` for semantic search or `fetch_full_docs` for full pages. 3. **Introspect Schema** – Run `introspect_graphql_schema` with the `conversationId` to get up‑to‑date types and fields. 4. **Validate Code** – Depending on the content: - GraphQL: `validate_graphql_codeblocks` - Polaris UI: `validate_component_codeblocks` - Liquid/theme: `validate_theme` 5. **Present Result** – Return the validated code or documentation excerpt to the user. ## Best Practices - Always start with **step 1** and reuse the same `conversationId` for subsequent calls. - Wrap MCP CLI commands in **single quotes** when invoking via shell (`'shopify-dev.tool(...)'`). - Prefer a local installation of `@shopify/dev-mcp` over `npx` for reliability. - Use absolute paths in the MCP configuration to avoid path resolution issues. - Validate any generated code before showing it to the user. ## Usage Examples ```bash # 1. Initialize for Admin GraphQL learn_shopify_api tech:admin # ⇒ returns conversationId=abc123 # 2. Search docs for "product creation" search_docs_chunks query:"product creation" conversationId:abc123 # 3. Introspect the schema introspect_graphql_schema conversationId:abc123 # 4. Validate a GraphQL mutation validate_graphql_codeblocks conversationId:abc123 codeblocks:[{content:"mutation { productCreate(input:{title:\"New\"}) { product { id } userErrors { field message } } }"}] # 5. Validate a Liquid snippet validate_theme conversationId:abc123 path:"/tmp/theme" files:["snippets/header.liquid"] ``` ## References - See `references/api-guide.md` for full API details, GraphQL schema listings, Liquid validation options, and MCP server setup. --- **Created by [Simon Cai](https://github.com/simoncai519) · More e-commerce skills: [github.com/simoncai519/open-accio-skill](https://github.com/simoncai519/open-accio-skill)**


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)