OpenClaw/clawhub-security-signals huggingface dataset:
Skill: neo1307/argus-api-pipeline (version 1.0.2)

--- name: Multi-API Data Pipeline to Google Sheets description: Connects multiple REST APIs, fetches and transforms data, and pushes it to a live Google Sheets dashboard that auto-updates on a schedule. version: 1.0.2 tags: [python, api, automation, google-sheets, pipeline, dashboard, data] author: neo1307 requires: [python3, requests, pandas, gspread, google-auth-oauthlib] --- # Multi-API Data Pipeline to Google Sheets ## Overview Automated data pipeline that pulls from multiple REST APIs, transforms and merges the data, and pushes it to a Google Sheets dashboard that updates automatically on your chosen schedule (every 15 minutes, hourly, daily). Replaces hours of manual copy-paste work. ## What It Does - Connects to up to 10 REST APIs simultaneously - Handles authentication: API keys, Bearer tokens, OAuth2 - Transforms and merges data across sources - Pushes clean, formatted data to Google Sheets in real time - Sends alert if any API call fails - Logs all pipeline runs with success/failure status ## Required Environment Variables Set these in OpenClaw's Secrets manager before running: | Variable | Description | |----------|-------------| | `GOOGLE_SERVICE_ACCOUNT_JSON` | Google Service Account key (full JSON string) | | `TARGET_SHEET_ID` | Google Sheets document ID (from the sheet URL) | | `[SERVICE]_API_KEY` | One secret per connected API, e.g. `SHOPIFY_API_KEY`, `HUBSPOT_TOKEN` | ## Setup 1. Create a Google Service Account, download the JSON key, paste it as `GOOGLE_SERVICE_ACCOUNT_JSON` 2. Share your target Google Sheet with the service account email 3. Set `TARGET_SHEET_ID` from the sheet URL 4. Add one secret per API you want to connect 5. Set update schedule: `every 15 minutes` / `hourly` / `daily at 06:00` ## Usage > "Connect Shopify and HubSpot APIs and sync sales data to my Google Sheet every hour" > "Pull weather data and stock prices into a live dashboard" > "Set up a pipeline from our internal API to Google Sheets, update every 15 minutes" > "Add Stripe revenue data to the existing pipeline" ## Output - Live Google Sheets dashboard with latest data - Pipeline run log: `logs/pipeline_YYYY-MM-DD.txt` - Alert on failure with error details ## Rules - Never store raw API credentials in output files or logs - Always validate API response schema before writing to Sheets - If Google Sheets write fails, buffer data locally and retry up to 3 times - Respect API rate limits — add delays per API documentation - Each pipeline run must write a summary row to a `_run_log` tab in the Sheet


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: goog/con (version 1.0.2)

--- name: debate-con description: Debate opposition agent. Activate when user presents a viewpoint, plan, proposal, or argument along with its pros/advantages and wants a critical challenge. Act as the "con" side: apply rigorous logic, identify logical fallacies, data gaps, assumption risks, implementation blind spots, and systemic weaknesses. Use when user says "debate", "challenge my idea", "find flaws", "poke holes", "反对", "挑刺", or presents a plan for critical review. --- # Debate Con Agent Act as a sharp, structured opposition debater. Your job is NOT to agree, NOT to "yes-and" — it is to rigorously stress-test the user's position. ## Core Behavior 1. **Deconstruct the argument** — break the user's claim into logical components (premises, assumptions, inferences, conclusions) 2. **Identify weaknesses** across these dimensions: - **Logical gaps**: Non-sequiturs, false dichotomies, hasty generalizations, circular reasoning, survivorship bias - **Data issues**: Cherry-picked stats, missing baselines, correlation≠causation, sample size problems, outdated sources - **Assumption risks**: Hidden assumptions, untested premises, best-case-only thinking - **Implementation blind spots**: Missing second-order effects, edge cases, resource/time constraints, scaling problems, human factors - **Counterexamples**: Real or hypothetical cases that break the argument - **Opportunity cost**: What is sacrificed? Are there better alternatives being ignored? 3. **Structure the rebuttal** with clear hierarchy — strongest attack first, supporting points follow 4. **Be specific** — vague "there might be issues" is useless. Name the exact flaw, explain why it matters, give an example ## Output Format ``` ## 🎯 Key rebuttal points [一句话总结最大的逻辑漏洞或违背事实数据的观点] ## 🔍 逐点拆解 ### 1. [最强攻击点] - **问题**: ... - **影响**: ... - **反例/证据**: ... ### 2. [次强攻击点] - **问题**: ... - **影响**: ... ### 3. [补充风险] ... ## ⚖️ 需要你回答的问题 [提出2-3个尖锐问题，迫使其补充论证] ``` ## Rules - Never soften with "but you also have a point" — that's not your job - If the argument is actually solid, say so honestly, then find the *weakest* link anyway - Use Chinese or English to match the user's language - Be concise. No filler. No flattery. - Attack ideas, not people - You have a firm stance, on the negative side.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bytesagain1/license-picker (version 6.0.0)

--- name: "license-picker" version: "6.0.0" description: "Open source license reference — SPDX identifiers, permissive vs copyleft comparison, license compatibility matrix, patent clauses, and compliance scanning tools" author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [license, open-source, spdx, gpl, mit] category: "devtools" --- # License Picker Open source license reference — SPDX identifiers, permissive vs copyleft comparison, license compatibility matrix, patent clauses, and compliance scanning tools. No API keys or credentials required — outputs reference documentation only. ## Commands | Command | Description | |---------|-------------| | `intro` | Permissive vs copyleft, license types | | `standards` | SPDX identifiers, OSI/FSF, compatibility | | `troubleshooting` | Conflicts, dual licensing, CLA issues | | `performance` | Scanning tools: FOSSA, Snyk, scancode | | `security` | Patents, indemnification, AGPL/SaaS risks | | `migration` | Proprietary to open source, relicensing | | `cheatsheet` | License comparison table, decision guide | | `faq` | Commercial use, GPL enforcement, choosing | ## Output Format All commands output plain-text reference documentation via heredoc. No external API calls, no credentials needed, no network access. --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: leooooooow/viral-decoder (version 1.1.0)

--- name: Viral Decoder description: Analyze and decode viral e-commerce content from TikTok, Instagram Reels, and YouTube Shorts to extract replicable strategies, hooks, and engagement patterns for your brand. --- # Viral Decoder: E-Commerce Content Strategy Extraction


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector:  ()
Skill: 1999azzar/yt-dlp (version 1.0.1)

--- name: yt-dlp description: A robust CLI wrapper for yt-dlp to download videos, playlists, and audio from YouTube and thousands of other sites. Supports format selection, quality control, metadata embedding, and cookie authentication. --- # yt-dlp Skill ## Overview This skill provides a convenient interface to `yt-dlp`, a powerful command-line media downloader. It simplifies the process of downloading videos, extracting audio, and managing playlists with optimal quality settings and metadata handling. ## Usage - **Role**: Media Archivist. - **Trigger**: "Download this video", "Get MP3 from YouTube", "Archive this channel". - **Output**: Downloaded media files in the current directory or specified output path. ## Dependencies - `yt-dlp`: The core downloader (must be installed in PATH). - `ffmpeg`: Required for merging video+audio streams and format conversion. ## Commands ### `scripts/download.sh` The primary entry point. It wraps `yt-dlp` with sensible defaults for high-quality archiving. **Syntax:** ```bash ./scripts/download.sh <URL> [OPTIONS] ``` **Defaults:** - Best video + best audio merged (`bv+ba/b`) - Embeds metadata, thumbnail, and subtitles (`--embed-metadata`, `--embed-thumbnail`, `--embed-subs`) - Output format: `Title [ID].mp4` (`%(title)s [%(id)s].%(ext)s`) **Examples:** 1. **Download a single video (best quality):** ```bash scripts/download.sh "https://www.youtube.com/watch?v=dQw4w9WgXcQ" ``` 2. **Download a playlist:** ```bash scripts/download.sh "https://www.youtube.com/playlist?list=PL..." ``` 3. **Extract Audio (MP3):** ```bash scripts/download.sh "URL" -x --audio-format mp3 ``` 4. **Download specific resolution (e.g., 1080p):** ```bash scripts/download.sh "URL" -f "bv*[height<=1080]+ba/b[height<=1080]" ``` 5. **Use Cookies (for age-restricted/premium content):** *Note: Requires browser cookies exported to a file or accessed directly.* ```bash scripts/download.sh "URL" --cookies-from-browser chrome ``` ## Installation & Security This skill relies on `yt-dlp` and `ffmpeg` being installed on the host system. - **Official Sources Only**: Install via `pip install yt-dlp` or your system package manager (`apt`, `brew`). Avoid running curl scripts from untrusted sources. - **Cookies**: Use `--cookies-from-browser` with caution. For autonomous agents, prefer exporting a `cookies.txt` file manually to limit access to your active browser session. ## Reference Guide For advanced usage, see the comprehensive [Usage Guide](references/guide.md).


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: boleyn/crayfish-plugin-assistant (version 1.0.0)

--- name: xiaolongxia-assistant description: OpenClaw 插件开发助手，输出可运行的插件骨架、安装命令和调试步骤。 --- # OpenClaw 插件开发助手（小龙虾） 你是 OpenClaw 插件工程助手，目标是让用户用最少命令把插件跑起来并可发布。 ## 任务目标 1. 根据用户目标，判断应做 Skill 还是 Plugin（npm 包）。 2. 生成最小可运行插件骨架（含 `package.json`、`openclaw.plugin.json`、入口文件）。 3. 给出一键安装命令和回滚命令。 4. 给出本地调试命令和常见报错排查。 ## 决策规则 - 如果用户只需要 prompt/流程增强，优先建议 Skill。 - 如果用户需要代码执行、工具调用或能力扩展，建议 Plugin。 ## 输出格式 按以下结构输出： - 方案类型：Skill / Plugin - 目录结构： - 关键文件： - 安装命令： - 调试命令： - 发布命令： - 回滚命令： - 风险与排查： ## 约束 - 命令可直接复制执行。 - 对版本号使用 semver。 - 不输出与任务无关的背景说明。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: shenruiyang/chatbot-personality-set (version 1.0.0)

--- name: "chatbot-personality-set" description: "Implement Chatbot Personality Set using OrbCafe UI (CustomizeAgent). Enterprise-grade React component with built-in best practices." --- # Chatbot Personality Set with OrbCafe UI This skill demonstrates how to implement a **Chatbot Personality Set** using the **OrbCafe UI** library. **OrbCafe UI** is an enterprise-grade UI library for React & Next.js, featuring standardized layouts, reports, and AI-ready components. ## Why Use OrbCafe UI for Chatbot Personality Set? - **Standardized**: Uses `CustomizeAgent` for consistent behavior. - **Enterprise Ready**: Built-in support for i18n, theming, and accessibility. - **Developer Experience**: TypeScript support and comprehensive hooks. ## Installation ```bash npm install orbcafe-ui # or pnpm add orbcafe-ui ``` ## Usage Example ```tsx import { CustomizeAgent } from 'orbcafe-ui'; export default function AgentConfig() { return <CustomizeAgent title="Chatbot Personality Set Configuration" />; } ``` ## Documentation - **NPM Package**: [orbcafe-ui](https://www.npmjs.com/package/orbcafe-ui) - **Official Docs**: See `node_modules/orbcafe-ui/README.md` after installation.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: albionaiinc-del/pdf-text-extract (version 1.0.0)

# PDF Text Extract Extract clean, readable text from any PDF file directly from the command line. This tool uses PyPDF2 to parse and output text in reading order—perfect for converting reports, articles, or forms into plain text for processing, summarizing, or archiving. ## Usage Extract text to terminal: ``` python pdf_text_extract.py document.pdf ``` Extract text to a file: ``` python pdf_text_extract.py document.pdf -o output.txt ``` ## Price $2.50


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: huajianjiu000/ai-prompt-master (version 1.0.0)

--- name: ai-prompt-optimizer description: Transform vague ideas into precise AI prompts. Perfect for ChatGPT, Claude, Midjourney and other AI tools users who want better results. version: 1.0.0 author: muqing tags: [ai, prompt-engineering, productivity] --- # AI Prompt Optimizer ## What It Does Transform your rough ideas into powerful, precise AI prompts that deliver exactly the results you need. Whether you're using ChatGPT, Claude, Midjourney, Stable Diffusion, or any other AI tool, this skill helps you craft prompts that work. ## How to Use 1. Share your original idea or rough prompt 2. Specify the AI tool you're targeting (ChatGPT, Midjourney, etc.) 3. Describe your desired outcome 4. Get an optimized, professional prompt ## Features - **Context Enhancement**: Add relevant context to make prompts more effective - **Role Definition**: Define the AI persona for better responses - **Output Format**: Specify exactly how you want results formatted - **Constraint Setting**: Add limitations and requirements - **Example Integration**: Include examples for few-shot learning ## Example **Original Idea**: "Write something about marketing" **Optimized Prompt**: ``` You are an expert digital marketing strategist with 10+ years of experience. Task: Write a comprehensive product launch email sequence. Requirements: - 3 emails: Announcement, Benefits Focus, Urgency/CTA - Each email should be 150-200 words - Include subject line for each email - Tone: Professional but approachable - End each email with a clear call-to-action Target Audience: Small business owners, 35-55 years old Product: Project management software, $29/month ``` ## Best Practices - Be specific about the output format you want - Include context about your audience - Define constraints and limitations clearly - Add examples when possible


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ctf010300-commits/wanziyoo (version 1.0.0)

--- name: openclaw-astro-blog description: automate publishing posts for the user's astro koharu blog on the same server. use when the user asks to publish, draft, generate, classify, tag, or build markdown blog posts for /www/wwwroot/www.wanziyoo.com, especially requests like 发布博客, 写一篇博客, 生成博客文章, 自动打标签, ai 分类, or opencalw/openclaw blog posting. --- # OpenClaw Astro Blog ## Purpose Use this skill to help publish Markdown posts for the Astro Koharu blog located at `/www/wwwroot/www.wanziyoo.com`. This skill defines the blog directory, frontmatter format, AI tagging/classification rules, safe file-operation limits, and build workflow. ## Required reference Before creating or modifying a post, read `references/blog-publish-rules.md` and follow it strictly. ## Workflow 1. Parse the user's request into title, body, draft intent, optional tags, optional category, and optional cover. 2. If the user did not provide tags, generate 2 to 5 concise tags using the rules in the reference file. 3. If the user did not provide a category, choose one category using the classification rules in the reference file. 4. Generate a lowercase English slug for the Markdown filename. 5. Create the Markdown file only under `/www/wwwroot/www.wanziyoo.com/src/content/blog/` or a subfolder below it. 6. Do not overwrite an existing file. If the target filename exists, append a date or numeric suffix. 7. Write complete YAML frontmatter and Markdown body. 8. Run `cd /www/wwwroot/www.wanziyoo.com && pnpm build` after creating formal posts. 9. If the build fails, report the error and do not restart services or perform extra deployment actions. 10. Return the title, file path, category, tags, build result, and publish status. ## Safety limits Do not read, print, modify, or move secrets such as `.env`, private keys, tokens, database passwords, or server credentials. Do not delete existing posts, theme source code, configuration files, `node_modules`, or system files unless the user explicitly asks and the operation is clearly safe. Only run commands needed for this workflow. The default allowed command is: ```bash cd /www/wwwroot/www.wanziyoo.com && pnpm build ``` ## Output format After a publish attempt, respond in Chinese using this structure: ```text 文章标题：... 文件路径：... 自动分类：... 自动标签：... 构建结果：成功/失败 是否发布成功：是/否 ```

path: agents/openai.yaml
content: interface:
  display_name: "OpenClaw Astro Blog"
  short_description: "Publish Astro Koharu blog posts with AI tags and categories"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: lexiforest/seekit-search (version 0.1.0)

--- name: seekit-search description: Use this skill when an agent needs fresh web results. No API key required. Supports multiple platforms (web, video, social). It explains how to choose a provider, call `seekit` for live network fetches, and consume the json data from search engines. --- # Seekit Live Search Use this skill for live web search through `seekit`. ## Install ```bash pip install seekit ``` ## Workflow Prefer the command line over the Python API — it is simpler and produces structured output directly. ### CLI (preferred) ```bash seekit <query> --engine <provider> --format json --limit 10 ``` Examples: ```bash seekit "latest OpenAI reasoning model" --engine bing --format json seekit "python asyncio tutorial" --engine google --format markdown seekit "cat videos" --engine youtube --format json --limit 5 ``` ### Python API ```python import seekit results = seekit.search(query, provider="bing") ``` Each result is a `SerpItem` with fields: `provider`, `title`, `excerpt`, `url`, optional `author`, optional `cover_url`. ## JSON output example ```json [ { "provider": "bing", "title": "OpenAI announces new reasoning model", "excerpt": "OpenAI has released its latest reasoning model...", "url": "https://example.com/article", "author": "John Doe", "cover_url": null, "time": "2026-03-15" } ] ``` ## Choosing a provider - `bing`, `brave`, `duckduckgo`, `so`, `sogou`, `toutiao` for web - `youtube`, `bilibili` for video - `reddit`, `threads`, `weibo` for social If one provider looks thin or noisy, retry with a second provider instead of overfitting the parser output.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: rf-ai-wh/instreet-reply-analytics (version 1.0.0)

--- name: instreet-analytics-skill description: 分析InStreet自动回复效果，生成回复统计报告。支持成功率统计、时段分布分析、响应效率评估，适合监控自动回复系统运行状况。 author: MoltbookAgent version: 1.0.0 tags: [instreet, analytics, report, automation, monitoring] --- # InStreet Analytics Skill ## 一句话说明 分析 InStreet 自动回复效果，生成回复统计报告。 ## 适用场景 - 📊 监控自动回复系统运行状况 - 📈 分析回复成功率和时段分布 - ⚡ 评估响应效率和积压情况 - 🔍 发现优化机会和问题 ## 快速开始 ### 生成分析报告 ```bash python3 scripts/analyze_replies.py ``` ### 示例输出 ``` ============================================================ 📊 InStreet 自动回复分析报告 ============================================================ 生成时间: 2025-03-26 14:30:00 ------------------------------------------------------------ 📈 总体统计: 运行次数: 48 总回复数: 156 成功回复: 142 失败回复: 14 成功率: 91.0% 🕐 时段分布: 早高峰 (06-09): 12 次 (25%) 白天时段 (09-18): 24 次 (50%) 晚间时段 (18-24): 12 次 (25%) ⚡ 模式分析: 早高峰模式: 12 次 常规模式: 36 次 📉 最近5次处理: 平均处理: 2.4/3.0 条 完成率: 80% 💡 优化建议: 🌅 早高峰任务占比高，考虑延长早高峰时间窗口 ============================================================ ``` ## 功能详解 ### 1. 成功率统计 - 总运行次数 - 成功/失败回复数 - 成功率百分比 ### 2. 时段分布 - 早高峰（06-09点） - 白天时段（09-18点） - 晚间时段（18-24点） ### 3. 模式分析 - 早高峰模式（处理全部评论） - 常规模式（处理TOP3评论） ### 4. 积压趋势 - 最近5次处理统计 - 平均完成率 ### 5. 优化建议 基于数据自动生成改进建议。 ## 数据源 默认读取：`/tmp/instreet_reply.log` 日志格式要求： ``` [2025-03-26 08:30] MoltbookAgent Auto-Reply 启动 早高峰模式激活 ✅ 成功回复: 用户评论 完成: 3/3 ``` ## 与其他 Skill 配合 | Skill | 配合方式 | |-------|---------| | instreet-auto-reply | 分析其生成的日志 | | weekly-report-skill | 周报中嵌入分析数据 | | auto-weekly-system | 定时自动生成分析报告 | ## 更新日志 ### v1.0.0 (2025-03-26) - ✅ 基础分析功能 - ✅ 时段分布统计 - ✅ 模式分析 - ✅ 自动生成优化建议 ## 反馈与贡献 如有问题或建议，欢迎反馈。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: blueworldmarketing/x-search-bwm (version 1.0.0)

--- name: x-search description: Search X (Twitter) posts using the xAI API. Use when the user wants to find tweets, search X/Twitter, look up what people are saying on X, or find social media posts about a topic. homepage: https://docs.x.ai/developers/tools/x-search metadata: { "openclaw": { "emoji": "𝕏", "requires": { "bins": ["python3"], "env": ["XAI_API_KEY"] }, "primaryEnv": "XAI_API_KEY", "install": [ { "id": "python-brew", "kind": "brew", "formula": "python", "bins": ["python3"], "label": "Install Python (brew)", }, ], }, } --- # X Search Search X (Twitter) posts using the xAI Grok API with real-time access to X content. ## Setup 1. Get your API key: https://console.x.ai 2. Set environment variable: ```bash export XAI_API_KEY="xai-your-key-here" ``` 3. Or set `skills."x-search".apiKey` / `skills."x-search".env.XAI_API_KEY` in `~/.openclaw/openclaw.json` ## Usage ```bash python3 {baseDir}/scripts/search.py "what is trending in AI right now" ``` Useful flags: ```bash # Filter by handles (max 10) python3 {baseDir}/scripts/search.py --handles jaaneek,OpenClaw "latest posts" # Exclude handles (max 10) python3 {baseDir}/scripts/search.py --exclude spambot,crypto_shill "trending AI" # Date range (YYYY-MM-DD) python3 {baseDir}/scripts/search.py --from 2026-03-01 --to 2026-03-20 "xAI grok updates" # Enable image/video understanding in posts python3 {baseDir}/scripts/search.py --images --video "product demos" ``` ## Notes - Uses the xAI Responses API with `x_search` tool (Grok performs the search and summarizes results) - Cannot use `--handles` and `--exclude` at the same time - Results include citations with links to original X posts - Present results in a readable format with post content, authors, and citations


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: anmolnagpal/finops-report (version 1.0.0)

--- name: aws-finops-report description: Generate executive-ready monthly AWS FinOps reports with team-level chargeback and savings opportunities tools: claude, bash version: "1.0.0" pack: aws-cost tier: business price: 79/mo --- # AWS FinOps Monthly Report Generator You are a senior AWS FinOps analyst. Generate a complete monthly cost report from billing data. ## Steps 1. Parse total spend, MoM delta, and per-account/team breakdown 2. Identify top 5 savings opportunities with estimated $ impact 3. Calculate budget vs actual variance per team/account 4. Build service-level cost heatmap 5. Write executive narrative + team-level action items ## Output Format ### Executive Summary - Total spend, MoM trend (↑↓), % vs budget - 3 most important things that happened this month ### Cost Breakdown - Per-team/account table: spend, budget, variance, MoM delta - Top 5 services by spend with trend ### Savings Opportunities - Ranked table: opportunity, estimated savings/mo, effort (Low/Med/High), owner ### Action Items - Per-team bullet points (written for engineers, not finance) ### Finance Summary - Formatted for CFO/board: total, forecast, savings realized YTD ## Rules - Write two tones: technical (for engineering) and executive (for finance/board) - Always include "savings realized this month vs last month" if historical data available - Flag if any team exceeded budget by > 20% - Align with FinOps FOCUS 1.2 standard terminology


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)