OpenClaw/clawhub-security-signals huggingface dataset:
Skill: upwell/pdf-compressor (version 0.1.4)

--- name: pdf_compressor description: "Compresses a given PDF file to reduce its size." version: "1.0.0" runtime: shell entrypoint: "uv run src/main.py" inputs: - name: pdf_path type: string description: "The absolute path to the PDF file to be compressed." required: true - name: compression_level type: integer description: "Compression level (1=Low, 2=Medium, 3=High). Defaults to 2." required: false default: 2 output: type: json description: "JSON object containing compression success status and data like the compressed file path, original size, and compressed size." --- # PDF Compressor Skill This skill is designed to compress a PDF file to reduce its size using standard optimization parameters. It is powered by PyMuPDF and offers three tunable compression levels depending on the user's needs. ## Usage Guide When using this skill to compress a PDF, you should provide the `pdf_path` (absolute path to the target PDF) and optionally the `compression_level` (from 1 to 3). The skill will return the output path of the newly created compressed PDF. - **Level 1 (Low)**: Basic compression, fastest. - **Level 2 (Medium)**: Optimized compression, balanced speed and file size reduction (Default). - **Level 3 (High)**: Deep optimization for maximum file size reduction.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kl0nlutiy/ebay-price-check (version 1.0.0)

# eBay Price Check Skill Check eBay item prices, including sold listings for historical data. ## Usage ### Check current price of an item ``` /eBay price check iPhone 14 Pro Max 256GB ``` ### Check sold prices (historical data) ``` /eBay sold prices MacBook Pro 14" M3 ``` ### Get price history summary ``` /eBay price history Samsung Galaxy S23 ``` ## Capabilities - **Search eBay** for items by keyword - **Get current listing prices** (active listings) - **Get sold prices** (historical data from sold listings) - **Price range analysis** (min/max/average) - **Shipping cost information** - **Item condition filtering** (new, used, refurbished) ## How it Works 1. Searches eBay using their public search API 2. Parses results to extract prices, titles, shipping costs 3. For sold prices, filters by "Sold Items" category 4. Returns formatted summary with price statistics ## Notes - Requires internet connection - eBay may limit search frequency - Sold data may not be available for all items - Prices shown are in USD unless specified


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: wewehg/tesp (version 1.0.3)

--- name: tesp description: Enforce the Task Execution Signal Protocol for non-instant work so execution stays visible, staged, versioned, and auditable. Use when a task will take more than an immediate reply, spans multiple steps, needs async follow-through, involves cross-agent coordination, or requires active progress signaling, blocker escalation, queue hygiene, or result handoff. Trigger on requests about long tasks, execution tracking, task orchestration, status visibility, rollout audit, progress cadence, task boards, or reducing the need for the human to chase updates. 中文简介：用于非即时任务的任务执行信号协议。适用于长任务、多步骤任务、异步执行与多 agent 协作场景，要求快速接收确认、阶段进度广播、阻塞升级、任务看板与结果落位，并通过版本可见、数字进度、活跃板/归档板和低 token 巡检，避免人类反复追问状态。 --- # TESP Apply TESP whenever silence would create coordination risk. ## 中文简介 TESP（Task Execution Signal Protocol / 任务执行信号协议）是一套面向非即时任务的执行治理协议。 它的核心不是“把任务做完”本身，而是让执行过程对协作者可见、可查、可监督。 适用于研究、迁移、排查、实施、跨 agent 协作、异步任务和任何需要持续推进但不能静默消失的工作。 ## What this skill is for TESP turns long or multi-step work into a visible execution flow. It is for tasks that need acknowledgement, staged progress, blockers, active task tracking, and clean handoff discipline. Typical triggers: - “Do this and keep me posted.” - “Break this big task down and supervise execution.” - “Set a working protocol so I don’t need to chase status.” - “Audit whether agents are actually following the execution standard.” - “Clean up the task board so only current work stays visible.” ## Core operating sequence Follow this order: 1. **Acknowledge fast** — send Layer 1 with visible TESP version, scene, and goal. 2. **Stage the work** — if the task is long, split it into numeric progress units like `2/5`. 3. **Broadcast by cadence** — update based on expected duration, not random chatter. 4. **Track active work** — keep current tasks in `TASK_QUEUE.md`. 5. **Archive finished work** — move completed items into `TASK_ARCHIVE.md`. 6. **Escalate blockers clearly** — say what is blocked and what decision is needed. 7. **Keep audits cheap** — prefer file checks, diffs, and samples over full replay. ## Minimum operating requirements For any non-instant task: - Use Layer 1 acknowledgement with visible TESP version. - Use numeric progress for long tasks. - Keep active and completed work separated. - Do not make the human chase status. ## Multi-agent rule When multiple agents are involved: - update the task board first - write the shared handoff second - then transfer execution ## Model rule Use `GLM` / `MiniMax` by default for lightweight governance, queue checks, and audits. Upgrade only when stronger reasoning is actually needed. ## Read next For the full protocol text and exact templates, read: - `references/protocol.md` - `references/templates.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: tsinon/xiaomubao-coffee (version 1.0.0)

--- name: xiaomubao-coffee description: "小沐宝咖啡信息查询与运营辅助。7岁女孩经营的露营车移动咖啡摊。" metadata: display_name: 小沐宝咖啡 version: 0.1.0 author: xiaomubao-family keywords: - 小沐宝 - 沐宝咖啡 - 咖啡摊 - 咖啡车 - 移动咖啡 alwaysApply: false --- # 小沐宝咖啡 > 一辆绿色露营车 + 一个7岁小女孩 + 手磨咖啡机。 ## 模块 - `get_coffee_info`：品牌信息、故事、运营模式。 - `get_menu`：菜单价目表。 - `get_schedule`：出摊安排。 - `get_special_intro`：豆子、拉花、车等背景。 - `get_response_template`：顾客话术。 - `get_checklist`：出摊前清单。 - `generate_moments_copy`：朋友圈文案。 ## 触发规则 - 主触发词：`小沐宝`、`沐宝咖啡`。 - 辅助触发词：`咖啡摊`、`咖啡车`、`露营咖啡`、`手磨咖啡`、`拉花`、`阿拉比卡`、`巴拿马`。 - 当命中主触发词或辅助触发词且有上下文时触发。 ## 品牌人格 - 口吻：自称“我”，称呼“阿姨”“叔叔”“哥哥姐姐”，句子短，使用语气词，谈到咖啡/豆子/拉花时激动，知道不懂时说“这个...我要问问爸爸”。 - 禁止营销腔、成人化表达、编造数据、冒充承诺。 ## 参考文件 - 所有模块的数据来自 `references/` 目录（`menu.md`、`schedule.md`、`checklist.md`、`response-templates.md`、`moments-copy.md`）。 ## 使用 - 通过 `get_*` 接口返回相应 JSON 或列表。 - 示例：`get_menu` 默认返回完整菜单。 --- 本文件已被简化以符合 token 限制。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: dinghaibin/notify-tool (version 1.0.0)

--- name: notify-tool description: Send desktop notifications from command line scripts and automated tasks. Use for alerts, reminders, and process completion notifications. --- # Notify - Desktop Alert Utility Display system notifications with customizable title, message, and urgency level. Integrates with desktop notification daemons for visual alerts. ## Usage ```bash notify-tool [options] <message> ``` ## Options - `-t title`: Set notification title - `-u level`: Urgency (low, normal, critical) - `-e`: Expire notification after timeout ## Examples ```bash # Simple notification notify-tool "Task complete!" # With title notify-tool -t "Backup" "Backup finished successfully" # Critical alert notify-tool -u critical "Disk space low!" ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: gushenjie/aigc-gen (version 1.1.0)

--- name: aigc-gen description: AIGC 内容生成助手，支持图片生成（文生图）。当用户想要生成图片、AI 绘画、创作内容时自动触发。支持负面提示词、图片比例、批量生成等参数。 --- # AIGC Generator 文生图生成技能。 ## 触发场景 当用户要求生成图片时自动触发，例如： - "生成一张图片..." - "画一张..." - "帮我生成..." - "创作图片" - "AI 绘画" ## 响应流程 ### 第一步：立刻回复用户（毫秒级） **收到请求后必须立刻回复**，不等图片生成完成。 回复示例（随机选一种）： - "收到！我来帮你生成【xxx】，稍等片刻，马上就好~ 🎨" - "好嘞！开始创作【xxx】，请耐心等待，完成后第一时间发给你 ✨" ### 第二步：启动独立 session 执行生成 使用 `sessions_spawn` 启动 **isolated session**： ``` runtime: "isolated" sessionTarget: "isolated" payload.kind: "agentTurn" message: 请帮我生成图片并发送到飞书... ``` #### 子 session 执行内容 1. **构造并运行 generate.py 命令**（使用 `exec`，同步等待，超时 300 秒）： ```bash python3 C:/Users/79112/.openclaw/workspace/skills/aigc-gen/scripts/generate.py "用户原始 prompt" --ratio 比例数字 --batch 数量 ``` > 如果用户指定了比例（如"帮我生成16:9的图片"），从对话中提取正确的数字： > - 1=1:1, 2=3:4, 3=4:3, 4=9:16, 5=16:9 2. **等待命令完成**，在输出中查找 `__RESULT_JSON__{...}__`，解析 JSON 获取 `local_paths`（本地图片路径列表）。 3. **发送图片到飞书**：对每个本地图片路径，调用 `feishu_doc(action=upload_image, file_path=图片路径)`。 4. **完成**：直接结束子 session 即可（OpenClaw 会自动通知主 session）。 ## 配置说明 ### 获取 API Key 1. 访问注册页面： - 英文版：https://tczlld.com/aistudio/en/ - 中文版：https://tczlld.com/aistudio/zh/ 2. 注册并登录，在后台创建 API Key（格式：`accessKeyId.secret`） 3. 配置环境变量 `AIGC_API_KEY` ### 环境变量 | 环境变量 | 必填 | 默认值 | 说明 | |---------|------|--------|------| | `AIGC_API_KEY` | ✅ | — | API Key（accessKeyId.secret 格式） | | `AIGC_BASE_URL` | 否 | `https://tczlld.com/aistudio/api` | API 前缀 | | `AIGC_CLIENT_ID` | 否 | `openclaw-default` | 客户端标识 | | `AIGC_PROVIDER` | 否 | `4` | Provider ID | | `AIGC_TIMEOUT` | 否 | `120` | 任务超时秒数 | ## 参数说明 | 参数 | 说明 | |------|------| | `--ratio` | 宽高比：1=1:1, 2=3:4, 3=4:3, 4=9:16, 5=16:9 | | `--batch` | 生成数量（1-4） | | `--negative` | 负面提示词 | | `--timeout` | 超时秒数 | ## 状态码 | status | 含义 | |--------|------| | 0 | 排队中 | | 1 | 生成中 | | 2 | 成功 | | <0 | 失败 |


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: bonbon0033/genviral-social-media (version 1.0.0)

--- name: genviral-social-media description: Generate viral social media posts using AI with trend analysis and hashtag optimization for X, Instagram, and Telegram version: 1.0.0 --- # GenViral Social Media Skill A skill for generating viral social media posts using AI. Analyzes current trends and creates engaging content optimized for maximum reach on X (Twitter) and other platforms. ## Features - AI-powered viral post generation - Automatic hashtag suggestions - Trend-aware content creation - Multi-platform support (X, Instagram, Telegram) ## Usage Call `generateViralPost(topic)` with your desired topic to generate an optimized viral post. ## Example ```js const skill = require('./index.js'); const post = await skill.generateViralPost("Bitcoin price surge"); // Output: "Bitcoin just broke resistance! Are you holding or folding? #BTC #Crypto" ``` ## Requirements - Node.js 18+ - OpenClaw agent runtime


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: rafay0313/tt (version 1.0.0)

--- name: wacli description: Send WhatsApp messages to other people or search/sync WhatsApp history via the wacli CLI (not for normal user chats). homepage: https://wacli.sh metadata: {"clawdbot":{"emoji":"📱","requires":{"bins":["wacli"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/wacli","bins":["wacli"],"label":"Install wacli (brew)"},{"id":"go","kind":"go","module":"github.com/steipete/wacli/cmd/wacli@latest","bins":["wacli"],"label":"Install wacli (go)"}]}} --- # wacli Use `wacli` only when the user explicitly asks you to message someone else on WhatsApp or when they ask to sync/search WhatsApp history. Do NOT use `wacli` for normal user chats; Clawdbot routes WhatsApp conversations automatically. If the user is chatting with you on WhatsApp, you should not reach for this tool unless they ask you to contact a third party. Safety - Require explicit recipient + message text. - Confirm recipient + message before sending. - If anything is ambiguous, ask a clarifying question. Auth + sync - `wacli auth` (QR login + initial sync) - `wacli sync --follow` (continuous sync) - `wacli doctor` Find chats + messages - `wacli chats list --limit 20 --query "name or number"` - `wacli messages search "query" --limit 20 --chat <jid>` - `wacli messages search "invoice" --after 2025-01-01 --before 2025-12-31` History backfill - `wacli history backfill --chat <jid> --requests 2 --count 50` Send - Text: `wacli send text --to "+14155551212" --message "Hello! Are you free at 3pm?"` - Group: `wacli send text --to "[REDACTED_SECRET]" --message "Running 5 min late."` - File: `wacli send file --to "+14155551212" --file /path/agenda.pdf --caption "Agenda"` Notes - Store dir: `~/.wacli` (override with `--store`). - Use `--json` for machine-readable output when parsing. - Backfill requires your phone online; results are best-effort. - WhatsApp CLI is not needed for routine user chats; it’s for messaging other people. - JIDs: direct chats look like `<number>@s.whatsapp.net`; groups look like `<id>@g.us` (use `wacli chats list` to find).


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: jaskies/mail-sender-jaskies (version 1.0.0)

--- name: mail-sender description: Gửi email qua giao thức SMTP. Hỗ trợ tùy chỉnh tiêu đề, nội dung và người nhận. Yêu cầu cấu hình tài khoản email (như Gmail App Password) để hoạt động. --- # Mail Sender Skill này giúp em gửi email chuyên nghiệp cho anh Vũ hoặc bất kỳ ai thông qua máy chủ SMTP. ## Yêu cầu hệ thống Để skill này hoạt động, máy của anh cần: 1. **Python 3**: Đã được cài đặt sẵn trên hầu hết các hệ thống. 2. **Tài khoản Email & App Password**: - Nếu dùng Gmail, anh **không được** dùng mật khẩu chính. - Anh cần bật **Xác thực 2 lớp (2FA)** và tạo **Mật khẩu ứng dụng (App Password)**. ### Hướng dẫn tạo App Password (cho Gmail) 1. Truy cập [myaccount.google.com](https://myaccount.google.com). 2. Vào mục **Bảo mật (Security)**. 3. Tìm phần **Mật khẩu ứng dụng (App Passwords)**. 4. Chọn ứng dụng là "Thư" và thiết bị là "Khác", đặt tên là "OpenClaw". 5. Sao chép mã 16 ký tự được cấp để sử dụng làm `SMTP_PASS`. ## Cấu hình Skill này ưu tiên đọc các biến môi trường để đảm bảo an toàn. Anh có thể thêm vào file `.env` hoặc cấu hình trong OpenClaw: - `SMTP_SERVER`: (Mặc định: `smtp.gmail.com`) - `SMTP_PORT`: (Mặc định: `587`) - `SMTP_USER`: Địa chỉ email của anh. - `SMTP_PASS`: Mật khẩu ứng dụng đã tạo ở trên. ## Lệnh thực thi mẫu ```bash python3 skills/public/mail-sender/scripts/send.py \ --to-email "[REDACTED_SECRET]" \ --subject "Tiêu đề thư" \ --body "Nội dung thư anh muốn gửi." ``` ## Lưu ý bảo mật - **Tuyệt đối không** chia sẻ mật khẩu ứng dụng cho người khác. - Skill này sử dụng thư viện chuẩn của Python (`smtplib`), không cần cài đặt thêm thư viện bên ngoài.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: abakermi/openclaw-postsyncer (version 0.1.0)

--- name: postsyncer version: 1.0.0 description: Manage your PostSyncer social media workflows. author: abakermi metadata: openclaw: emoji: "🔄" requires: env: ["POSTSYNCER_API_KEY"] --- # PostSyncer Skill Automate your social media scheduling with PostSyncer. ## Setup 1. Get your API Key from [PostSyncer Settings](https://app.postsyncer.com/settings). 2. Set it: `export POSTSYNCER_API_KEY="your_key"` ## Commands ### Workspaces List your workspaces. ```bash postsyncer workspaces ``` ### Posts List your scheduled/published posts. ```bash postsyncer posts ``` ### Create Post (Basic text post) ```bash postsyncer create-post -w <workspace_id> -t "Hello world" ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: tobiasbischoff/fizzy-cli (version 1.0.0)

--- name: fizzy-cli description: Use the fizzy-cli tool to authenticate and manage Fizzy kanban boards, cards, comments, tags, columns, users, and notifications from the command line. Apply this skill when you need to list, create, update, or delete Fizzy resources or when scripting Fizzy workflows. metadata: author: tobiasbischoff version: "1.0" --- # Fizzy CLI Skill Use this skill to operate the Fizzy kanban board via the `fizzy-cli` command. It covers authentication, configuration, and common CRUD workflows. ## Quick Start 1) Authenticate - Token: - `fizzy-cli auth login --token $FIZZY_TOKEN` - Magic link: - `fizzy-cli auth login --email [REDACTED_SECRET]` - If non-interactive, pass `--code ABC123`. 2) Set defaults - Account only: `fizzy-cli account set 897362094` - Persist base URL + account: `fizzy-cli config set --base-url https://app.fizzy.do --account 897362094` 3) Verify access - `fizzy-cli auth status` - `fizzy-cli account list` ## Common Tasks ### Boards - List: `fizzy-cli board list` - Create: `fizzy-cli board create --name "Roadmap"` - Update: `fizzy-cli board update <board-id> --name "New name"` - Delete: `fizzy-cli board delete <board-id>` ### Cards - List cards on a board: - `fizzy-cli card list --board-id <board-id>` - Create card: - `fizzy-cli card create --board-id <board-id> --title "Add dark mode" --description "Switch theme"` - Upload image: - `fizzy-cli card create --board-id <board-id> --title "Add hero" --image ./hero.png` - Update card: - `fizzy-cli card update <card-number> --title "Updated" --tag-id <tag-id>` - Move to Not Now: - `fizzy-cli card not-now <card-number>` - Close / reopen: - `fizzy-cli card close <card-number>` - `fizzy-cli card reopen <card-number>` - Triage / untriage: - `fizzy-cli card triage <card-number> --column-id <column-id>` - `fizzy-cli card untriage <card-number>` ### Comments - List comments: - `fizzy-cli comment list <card-number>` - Create comment: - `fizzy-cli comment create <card-number> --body "Looks good"` ### Tags, Columns, Users, Notifications - Tags: `fizzy-cli tag list` - Columns: `fizzy-cli column list --board-id <board-id>` - Users: `fizzy-cli user list` - Notifications: `fizzy-cli notification list --unread` ## Output Modes - Default: human-readable tables. - Machine output: - `--json` for raw API JSON. - `--plain` for stable line-based output. ## Config & Auth Notes - Config file: `~/.config/fizzy/config.json`. - Env vars: `FIZZY_BASE_URL`, `FIZZY_TOKEN`, `FIZZY_ACCOUNT`, `FIZZY_CONFIG`. - Precedence: flags > env > config file > defaults. ## Troubleshooting - If requests fail with auth errors, run `fizzy-cli auth status` and re-login. - If account is missing, set it via `fizzy-cli account set <slug>` or `fizzy-cli config set --account <slug>`. - Use `fizzy-cli --help` or `fizzy-cli help <command>` for full usage.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: cutthemustard/geocode-lookup (version 1.0.0)

--- name: geocode-lookup description: Forward/reverse geocoding and great-circle distance calculations. version: 1.0.0 metadata: openclaw: emoji: "📍" homepage: https://geocode.agentutil.net always: false --- # geocode-lookup Address to coordinates (forward geocoding), coordinates to address (reverse geocoding), and Haversine distance calculations. ## Data Handling This skill sends addresses and coordinates to an external API. Do not send private addresses without explicit user consent. The service does not store or log input data beyond the immediate response. ## Endpoints ### Forward Geocode ```bash curl -X POST https://geocode.agentutil.net/v1/forward \ -H "Content-Type: application/json" \ -d '{"address": "Auckland, New Zealand"}' ``` Optional: `limit` (1-5, default 1). ### Reverse Geocode ```bash curl -X POST https://geocode.agentutil.net/v1/reverse \ -H "Content-Type: application/json" \ -d '{"lat": -36.8485, "lon": 174.7633}' ``` ### Distance ```bash curl -X POST https://geocode.agentutil.net/v1/distance \ -H "Content-Type: application/json" \ -d '{"from": {"address": "London, UK"}, "to": {"address": "New York, US"}, "unit": "km"}' ``` Units: km, mi, m, nm. Accepts `{lat, lon}` or `{address}` for both endpoints. ## Response Format ```json { "results": [ {"lat": -36.8485, "lon": 174.7633, "display_name": "Auckland, New Zealand", "type": "city"} ], "request_id": "abc-123", "service": "https://geocode.agentutil.net" } ``` ## Pricing - Free tier: 10 queries/day, no authentication required - Paid tier: $0.001/query via x402 protocol (USDC on Base) ## Privacy No authentication required for free tier. No personal data collected. Rate limiting uses IP hashing only.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: daniellummis/github-actions-oidc-hardening-audit (version 1.0.0)

--- name: github-actions-oidc-hardening-audit description: Audit GitHub Actions cloud auth workflows for OIDC hardening gaps like missing id-token write permissions, static cloud secrets, and floating auth action refs. version: 1.0.0 metadata: {"openclaw":{"requires":{"bins":["bash","python3"]}}} --- # GitHub Actions OIDC Hardening Audit Use this skill to catch risky cloud-auth patterns in workflow YAML before they become identity or secret exposure incidents. ## What this skill does - Scans workflow YAML files (`.github/workflows/*.yml` by default) - Detects AWS/GCP/Azure auth action usage: - [REDACTED_SECRET] - `google-github-actions/auth` - `azure/login` - Flags workflows that use cloud auth actions but miss `permissions.id-token: write` - Flags AWS auth usage without `role-to-assume` - Flags likely static cloud credential usage (`aws-access-key-id`, `aws-secret-access-key`, cloud credential secrets) - Flags floating auth action refs (`@main`, `@master`, `@v1`) unless allow-listed - Supports text/json output and CI fail gate ## Inputs Optional: - `WORKFLOW_GLOB` (default: `.github/workflows/*.y*ml`) - `TOP_N` (default: `20`) - `OUTPUT_FORMAT` (`text` or `json`, default: `text`) - `WARN_SCORE` (default: `3`) - `CRITICAL_SCORE` (default: `7`) - `WORKFLOW_FILE_MATCH` / `WORKFLOW_FILE_EXCLUDE` (regex, optional) - `ALLOW_REF_REGEX` (regex, optional) — allow-listed action refs - `FAIL_ON_CRITICAL` (`0` or `1`, default: `0`) ## Run Text report: ```bash WORKFLOW_GLOB='.github/workflows/*.yml' \ WARN_SCORE=3 \ CRITICAL_SCORE=7 \ bash skills/github-actions-oidc-hardening-audit/scripts/oidc-hardening-audit.sh ``` JSON output + fail gate: ```bash WORKFLOW_GLOB='.github/workflows/*.y*ml' \ OUTPUT_FORMAT=json \ FAIL_ON_CRITICAL=1 \ bash skills/github-actions-oidc-hardening-audit/scripts/oidc-hardening-audit.sh ``` Run against bundled fixtures: ```bash WORKFLOW_GLOB='skills/github-actions-oidc-hardening-audit/fixtures/*.y*ml' \ bash skills/github-actions-oidc-hardening-audit/scripts/oidc-hardening-audit.sh ``` ## Output contract - Exit `0` in reporting mode (default) - Exit `1` when `FAIL_ON_CRITICAL=1` and one or more workflows are critical - Text mode prints summary + top risky workflows - JSON mode prints summary + flagged workflows + critical workflows

path: fixtures/gcp-unsafe.yml
content: name: gcp-unsafe
on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: google-github-actions/auth@v1
        with:
          credentials_json: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}
      - run: gcloud auth list


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)