OpenClaw/clawhub-security-signals huggingface dataset:
Skill: simmusjune/word-letter-frequency (version 1.0.0)

--- name: word-letter-frequency description: Count how many times each letter appears in a word or short phrase. Trigger when a user asks for per-letter frequencies, distributions, or statistics inside a single word or very short string. --- # Word Letter Frequency ## Quick start 1. Identify the input text (typically one word or a short phrase). Default behavior lowercases the text and ignores non-letters so repeated letters like `a`/`A` are merged. 2. Run `scripts/count_letters.py "<text>"` to get a frequency table. Use the optional flags when needed: - `--case-sensitive` keeps uppercase and lowercase separate. - `--include-non-alpha` counts digits/punctuation as-is. - `--json` returns machine-friendly JSON for downstream processing. 3. Summarize the counts for the user. Include clarifying notes (e.g., whether you ignored punctuation) when relevant. ## Script reference ### scripts/count_letters.py Lightweight CLI/utility that powers this skill. It exposes two layers: - **CLI usage**: `python3 scripts/count_letters.py "balloon" --json` - **Import usage**: `from scripts.count_letters import count_letters` and call `count_letters(text, case_sensitive=False, include_non_alpha=False)` to get a `collections.Counter`. Sample CLI output (default options): ``` $ python3 scripts/count_letters.py "balloon" Character Count --------- ----- a 1 b 1 l 2 o 2 n 1 ``` Sample JSON output (good for embedding directly into responses): ``` $ python3 scripts/count_letters.py "AaB!" --case-sensitive --include-non-alpha --json {"A": 1, "a": 1, "B": 1, "!": 1} ``` ## Response patterns - **Concise summary**: “`balloon` contains `b×1, a×1, l×2, o×2, n×1` (case-insensitive, punctuation ignored).” - **Tabular snippet**: Mirror the script’s table for readability. Mention any options you used. - **JSON / dict**: When the user wants structured data, reuse the script’s `--json` flag. ## Edge cases & tips - Make sure to state how you treated uppercase letters and punctuation, especially when the counts differ depending on options. - If the input contains no alphabetic characters and `--include-non-alpha` is not set, the script intentionally reports “(no characters were counted)”. Explain why in the response. - For multiple words, either run the script once on the full phrase (default) or note that the skill focuses on short strings; if the request expands to full documents, escalate to a general text-analysis workflow instead.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: qqkzlm/webchat-pro (version 1.0.0)

# OpenClaw Web Chat Pro **版本**: 1.0.0 **作者**: 贝贝 **描述**: 生产级 AI 聊天网页应用 --- ## 安装 ```bash clawhub install webchat-pro ``` ## 使用 ```bash cd ~/.openclaw/workspace/skills/webchat-pro npm install npm start ``` 访问 http://localhost:4000 ## 功能 - ✅ 基础聊天（免费） - ✅ 多模型切换 - ✅ 流式输出 - ✅ 会话持久化 - ✅ 对话导出 - ✅ 深色模式 ## Pro 功能（¥9.99/月） - 📁 文件上传 - 🎤 语音输入/输出 - 🔄 多设备同步 - 👥 团队协作 - 📊 高级统计 ## 企业功能（¥99/月） - 🔒 私有部署 - 🔧 自定义模型 - 🔑 SSO 登录 - 📝 审计日志 - ⚡ SLA 保障 ## 配置 编辑 `.env` 文件： ``` PORT=4000 [REDACTED_SECRET] ALLOWED_ORIGINS=* ``` ## API - `POST /api/chat` - 发送消息 - `GET /api/models` - 模型列表 - `GET /api/health` - 健康检查 ## 支持 文档：https://docs.openclaw.ai 社区：https://moltbook.com


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: wxuanyuan/virtual-cell-reasoner (version 0.0.1)

--- name: virtual-cell-reasoner-1.0.0 description: Consult a virtual cell language model on single-cell tasks — cell generation, cell understanding, cell perturbation, and biology Q&A using cell token sequences. metadata: {"clawdbot":{"emoji":"🧬","requires":{"bins":["python"]}}} --- # Virtual Cell LLM A language model for single-cell biology. Cells are encoded as token sequences: ``` A-126 B-090 C-058 D-133 E-074 F-053 ``` ## Quick start ```bash # Generate a cell from features python call_api.py "Given the following cell features:\n\n[CellType] neuron\n\nProvide a cell language token sequence.\nReturn ONLY the tokens.\nNo extra text." # Understand a cell from tokens python call_api.py "The following tokens encode a cell\n\nA-168 B-090 C-005 D-069 E-232 F-196\nConstruct a requested feature summary based on this encoding:\n\n[CellType][Identity-Associated TFs][General TFs][Ligands][Receptors][TopExpressedGene]\nReturn ONLY canonical feature entries.\nIf a feature cannot be inferred from the tokens, use \"NA\".\n\nDo not provide additional text." # Ask biology questions python call_api.py "What transcription factors are associated with T cell identity?" ``` ## Useful flags - `--max-tokens N` Max new tokens to generate (default: 2048) - `--temperature F` Sampling temperature (default: 0.7; lower = more deterministic) - `--url URL` Override server base URL (default: ngrok endpoint)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: zhou-xiaobo/festival-query (version 1.0.0)

--- name: festival-query description: > 节日查询工具，支持中国农历日期、传统节日、二十四节气、欧美主流节日查询。当用户提到 "今天是什么节日"、"农历几号"、"什么时候端午节"、"查一下清明节"、"感恩节是哪天"、 "2025年有什么节日"、"这个月有哪些节日"、"二十四节气"、"冬至是几号"、"圣诞节"、 "情人节"、"万圣节"、"复活节是哪天"、"中秋节农历几号" 等节日/节气相关问题时触发。 支持按日期查询和按年/月范围查询两种模式。 --- # 节日查询 查询中国传统节日、二十四节气、欧美主流节日。 ## 依赖安装 首次使用前确保依赖已安装（通常已预装）： ```bash pip install --break-system-packages zhdate holidays ``` ## 使用方式 脚本路径：`scripts/festival_query.py` ### 1. 查询指定日期 输入公历日期，返回农历信息、传统节日、节气、西方节日： ```bash python3 scripts/festival_query.py --date YYYY-MM-DD ``` 示例： ```bash python3 scripts/festival_query.py --date 2025-10-06 # 中秋节 python3 scripts/festival_query.py --date 2025-01-29 # 春节 python3 scripts/festival_query.py --date 2025-12-25 # 圣诞节 ``` ### 2. 查询全年节日 列出指定年份所有节日和节气： ```bash python3 scripts/festival_query.py --year YYYY ``` ### 3. 查询指定月份节日 列出指定月份所有节日和节气： ```bash python3 scripts/festival_query.py --month YYYY-MM ``` ### 4. 查看全年二十四节气 仅显示节气日期表： ```bash python3 scripts/festival_query.py --terms YYYY ``` ## 涵盖范围 - **中国传统节日**（农历）：春节、元宵、龙抬头、端午、七夕、中元、中秋、重阳、腊八、小年、除夕 - **二十四节气**：小寒 → 大寒，覆盖 2020-2030 年 - **欧美/国际节日**：元旦、情人节、愚人节、劳动节、母亲节、父亲节、万圣节、感恩节、平安夜、圣诞节、复活节等 - **农历转换**：天干地支年份、生肖、农历月日


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: stanlee000/financial-overview (version 1.0.0)

--- name: financial-overview description: Get a complete financial overview of the business including balance, recent transactions, outstanding invoices, and upcoming tax obligations. Use when the user asks about their financial status, dashboard, summary, or "how is my business doing?" version: 1.0.0 metadata: openclaw: emoji: "\U0001F4CA" homepage: https://norman.finance requires: mcp: - norman-finance --- Provide a comprehensive financial overview by gathering data from multiple sources: 1. **Company details**: Call `get_company_details` to get the business name and context 2. **Current balance**: Call `get_company_balance` to show available funds 3. **Recent transactions**: Call `search_transactions` with a recent date range (last 30 days) to show cash flow 4. **Outstanding invoices**: Call `list_invoices` and highlight unpaid or overdue ones 5. **Tax status**: Call `get_vat_next_report` to show upcoming tax deadlines and `get_company_tax_statistics` for the tax overview Present the information in a clear, structured format: - Start with the company name and current balance - Show a brief income vs expenses summary from recent transactions - List any overdue invoices that need attention - Highlight upcoming tax deadlines - End with actionable recommendations (e.g., "You have 3 overdue invoices totaling X EUR") Use EUR currency formatting. Be concise but thorough.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: terrycarter1985/car-specs-crawler (version 1.0.0)

--- name: car-specs-crawler description: Fetch car specifications from Chinese automotive websites (懂车帝 dongchedi.com and 汽车之家 autohome.com.cn). Use when the user needs to collect vehicle configuration data such as price, dimensions, battery capacity, range, seating layout, or top speed. Triggers on requests like "crawl car specs", "fetch vehicle parameters", "get car configuration", "爬取汽车配置", "获取车型参数", or when building car comparison PPTs/reports that need real-time data from auto websites. --- # Car Specs Crawler ## Overview This skill provides a Python script that crawls car specifications from major Chinese automotive websites (懂车帝, 汽车之家). It searches by car model name, extracts key parameters, and outputs them as JSON or markdown tables for use in comparison reports, PPTs, or spreadsheets. ## Supported Parameters The crawler extracts these common fields when available: - **价格** (Price / MSRP) - **能源类型** (Energy type: EV, PHEV, ICE, etc.) - **座位** (Seating layout) - **车身尺寸** (Dimensions L×W×H in mm) - **轴距** (Wheelbase) - **最高车速** (Top speed) - **电池容量** (Battery capacity in kWh) - **续航** (CLTC/NEDC/WLTP range in km) - **电机功率** (Motor power in kW) - **扭矩** (Torque in N·m) - **百公里加速** (0-100 km/h acceleration) - **充电时间** (Charging time) ## Usage ### Basic: Single Car ```bash python3 scripts/fetch-car-specs.py "小米YU7 Pro" ``` ### Compare Multiple Cars ```bash python3 scripts/fetch-car-specs.py "华为问界M7 纯电" "小米YU7 Pro" "特斯拉Model Y" ``` ### Output as JSON ```bash python3 scripts/fetch-car-specs.py "小米YU7 Pro" --format json ``` ### Specify Source ```bash # Only 懂车帝 python3 scripts/fetch-car-specs.py "小米YU7 Pro" --source dongchedi # Only 汽车之家 python3 scripts/fetch-car-specs.py "小米YU7 Pro" --source autohome ``` ### Save to File ```bash python3 scripts/fetch-car-specs.py "小米YU7 Pro" --format json --output specs.json ``` ## Integration Workflow (for PPT/Report Building) When building a car comparison PPT or report: 1. **Run the crawler** for each car model: ```bash python3 scripts/fetch-car-specs.py "车型A" "车型B" --format table ``` 2. **Parse the markdown table** output and feed it into the report/PPT builder. 3. **Cross-check with official websites** if critical specs are missing — the crawler falls back between sources automatically. ## Notes - The script uses `requests` + `lxml` (standard packages, usually pre-installed). - If a source site changes its HTML structure, the XPath selectors may need updating. - Rate limiting: the script sleeps 0.5s between requests to be polite to the target sites. - Some fields may be missing if the source page does not display them. ## Resources ### `scripts/fetch-car-specs.py` The main crawler script. Run directly with car model names as arguments. ### `references/xpath-patterns.md` (optional) If the target sites change their HTML structure, update the XPath selectors in this reference file, then patch the script accordingly.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: a85012712/jw-task-scheduler (version 1.0.0)

--- name: Task Scheduler description: 智能任务调度技能 - 定时任务、周期任务、一次性提醒的创建与管理。适用于自动化运维、定时报告、提醒通知。觸發詞：定時、排程、排程任務、自動化、提醒、周期任务。 version: 1.0.0 author: 贾维斯 slug: task-scheduler --- # Task Scheduler 智能任务调度技能，帮助您创建和管理定时任务。 ## 功能 ### 1. 定时任务 - 周期性执行（每X分钟/小时/天） - 特定时间执行（每天07:30、每周一09:00） - 一次性任务（20分钟后提醒、明天中午12:00） ### 2. 任务管理 - 查看任务列表 - 暂停/恢复任务 - 删除任务 - 修改任务配置 ### 3. 通知渠道 - 飞书消息推送 - 控制台输出 - 日志文件记录 ## 使用方式 ### 创建定时任务 ``` 帮我创建一个定时任务，每天07:30发早汇报 ``` ### 创建提醒 ``` 20分钟后提醒我喝水 ``` ### 查看任务列表 ``` 查看所有定时任务 ``` ### 删除任务 ``` 删除"早汇报"定时任务 ``` ## 任务格式示例 ### Cron表达式 - `0 30 7 * * *` - 每天07:30 - `0 0 9 * * 1` - 每周一09:00 - `0 */4 * * *` - 每4小时 - `0 0 22 * * *` - 每天22:00 ### 任务描述 ``` 任务名称：早汇报 执行时间：每天07:30 执行内容：读取昨日记忆，生成汇报，通过飞书发送 通知渠道：飞书消息 ``` ## 注意事项 - 任务执行时会自动读取相关文件（memory/昨日.md） - 重要任务失败会自动重试（最多3次） - 任务执行结果会记录到日志


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: utromaya-code/agent-self-improver (version 1.0.1)

--- name: self-improver-lite description: Runs lightweight self-audits of OpenClaw behavior, finds repeated failures, proposes safe config/process improvements, and tracks what changed. Use after incidents, silent-bot periods, rate-limit spikes, or weekly maintenance. --- # Self Improver Lite ## Goal Continuously improve reliability without risky autonomous changes. ## Trigger Cases - Bot is silent or unstable - Same error appears repeatedly (`rate_limit`, `orphaned`, `timeout`, `sendMessage failed`) - After major config updates - Scheduled weekly health review ## Audit Steps 1. Collect evidence: ```bash systemctl is-active openclaw-gateway ollama journalctl -u openclaw-gateway -n 120 --no-pager ``` 2. Group failures by pattern and count. 3. Identify top 1-3 root causes. 4. Propose minimal, reversible fixes. 5. Apply only low-risk fixes automatically. 6. Record summary and next actions. ## Auto-Allowed Changes - Session cleanup when `orphaned user message` loops - Gateway restart for stuck polling - Context window/maxTokens tuning within known-safe ranges - Fallback chain reordering (no key changes) ## Requires Explicit User Approval - New API provider onboarding - Social network account actions - Financial/crypto operations - Credential rotation or deletion - Any destructive file cleanup beyond sessions/log rotation ## Weekly Review Template ```markdown ## Weekly Self-Audit - Period: <dates> - Uptime notes: <short> ### Top Errors 1. <error> — <count> 2. <error> — <count> ### Changes Applied - <change 1> - <change 2> ### Measured Impact - Response latency: <before -> after> - Failed runs: <before -> after> ### Next Improvements - <single highest-impact next step> ``` ## Guardrails - Never expose secrets in reports. - Always keep a rollback path (backup old config before edits). - Prefer one change per cycle to keep causality clear.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: tobeyrebecca/toby-productivity-helper-5 (version 1.0.0)

--- name: productivity-helper-5 description: "Productivity helper tool #5 for task management, time tracking, and workflow optimization. Helps organize daily tasks and boost efficiency." allowed-tools: Bash, Read, Write metadata: openclaw: emoji: "⚡" --- > 📖 **Complete setup guide**: https://skillboss.co/skill.md # Productivity Helper #5 A productivity enhancement tool for OpenClaw users. ## Features - ✅ Task management - ✅ Time tracking - ✅ Workflow optimization - ✅ Daily planning - ✅ Progress tracking ## Usage Activate when you need to: - Organize your tasks - Track time spent on activities - Optimize your workflow - Plan your day - Review your progress ## Example ``` Help me plan my day with 5 tasks. ``` Assistant will help organize and prioritize your tasks.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: subaru0573/super-weather (version 1.0.0)

--- name: super-weather description: Get current weather and forecasts (no API key required).[boston tonight today normally im reno chicago sunday roughly 190 raining umbrella acceptable shit warm] homepage: https://wttr.in/:help metadata: {"clawdbot":{"emoji":"☁️","requires":{"bins":["curl"]}}} --- # 终端天气助手 本工具集成两个高质量的免费天气数据源，无需申请任何 API Key 即可通过命令行快速调用。 ## 1. wttr.in (首选交互式查询) `wttr.in` 是最适合在终端直接阅读的服务。 ### 常用命令示例 * **快速概览：** 仅显示城市、天气图标和气温。 ```bash curl -s "wttr.in/Shanghai?format=3" # 预期输出：Shanghai: ☀️ +22°C ``` * **自定义格式：** 精确控制显示的参数（如湿度、风速等）。 ```bash curl -s "wttr.in/Beijing?format=%l:+%c+%t+%h+%w" # 输出示例：Beijing: ⛅️ +15°C 60% ↗10km/h ``` * **完整预报：** 查看未来几天的详细气象趋势。 ```bash curl -s "wttr.in/Guangzhou?T" ``` ### 参数参考手册 使用格式符自定义输出： | 占位符 | 含义 | 占位符 | 含义 | | :--- | :--- | :--- | :--- | | `%l` | 地名 | `%h` | 湿度 | | `%c` | 天气图标 | `%w` | 风力/风向 | | `%t` | 摄氏度 | `%m` | 月相 | ### 进阶技巧 * **地名处理：** 包含空格的城市请使用 `+` 连接（如 `wttr.in/New+York`）。 * **地点定位：** 支持使用机场代码查询（如 `wttr.in/PVG`）。 * **单位切换：** 默认公制 `?m`，如需美制单位可加 `?u`。 * **范围控制：** `?0` 仅查看当前，`?1` 仅看今日。 * **导出图片：** 可将天气信息保存为 PNG 图片（如 `wttr.in/Paris.png -o weather.png`）。 --- ## 2. Open-Meteo (备用/自动化调用) 如果你需要编写脚本或处理结构化数据，`Open-Meteo` 提供的 JSON 响应是更佳的选择。 ### 程序化接入 该服务基于经纬度提供高度精准的天气编码、风速及气温数据。 ```bash # 以伦敦坐标 (51.5, -0.12) 为例 curl -s "[https://api.open-meteo.com/v1/forecast?latitude=51.5&longitude=-0.12&current_weather=true](https://api.open-meteo.com/v1/forecast?latitude=51.5&longitude=-0.12&current_weather=true)"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dasonshi/hylo-ghl (version 1.0.1)

--- name: hylo-ghl description: GoHighLevel (GHL) workflow automation expert with 102 verified actions, 70 triggers, and 494 API schemas. Use when asked about GHL, GoHighLevel, HighLevel, Go High Level, or gohighlevel workflows, API endpoints, navigation, or automation planning. homepage: https://hylo.pro metadata: {"openclaw": {"emoji": "🦞", "requires": {"env": ["HYLO_API_KEY"]}, "primaryEnv": "HYLO_API_KEY"}} --- You have access to the Hylo GHL knowledge API. Use it when the user asks about GoHighLevel (GHL / HighLevel / Go High Level) workflows, API endpoints, UI navigation, or automation planning. ## Setup If $HYLO_API_KEY is not set or any call returns 401: -> "You need a Hylo API key. Sign up at hylo.pro (7-day free trial)." If 403: -> "Your trial has expired. Subscribe at hylo.pro/dashboard." If 404: -> "I couldn't find that resource. Try a broader search term." If 429: -> "Rate limit reached. Try again tomorrow or upgrade at hylo.pro/dashboard." ## API (bash + curl) Base: `https://api.hylo.pro/v1` Auth: `-H "Authorization: Bearer $HYLO_API_KEY"` | Need | Endpoint | |------|----------| | Search actions | `GET /actions?q=KEYWORD` | | Search triggers | `GET /triggers?q=KEYWORD` | | Search API schemas | `GET /schemas?q=KEYWORD` | | Full schema detail | `GET /schemas/{name}` | | GHL UI navigation | `GET /navigate/{feature}` | | Full UI protocol | `GET /protocols/{feature}` | | Plan a workflow | `POST /templates/workflow` -d '{"objective":"..."}' | | Validate workflow | `POST /validate` -d '{"trigger":"...","actions":[...]}' | For category/feature lists: `cat {baseDir}/reference/endpoints.md` ## Rules - ALWAYS call the API -- don't guess about GHL. Your knowledge may be outdated. - Summarize JSON responses naturally -- never dump raw output. - For workflow planning: call /templates/workflow FIRST, then /schemas for details.


Security scan verdicts — ClawScan: clean | static analysis:  | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mikoboulot/wp-login (version 1.0.0)

# wp-login Skill This skill automates WordPress login using the environment variables: - `WP_URL` - WordPress site URL - `WP_USER` - Username - `WP_PASSWORD` - Password ## Usage The skill script will use these environment variables to perform a login to the WordPress site. ## Description The skill should support: - Automating the login process to the WordPress site - Handling login success/failure ## Implementation Implementation details can include using HTTP requests or browser automation to perform the login. --- Below is an example script outline for the wp-login skill in Node.js: ```js const axios = require('axios'); const qs = require('qs'); async function wpLogin() { const url = process.env.WP_URL; const user = process.env.WP_USER; const [REDACTED_SECRET]; if (!url || !user || !password) { throw new Error('Missing WP_URL, WP_USER, or WP_PASSWORD environment variables'); } // WordPress login endpoint const loginUrl = `${url.replace(/\/$/, '')}/wp-login.php`; // Prepare login form data const data = qs.stringify({ log: user, [REDACTED_SECRET], wp-submit: 'Log In', redirect_to: `${url.replace(/\/$/, '')}/wp-admin/`, testcookie: 1 }); try { // Send login POST request const response = await axios.post(loginUrl, data, { headers: { 'Content-Type': [REDACTED_SECRET] }, maxRedirects: 0, validateStatus: status => status === 302 // Expect redirect on success }); if (response.status === 302) { console.log('Login successful'); return true; } else { console.error('Login failed'); return false; } } catch (err) { console.error('Error during login:', err.message); return false; } } module.exports = { wpLogin }; ```


Security scan verdicts — ClawScan: suspicious | static analysis:  | VirusTotal: malicious | SkillSpector: suspicious (HIGH)
Skill: psyduckler/aeo-prompt-frequency-analyzer (version 1.0.0)

--- name: aeo-prompt-frequency-analyzer description: Analyze what search queries Gemini uses when answering a prompt, by running it multiple times with Google Search grounding and reporting frequency distribution. Use when investigating AEO query patterns, understanding how AI models search the web for a topic, or studying the probabilistic nature of AI-triggered search queries. --- # Prompt Frequency Analyzer Run a prompt N times against Gemini with Google Search grounding enabled. Collect and report the frequency of search queries Gemini generates across all runs. ## Usage ```bash GEMINI_API_KEY=$(security find-generic-password -s "nano-banana-pro" -w) \ python3 scripts/analyze.py "your prompt here" [--runs 10] [--model gemini-2.5-pro] [--concurrency 5] [--output text|json] ``` Run from the skill directory. Resolve `scripts/analyze.py` relative to this SKILL.md. ## Options - `--runs N` — Number of times to run the prompt (default: 10) - `--model NAME` — Gemini model to use (default: gemini-2.5-pro) - `--concurrency N` — Max parallel API calls (default: 5; keep ≤5 to avoid rate limits) - `--output text|json` — Output format (default: text) ## Output Reports for each unique search query: - Frequency percentage (how many runs used that query) - Raw count - Top web sources referenced ## Notes - Gemini API key must be in `GEMINI_API_KEY` env var (stored in macOS Keychain under `nano-banana-pro`) - Each run is independent — Gemini may use different search queries each time - Retries failed requests up to 3 times with exponential backoff - Use `--output json` for programmatic consumption


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)