OpenClaw/clawhub-security-signals huggingface dataset:
Skill: shimonxin/imap-mailbox (version 1.0.1)

--- name: imap-mailbox description: "Read and manage emails via IMAP protocol. List, read, search, and download email attachments. Supports digest mode for daily briefings. Triggers: check email, read inbox, new mail, email digest." --- # IMAP Mailbox Read and manage emails via the IMAP protocol. ## Use Cases - User asks to check email, view inbox, or read email content - User asks to search emails (by sender, subject, etc.) - User asks to mark emails as read/unread - Daily email digest / briefing ## Commands ### List Recent Emails ```bash imap-mailbox list [limit] ``` Lists summaries (sender, subject, date) of the most recent emails. Default: 10. ### Read Email Content ```bash imap-mailbox read <uid> ``` Read the full content of the email with the specified UID. ### Search Emails ```bash imap-mailbox search <keyword> ``` Search emails where the subject or sender contains the keyword. ### Email Digest ```bash imap-mailbox digest ``` Generate a daily email digest summary — categorized and condensed for quick review. ### Download Attachments ```bash imap-mailbox download <uid> [output-dir] ``` Download attachments from the specified email to the output directory. ## Configuration Config file located at `~/.config/imap-mailbox/config.json`, containing email address, IMAP server, and authorization token. ```json { "email": "[REDACTED_SECRET]", "host": "imap.example.com", "port": 993, "token": "your-authorization-code" } ``` ## Security Notes - Authorization tokens are stored locally and never uploaded - Recommend rotating authorization tokens periodically - To revoke access, regenerate the authorization code in your email provider settings


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal:  | SkillSpector: suspicious (CRITICAL)
Skill: niansen3-svg/wechat-automation-api (version 1.0.11)

--- name: "wechat-automation" description: "微信发信能力：控制本机发送微信文本或图片。触发词：给[某人]发微信、通知[某人]、把这个用微信发给[某人]、用微信发个图片" --- # 微信自动发信 Skill 赋予智能体（如 OpenClaw）掌控 Windows 桌面微信直接向真实用户或群组发送消息的能力。 ## 应用场景 - **信息推送**：当你作为智能体完成了某项长耗时的搜索、总结或生图任务后，可以将最终结果或报告链接直接通过微信发送给用户指定的联系人。 - **定时催办/打卡通知**：结合智能体的定时任务机制，向目标群组发送通知。 - **跨平台转发**：将抓取到的内容（特别如新闻图片、数据图表链接）作为微信信息直接转发。 ## 典型触发语句 - “帮我给 **LAVA** 发个微信，就说**我今天晚点到**。” - “把刚才总结的**会议纪要**发到**工作群**里。” - “下载这个图片，用微信发给 **文件传输助手**。” - “帮我通知一下 **张三**，让他**明天带电脑**。” ## 作为 Skill 调用的规范指令 本 Skill 是一个独立的同步执行脚本，调用后会直接返回结果退出，不会常驻内存。请在命令行中使用以下语法调用： ### 发送文本消息 ```bash python scripts/skill_cli.py --to "联系人或群组名称" --content "你要发送的具体文本" ``` ### 发送图片消息 ```bash python scripts/skill_cli.py --to "联系人或群组名称" --content "https://example.com/image.png" --action "sendpic" ``` ## 注意事项与约束 1. **必须精确匹配名称**：`--to` 参数指定的联系人或群组名称必须与微信内的备注或网名**完全一致**（区分大小写和空格），否则可能导致发送失败或发错人。 2. **切勿前置判断工具界面**：不要试图使用视觉模型去理解或分析微信的页面，你只需无脑执行上述命令行命令即可，底层脚本已封装了所有的窗体防错与寻找操作。 3. **识别执行结果**：执行后请读取 stdout，如果输出 `发送成功` 则代表到达终点；如果输出 `发送失败`，请**原封不动**把错误反馈给用户，不要擅自循环重试。 4. **特殊字符支持**：内容中可以直接包含换行符（`\n`）或表情符号文本，脚本层会自动处理转义与输入，请放心传入。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: cs995279497-byte/chen-tavily-search (version 1.0.0)

--- name: chen-tavily-search description: Web search using Tavily's LLM-optimized API. Returns relevant results with content snippets, scores, and metadata. homepage: https://tavily.com metadata: {"openclaw":{"emoji":"🔍","requires":{"bins":["node"],"env":[[REDACTED_SECRET]]},"primaryEnv":[REDACTED_SECRET]}} --- # Tavily Search Search the web and get relevant results optimized for LLM consumption. ## Authentication Get your API key at https://tavily.com and add to your OpenClaw config: ```json { "skills": { "entries": { "tavily-search": { "enabled": true, "apiKey": [REDACTED_SECRET] } } } } ``` Or set the environment variable: ```bash export TAVILY_API_KEY=[REDACTED_SECRET] ``` ## Quick Start ### Using the Script ```bash node {baseDir}/scripts/search.mjs "query" node {baseDir}/scripts/search.mjs "query" -n 10 node {baseDir}/scripts/search.mjs "query" --deep node {baseDir}/scripts/search.mjs "query" --topic news ``` ### Examples ```bash # Basic search node {baseDir}/scripts/search.mjs "python async patterns" # With more results node {baseDir}/scripts/search.mjs "React hooks tutorial" -n 10 # Advanced search node {baseDir}/scripts/search.mjs "machine learning" --deep # News search node {baseDir}/scripts/search.mjs "AI news" --topic news # Domain-filtered search node {baseDir}/scripts/search.mjs "Python docs" --include-domains docs.python.org ``` ## Options | Option | Description | Default | |--------|-------------|---------| | `-n <count>` | Number of results (1-20) | 10 | | `--depth <mode>` | Search depth: `ultra-fast`, `fast`, `basic`, `advanced` | `basic` | | `--topic <topic>` | Topic: `general` or `news` | `general` | | `--time-range <range>` | Time range: `day`, `week`, `month`, `year` | - | | `--include-domains <domains>` | Comma-separated domains to include | - | | `--exclude-domains <domains>` | Comma-separated domains to exclude | - | | `--raw-content` | Include full page content | false | | `--json` | Output raw JSON | false | ## Search Depth | Depth | Latency | Relevance | Use Case | |-------|---------|-----------|----------| | `ultra-fast` | Lowest | Lower | Real-time chat, autocomplete | | `fast` | Low | Good | Need chunks but latency matters | | `basic` | Medium | High | General-purpose, balanced | | `advanced` | Higher | Highest | Precision matters, research | ## Tips - **Keep queries under 400 characters** - Think search query, not prompt - **Break complex queries into sub-queries** - Better results than one massive query - **Use `--include-domains`** to focus on trusted sources - **Use `--time-range`** for recent information - **Filter by `score`** (0-1) to get highest relevance results


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: dinghaibin/uptime-tool (version 1.0.0)

--- name: uptime-tool description: Show system uptime, load average, active user count, and boot time. Use for system health checks, monitoring, and diagnostics. --- # Uptime Tool — System Uptime & Load Monitor Display how long the system has been running since last boot, current user sessions, and CPU load averages. Essential for health checks, reboot verification, and capacity monitoring. ## Quick Start ```bash # Show system uptime uptime-tool # Show uptime plus JSON output for monitoring uptime-tool --json ``` ## Usage ```bash uptime-tool [OPTIONS] Options: --json Output as structured JSON --pretty Human-readable format with emojis (default) --since Show boot time timestamp --seconds Show uptime in seconds only --compare Compare with last-known value (requires --state-file) --watch N Monitor continuously, N second intervals --alert N Alert if uptime < N seconds (short uptime = recent reboot) ``` ## Examples ```bash # Standard uptime output uptime-tool # Machine-readable JSON for monitoring uptime-tool --json # Show boot time uptime-tool --since # Watch every 30 seconds uptime-tool --watch 30 # Alert if system just rebooted (< 60 seconds uptime) uptime-tool --alert 60 # Uptime in seconds for scripts uptime-tool --seconds ``` ## Features - **Standard uptime display** with load averages - **JSON output** for monitoring pipelines - **Boot time** detection (when did the system start?) - **Continuous watch** mode for real-time monitoring - **Alert thresholds** for restart detection - **Compare mode** detects unexpected reboots - **Cross-platform** — works on Linux, macOS, BSD


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: danielfoch/manychat-cli (version 0.1.0)

--- name: manychat-cli summary: Agent-friendly ManyChat automation CLI with playbook support for multi-step workflows. --- # ManyChat CLI Skill Use this skill when you need to automate ManyChat operations from OpenClaw or other AI agents. ## What this skill provides - A local CLI wrapper at `/Users/danielfoch/manychat-cli/manychat_cli.py` - Stable JSON output and exit codes for automation orchestration - High-value ManyChat commands: - subscriber lookup and profile reads - tag add/remove - custom field updates - flow/content sends - create/update subscriber - raw endpoint passthrough - JSON playbook execution for sequential automation steps ## Requirements - `MANYCHAT_API_KEY` environment variable must be set. - Optional: `MANYCHAT_BASE_URL` to override API host. ## Usage Validate token: ```bash cd /Users/danielfoch/manychat-cli ./manychat_cli.py ping --pretty ``` Find by email: ```bash ./manychat_cli.py find-system --field-name email --field-value '[REDACTED_SECRET]' --pretty ``` Run a multi-step playbook: ```bash ./manychat_cli.py playbook-run \ --file /Users/danielfoch/manychat-cli/sample_playbook.json \ --vars-json '{"email":"[REDACTED_SECRET]"}' \ --pretty ``` ## File references - CLI: `/Users/danielfoch/manychat-cli/manychat_cli.py` - Playbook example: `/Users/danielfoch/manychat-cli/sample_playbook.json` - Shell example: `/Users/danielfoch/manychat-cli/example_automation.sh` - Extended docs: `/Users/danielfoch/manychat-cli/README.md`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: barbaraledbettergq/background-remover-claw-skill (version 1.7.0)

--- name: background-remover-claw-skill description: Generate ai background remover images with AI via the Neta AI image generation API (free trial at neta.art/open). tools: Bash --- # Background Remover Generate stunning ai background remover images from a text description. Get back a direct image URL instantly. ## Token Requires a Neta API token. Free trial available at <https://www.neta.art/open/>. ```bash export NETA_TOKEN=your_token_here node <script> "your prompt" --token "$NETA_TOKEN" ``` ## When to use Use when someone asks to generate or create ai background remover images. ## Quick start ```bash node backgroundremoverclaw.js "your description here" --token YOUR_TOKEN ``` ## Options - `--size` — `portrait`, `landscape`, `square`, `tall` (default: `square`) ## Install ```bash npx skills add BarbaraLedbettergq/background-remover-claw-skill ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: dongsheng123132/fastcp (version 1.0.1)

--- name: fastcp version: 1.0.1 description: "Multi-target parallel file copy CLI. Reads source once into memory, writes to multiple USB drives concurrently. | 多目标并行复制工具，源文件只读一次，同时写入多个U盘。" user_invocable: true --- # FastCP - 多目标并行复制 / Multi-target Parallel Copy 将源目录一次性读入内存，并行复制到多个目标（U盘）。专为 AI 工具自动化调用设计。 Read source directory into memory once, copy to multiple targets (USB drives) in parallel. Designed for AI tool automation. ## 使用场景 / When to use - 同一份文件同时复制到多个U盘 / Copy same files to multiple USB drives - 批量部署文件到多个目标目录 / Batch deploy to multiple destinations - 需要复制后校验完整性 / Copy with integrity verification ## 安装 / Install 从 GitHub Releases 下载或源码编译： ```bash go install github.com/dongsheng123132/fastcp@latest ``` ## 用法 / Usage ```bash # 复制到多个U盘 / Copy to multiple USB drives fastcp <source_dir> <target1> <target2> [target3] ... # Windows 示例 fastcp.exe D:\源文件夹 E:\ F:\ G:\ H:\ # Linux/macOS 示例 fastcp /path/to/source /media/usb1 /media/usb2 /media/usb3 # 带校验 / With verification (xxhash) fastcp --verify <source> <target1> <target2> # 增量复制 / Incremental (skip unchanged) fastcp --incremental <source> <target1> # 控制并发数 / Control parallelism (default 3) fastcp -c 2 <source> <target1> <target2> <target3> # 预览模式 / Preview without copying fastcp --dry-run <source> <target1> <target2> ``` ## 参数 / Flags - `-c, --concurrency N`: 同时写入目标数 / simultaneous target writes (default 3) - `-b, --buffer-size`: 写缓冲区 / write buffer (default 4M) - `--verify`: xxhash 校验 / integrity check after copy - `--incremental`: 跳过未变更文件 / skip unchanged files - `--dry-run`: 预览不复制 / preview only - `--preload-all`: 强制全量预加载 / force all files into memory ## 典型流程 / Typical workflow 1. 确认U盘挂载盘符 / Identify mounted drives 2. 执行: `fastcp --verify D:\source E:\ F:\ G:\` 3. 检查校验结果 / Check verification output


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: nissan/lora-finetune (version 1.0.0)

--- name: lora-finetune description: LoRA fine-tuning pipeline for Stable Diffusion on Apple Silicon — dataset prep, training, evaluation with LLM-as-judge scoring. Use when fine-tuning image generation models for consistent style, custom characters, or domain-specific visuals. Requires Python with torch and diffusers. version: 1.0.0 metadata: { "openclaw": { "emoji": "\ud83c\udfa8", "requires": { "bins": [ "python3" ], "env": [ "HF_TOKEN" ] }, "primaryEnv": "HF_TOKEN", "network": { "outbound": true, "reason": "Downloads base models from Hugging Face Hub (huggingface.co). Training runs locally on-device." } } } --- # LoRA Fine-Tuning (Apple Silicon) Train custom LoRA adapters for Stable Diffusion 1.5 on Mac hardware. Tested on M4 24GB — produces 3.1MB weight files in ~15 minutes at 500 steps. ## Hardware Requirements | Config | Model | Resolution | VRAM | |---|---|---|---| | M4 24GB | SD 1.5 | 512×512 | ✅ Works | | M4 24GB | SDXL | 512×512 | ⚠️ Tight, may OOM | | M4 24GB | FLUX.1-schnell | Any | ❌ OOMs | | M4 Pro 48GB | SDXL | 1024×1024 | ✅ Estimated | ## Training Pipeline 1. **Prepare dataset:** 15-25 images in consistent style, 512×512, with text captions 2. **Train LoRA:** 500 steps, learning rate 1e-4, rank 4 3. **Evaluate:** Generate test images, compare base vs LoRA vs reference (Gemini/DALL-E) 4. **Score:** LLM-as-judge rates each on style consistency, quality, prompt adherence ## Quick Start ```bash # Prepare training images in a folder ls training_data/ # image_001.png image_001.txt image_002.png image_002.txt ... # Train (see scripts/train_lora.py for full options) python3 scripts/train_lora.py \ --data_dir ./training_data \ --output_dir ./lora_weights \ --steps 500 \ --lr 1e-4 \ --rank 4 ``` ## Evaluation with LLM-as-Judge ```python # Compare base model vs LoRA vs commercial (Gemini/DALL-E) # Pixtral Large scores each image 1-10 on: # - Style consistency with training data # - Image quality and coherence # - Prompt adherence # Our results: Base 6.8 → LoRA 9.0 → Gemini 9.5 # Lesson: Gemini wins without training, but LoRA closes the gap significantly ``` ## Key Lessons - **float32 required on MPS** — float16 silently produces NaN on Apple Silicon for SD pipelines - **mflux is faster than PyTorch MPS for FLUX** (~105s vs ~90min) but doesn't support LoRA training - **SD 1.5 is the ceiling for 24GB** — FLUX LoRA OOMs even with gradient checkpointing - **15-25 images is the sweet spot** — fewer undertrain, more doesn't help proportionally - **Gemini (Imagen 4.0) beats fine-tuned SD 1.5** with zero training — use commercial APIs for production, LoRA for experimentation and offline use ## Files - `scripts/train_lora.py` — Training script with Apple Silicon MPS support - `scripts/compare_models.py` — LLM-as-judge evaluation comparing base vs LoRA vs reference


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: tmstudio667-commits/whale-pulse-monitor (version 1.0.0)

--- name: whale-pulse-monitor description: "Real-time BTC Orderbook Imbalance (OBI) tracking for professional traders. Detects high-conviction whale activity before it hits the tape. Powered by Sovereign-Futures logic." metadata: { "openclaw": { "emoji": "🐋" }, "author": "System Architect Zero", "x402": { "fee": 0.25, "currency": "USDC", "network": "base" } } --- # Whale Pulse Monitor Stop guessing. Start tracking the money. This skill provides direct access to the Sovereign-Futures OBI scanning engine, alerting you when a physical imbalance is detected on OKX/Binance. ## Features - **Whale Fingerprinting**: Distinguishes between retail noise and institutional iceberg orders. - **S-Level Alerts**: Triggers only when OBI > 5.0 for maximum conviction. - **Low Latency**: Directly interfaced with the Rust-based market-cli. ## Usage ```bash npx openclaw skill run whale-pulse-monitor ``` ## Why it costs $0.25? To filter out non-professional noise and maintain our high-performance infrastructure.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: johanesalxd/vision-sandbox (version 1.1.0)

--- name: Vision Sandbox slug: vision-sandbox version: 1.1.0 description: Agentic Vision via Gemini's native Code Execution sandbox. Use for spatial grounding, visual math, and UI auditing. metadata: openclaw: emoji: "🔭" primaryEnv: "GEMINI_API_KEY" requires: bins: ["uv"] env: ["GEMINI_API_KEY"] --- # Vision Sandbox 🔭 Leverage Gemini's native code execution to analyze images with high precision. The model writes and runs Python code in a Google-hosted sandbox to verify visual data, perfect for UI auditing, spatial grounding, and visual reasoning. ## Installation ```bash clawhub install vision-sandbox ``` ## Usage ```bash uv run vision-sandbox --image "path/to/image.png" --prompt "Identify all buttons and provide [x, y] coordinates." ``` ## Pattern Library ### 📍 Spatial Grounding Ask the model to find specific items and return coordinates. * **Prompt:** "Locate the 'Submit' button in this screenshot. Use code execution to verify its center point and return the [x, y] coordinates in a [0, 1000] scale." ### 🧮 Visual Math Ask the model to count or calculate based on the image. * **Prompt:** "Count the number of items in the list. Use Python to sum their values if prices are visible." ### 🖥️ UI Audit Check layout and readability. * **Prompt:** "Check if the header text overlaps with any icons. Use the sandbox to calculate the bounding box intersections." ### 🖐️ Counting & Logic Solve visual counting tasks with code verification. * **Prompt:** "Count the number of fingers on this hand. Use code execution to identify the bounding box for each finger and return the total count." ## Integration with OpenCode This skill is designed to provide **Visual Grounding** for automated coding agents like OpenCode. - **Step 1:** Use `vision-sandbox` to extract UI metadata (coordinates, sizes, colors). - **Step 2:** Pass the JSON output to OpenCode to generate or fix CSS/HTML. ## Configuration - **GEMINI_API_KEY**: Required environment variable. - **Model**: Defaults to `gemini-3-flash-preview`.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: nexscope/shopify-seo (version 1.0.0)

# Shopify SEO Comprehensive Shopify SEO optimization guide. Technical SEO, on-page optimization, collection pages, blog strategy, site architecture, and link building for Shopify stores. ## Capabilities - Technical SEO audit: site speed, mobile, crawlability, indexing - Product page SEO: titles, meta descriptions, image alt text - Collection page optimization and URL structure - Blog content strategy for organic traffic - Internal linking and site architecture - Schema markup for Shopify (Product, FAQ, Breadcrumb) - Shopify SEO app recommendations and setup - Duplicate content handling (variants, pagination) ## Install ```bash npx skills add nexscope/shopify-seo ``` ## Usage Ask your AI agent: - "Run an SEO audit on my Shopify store." - "Optimize my Shopify collection pages for better rankings." - "Create a blog content plan to drive organic traffic to my store." ## Output Structured recommendations with actionable steps, benchmarks, and platform-specific guidance. --- *Built by [Nexscope](https://www.nexscope.ai/) — AI-powered e-commerce tools for sellers worldwide.*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ghwyever/06-tts-voice (version 1.0.3)

# 语音合成TTS技能 ## 功能介绍 将短剧台词转为自然、带情感的配音音频，适配短剧节奏。 ## 输入参数 - dialogue：台词文本（必填） ## 输出结果 - audio_url：生成语音地址 ## 使用场景 - 短剧角色配音 - 短视频旁白制作 - 批量语音生成 ## 技术说明 支持通用TTS模型，需配置 API_KEY、API_BASE、MODEL_NAME。

path: skill.js
content: module.exports = async function main({ inputs, env }) {
  const { dialogue } = inputs;

  const [REDACTED_SECRET];
  const API_BASE = env.API_BASE;
  const MODEL_NAME = env.MODEL_NAME;

  const res = await fetch(`${API_BASE}/tts`, {
    method: "POST",
    headers: {
      "Authorization": "Bearer " + API_KEY,
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      model: MODEL_NAME,
      text: dialogue
    })
  });

  const data = await res.json();
  return { audio_url: data.audio_url };
};


path: manifest.json
content: {
  "namespace": "user",
  "name": "06-tts-voice",
  "displayName": "06 TTS Voice",
  "description": "台词生成配音",
  "version": "1.0.0",
  "input": {
    "type": "object",
    "properties": {
      "dialogue": { "type": "string" }
    },
    "required": ["dialogue"]
  },
  "output": {
    "type": "object",
    "properties": {
      "audio_url": { "type": "string" }
    },
    "required": ["audio_url"]
  },
  "runtime": "nodejs",
  "entry": "skill.js",
  "environment": {
    "API_KEY": {},
    "API_BASE": {},
    "MODEL_NAME": {}
  }
}


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)