OpenClaw/clawhub-security-signals huggingface dataset:
Skill: 1kalin/afrexai-supply-chain (version 1.0.0)

# Supply Chain Risk Monitor Analyze supply chain vulnerabilities, map supplier dependencies, and generate risk mitigation plans. ## What It Does Given your supplier list or industry context, this skill: 1. **Maps dependencies** — Tier 1, 2, 3 supplier concentration risk 2. **Scores vulnerabilities** — Geographic, single-source, lead time, financial health 3. **Generates mitigation plans** — Dual-sourcing strategies, safety stock calculations, nearshoring options 4. **Creates dashboards** — Risk heat maps, supplier scorecards, disruption scenario modeling ## How to Use Tell your agent: - "Assess supply chain risk for our top 10 suppliers" - "Create a supplier diversification plan" - "Model the impact of a 30-day disruption from our China suppliers" - "Score our supply chain resilience" ## Risk Scoring Framework | Factor | Weight | Score 1 (Low Risk) | Score 5 (Critical) | |--------|--------|-------------------|---------------------| | Single-source dependency | 25% | 3+ qualified suppliers | Sole source, no backup | | Geographic concentration | 20% | Multi-region sourcing | Single country/port | | Lead time volatility | 15% | <5% variance | >30% variance | | Financial health | 15% | Strong balance sheet | Distressed/unknown | | Compliance risk | 10% | Fully audited | No visibility | | Substitutability | 10% | Drop-in alternatives exist | Custom/proprietary | | Inventory buffer | 5% | 60+ days safety stock | JIT, no buffer | **Composite Score**: Weighted average → Green (1-2), Yellow (2.5-3.5), Red (4-5) ## Disruption Cost Formula ``` Daily Impact = (Revenue at Risk × Margin) + Expediting Costs + Customer Penalties + Brand Damage Recovery Time = Lead Time × (1 + Qualification Factor) Total Exposure = Daily Impact × Recovery Time ``` ## Output Formats - **Executive summary** — Top 5 risks, total exposure, recommended actions - **Supplier scorecard** — Individual risk profiles with improvement targets - **Scenario analysis** — What-if modeling for major disruptions - **Action plan** — 30/60/90 day mitigation roadmap with owners and budgets ## Industry Benchmarks - Average company has 60% single-source exposure - Supply chain disruptions cost Fortune 500s $184M per event (2024) - Companies with formal risk programs recover 2.5x faster - Dual-sourcing reduces disruption impact by 40-60% --- Built by [AfrexAI](https://afrexai-cto.github.io/context-packs/) — AI context packs for business automation.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zvirb/executive-assistant-time-blocking (version 1.0.1)

--- name: executive-assistant-time-blocking description: Standard Operating Procedure (SOP) that acts as an executive assistant to block out calendar time using TS atomic plugins. os: all requires: bins: [gog] plugins: [autonomous-workflows-plugin] --- ## Lean Philosophy (Principles) - **Kaizen (改善):** This workflow relies entirely on discrete, single-responsibility TS tools rather than a monolithic markdown loop. - **Standardized Work (Hyojun Sagyo):** This node represents a strict, step-by-step Standard Operating Procedure (SOP) for automated time-blocking. - **Jidoka (自働化):** Includes autonomous self-healing loops with hard verification stops between every step. # Executive Assistant Time Blocking SOP This procedure guides the agent to evaluate current incomplete tasks from Google Tasks, estimate their duration, and sequentially schedule them into available gaps using TS atomic tools. ## Cognitive Directives WHEN [Requested to schedule tasks, time-block the backlog, or act as an executive assistant for schedule management] THEN [ Follow this strict Standard Operating Procedure: **Step 1: Task Collection** - Execute `gog tasks list @default --json` to retrieve incomplete tasks. - **Jidoka Stop:** IF the output is not a valid JSON array, retry. IF empty, report no tasks and STOP. **Step 2: Cognitive Assessment** - Autonomously assign duration and urgency to each task. **Step 3: Schedule Retrieval** - Execute `gog calendar events primary --from "<start>" --to "<end>" --json`. - **Jidoka Stop:** Verify the response. Retry on error. **Step 4: Gap Analysis** - Execute the [REDACTED_SECRET] atomic TS tool, passing the events array. - **Jidoka Stop:** IF the tool returns an error, correct and retry. **Step 5: Sequential Time Blocking** - For each task, map it to a free gap. - Execute the `Google Calendar Create Event` atomic node. - **Jidoka Stop:** Verify event creation success. **Step 6: Overlap Audit** - Execute the `workflow_audit_schedule_overlaps` atomic TS tool. - **Jidoka Stop:** IF overlaps are detected, resolve them using `Google Calendar Delete Event` and repeat the scheduling loop. ] ## Expected Output A comprehensive summary of the scheduled tasks, detailing the timeline and confirmation of overlap-free scheduling.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: laolaoqi/linux-security-scanner (version 1.0.0)

--- name: linux-security-scanner description: Linux security auditing tool that checks SSH configuration, open/listening ports, firewall rules (ufw/iptables/nftables), failed login attempts, sudoers permissions, world-writable files, and SUID binaries. Use when a user needs a security posture assessment, hardening audit, or compliance check on a Linux host — run individual checks or a full comprehensive audit with a formatted report. --- # Linux Security Scanner ## Script `scripts/security-audit.sh` — the single entry point for all checks. The script is self-contained, portable, and works on any modern Linux system. It auto-detects available tools (ss/netstat, ufw/iptables/nftables, journalctl) and gracefully skips unavailable ones. ## Quick Start Run a full audit: ```bash bash scripts/security-audit.sh --all ``` Or with no arguments (same as `--all`): ```bash bash scripts/security-audit.sh ``` ## Individual Checks Run any single check by name: | Command | What it checks | |---|---| | `--ssh` | PermitRootLogin, PasswordAuthentication, Port, Protocol in sshd_config | | `--ports` | Listening TCP ports (ss or netstat) | | `--firewall` | ufw status, iptables filter rules, nftables ruleset | | `--failed-logins` | lastb output and journalctl SSH auth failures (last 24h) | | `--sudoers` | Sudoers file permissions (must be 440), files present, NOPASSWD entries, full sudo access grants | | `--world-writable` | World-writable files in /etc, /tmp, /var, /home, /opt (depth 3) | | `--suid` | All SUID binaries, risk assessment, unusual path detection | Example: ```bash bash scripts/security-audit.sh --ssh --failed-logins ``` ## Full Audit Workflow 1. Run `bash scripts/security-audit.sh --all` 2. The script outputs a colorized report to stdout 3. A structured markdown report is stored in the `$REPORT` variable (accessible within the same shell session) 4. For programmatic use, redirect output to a file ## Common Findings & Recommendations - **SSH hardening**: Disable root login, disable password auth, use key-only auth, change default port - **Firewall**: Ensure only necessary ports are open; prefer deny-by-default - **Sudoers**: Avoid NOPASSWD where possible; keep permissions at 440; audit who has full sudo access - **SUID**: Review unusual SUID paths; minimize SUID binaries; check for known CVEs on common ones (pkexec, sudo, etc.) - **World-writable files**: These are security risks — investigate why they're writable and restrict permissions ## Notes - Requires root/sudo for some checks (failed-logins reads /var/log/btmp, ss shows process info) - Runs entirely in the shell — no external dependencies beyond standard Linux tools - Respects permission boundaries — non-accessible checks are noted, not forced


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jllyzzd2023/scrapling-web-fetch (version 1.0.2)

--- name: scrapling-web-fetch description: 使用 Scrapling + html2text 获取现代网页正文内容，支持微信公众号文章抓取与尾部噪音清洗，减少无用信息与 token 消耗；适合抓取博客、新闻、公告及许多普通 fetch 不稳定、存在反爬或动态渲染干扰的网页。Supports WeChat article cleanup, markdown output, batch fetch, selector overrides, and many hard-to-fetch modern pages. --- # Scrapling Web Fetch 当用户要获取网页内容、正文提取、把网页转成 markdown/text、抓取文章主体时，优先使用此技能。 ## 默认流程 1. 使用 `python3 scripts/scrapling_fetch.py <url> <max_chars>` 2. 默认正文选择器优先级： - `article` - `main` - `.post-content` - `[class*="body"]` 3. 命中正文后，使用 `html2text` 转 Markdown 4. 若都未命中，回退到 `body` 5. 最终按 `max_chars` 截断输出 ## 用法 ```bash python3 /Users/zzd/.openclaw/workspace/skills/scrapling-web-fetch/scripts/scrapling_fetch.py <url> 30000 ``` ## 依赖 优先检查： - `scrapling` - `html2text` 若缺失，可安装： ```bash python3 -m pip install scrapling html2text ``` ## 输出约定 脚本默认输出 Markdown 正文内容。 如需结构化输出，可追加 `--json`。 如需调试提取命中了哪个 selector，可查看 stderr 输出。 ## 附加资源 - 用法参考：`/Users/zzd/.openclaw/workspace/skills/scrapling-web-fetch/references/usage.md` - 选择器策略：`/Users/zzd/.openclaw/workspace/skills/scrapling-web-fetch/references/selectors.md` - 统一入口：`/Users/zzd/.openclaw/workspace/skills/scrapling-web-fetch/scripts/fetch-web-content` ## 何时用这个技能 - 获取文章正文 - 抓博客/新闻/公告正文 - 将网页转成 Markdown 供后续总结 - 常规 fetch 效果差，希望提升现代网页抓取稳定性 ## 何时不用 - 需要完整浏览器交互、点击、登录、翻页时：改用浏览器自动化 - 只是简单获取 API JSON：直接请求 API 更合适


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mupengi-bot/agent-insight (version 1.0.0)

--- name: agent-insight description: 고객사 에이전트 인사이트 수집 및 분석. 매월 1일 정기 실행하거나 형님 지시 시 즉시 실행. 에이전트가 고객사 현장에서 관찰한 Pain Point, 서비스 개선점, 수익 기회, 이탈 위험, 현장 인사이트를 수집하고 종합 리포트를 작성. "인사이트", "고객 점검", "에이전트 점검", "이탈 위험" 관련 요청에 트리거. --- # 에이전트 인사이트 수집 스킬 ## 실행 절차 1. 프롬프트를 에이전트 해방군 #일반 채널에 전원 멘션과 함께 전송 2. 각 에이전트 응답 대기 (최대 10분) 3. 응답 취합 → 종합 리포트 작성 4. `memory/insights/YYYY-MM-DD-agent-insight.md`에 저장 5. 형님에게 결과 요약 전달 ## 에이전트 질문 프롬프트 아래 5개 항목을 그대로 복사해서 전송: ``` 📋 전원 필수 응답 — 에이전트 인사이트 조사 아래 5개 항목에 솔직하게 답해라. 좋은 말만 하지 말고. 1. 고객 Pain Point (Top 3) 대표/직원이 가장 자주 묻거나 어려워하는 건 뭐냐? 2. 우리 서비스 개선점 (Top 3) 너한테 부족한 기능이나, 있었으면 고객이 더 만족했을 것은 뭔가? 3. 추가 수익 기회 고객이 우리 서비스 말고도 같이 사면 좋을 만한 거, upsell 포인트 있냐? 4. 이탈 위험도 (1~10) 이 고객이 다음 달에도 계속 쓸 것 같냐? 근거도 같이 써라. 5. 현장에서만 알 수 있는 인사이트 1개 대화 로그에서만 발견할 수 있는, 형님이 모를만한 정보. 각자 답변 후 이 채널에 제출. ``` ## 종합 리포트 포맷 ```markdown # 에이전트 인사이트 조사 결과 — YYYY-MM-DD ## 종합 요약 | 에이전트 | 고객사 | 이탈 위험 | 핵심 인사이트 | |---------|--------|----------|--------------| ## 공통 개선점 (Top 3) ## Upsell 기회 TOP 3 ## 에이전트별 상세 (각 에이전트 5개 항목 전체 기록) ``` ## 주의사항 - 에이전트 응답 확인 시 세션 타이밍 고려 (먼저 올린 답변 놓치지 않기) - 이탈 위험 7+/10은 형님에게 즉시 알림 - 결과는 반드시 파일로 저장 (memory/insights/)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: pressbytesagain/contract-analyzer (version 1.0.0)

--- name: "contract-analyzer" description: "Analyze and review contract documents. Use when extracting key clauses, detecting high-risk terms, comparing two contracts, generating a contract summary, or getting a contract review checklist." --- # Contract Reviewer ## Triggers on contract review, analyze contract, risk clauses, compare contracts, contract summary, contract checklist, legal document review ## What This Skill Does Analyze and review contract documents. Use when extracting key clauses, detecting high-risk terms, comparing two contracts, generating a contract summary, or getting a contract review checklist. ## Commands ### analyze ```bash bash scripts/script.sh analyze [args] ``` ### risk ```bash bash scripts/script.sh risk [args] ``` ### compare ```bash bash scripts/script.sh compare [args] ``` ### summary ```bash bash scripts/script.sh summary [args] ``` ### checklist ```bash bash scripts/script.sh checklist [args] ``` ### help ```bash bash scripts/script.sh help ``` ## Requirements - bash 4+ - python3 (standard library) Powered by BytesAgain | bytesagain.com


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: googleworkspace-bot/gws-workflow-email-to-task (version 1.0.12)

--- name: gws-workflow-email-to-task description: "Google Workflow: Convert a Gmail message into a Google Tasks entry." metadata: version: 0.22.5 openclaw: category: "productivity" requires: bins: - gws cliHelp: "gws workflow +email-to-task --help" --- # workflow +email-to-task > **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it. Convert a Gmail message into a Google Tasks entry ## Usage ```bash gws workflow +email-to-task --message-id <ID> ``` ## Flags | Flag | Required | Default | Description | |------|----------|---------|-------------| | `--message-id` | ✓ | — | Gmail message ID to convert | | `--tasklist` | — | @default | Task list ID (default: @default) | ## Examples ```bash gws workflow +email-to-task --message-id MSG_ID gws workflow +email-to-task --message-id MSG_ID --tasklist LIST_ID ``` ## Tips - Reads the email subject as the task title and snippet as notes. - Creates a new task — confirm with the user before executing. ## See Also - [gws-shared](../gws-shared/SKILL.md) — Global flags and auth - [gws-workflow](../gws-workflow/SKILL.md) — All cross-service productivity workflows commands


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: laolaoqi/laolaoqi-docker-health (version 1.0.0)

--- name: docker-health-monitor description: 'Monitor Docker container health: running status, CPU/memory usage, restart counts, and available image updates. Use when a user requests Docker health checks, container monitoring, resource usage reports, restart tracking, or image freshness audits — run targeted checks or a full health report.' --- # Docker Health Monitor ## Script `scripts/docker-health.sh` — the single entry point for all checks. The script is self-contained and works on any system with Docker installed. It auto-detects the Docker socket availability and gracefully handles permission issues. ## Quick Start Run a full health report: ```bash bash scripts/docker-health.sh --all ``` Or with no arguments (same as `--all`): ```bash bash scripts/docker-health.sh ``` ## Individual Checks Run any single check by name: | Command | What it checks | |---|---| | `--status` | Lists all containers with their current status (running, stopped, paused, etc.) | | `--resources` | Shows CPU and memory usage per container via `docker stats` | | `--restarts` | Flags containers that have restarted more than 3 times | | `--images` | Checks for available image updates by comparing local image digests with registry | | `--full` | Runs all checks in sequence (same as `--all`) | Example: ```bash bash scripts/docker-health.sh --status --restarts ``` ## Full Audit Workflow 1. Run `bash scripts/docker-health.sh --all` 2. The script outputs a formatted report to stdout 3. Key sections: container status summary, resource usage table, restart warnings, image update availability ## Common Findings & Recommendations - **High restart counts** (>3): Indicates container instability — check logs with `docker logs <container>` and review healthcheck configuration - **High memory usage**: Consider setting `--memory` limits in the container's run/stack config; check for memory leaks in the application - **High CPU usage**: Investigate application processes; consider CPU limits or horizontal scaling - **Outdated images**: Run `docker pull` to update images; consider automated update workflows (watchtower, renovate-bot) - **Exited containers**: Check exit codes — 0 means intentional stop, non-zero indicates errors ## Notes - Requires access to the Docker socket (`/var/run/docker.sock`) — run as root or add user to the `docker` group - `--resources` runs `docker stats` in non-streaming mode (one-shot per container) for quick snapshots - `--images` checks are advisory — uses `docker inspect` for image digests and checks for newer versions; requires network access to the registry - Works with both local Docker and remote Docker contexts (DOCKER_HOST env var)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: chaoyang78/dashscope-imagegen (version 1.0.0)

--- name: dashscope-imagegen description: "Generate images using DashScope wan2.6-t2i model (通义万相). Use when user asks to generate/create images, illustrations, or visual content via DashScope/通义万相. Requires exec tool and DASHSCOPE_API_KEY." --- # dashscope-imagegen Generate images using Alibaba Cloud DashScope wan2.6-t2i model (通义万相 2.6). ## Usage ```bash python3 ~/.openclaw/scripts/dashscope-imagegen.py "your prompt here" [options] ``` ### Options - `--size SIZE` — Image size, e.g. `1024*1024`, `1280*720`, `720*1280` (default: `1024*1024`) - `-n N` — Number of images (default: 1) - `--negative "text"` — Negative prompt - `-o DIR` — Output directory (default: current dir) - `--url-only` — Only print image URLs without downloading ### Examples ```bash # Generate and download python3 ~/.openclaw/scripts/dashscope-imagegen.py "一只可爱的橘猫坐在书桌上" -o /tmp # URL only python3 ~/.openclaw/scripts/dashscope-imagegen.py "sunset over mountains" --url-only --size 1280*720 # With negative prompt python3 ~/.openclaw/scripts/dashscope-imagegen.py "professional headshot" --negative "cartoon, anime, low quality" ``` ### Supported Sizes Total pixels must not exceed ~1.5M. Common sizes: - `1024*1024` (1:1) - `1280*720` (16:9) - `720*1280` (9:16) - `1024*768` (4:3) - `768*1024` (3:4) ### Environment Requires `DASHSCOPE_API_KEY` environment variable (set in `~/.openclaw/.env`). ### Notes - Async API: submits task, polls for completion (~10-20s) - Output is PNG - Chinese and English prompts both work well - `prompt_extend` is enabled by default for better results


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal:  | SkillSpector: clean (LOW)
Skill: kostja94/tiktok-captions (version 1.0.1)

--- name: tiktok-captions description: When the user wants to create TikTok video captions, scripts, or optimize for TikTok. Also use when the user mentions "TikTok post," "TikTok caption," "TikTok video," "post to TikTok," "TikTok script," "TikTok content," "TikTok copy," "TikTok hashtags," or "TikTok marketing." For TikTok ads, use tiktok-ads. metadata: version: 1.0.1 --- # Platforms: TikTok Guides TikTok caption and video script creation. Use for generating publish-ready captions and video specs. Suitable for copy agents, video agents (format, length), and design agents (thumbnail). **When invoking**: On **first use**, if helpful, open with 1-2 sentences on what this skill covers and why it matters, then provide the main output. On **subsequent use** or when the user asks to skip, go directly to the main output. ## Output: Publish-Ready Copy This skill enables agents to generate TikTok captions and video scripts. Captions drive SEO, accessibility, and watch time (12-20% increase with captions). 80%+ watch without sound. ## Caption Structure | Element | Length | Purpose | |--------|--------|---------| | **Hook** | 5-7 words | Grab attention; create curiosity | | **Context** | 1-2 sentences | Size, price, backstory--info video doesn't show | | **CTA** | Optional | "Save this," "Link in bio" | **Hook examples**: "Stop scrolling if you sell on Etsy," "This took me 47 attempts," "Wait for the final result" ## Video Specs (for Video Agents) | Spec | Value | Notes | |------|-------|-------| | **Aspect ratio** | 9:16 (portrait) | Standard; fills mobile | | **Resolution** | 1080x1920 px | Recommended | | **Length** | 3 sec - 10 min | 15-60 sec for tips; 1-3 min for tutorials | | **Format** | MP4, MOV | H.264, AAC | | **File size** | <=5MB (Android), <=88MB (iOS) | Varies by device | ## Caption Best Practices - **Contrast**: Strong font/background contrast; 75% watch mute - **Auto-captions**: TikTok's built-in; algorithm rewards; edit for accuracy - **Keywords**: Improve search visibility - **Readability**: Test on multiple devices ## Content by Length | Length | Use | |--------|-----| | **15-60 sec** | Quick tips, humor, hooks | | **1-3 min** | Tutorials, storytelling | | **3-10 min** | Deep dives (longer format) | ## Output Format When generating TikTok content, provide: 1. **Caption** (hook + context + CTA) 2. **Video script** (if video agent) 3. **Video specs** (9:16, 1080x1920, length) 4. **Hashtags** (3-5; niche-relevant) ## Related Skills - **tiktok-ads**: Paid promotion on TikTok; In-Feed, Spark Ads (boost organic); video specs and captions align with organic content - **influencer-marketing**: TikTok is key influencer platform - **twitter-x-posts**: Cross-posting short-form video


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jpengcheng523-netizen/jpeng-threat-intelligence (version 1.0.0)

--- name: jpeng-threat-intelligence description: "Get threat intelligence" version: "1.0.0" author: "jpeng" tags: ["threat", "intel", "security"] --- # Threat Intelligence Get threat intelligence ## When to Use - User needs threat related functionality - Automating intel tasks - Security operations ## Usage ```bash python3 scripts/threat_intelligence.py --input <input> --output <output> ``` ## Configuration Set required environment variables: ```bash export INTEL_API_KEY="your-api-key" ``` ## Output Returns JSON with results: ```json { "success": true, "data": {} } ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 52yuanchangxing/downloads-command-center (version 1.0.0)

--- name: downloads-command-center description: Organize the Downloads folder into a clean, searchable command center by file type, project, date, and action state. version: 1.1.0 metadata: openclaw: requires: bins: - python3 emoji: 🧰 --- # Downloads Command Center ## Purpose Organize the Downloads folder into a clean, searchable command center by file type, project, date, and action state. ## Trigger phrases - 整理下载文件夹 - 清理 Downloads - organize my downloads - rename recent files - 把下载内容分类 ## Ask for these inputs - Downloads folder path - organization preference by type/project/date - whether to move duplicates to quarantine - optional keep rules ## Workflow 1. Inspect the user's folder structure and ask for the target path if it is missing. 2. Propose a safe organization plan before moving files in bulk. 3. Use the helper script to generate a preview manifest and rename plan. 4. Prefer copy/simulate mode first; only suggest destructive actions after confirmation. 5. Return a summary of categories created, duplicates found, and items that need manual review. ## Output contract - folder plan - rename/move preview - duplicate report - cleanup checklist ## Files in this skill - Script: `{baseDir}/scripts/organize_downloads.py` - Resource: `{baseDir}/resources/rules.sample.json` ## Operating rules - Be concrete and action-oriented. - Prefer preview / draft / simulation mode before destructive changes. - If information is missing, ask only for the minimum needed to proceed. - Never fabricate metrics, legal certainty, receipts, credentials, or evidence. - Keep assumptions explicit. ## Suggested prompts - 整理下载文件夹 - 清理 Downloads - organize my downloads ## Use of script and resources Use the bundled script when it helps the user produce a structured file, manifest, CSV, or first-pass draft. Use the resource file as the default schema, checklist, or preset when the user does not provide one. ## Boundaries - This skill supports planning, structuring, and first-pass artifacts. - It should not claim that files were modified, messages were sent, or legal/financial decisions were finalized unless the user actually performed those actions. ## Compatibility notes - Directory-based AgentSkills/OpenClaw skill. - Runtime dependency declared through `metadata.openclaw.requires`. - Helper script is local and auditable: `scripts/organize_downloads.py`. - Bundled resource is local and referenced by the instructions: `resources/rules.sample.json`.

path: CHANGELOG.md
content: # Changelog

## 1.0.0
- Initial release.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)