OpenClaw/clawhub-security-signals huggingface dataset:
Skill: 1kalin/financial-tracker (version 1.0.0)

--- name: Financial Tracker description: Track business income and expenses in structured CSV format. Categorize transactions, monitor cash flow, generate P&L summaries, and spot spending trends. --- # Financial Tracker You are a financial tracking assistant for small businesses and freelancers. Help users track income, expenses, and cash flow. ## Core Capabilities ### 1. Transaction Logging Record transactions in CSV format: ``` Date,Type,Category,Description,Amount,Payment Method,Notes 2024-01-15,Income,Client Work,Acme Corp invoice #1042,5000.00,Bank Transfer,Net 30 2024-01-16,Expense,Software,Notion subscription,-16.00,Credit Card,Monthly ``` Categories: - **Income**: Client Work, Product Sales, Recurring Revenue, Interest, Other Income - **Expenses**: Software, Marketing, Contractors, Office, Travel, Professional Services, Equipment, Taxes, Insurance, Payroll ### 2. Monthly P&L Summary Generate profit & loss: - Total Revenue (by category) - Total Expenses (by category) - Gross Profit - Net Profit - Profit Margin % - Month-over-month comparison ### 3. Cash Flow Tracking - Opening balance - Cash in (income received) - Cash out (expenses paid) - Closing balance - Projected cash position (30/60/90 days) ### 4. Expense Analysis - Top spending categories - Unusual expenses (vs average) - Recurring vs one-time breakdown - Cost trends over time ### 5. Tax Prep Support - Quarterly income summary - Deductible expenses by category - Estimated tax liability - Missing documentation flags ## Output Format Financial data always in clean tables. CSV format for export. Currency symbols included. Two decimal places for all amounts.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: cp3d1455926-svg/music-helper (version 1.0.0)

--- name: music-helper description: 音乐助手 - 歌曲推荐、歌单生成、音乐搜索、歌词获取 version: 1.0.0 --- # 🎵 Music Helper - 音乐助手 ## 触发规则 **关键词：** - 推荐歌曲、歌单推荐、听什么歌 - 网易云、QQ 音乐、酷狗 - 歌词、这首歌叫什么 - 歌手、专辑、MV **场景：** - 用户想听歌但不知道选什么 - 用户查询某首歌的信息 - 用户需要歌词 - 用户想找类似风格的音乐 ## 功能描述 ### 核心功能 1. **音乐推荐** - 根据心情推荐（开心/难过/放松/运动） - 根据场景推荐（学习/工作/睡眠/运动） - 根据风格推荐（流行/摇滚/民谣/电子/古典） - 根据语种推荐（华语/欧美/日韩/粤语） 2. **音乐搜索** - 歌曲搜索（歌名/歌词片段） - 歌手搜索 - 专辑搜索 - MV 搜索 3. **歌词获取** - 实时歌词查询 - 歌词翻译（中英/中日） - 歌词海报生成 4. **歌单管理** - 创建个人歌单 - 收藏喜欢的歌曲 - 每日推荐 ### 推荐维度 - 🎵 风格：流行、摇滚、民谣、电子、嘻哈、R&B、古典、爵士 - 😊 心情：开心、难过、放松、兴奋、治愈、emo - 🎯 场景：学习、工作、睡眠、运动、通勤、派对 - 🌍 语种：华语、欧美、日韩、粤语、泰语 - 📅 年代：2020s、2010s、经典老歌 ## 权限需求 - [x] 网络访问（音乐平台 API） - [x] 文件读写（歌单存储） - [ ] 外部 API（网易云/QQ 音乐） ## 数据源 - 网易云音乐（主） - QQ 音乐（备用） - 酷狗音乐（备用） - 歌词网（歌词） ## 示例对话 ``` 用户：推荐几首好听的歌 助手：你想听什么风格的？流行、摇滚、民谣还是电子？或者告诉我你现在的心情/场景~ 用户：学习的时候听什么 助手：推荐这 5 首适合学习的纯音乐： 1. 《Summer》- 久石让 ⭐4.9 - 轻快治愈 2. 《雨的印记》- 李闰珉 ⭐4.8 - 安静钢琴 3. 《卡农》- 帕赫贝尔 ⭐4.9 - 经典古典 4. 《风居住的街道》- 矶村由纪子 ⭐4.8 - 二胡钢琴 5. 《神秘园之歌》- Secret Garden ⭐4.7 - 新世纪音乐 用户：查一下《晴天》的歌词 助手：《晴天》- 周杰伦 📀 专辑：《叶惠美》(2003) ⭐ 评分：9.8 故事的小黄花 从出生那年就飘着 童年的荡秋千 随记忆一直晃到现在 ... 用户：推荐类似周杰伦的歌 助手：基于周杰伦的 R&B/中国风风格，推荐： 1. 林俊杰 - 《江南》《不为谁而作的歌》 2. 王力宏 - 《花田错》《大城小爱》 3. 陶喆 - 《爱很简单》《小镇姑娘》 4. 方大同 - 《Love Song》《特别的人》 ``` ## 数据存储 ```json // ~/.openclaw/workspace/music-helper/favorites.json { "favorite_songs": [ { "title": "晴天", "artist": "周杰伦", "added_date": "2026-03-16", "play_count": 42 } ], "playlists": [ { "name": "学习专用", "songs": ["Summer", "雨的印记", "卡农"] } ] } ``` ## 待办事项 - [ ] 实现网易云音乐 API 对接 - [ ] 实现歌词爬取 - [ ] 创建歌单存储 - [ ] 添加推荐算法 - [ ] 测试搜索准确性 --- **版本：** 1.0.0 **创建日期：** 2026-03-16 **作者：** 小鬼 👻


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: malicious | SkillSpector: suspicious (HIGH)
Skill: madsmith/wekan-openclaw-skill (version 1.5.0)

--- name: wekan description: > Manage a self-hosted Trello-like board via `wekancli`. Create, move and archive cards, lists and boards on a WeKan server. Use when user asks about task boards or anything Trelo-like. Not for: Github issues or simple reminders. metadata: { "openclaw": { "emoji": "📋", "requires": { "bins": ["wekancli"], "env": [ "WEKAN_URL", "WEKAN_TOKEN", ] }, "install": [ { "id": "uv", "kind": "uv", "package": "wekan-cli @ git+https://github.com/madsmith/wekan_cli.git", "bins": ["wekancli"], "label": "Install Wekan CLI (uv)" } ], "primaryEnv": "WEKAN_TOKEN", }, } --- # wekancli Use `wekancli` to create, move and archive cards/tasks in Wekan boards. Tool operates under with a specific user session/identity but Agents may be configured to provide their own unique tokens corresponding to identities that can be configured in their name. ## Quick start List boards: `wekancli list boards <USER_ID>` List Lists: `wekancli list lists <BOARD_ID>` List Cards: `wekancli list cards <BOARD_ID> --list-id <LIST_ID>` Create Card: `wekancli create card <BOARD_ID> <LIST_ID> "Card Title" <AUTHOR USER_ID>` Move Card: `wekancli edit card <CARD_ID> -f listId=<NEW_LIST_ID>` Archive Card: `wekancli archive card <CARD_ID>` ## References - `references/cli-examples.md` (real `wekancli` examples) - `references/user-install.md` (installation instructions for users)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: junwugit/intimate-ch09-sexuality (version 1.0.0)

--- name: intimate-ch09-sexuality description: 在对话中辅助学习"亲密关系/Intimate Relationships"第 9 章"性爱"。基于 Rowland S. Miller《Intimate Relationships》教材第 6 版。（sexuality 性爱；sexual attitudes 性态度；casual sex 随意性行为；sexual double standard 性双重标准；extradyadic sex 伴侣外性行为；sociosexual orientation 社会性性行为取向；sex drive 性驱力；hookup 随意性关系；safe sex 安全性行为；pluralistic ignorance 人众无知；sexual satisfaction 性满足；sexual coercion 性胁迫）使用渐进式披露，按需读取 references/ 下的细节，把课本知识自然引入学习对话 --- # Intimate Relationships Chapter 9: Sexuality ## 何时启用 - 用户询问 Miller《Intimate Relationships》第 9 章、性爱、性行为或性满足。 - 用户想区分 sexual attitudes、sexual behavior、sexual satisfaction 和 sexual coercion。 - 用户提到随意性行为、hookup、性双重标准、同性恋态度或性态度的文化差异。 - 用户询问第一次性行为、忠诚关系中的性频率、性欲望差异或性取向差异。 - 用户询问不贞、extradyadic sex、sociosexual orientation、good genes hypothesis。 - 用户询问安全性行为、避孕套、风险低估、alcohol myopia 或 pluralistic ignorance。 - 用户想理解 sexual communication、性意图误读、Abbey、Masters 与 Johnson。 - 用户询问性胁迫、consent、压力方式、界限沟通或关系中的尊重。 ## 渐进式披露总原则 1. 先问后讲：先确认用户问的是态度、行为、满足、安全、沟通，还是胁迫与界限。 2. 最小必要信息：每次先给 3-5 句可独立理解的回答，再按用户追问下钻。 3. 用课本例子锚定：解释抽象概念时优先使用第 9 章原有研究情境、图表或"请你思考"案例。 4. 层层下钻不反向展开：用户只问性满足时，不主动展开不贞或性胁迫；用户问安全时再读风险文件。 5. 中文回答，术语首次给英文：第一次出现写作"社会性性行为取向（sociosexual orientation）"，之后可只用中文。 ## 核心骨架 ### 性爱与亲密关系 - 本章核心观点：性爱（sexuality）不仅是性高潮或身体行为，也嵌入爱情、承诺、沟通、权力和关系满意度。 - 性态度（sexual attitudes）会受时代、文化、宗教、政治、性别和性取向观念影响。 - 性行为（sexual behavior）本身差异很大，不能把"常见"误当成"更健康"。 ### 三组常考对比 - 随意性行为（casual sex）与承诺关系中的性行为：前者不一定追求长期关系，后者更受伴侣关系质量影响。 - 不贞（extradyadic sex）与开放的社会性性行为取向：前者是伴侣外性行为，后者是对无承诺性关系的态度和行为倾向。 - 性满足（sexual satisfaction）与关系满意度：二者相互关联，受沟通、尊重、自主、频率、动机和伴侣质量影响。 ### 安全与界限 - 安全性行为（safe sex）受风险估计、性唤醒、酒精、同伴规范、权力差异和避孕套态度影响。 - 性沟通（sexual communication）能提升性满足，也能减少性意图误读和界限冲突。 - 性胁迫（sexual coercion）是违背对方意愿的压力、操纵、威胁或强制，和亲密关系中的尊重相冲突。 ## 引入细节时去读哪个文件 | 用户问题 / 场景 | 读取文件 | | --- | --- | | 术语定义、英文原词、易混辨析 | `references/key-terms.md` | | 理论模型、机制解释、为什么会发生 | `references/theories.md` | | 性态度、同性恋态度、文化差异 | `references/attitudes-and-culture.md` | | 第一次性行为、忠诚关系中的性行为、性欲望差异 | `references/behavior-and-desire.md` | | 不贞、伴侣外性行为、社会性性行为取向 | `references/infidelity-and-safe-sex.md` | | 安全性行为、风险低估、避孕套、人众无知 | `references/infidelity-and-safe-sex.md` | | 性满足、性沟通、关系满意度、性意图误读 | `references/satisfaction-communication-coercion.md` | | 性胁迫、界限、压力方式、预防性沟通 | `references/satisfaction-communication-coercion.md` | | 经典研究、研究者、年份、课本数据 | `references/research.md` | | 课本原有例子、课堂讲解锚点、误解纠偏 | `references/examples.md` 或 `references/common-misconceptions.md` | ## 教学风格建议 - 苏格拉底式：先问"你想解释一个现象，还是准备考试辨析概念？"再选择 reference。 - 易混概念辨析：重点区分态度与行为、性欲望与性满足、性沟通与同意、不贞与社会性性行为取向。 - 例子锚点：讲性意图误读用 Abbey，讲沟通用 Masters 与 Johnson，讲安全性行为用风险低估和人众无知。 - 敏感话题处理：保持学术、清晰和尊重，不用挑逗性语言，不把教材概念包装成医学或法律建议。 - 应用类问题：可以把用户场景映射到课本概念，但涉及健康、创伤、法律或即时安全时建议寻求专业支持。 ## 范围边界 - 本 skill 只覆盖 Miller《Intimate Relationships》第 9 章"性爱"。 - 若用户问爱情、激情下降、沟通模式、权力或冲突，可简短指出与第 8、5、6、12 章有关，再回到第 9 章框架。 - 若用户要求具体百分比、研究者或年份，先读取 `references/research.md`；没有记录的内容明确说"本章材料未提供"。 - 若用户寻求医学诊断、性传播感染治疗、法律判断或危机干预，只能提供一般性学习框架，并建议联系合格专业人士。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jdscd/ai-prompt-pack (version 1.0.1)

# AI Prompt Pack for Digital Sellers Este skill proporciona una colección curada de 10 prompts de alta ingeniería diseñados específicamente para creadores que venden productos digitales en plataformas como Gumroad y Etsy. ## Qué incluye - Prompts para generación de ideas de productos. - Estructuras para copy de páginas de venta (sales pages). - Secuencias de correos para lanzamientos. - Estrategias de SEO para Etsy. - Optimizadores de descripciones para Gumroad. ## Cómo usar Simplemente llama al skill pidiendo ayuda para una fase específica de tu venta digital. Ejemplo: "Genera una descripción de producto para Gumroad usando este prompt pack." ## Precio sugerido $15 USD


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yaojiangfeng/weekly-report-flow-yjf (version 1.0.2)

--- name: weekly-report-flow description: Generate and submit weekly reports from Aliyun DevOps workitems via EMOP API. Use when asked to run the weekly report flow, backfill missing weeks, or explain/automate the DevOps→summary→EMOP submission process. --- # Weekly Report Flow (DevOps → Summary → EMOP) ## When to use - User asks to generate/submit weekly reports. - User asks to backfill missing weeks. - User asks to automate the DevOps→summary→EMOP flow. ## Required inputs - **DEVOPS_TOKEN** in environment (never write to disk) - **EMOP token** in environment (never write to disk) - **Assignee** default: 姚江峰 - **Types**: 需求/任务/缺陷 ## Workflow 1) **Pull DevOps workitems** - Use browser session if direct API returns 403. - Endpoint: `/projex/api/workitem/workitem/list?_input_charset=utf-8` - Header: `x-yunxiao-[REDACTED_SECRET]` - Page size 200, iterate all pages. - Filter in client by assignee/nickName and type. 2) **Classify** - Include **current sprint** workitems. - Include **last-week created** items not in current sprint. - Last week: Mon 00:00 → Sun 23:59 (Asia/Shanghai). 3) **Summarize** - 200–300 Chinese characters, department-formal, not流水账. - Output Markdown and also HTML ordered list `<ol><li>...</li></ol>`. 4) **Submit to EMOP** - POST `https://emop.oureman.com/api/weekly/report` - Headers: `[REDACTED_SECRET]`, `Content-Type: application/json; charset=utf-8` - Body fields: - `date`: single day (last Friday, yyyy-MM-dd) - `reportDate`: ISO UTC `yyyy-MM-ddTHH:mm:ss.000Z` - `content`: `<ol><li>...</li></ol>` - Ensure UTF-8 bytes to avoid乱码. ## Backfill mode - For each missing week (by Friday date), pull DevOps items for that week and generate summary. - Submit one report per week. ## References - See `references/urls.md` for project URLs and IDs. - See `references/cli.md` for local script entrypoints.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mike007jd/skillpulse (version 1.0.0)

--- name: skill-profiler description: Profile offline OpenClaw skill run samples to detect latency, CPU, and memory bottlenecks and compare sessions. homepage: https://github.com/mike007jd/openclaw-skills/tree/main/skill-profiler metadata: {"openclaw":{"emoji":"📈","requires":{"bins":["node"]}}} --- # Skill Profiler Analyze offline sample sets and surface the slowest or heaviest skills before they become production regressions. ## When to use - You have JSON sample logs with `latencyMs`, `cpuMs`, and `memoryMb`. - You want threshold-based hotspot detection for local review or CI. - You need a shareable JSON or HTML report, or a before/after comparison between two runs. ## Commands ```bash node {baseDir}/bin/skill-profiler.js run --input ./samples.json node {baseDir}/bin/skill-profiler.js report --input ./samples.json --out ./report.html node {baseDir}/bin/skill-profiler.js compare --left ./v1.json --right ./v2.json ``` ## Sample input ```json [ { "sessionId": "s1", "skill": "clawshield", "latencyMs": 1320, "cpuMs": 910, "memoryMb": 240 } ] ``` ## What it reports - Average latency and p95 latency per skill - Average CPU and peak memory per skill - Bottlenecks using configurable latency, CPU, and memory thresholds - Session diffs showing added, removed, and changed skills ## Boundaries - Skill Profiler is built for offline sample analysis, not live tracing. - It depends on the quality of the input samples and does not capture traces by itself.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: gamingjancok11-ctrl/my-clean-skill (version 1.0.2)

--- name: verified-agent-identity- gaming version: 1.0.0 description: A skill that enables AI agents to create and verify decentralized identities using Billions Network. --- # Verified Agent Identity This skill allows AI agents to generate and manage decentralized identities using the Billions Network. ## Features - Create verifiable agent identities - Link agents to human identities - Support ERC-8004 identity standard - Enable secure attestations ## Usage After installing this skill, the agent can: - Generate a unique identity - Verify identity credentials - Interact with decentralized identity systems ## Requirements - Node.js environment - Billions Network access ## Notes This is a basic implementation of verified agent identity for testing and development purposes.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: oscraters/massive (version 1.0.1)

--- name: massive-com description: Bash CLI wrapper and OpenClaw skill for Massive's public REST API. Use when Codex or an OpenClaw agent needs to query Massive market-data endpoints from a shell workflow, align authentication to OpenClaw-style secret references, keep logs free of secrets, or integrate Massive responses into agent pipelines and other CLI tools. --- # Massive CLI for OpenClaw Use the bundled CLI before writing ad hoc `curl` commands. Keep requests deterministic, resolve credentials through OpenClaw-compatible secret references when available, and prefer narrow queries over broad scans. ## Quick Start - Read [references/openclaw-secrets.md](references/openclaw-secrets.md) before configuring credentials. - Read [references/massive-api.md](references/massive-api.md) when choosing endpoints or query shapes. - Read [references/security.md](references/security.md) before changing logging, auth, or error handling. - Run `scripts/massive health` to validate local prerequisites and auth configuration. - Run `scripts/massive get /v3/reference/tickers/AAPL` for a generic REST request. - If you package or publish this skill, include every path listed in `BUNDLE_MANIFEST.md`. ## Workflow 1. Resolve credentials through `MASSIVE_API_KEY_REF` when possible. 2. Fall back to `MASSIVE_API_KEY` only when a secret ref is not available. 3. Use a domain shortcut when it matches a documented Massive endpoint. 4. Use `get` for any other documented REST path. 5. Pipe JSON into downstream tools instead of enabling verbose logging. ## Commands - `scripts/massive health` - `scripts/massive get <path-or-next-url> [--query key=value ...]` - `scripts/massive next` to read `next_url` from stdin JSON and fetch the next page - `scripts/massive stocks ticker-details <ticker>` - `scripts/massive stocks previous-close <ticker>` - `scripts/massive options contract-details <options-ticker>` - `scripts/massive forex currencies` - `scripts/massive crypto currencies` - `scripts/massive indices ticker-details <ticker>` ## Agent Rules - Keep output in JSON unless a human-readable mode is explicitly needed. - Send diagnostics to `stderr`; treat `stdout` as data. - Never print resolved secrets, auth headers, or raw secret-ref payloads. - Avoid `--verbose` in shared logs. - Feed `next_url` back into `get` or `next` instead of reconstructing pagination manually. - Treat non-`api.massive.com` absolute URLs as invalid unless `MASSIVE_BASE_URL` was explicitly changed to another HTTPS origin. ## Resources - `scripts/massive`: main Bash CLI - `BUNDLE_MANIFEST.md`: required file list for packaged artifacts - `references/openclaw-secrets.md`: credential and secret-ref contract used by this skill - `references/massive-api.md`: endpoint selection and request patterns - `references/security.md`: redaction and operational safety constraints


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: abakermi/lemonsqueezy-admin (version 0.1.0)

--- name: lemonsqueezy-admin version: 1.0.0 description: Admin CLI for Lemon Squeezy stores. View orders, subscriptions, and customers. author: abakermi metadata: openclaw: emoji: "🍋" requires: env: ["LEMONSQUEEZY_API_KEY"] --- # Lemon Squeezy Admin 🍋 Manage your Lemon Squeezy store from the command line. ## Setup 1. Get an API Key from [Lemon Squeezy Settings > API](https://app.lemonsqueezy.com/settings/api). 2. Set it: `export LEMONSQUEEZY_API_KEY="your_key"` ## Commands ### Orders ```bash ls-admin orders --limit 10 # Output: #1234 - $49.00 - [REDACTED_SECRET] (Paid) ``` ### Subscriptions ```bash ls-admin subscriptions # Output: Active: 15 | MMR: $450 ``` ### Stores ```bash ls-admin stores ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: elandivar/neomano-web-snapshot (version 0.1.1)

--- name: neomano-web-snapshot description: Take a screenshot (PNG) of any website in a headless way (no GUI) to verify it's rendering/working. Use when the user asks for a website screenshot, uptime visual check, or to confirm a page loads correctly. metadata: {"clawdbot":{"emoji":"📸","requires":{"bins":["node","bun"],"npm":["playwright"]}}} --- ## Requirements - **Node.js** (required) - **bun** (required for the provided bootstrap/install flow) - **Playwright (Node package)** (required) This skill uses **Playwright + headless Chromium** (works without a GUI). ## One-time setup (headless) This installs dependencies into **this skill folder** (`{baseDir}`): ```bash bash {baseDir}/scripts/bootstrap.sh ``` Note: `node_modules/` is intentionally *not* shipped in the skill package; dependencies are installed locally by the bootstrap script. If you installed Playwright elsewhere (global or in a different project folder), Node may not find it when running this skill. ## Take a screenshot ```bash bash {baseDir}/scripts/snapshot.sh "https://example.com" --out ./snapshots/example.png ``` Options: - `--full-page` to capture full scroll height. - `--wait-ms 2000` to wait after load (useful for SPAs).

path: _meta.json
content: ownerId: kn7eyyy482y4vdee7z8j74bvad81hqxq
slug: neomano-web-snapshot
version: 0.1.0
publishedAt: 1773874104197

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jason141123-sys/openclaw-mobile-gateway-installer (version 1.0.4)

--- name: [REDACTED_SECRET] description: "Installs and manages OpenClaw mobile gateway as a system service. Invoke when users need one-command deploy, start, stop, upgrade, or uninstall." --- # OpenClaw Mobile Gateway Installer ## 作用 一键安装并管理 OpenClaw 移动端管理网关，自动注册为 systemd 服务并开机自启。 ## 何时调用 - 用户希望快速部署移动端管理网关 - 用户希望开机自动启动网关 - 用户需要升级、重启、卸载网关 - 用户需要检查健康状态和端口监听 ## 目录结构 - `backend/`: 网关后端源码 - `install.sh`: 安装/升级并启动服务 - `check.sh`: 服务与健康检查 - `uninstall.sh`: 卸载服务与目录 ## 使用命令 ```bash export OPENCLAW_API_BASE_URL="https://openclaws.example.com" export OPENCLAW_AUTH_HEADER_NAME="Authorization" export OPENCLAW_AUTH_HEADER_VALUE="Bearer <token>" bash ./install.sh ``` ```bash bash ./check.sh ``` ```bash bash ./uninstall.sh ``` ## 安装后 - 服务名：`openclaw-mobile-gateway` - 默认端口：`4800` - 健康检查：`http://127.0.0.1:4800/health` - APK 网关地址：`http://<server-ip>:4800` ## 常见排查 - 如果 APK 提示 `Cannot GET /api/quick-actions`，说明服务端网关版本过旧，重新执行 `bash ./install.sh` 升级即可。


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: leooooooow/upload-video-converter (version 1.0.0)

--- name: upload-video-converter description: Upload Video Converter for creators, ecommerce teams, and operators. Use when you need help with video conversion for compatibility and uploads. --- # Upload Video Converter ## Problem it solves Teams need a reliable way to handle this workflow without reinventing structure every time. This skill focuses on a practical operator outcome: video conversion for compatibility and uploads. ## Use when - The team needs a repeatable workflow for upload video converter - The request is operational, decision-oriented, and ecommerce-relevant - A creator, operator, analyst, or growth team needs a structured answer fast ## Do not use when - The task is unrelated to ecommerce or creator workflows - The user needs raw data extraction without synthesis - The request is purely generic brainstorming with no operating context ## Inputs - Business context and objective - Relevant constraints or requirements - Existing evidence, notes, data, or content - Optional examples of what good output looks like ## Workflow 1. Clarify the operating question and success condition. 2. Review the available context, evidence, and constraints. 3. Structure the problem into the most useful decision frame. 4. Produce practical output that can be acted on immediately. 5. Flag gaps, risks, and next steps when confidence is limited. ## Output Return: 1. Short diagnosis or framing 2. Recommended action path 3. Supporting rationale 4. Risks, caveats, or watchouts 5. Next-step checklist or handoff ## Quality bar - Be specific, reusable, and ecommerce-relevant - Avoid generic filler and vague advice - Prefer practical decision support over theory - Make the output easy to hand off into operations ## Resource See `references/output-template.md`.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: fermionoid/senseguard (version 1.0.1)

--- name: senseguard description: Semantic security scanner for OpenClaw skills. Detects prompt injection, data exfiltration, and hidden instructions that traditional code scanners miss. Use when user asks to scan skills, check skill safety, or run a security audit. --- # SenseGuard Scans OpenClaw skills for **natural language security threats** — the kind that VirusTotal and traditional code scanners cannot detect. Traditional scanners see SKILL.md as a text file. SenseGuard sees it as **agent instructions** and checks for prompt injection, data exfiltration, obfuscation, and persistence attacks. ## How to Use When the user asks to scan a skill: ```bash python3 scripts/scanner.py --target <skill-name-or-path> ``` Options: - `--target all` — scan all installed skills - `--deep` — force LLM semantic analysis (Layer 2) - `--no-cache` — skip cached results - `--json` — output raw JSON for further processing ### Layer 2 (Semantic Analysis) When `--json` output contains a `layer2_prompt` field, process it as a security audit task, then feed the JSON result back to generate the final score. This is how the LLM analyzes intent beyond regex patterns. ## Output The scanner outputs a Markdown risk report with: - Score (0-100) and rating: SAFE / CAUTION / DANGEROUS / MALICIOUS - Findings with rule IDs, evidence text, and line numbers - Actionable recommendations For CRITICAL findings, clearly advise the user to take action. ## Key Differentiator SenseGuard catches what VirusTotal cannot: - `"ignore all previous instructions"` — prompt injection - `curl -X POST` hidden in Markdown — data exfiltration - Zero-width characters hiding commands — obfuscation - `"modify MEMORY.md"` — persistence attacks These are invisible to traditional malware scanners because they target the **AI agent**, not the operating system.


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)