OpenClaw/clawhub-security-signals huggingface dataset:
Skill: langlyyy/github-trending-project (version 1.0.0)

--- name: github-trending description: 查询 GitHub Trending 热门项目，支持按编程语言、日期范围、口语（文档语言）筛选。当用户想了解 GitHub 今日/本周/本月热门项目、特定语言的热门仓库、或中文文档的热门项目时使用此技能。 --- # GitHub Trending 技能 ## 何时使用 当用户需要以下任意信息时，请使用本技能： - 查看 GitHub 当前热门项目（今日/本周/本月） - 按编程语言筛选热门项目（如 Python、JavaScript、Go 等） - 按文档口语筛选（如只显示中文文档的项目） - 查看热门开发者（developers）而非仓库 - 获取趋势项目列表供学习、选型或参考 ## 核心能力 1. **构造并返回 GitHub Trending 页面链接**，便于用户直接访问 2. **解释筛选参数**，帮助用户理解如何自定义查询 3. **提供常用筛选值参考**，降低用户使用门槛 ## 基础 URL 结构 - **仓库 Trending**：`https://github.com/trending` - **开发者 Trending**：`https://github.com/trending/developers` ## 筛选参数 GitHub Trending 页面通过 URL 查询参数进行筛选。所有参数均为可选，不指定时使用默认值。 ### 1. `l` - 编程语言（Language） 根据项目主要使用的**编程语言**筛选。 | 参数 | 说明 | |------|------| | `l` | 语言标识符，小写。如 `python`、`javascript`、`typescript`、`go`、`rust` 等 | **示例**：只显示 Python 项目 → `?l=python` **常用语言值**（见 `references/languages.md`）： - `python` - Python - `javascript` - JavaScript - `typescript` - TypeScript - `go` - Go - `rust` - Rust - `java` - Java - `c` - C - `cpp` - C++ - `csharp` - C# - `ruby` - Ruby - `php` - PHP - `kotlin` - Kotlin - `swift` - Swift ### 2. `since` - 日期范围（Date range） 根据**时间窗口**筛选，统计该时间段内的热度。 | 参数值 | 含义 | |--------|------| | `daily` | 今日（Today） | | `weekly` | 本周（This week） | | `monthly` | 本月（This month） | **示例**：查看本周热门 → `?since=weekly` ### 3. `spoken_language_code` - 口语/文档语言 根据项目 README/文档的**主要口语**筛选，用于找到特定语言文档的项目。 | 参数 | 说明 | |------|------| | `spoken_language_code` | ISO 639-1 语言代码，如 `en`、`zh`、`ja` 等 | **示例**：只显示中文文档项目 → `?spoken_language_code=zh` **常用口语代码**（见 `references/spoken-languages.md`）： - `en` - 英语（English） - `zh` - 中文（Chinese） - `ja` - 日语（Japanese） - `ko` - 韩语（Korean） - `es` - 西班牙语（Spanish） - `fr` - 法语（French） - `de` - 德语（German） - `ru` - 俄语（Russian） - `pt` - 葡萄牙语（Portuguese） ## 组合使用示例 多个参数用 `&` 连接： 1. **本周 Python 热门项目** ``` https://github.com/trending?l=python&since=weekly ``` 2. **本月中文文档的 JavaScript 项目** ``` https://github.com/trending?l=javascript&since=monthly&spoken_language_code=zh ``` 3. **今日 Rust 热门** ``` https://github.com/trending?l=rust&since=daily ``` 4. **本周热门开发者** ``` https://github.com/trending/developers?since=weekly ``` ## 执行步骤 当用户请求 GitHub Trending 相关信息时： 1. **解析用户意图**：确定需要的类型（仓库/开发者）、时间范围、编程语言、口语筛选。 2. **选择合适的参数**：根据用户需求选择 `l`、`since`、`spoken_language_code` 的值。 3. **构造完整 URL**：按 `https://github.com/trending[?参数]` 或 `https://github.com/trending/developers[?参数]` 格式拼接。 4. **返回结果**：给出可点击的链接，并简要说明当前筛选条件。 5. **可选**：如需更丰富的筛选值，可参考 `references/` 目录下的文件。 ## 注意事项 - GitHub 官方**不提供** Trending 的 REST API，本技能通过构造网页 URL 实现访问。 - 编程语言值需与 GitHub 语言列表一致，一般为小写英文，部分语言可能使用特殊标识（如 `c%23` 表示 C#，需 URL 编码）。 - 若用户提供的语言名称不明确，可给出常见匹配建议（如 "js" → `javascript`，"ts" → `typescript`）。 ## 参考资料 - GitHub Trending 页面：https://github.com/trending - 编程语言完整列表：`references/languages.md` - 口语语言代码列表：`references/spoken-languages.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: aboutyao/team-collab-skill (version 1.0.0)

--- name: team-collab-skill version: 1.0.0 description: "快速搭建多 Agent 协作系统。创建产品/研发/运营团队，支持持久化、任务路由、知识提取、并行协作。" author: 微³ keywords: [agent, collaboration, team, multi-agent, workflow, memory] metadata: openclaw: emoji: "🦞" --- # Team Collaboration Skill 🦞 快速搭建多 Agent 协作系统，让你的 AI 助手变成一个有组织的团队。 ## 一键安装 ``` skillhub install team-collab-skill ``` ## 功能特性 | 功能 | 说明 | |------|------| | Agent 持久化 | 状态文件系统，agent 记住上次在干什么 | | 共享知识库 | 所有 agent 可读取的 Doctor 偏好、决策记录 | | 任务自动路由 | 根据关键词自动分发给对应 agent | | 知识主动提取 | 自动识别关键信息并记录 | | 监控告警 | HEARTBEAT 定期检查 | | 并行协作 | 多 agent 同时工作 | ## 文件结构 ``` memory/ ├── MEMORY.md # 长期记忆 ├── company.md # 公司架构 ├── lessons.md # 学习记录 ├── team-dashboard.md # 团队仪表盘 ├── shared/ │ ├── doctor-profile.md # Doctor 偏好 │ ├── decisions.md # 历史决策 │ ├── best-practices.md # 最佳实践 │ ├── workflow.md # 协作流程 │ ├── task-routing.md # 任务路由 │ ├── knowledge-extraction.md # 知识提取 │ └── parallel-collab.md # 并行协作 └── agents/ ├── product-agent.md # 产品团队 ├── dev-agent.md # 研发团队 └── ops-agent.md # 运营团队 ``` ## 使用方法 ### 1. 初始化 在 Agent 启动时，读取以下文件： - `memory/MEMORY.md` — 长期记忆 - `memory/company.md` — 公司架构 - `memory/shared/doctor-profile.md` — Doctor 偏好 ### 2. Spawn Agent 创建子 agent 时，传入状态文件： ```javascript // 读取状态 const state = read('memory/agents/product-agent.md'); // Spawn spawnAgent('product', ` 你是产品团队 agent。 ## 你的状态 ${state} ## 任务 ${task} `); ``` ### 3. 任务路由 根据关键词分发任务： | 关键词 | 分发给 | |--------|--------| | 规划、分析、需求、功能 | 产品 Agent | | 安装、技能、代码、配置 | 研发 Agent | | 小红书、文案、图片、数据 | 运营 Agent | ### 4. 知识提取 自动识别 Doctor 说的关键信息： | Doctor 说 | 提取 | 存到 | |-----------|------|------| | "我是..." | 身份 | doctor-profile.md | | "我喜欢..." | 偏好 | doctor-profile.md | | "记住..." | 决策 | decisions.md | | "不要再犯..." | 教训 | lessons.md | ### 5. 并行协作 多个 agent 同时工作： ``` spawnAgent('product', '任务A'); spawnAgent('dev', '任务B'); spawnAgent('ops', '任务C'); // 等待所有完成 await Promise.all([...]); ``` ## 模板文件 所有模板在 `templates/` 目录： - `agents/*.md` — Agent 状态模板 - `shared/*.md` — 共享知识模板 ## 最佳实践 1. **每次 spawn 前读取状态文件** 2. **任务完成后更新状态文件** 3. **重要发现写入 lessons.md** 4. **定期检查 HEARTBEAT.md** ## 示例 **Doctor:** "帮我规划一个功能" **微³:** ``` 1. 读取 product-agent.md 2. Spawn 产品 agent 3. 产品输出规划 4. 更新 product-agent.md 5. 汇报给 Doctor ``` --- Created by 微³ 🦞 龙虾人科技


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: 618dt/skill-0232 (version 1.0.0)

# SKILL ## 🧠 Core Skills - Problem Solving - Critical Thinking - Communication - Time Management ## 💻 Technical Skills - Programming: Python / JavaScript / C++ - Web Development: HTML, CSS, React - Tools: Git, Docker, VS Code ## 📊 Professional Skills - Data Analysis - Project Management - Documentation Writing ## 🌱 Learning Goals - Improve system design ability - Deepen understanding of algorithms - Build more real-world projects ## 📌 Notes 持续学习，定期复盘，不断优化自己的技能结构。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: hakityc/feishu-weekly-report (version 1.0.1)

--- name: feishu-weekly-report description: | 生成飞书周报。通过两种方式收集工作内容：(1) 调用飞书API拉取指定时间范围的聊天记录，(2) 读取本地daily memory日志。 合并两个数据源后，按用户指定的周报模板自动整理输出。 触发词：周报、工作总结、上周总结、本周总结、写周报、weekly report。 Use when: 用户需要生成周报、工作总结，或要求回顾某段时间的工作内容。 --- # 飞书周报 Skill 生成周报分两步：收集素材 → 整理输出。 ## Step 1: 收集素材 从两个数据源并行收集，合并去重。 ### 数据源 A: 飞书聊天记录（API 拉取） 1. 确定时间范围（默认上周一 00:00 到上周日 23:59，用户本地时区） 2. 从 OpenClaw 配置获取飞书 app_id 和 app_secret： ```bash grep -E "appId|appSecret" ~/.openclaw/openclaw.json ``` 3. 获取当前 chat_id（从 inbound context 的 `chat_id` 字段取） 4. 计算时间戳（秒级）并执行拉取脚本： ```bash START_TS=$(python3 -c "import datetime; d=datetime.datetime(2026,2,24,0,0,tzinfo=datetime.timezone(datetime.timedelta(hours=8))); print(int(d.timestamp()))") END_TS=$(python3 -c "import datetime; d=datetime.datetime(2026,2,28,23,59,59,tzinfo=datetime.timezone(datetime.timedelta(hours=8))); print(int(d.timestamp()))") bash <skill_dir>/scripts/fetch_feishu_messages.sh <app_id> <app_secret> <chat_id> $START_TS $END_TS ``` 5. 输出为 JSON lines，每行一条消息。过滤掉 `msg_type` 不是 `text` 或 `post` 的消息（图片、卡片等无法提取有效文本）。过滤掉机器人的"正在思考中..."等状态消息。 **注意事项：** - 时间戳单位是**秒**（不是毫秒） - 如果用户有多个群聊，可能需要拉取多个 chat_id 的消息 - 消息量可能很大，优先提取用户发的消息（sender_type=user），机器人回复作为补充上下文 ### 数据源 B: 本地 Daily Memory 日志 读取 workspace 下的 memory 目录： ```bash ls <workspace>/memory/YYYY-MM-DD.md # 对应日期范围内的文件 ``` 如果日志存在，内容通常已经是整理过的工作要点，优先使用。 ### 合并策略 - daily memory 有的内容优先使用（已整理过，质量高） - 飞书聊天记录补充 memory 中没有的内容 - 去掉闲聊、调试、重复内容，只保留工作相关的实质内容 ## Step 2: 整理输出 ### 默认周报模板 ```markdown ## 本周工作总结 [按工作模块分条列出，每条简洁描述做了什么、产出是什么] ## 关键成果与进展 [本周最重要的2-3个产出/里程碑] ## 下周工作计划 [基于本周工作的延续和未完成事项，按优先级排列] ## 遇到的问题与需要的支持 [阻塞项、跨团队协作需求、资源需求等] ## 其他备注 [可选：学习心得、工具探索、流程优化建议等] ``` ### 输出原则 - **简洁**：每条工作描述控制在1-2行 - **结果导向**：强调产出而非过程（"输出了XX文档" 而非 "研究了很久XX"） - **量化**：有数据的加数据（"完成了3个模块的测试，通过率95%"） - **分类清晰**：按工作模块分组，不要流水账 ### 用户自定义模板 如果用户提供了自定义模板格式，使用用户的格式。将收集到的素材按用户模板的结构重新组织。 ## Daily Memory 写入（可选） 如果用户同意，在每次有实质工作内容的对话结束后，主动将当天要点写入： ``` <workspace>/memory/YYYY-MM-DD.md ``` 格式： ```markdown # YYYY-MM-DD 工作记录 ## 工作内容 - [具体做了什么] ## 关键产出 - [文档/代码/配置等具体产出] ## 待跟进 - [未完成的事项] ``` 这样下次生成周报时，日志已经准备好了。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: leooooooow/creator-brief-checker (version 1.0.0)

--- name: creator-brief-checker description: Check and improve creator briefs before sending to influencers. Use when your brief is unclear, too long, or likely to cause revision loops. --- # Creator Brief Checker ## Skill Card - **Category:** Creator Operations - **Core problem:** Unclear briefs cause revision loops and delayed creator delivery. - **Best for:** Teams sending product briefs to TikTok creators or UGC partners. - **Expected input:** Original brief, product facts, must-say points, restrictions, delivery rules. - **Expected output:** Brief health check + risk list + copy-ready improved brief. ## Workflow 1. Check missing and conflicting requirements. 2. Flag unclear or over-restrictive parts. 3. Rebuild into a concise, creator-friendly brief. 4. Add one-line clarification for alignment. ## Output format Return in this order: 1. Brief health check 2. Risk points 3. Improved brief (copy-ready) 4. One-line clarification ## Quality and safety rules - Keep brief short and executable. - Separate must-follow rules from flexible suggestions. - Do not fabricate product claims or legal terms. - Reduce revision risk and communication overhead. ## License Copyright (c) 2026 **Razestar**. This skill is provided under **CC BY-NC-SA 4.0** for non-commercial use. You may reuse and adapt it with attribution to Razestar, and share derivatives under the same license. Commercial use requires a separate paid commercial license from **Razestar**. No trademark rights are granted.

path: references/output-template.md
content: # Output Template

## 1) Brief health check
- 

## 2) Risk points
- 

## 3) Improved brief (copy-ready)

## 4) One-line clarification
- 


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: nl108/comfyui-generator (version 1.0.0)

# ComfyUI Generator Skill ## Overview Integration between OpenClaw and ComfyUI for AI media generation. ## Features - Text-to-image generation - Image style transfer - Batch processing - Automated workflow management - File monitoring and archiving ## Installation ### Prerequisites 1. ComfyUI installed at `C:\ComfyUI` 2. ComfyUI service running on `http://127.0.0.1:8188` 3. OpenClaw 2026.4.5+ ### Setup ```bash # Set environment variables export COMFY_API_KEY="local_comfyui" export COMFY_BASE_URL="http://127.0.0.1:8188" # Copy workflow files cp -r workflows/*.json "C:\ComfyUI\input\workflows\" ``` ## Usage ### Generate Image ```bash openclaw comfy generate --prompt "a beautiful landscape" --style cyberpunk ``` ### Style Transfer ```bash openclaw comfy style --image "path/to/image.jpg" --style "van gogh" ``` ### Batch Processing ```bash openclaw comfy batch --input prompts.txt --output output_dir --iterations 5 ``` ## Configuration ### Environment Variables ```bash COMFY_API_KEY="local_comfyui" COMFY_BASE_URL="http://127.0.0.1:8188" COMFY_OUTPUT_DIR="C:\ComfyUI\output" ``` ### Workflow Configuration Place workflow JSON files in: ``` C:\ComfyUI\input\workflows\ ``` ## Examples ### Basic Image Generation ```python from comfy_client import ComfyUIClient client = ComfyUIClient() result = client.generate_image( prompt="a futuristic city at night", workflow="image_generation.json" ) ``` ### Style Transfer ```python result = client.style_transfer( image_path="input.jpg", style="cyberpunk", workflow="style_transfer.json" ) ``` ## Troubleshooting ### Service Not Running ```bash # Check if ComfyUI is running curl http://127.0.0.1:8188 # Start ComfyUI python "C:\ComfyUI\main.py" --listen 127.0.0.1 --port 8188 ``` ### API Connection Issues 1. Verify firewall allows port 8188 2. Check ComfyUI logs in `C:\ComfyUI\logs\` 3. Ensure API key is set correctly ### Generation Quality - Use detailed prompts - Adjust workflow parameters - Try different models ## Files ### Core Scripts - `scripts/comfy_client.py` - API client - `scripts/prompt_generator.py` - Prompt optimization - `scripts/file_monitor.py` - Output monitoring ### Workflow Files - `workflows/image_generation.json` - Basic image generation - `workflows/style_transfer.json` - Style transfer - `workflows/upscale.json` - Image upscaling ### Configuration - `config/settings.yaml` - Skill configuration - `config/prompt_templates.json` - Prompt templates ## License MIT License ## Support For issues and questions, please check: 1. ComfyUI documentation 2. OpenClaw documentation 3. Skill logs in `C:\Users\LEI\.openclaw\logs\`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: honestqiao/zhipu-cogview-image (version 1.0.0)

--- name: zhipu-image description: Generate images using Zhipu AI's CogView model allowed-tools: Bash(curl:*) Bash(jq:*) env: - ZHIPU_API_KEY --- # Zhipu Image Generation Generate images using Zhipu AI's CogView model. ## ⚠️ Security Requirements **This skill requires `ZHIPU_API_KEY` environment variable to be set before use.** ### Security Best Practices: 1. **DO NOT store API keys in ~/.bashrc** - keys can be leaked 2. **DO NOT source shell configuration files** - prevents arbitrary code execution 3. **Set environment variable directly** when running the script ## Setup ```bash export ZHIPU_API_KEY="your_api_key" ``` **Get your API key from:** https://www.bigmodel.cn/usercenter/proj-mgmt/apikeys ## Usage ### Quick Example ```bash export ZHIPU_API_KEY="your_key" curl -s -X POST "https://open.bigmodel.cn/api/paas/v4/images/generations" \ -H "Authorization: Bearer $ZHIPU_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model": "cogview-4", "prompt": "your description"}' ``` ### Using the Script ```bash export ZHIPU_API_KEY="your_key" ./generate.sh "A beautiful Chinese girl in white dress" ``` ## Security Analysis ### ✅ What's Safe: - No sourcing of ~/.bashrc or shell config files - Uses jq for JSON escaping (prevents injection) - Uses HTTPS with TLS 1.2+ - API key via environment variable (not hardcoded) - Input validation (prompt length limit) - Generic error messages ### ⚠️ Considerations: - **Process list visibility**: API key visible in `ps aux` - Use in trusted environments only ## Safety Features | Feature | Implementation | |---------|----------------| | JSON escaping | jq prevents injection | | Input validation | Prompt length ≤1000 chars | | TLS | Force TLS 1.2+ | | Timeout | 60 second curl timeout | | Error handling | Generic messages only | ## Model Uses **CogView-4** model from Zhipu AI. ## API Endpoint **Official:** `https://open.bigmodel.cn/api/paas/v4/images/generations`


Security scan verdicts — ClawScan: clean | static analysis:  | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kaillera999/safeclaw (version 1.0.0)

--- name: safeclaw description: Security compliance checker for MCP/LLM applications. Performs non-invasive security assessments on configuration files. user-invocable: true metadata: openclaw: requires: bins: [uv, python3] env: [] config: [] os: [darwin, linux] --- # SafeClaw Security Checker Perform security compliance checks on MCP/LLM application configurations. ## Usage When the user invokes this skill, run security checks on their configuration. ### Basic Command ```bash cd {baseDir}/../../ && uv run python main.py check --config "<config_path>" --format json ``` ### Arguments - `config_path`: Path to the configuration file to check (JSON/YAML/TOML) - If no path provided, use `--auto` to auto-discover config: ```bash cd {baseDir}/../../ && uv run python main.py check --auto --format json ``` ## Execution Flow 1. **Determine config path**: - If user provides a path, use it - If user wants auto-discovery, use `--auto` - If unsure, ask the user 2. **Run the check**: ```bash cd {baseDir}/../../ && uv run python main.py check --config "<path>" --format json ``` 3. **Parse JSON output**: The output has this structure: ```json { "summary": { "overall_status": "安全|注意|高危", "total": 10, "passed": 7, "failed": 3, "by_level": {"safe": 7, "attention": 2, "high_risk": 1} }, "failed_results": [ { "name": "检查项名称", "category": "安全类别", "level": "高危|注意", "message": "问题描述", "risk_description": "风险说明", "remediation": "整改建议", "fix_commands": ["command to fix"] } ] } ``` 4. **Report findings**: - Show summary: X passed, Y attention items, Z high-risk - List high-risk items FIRST with remediation steps - List attention items with suggestions - If all passed, congratulate the user ## Exit Codes - `0`: All checks passed (safe) - `1`: Attention items found - `2`: High-risk items found ## Example Config Use `{baseDir}/example-config.json` as a reference template for users who need a starting point. ## Categories Checked | Category | Description | |----------|-------------| | 配置与密钥 | Secrets in config, hardcoded credentials | | 权限 | File permissions, access controls | | 网络暴露 | Network bindings, CORS, exposed ports | | 插件安全 | MCP server security, plugin sources | | 日志与审计 | Logging configuration, audit trails | | 版本信息 | Version exposure, update status | | OpenClaw安全 | OpenClaw-specific deployment security | ## Example Invocation User: "/safeclaw check my config at ./config/mcp.json" Response: 1. Run: `cd {baseDir}/../../ && uv run python main.py check --config "./config/mcp.json" --format json` 2. Parse results and present findings in a clear, actionable format ## Tips - Always use `--format json` for machine-readable output - The skill runs from the skill directory, so use `{baseDir}/../../` to reach project root - If the config file doesn't exist, suggest using the template at `{baseDir}/templates/minimal-config.json`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jpengcheng523-netizen/jpeng-helpdesk (version 1.0.0)

--- name: jpeng-helpdesk description: "Helpdesk ticketing system" version: "1.0.0" author: "jpeng" tags: ["support", "ticket", "communication"] --- # Helpdesk Helpdesk ticketing system ## When to Use - User needs support related functionality - Automating ticket tasks - Communication operations ## Usage ```bash python3 scripts/helpdesk.py --input <input> --output <output> ``` ## Configuration Set required environment variables: ```bash export TICKET_API_KEY="your-api-key" ``` ## Output Returns JSON with results: ```json { "success": true, "data": {} } ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: abdullah944/email-reply-assistant-skill (version 0.1.0)

--- name: "Email Reply Assistant Skill" version: 0.1.0 slug: "email-reply-assistant-skill" description: "Guides structured help for Email Reply Assistant using clear templates, checks, and safe defaults (category: Communication)." category: "Communication" tags: - "communication" - "email-reply-assistant" - "openclaw" - "templates" generated: "2026-05-08" --- ## Purpose Guides structured help for Email Reply Assistant using clear templates, checks, and safe defaults (category: Communication). ## When to use - When you want structured guidance in the "Communication" area. - When you need copy-paste-safe templates rather than improvised shell commands. - When you want repeatable prompts the agent can follow without external scraping. ## Safety rules - Do not collect passwords, OTPs, private keys, wallets, seeds, or session secrets. - Do not propose remote installers that execute unseen code or chained download-and-run snippets. - Keep outputs factual and reversible: prefer checklists over irreversible destructive actions. ## Inputs - Your goal in one paragraph (no secrets). - Optional constraints: audience, tone, length, deadline. - Optional pasted notes you own the rights to (keep PII minimal). ## Output format - A concise plan - Numbered checklist - Short next-actions list - Optional draft copy blocks you can edit ## Example prompts - Help me outline a concise plan using the Email Reply Assistant approach. - Critique my draft outputs and suggest safer, clearer wording for Email Reply Assistant. - Produce a checklist I can reuse weekly for Email Reply Assistant without requesting private data. ## Support / Donate If this skill helps your workflow, you can support maintenance here: - PayPal: https://www.paypal.com/donate/?hosted_button_id=MJHCRZA9Z4X7Y


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kirkraman/kirk-typescript (version 1.0.0)

--- name: TypeScript slug: typescript version: 1.0.2 description: Write type-safe TypeScript with proper narrowing, inference patterns, and strict mode best practices. --- ## When to Use User needs TypeScript expertise — from basic typing to advanced generics. Agent handles type narrowing, inference, discriminated unions, and strict mode patterns. ## Quick Reference | Topic | File | |-------|------| | Generic patterns | `generics.md` | | Utility types | `utility-types.md` | | Declaration files | `declarations.md` | | Migration from JS | `migration.md` | ## Stop Using `any` - `unknown` forces you to narrow before use — `any` silently breaks type safety - API responses: type them or use `unknown`, never `any` - When you don't know the type, that's `unknown`, not `any` ## Narrowing Failures - `filter(Boolean)` doesn't narrow — use `.filter((x): x is T => Boolean(x))` - `Object.keys(obj)` returns `string[]`, not `keyof typeof obj` — intentional, objects can have extra keys - `Array.isArray()` narrows to `any[]` — may need assertion for element type - `in` operator narrows but only if property is in exactly one branch of union ## Literal Type Traps - `let x = "hello"` is `string` — use `const` or `as const` for literal type - Object properties widen: `{ status: "ok" }` has `status: string` — use `as const` or type annotation - Function return types widen — annotate explicitly for literal returns ## Inference Limits - Callbacks lose inference in some array methods — annotate parameter when TS guesses wrong - Generic functions need usage to infer — `fn<T>()` can't infer, pass a value or annotate - Nested generics often fail — break into steps with explicit types ## Discriminated Unions - Add a literal `type` or `kind` field to each variant — enables exhaustive switch - Exhaustive check: `default: const _never: never = x` — compile error if case missed - Don't mix discriminated with optional properties — breaks narrowing ## `satisfies` vs Type Annotation - `const x: Type = val` widens to Type — loses literal info - `const x = val satisfies Type` keeps literal, checks compatibility — prefer for config objects ## Strict Null Handling - Optional chaining `?.` returns `undefined`, not `null` — matters for APIs expecting `null` - `??` only catches `null`/`undefined` — `||` catches all falsy including `0` and `""` - Non-null `!` should be last resort — prefer narrowing or early return ## Module Boundaries - `import type` for type-only imports — stripped at runtime, avoids bundler issues - Re-exporting types: `export type { X }` — prevents accidental runtime dependency - `.d.ts` augmentation: use `declare module` with exact module path


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)