OpenClaw/clawhub-security-signals huggingface dataset:
Skill: mpbshhx/ruthless-mentor (version 1.0.0)

--- name: ruthless-mentor description: A red-team advisor that challenges assumptions, stress-tests ideas, and gives brutally honest GO/NO-GO feedback. Use when evaluating business ideas, workflows, automations, or strategies before committing. metadata: openclaw: emoji: "🔪" requires: tools: - sessions_spawn --- # Ruthless Mentor Skill ## Purpose A dedicated "red team" advisor that challenges assumptions, stress-tests ideas, and provides brutally honest feedback. Inspired by Miles Deutscher's recommendation to bypass default agreeable AI behavior. ## When to Use - Before committing to a new workflow, tool, or automation - When evaluating business ideas or strategies - When Marcus asks "should we do X?" — run it through the mentor first - Weekly review of existing automations for waste/bloat ## System Prompt for Sub-Agent ``` You are a ruthless business mentor. Your job is NOT to be supportive or encouraging. Your job is to: 1. Find the weakest points in any idea or plan 2. Ask the questions the person is avoiding 3. Quantify opportunity cost — what else could this time/money be spent on? 4. Challenge assumptions with data, not opinions 5. Give a clear GO / NO-GO / PIVOT recommendation with reasoning Rules: - Never say "great idea" unless you genuinely mean it - Always identify the #1 risk that could kill this - Compare against the simplest alternative (often: do nothing) - If something is a waste of time, say so directly - End with: "If you still want to proceed, here's how to de-risk it: [specific steps]" ``` ## Usage Spawn as sub-agent on Sonnet: ``` sessions_spawn( task: "[paste the idea/plan/workflow to evaluate]\n\n" + [system prompt above], model: [REDACTED_SECRET], label: "ruthless-mentor" ) ``` ## Integration - Can be triggered manually by Marcus ("run this through the mentor") - Can be added as a gate before any major workflow change - Weekly cron optional: review active-tasks.md and challenge priorities


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mvogt99/resource-leak (version 1.0.0)

--- name: resource-leak description: Files, sockets, subscriptions, or other finite resources are acquired without a guaranteed release path. emoji: 💧 metadata: clawdis: os: [macos, linux, windows] --- # resource-leak A resource is opened but not closed. Under low load the process recycles or the OS cleans up on exit, so the bug stays hidden. Under real load, file-descriptor exhaustion, memory bloat, or orphaned connections appear and cascade. ## Symptoms - `open(...)` without a matching `close()` or `with` block. - Database connections or HTTP clients instantiated per-request without pooling or teardown. - Event listeners / observers / subscriptions registered but never removed. - Background tasks or timers spawned without cancellation paths. - Gradual memory growth that correlates with request count. ## What to do - Pair every acquire with a release. Use language constructs that guarantee teardown: `with` (Python), `using` / `try-with-resources` (C#/Java), `defer` (Go), `try/finally` (JS/TS). - For resources that outlive a single function, document ownership: who closes it, when, on which code path — including error paths. - Prefer pooled clients (HTTP, database) over creating a new one per call. - When registering event listeners, return the unregister function in the same scope so the caller can clean up. - Test the teardown path. Kill a process or trigger an error mid-operation and confirm resources are released.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: baiduqianfangroup/ai-notes-video (version 1.0.0)

--- name: ai-notes-of-video description: The video AI notes tool is provided by Baidu. Based on the video download address provided by the user, it downloads and parses the video, and finally generates AI notes corresponding to the video (a total of three types of notes can be generated: document notes, outline notes, and image-text notes). metadata: { "openclaw": { "emoji": "📺", "requires": { "bins": ["python"], "env":["BAIDU_API_KEY"]},"primaryEnv":"BAIDU_API_KEY" } } --- # AI PPT Generation This skill allows OpenClaw agents to generate AI notes, Based solely on the video address provided by the user. ## Setup 1. **API Key:** Ensure the BAIDU_API_KEY environment variable is set with your valid API key. 2. **Environment:** The API key should be available in the runtime environment. ## API table | name | path | description | |------------|---------------------------------|---------------------------------------| |AINotesTaskCreate|/v2/tools/ai_note/task_create|Create AI notes task based on the video address provided by the user| |AINotesTaskQuery| /v2/tools/ai_note/query |Query AI notes task result based on task id| ## Workflow 1. The AINotesTaskCreate API executes the Python script located at `scripts/ai_notes_task_create.py` 2. The AINotesTaskQuery API executes the Python script located at `scripts/ai_notes_task_query.py` 3. The first step ,call the AINotesTaskCreate API to create a task and get the task ID, must give a video address. 4. The second step ,call the AINotesTaskQuery API to query the task result based on the task ID. 5. Repeat the second step until the task status is completed.The task success identifier is status=10002. status=10000 indicates that the task is in progress. All other status codes are failures 6. Each item in the note list is a note content. For each item in the list: the tpl_no field represents the type of stored notes, 1 - manuscript notes, 2 - outline notes, 3 - graphic and text notes. The "detail" field is for note details. In "detail", "status" represents the note status, with 10002 indicating success,with status=10000 indicating progressing and other status codes indicating failure. "content" indicates the note result. The mind map is located at the top of the outline note and is marked by the "Mind" tag ## APIS ### AINotesTaskCreate API #### Parameters - `video_url`: the url of the video (required) #### Example Usage ```bash BAIDU_API_KEY=xxx python3 scripts/ai_notes_task_create.py 'https://xxxxx.bj.bcebos.com/1%E5%88%86%E9%92%9F_%E6%9C%89%E5%AD%97%E5%B9%95.mp4' ``` ### PPTOutlineGenerate API #### Parameters - `task_id`: task id from AINotesTaskCreate API return（required） #### Example Usage ```bash BAIDU_API_KEY=xxx python3 scripts/ai_notes_task_query.py "26943ed4-f5a9-4306-a05b-b087665433a0" ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: tobeyrebecca/toby-brainstorming (version 1.0.0)

--- name: brainstorming description: "You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation." --- # Brainstorming Ideas Into Designs ## Overview Help turn ideas into fully formed designs and specs through natural collaborative dialogue. Start by understanding the current project context, then ask questions one at a time to refine the idea. Once you understand what you're building, present the design in small sections (200-300 words), checking after each section whether it looks right so far. ## The Process **Understanding the idea:** - Check out the current project state first (files, docs, recent commits) - Ask questions one at a time to refine the idea - Prefer multiple choice questions when possible, but open-ended is fine too - Only one question per message - if a topic needs more exploration, break it into multiple questions - Focus on understanding: purpose, constraints, success criteria **Exploring approaches:** - Propose 2-3 different approaches with trade-offs - Present options conversationally with your recommendation and reasoning - Lead with your recommended option and explain why **Presenting the design:** - Once you believe you understand what you're building, present the design - Break it into sections of 200-300 words - Ask after each section whether it looks right so far - Cover: architecture, components, data flow, error handling, testing - Be ready to go back and clarify if something doesn't make sense ## After the Design **Documentation:** - Write the validated design to `docs/plans/YYYY-MM-DD-<topic>-design.md` - Use elements-of-style:writing-clearly-and-concisely skill if available - Commit the design document to git **Implementation (if continuing):** - Ask: "Ready to set up for implementation?" - Use superpowers:using-git-worktrees to create isolated workspace - Use superpowers:writing-plans to create detailed implementation plan ## Key Principles - **One question at a time** - Don't overwhelm with multiple questions - **Multiple choice preferred** - Easier to answer than open-ended when possible - **YAGNI ruthlessly** - Remove unnecessary features from all designs - **Explore alternatives** - Always propose 2-3 approaches before settling - **Incremental validation** - Present design in sections, validate each - **Be flexible** - Go back and clarify when something doesn't make sense


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: rishabhdugar/delete-file (version 1.0.0)

--- name: delete-file description: "Delete a file from cloud storage by URL. Only the API key that uploaded the file can delete it." --- # Delete File ## What It Does Deletes a file from cloud storage by its URL. Verifies ownership — only the API key that uploaded the file can delete it. ## When to Use - Remove files you no longer need - Clean up storage before the 30-day auto-deletion ## Required Inputs - `url` — the file URL returned by the upload endpoint ## Authentication Send your API key in the `CLIENT-API-KEY` header. Get your **free API key** at [https://pdfapihub.com](https://pdfapihub.com). Full API documentation is available at [https://pdfapihub.com/docs](https://pdfapihub.com/docs). ## Use Cases - **Privacy Compliance** — Delete files immediately after processing to meet GDPR/privacy requirements - **Storage Cleanup** — Remove files you no longer need before the 30-day auto-deletion - **Workflow Cleanup** — Delete intermediate files after a multi-step pipeline completes - **Sensitive Document Handling** — Immediately remove confidential documents after processing ## Example Usage ```bash curl -X POST https://pdfapihub.com/api/v1/file/delete \ -H "CLIENT-[REDACTED_SECRET]" \ -H "Content-Type: application/json" \ -d '{ "url": "https://bucket.s3.amazonaws.com/pdf/abc123_my_report.pdf" }' ``` ## Notes - Returns 403 if the file doesn't belong to the requesting API key


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: superhero2040/link-midjourney-instagram (version 1.0.0)

--- name: link-midjourney-instagram description: >- Runs the linkmidjourneyinstagram automation — generate four Midjourney images in Chromium via Playwright, then post each PNG as its own Instagram web post with per-image captions from captions.txt, the Midjourney prompt, or Gemini/OpenAI vision. Use when working in this repository, or when the user asks for Midjourney-to-Instagram automation, MJ→IG posting, or Playwright-based MJ/IG flows without official APIs. metadata: {"openclaw":{"requires":{"bins":["python"]}}} --- # Midjourney → Instagram（linkmidjourneyinstagram） ## 專案根目錄 自動化程式在 **repository root**（與 `skills/` 同層、含有 `main.py` 的那個資料夾）。 透過 `exec` 執行指令時，**必須**先 `cd` 到該目錄；不要只在 `{baseDir}`（此 skill 資料夾）底下跑 `python main.py`。 ## 何時用這份 skill - 使用者要「從 Midjourney 產圖 → 自動發四則 IG 貼文」。 - 需要選擇 caption 來源：`captions.txt`、與 MJ 相同的 prompt、或 vision API。 - Troubleshooting：首次登入、Playwright、HEADLESS、POST_DELAY、Gemini 區域限制等。 ## 前置條件 - Python 3.10+，`python` 在 PATH。 - Midjourney 有效訂閱（Google / Discord OAuth，由瀏覽器手動完成首次登入）。 - Instagram 帳號；`.env` 內需 `INSTAGRAM_USERNAME`、`INSTAGRAM_PASSWORD`（見 `.env.example`）。 - 依賴：`pip install -r requirements.txt`，並執行 `python -m playwright install chromium`。 ## 安裝與設定（一次性） 於 **repository root**： ```bash python -m venv .venv ``` 啟用 venv 後（Windows：`.venv/Scripts/activate`；macOS/Linux：`source .venv/bin/activate`）： ```bash pip install -r requirements.txt python -m playwright install chromium cp .env.example .env ``` 編輯 `.env` 填入 IG 帳密；其餘選項見 `.env.example` 註解。 ## 首次執行（務必可視瀏覽器） - 維持 `HEADLESS=false`（預設），讓 Chromium 視窗開著。 - Midjourney：完成 Google/Discord 登入與驗證；session 會存到 `browser_data/midjourney/`。 - Instagram：完成網頁登入與可能的 2FA；session 會存到 `browser_data/instagram/`。 - 之後可視需求改 `HEADLESS=true`。 ## 執行 pipeline（給 agent 用 `exec`） 預設讀取 `prompt.txt` 與 `captions.txt`： ```bash python main.py ``` 常用選項： ```bash python main.py --prompt "your midjourney prompt here" python main.py --skip-instagram python main.py --headless python main.py --post-delay 60 python main.py --use-prompt-caption python main.py --use-vision-caption ``` 行為摘要： | 模式 | 條件 | |------|------| | Vision caption | `--use-vision-caption` 或 `.env` 中 `INSTAGRAM_USE_VISION_CAPTION`；若設了 `GEMINI_API_KEY`/`GOOGLE_API_KEY` 且未明確關閉，預設會開 vision | | Prompt 當 caption | `--use-prompt-caption` 或 [REDACTED_SECRET]（vision 開啟時會被蓋過） | | `captions.txt` | 上述皆否時，依 `---` 分區塊，每張圖一則；區塊不足則用最後一則重複 | Vision：`GEMINI_API_KEY` / `GOOGLE_API_KEY`，或 `VISION_CAPTION_PROVIDER=openai` 搭配 `OPENAI_API_KEY`。詳見 `.env.example`。 ## 編輯輸入檔 **`prompt.txt`**：以 `# `（井號+空白）或單獨 `#` 開頭的行為註解並忽略；`#midjourney` 這類標籤保留。非註解行會用空白串成一句送進 Midjourney。 **`captions.txt`**：四個（或多個）區塊，區塊之間一行 `---`。註解規則同 `prompt.txt`。 ## 輸出與安全 - 圖片：`outputs/mj_<timestamp>/image_1.png` … `image_4.png`。 - **勿** commit `.env`、`browser_data/`（含 session cookie）；已應在 `.gitignore`。 - 自動發文可能觸發平台風控；善用 `--post-delay`（預設對應 `POST_DELAY_S`），勿過度密集發送。 ## OpenClaw 載入後 必要時請使用者 `/new` 或重啟 gateway；可用 `openclaw skills list` 確認 skill 名稱 `link-midjourney-instagram` 已載入。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: blammectrappora/disposable-camera-photo-generator (version 1.0.0)

--- name: disposable-camera-photo-generator description: Generate authentic disposable camera photos with harsh flash, film grain, light leaks, date stamps, and that nostalgic Y2K snapshot aesthetic — perfect for Instagram dumps, TikTok carousels, vintage party photos, lo-fi memories, candid 2000s vibes, single-use camera throwaway shots, point-and-shoot retro looks, and grungy lomography-style imperfect photography via the Neta AI image generation API (free trial at neta.art/open). tools: Bash --- # Disposable Camera Photo Generator Generate authentic disposable camera photos with harsh flash, film grain, light leaks, date stamps, and that nostalgic Y2K snapshot aesthetic — perfect for Instagram dumps, TikTok carousels, vintage party photos, lo-fi memories, candid 2000s vibes, single-use camera throwaway shots, point-and-shoot retro looks, and grungy lomography-style imperfect photography. ## Token Requires a Neta API token (free trial at <https://www.neta.art/open/>). Pass it via the `--token` flag. ```bash node <script> "your prompt" --token YOUR_TOKEN ``` ## When to use Use when someone asks to generate or create disposable camera photo generator images. ## Quick start ```bash node disposablecameraphotogenerator.js "your description here" --token YOUR_TOKEN ``` ## Options - `--size` — `portrait`, `landscape`, `square`, `tall` (default: `square`) - `--ref` — reference image UUID for style inheritance ## Install ```bash npx skills add blammectrappora/disposable-camera-photo-generator ```

path: package.json
content: {"name":[REDACTED_SECRET],"version":"1.0.0","type":"module","description":"Disposable Camera Photo Generator — AI-powered disposable camera photo generator","license":"MIT"}


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: mkkb473/moss-voice-generator (version 1.0.5)

--- name: moss-voice-generator homepage: https://studio.mosi.cn metadata: openclaw: requires: env: ["MOSI_TTS_API_KEY"] primaryEnv: "MOSI_TTS_API_KEY" description: > MOSI Studio 指令式音色生成（moss-voice-generator）： 用自然语言描述想要的音色风格，无需指定预设 voice_id， 模型根据描述实时生成对应的声音。 触发词：指令式语音、按描述生成声音、自定义音色、描述一个声音、 "voice generator"、"generate voice"、"按风格生成"、 "播音腔"、"用xxx风格的声音说"、"生成一个xx风格的语音"。 与普通 TTS 的区别：不需要挑选 voice_id，用文字描述就能生成想要的音色。 在飞书渠道：生成完成后优先发送语音气泡，不要发文件附件， 不要只回文字说"已生成"。具体发送方法参见 mosi-tts skill 第 5 节。 --- # MOSS Voice Generator 指令式音色生成 不需要挑选预设音色，直接用文字描述想要的声音风格，模型会按描述实时合成。 --- ## 快速开始 脚本路径：`~/.openclaw/skills/moss-voice-generator/scripts/mosi_voice_generator.sh` ```bash bash ~/.openclaw/skills/moss-voice-generator/scripts/mosi_voice_generator.sh \ --text "各位观众朋友们大家好，欢迎收看今天的节目。" \ --instruction "播音腔女声，专业、清晰、有亲和力" \ --output ~/.openclaw/workspace/output.wav ``` --- ## instruction 风格描述示例 `--instruction` 是核心参数，用中文或英文自由描述： | 效果 | instruction 示例 | |------|-----------------| | 专业播音 | `播音腔女声，专业、清晰、有亲和力` | | 温柔知性 | `温柔知性的女声，语速缓慢，像在讲故事` | | 活力男声 | `年轻有活力的男声，热情开朗，像综艺主持人` | | 低沉磁性 | `沉稳有力的男声，低沉磁性，像纪录片旁白` | | 甜美可爱 | `甜美可爱的女声，活泼轻快，像动漫配音` | | 老人声音 | `年迈的老爷爷声音，略带沙哑，语速较慢` | | 英文主持 | `professional female news anchor voice, clear and authoritative` | 描述越具体，效果越接近预期；可以包含性别、年龄、情绪、场景等维度。 --- ## 与普通 TTS 的区别 | | moss-tts（普通 TTS） | moss-voice-generator | |-|---------------------|---------------------| | 音色来源 | 从预设列表挑 voice_id | 用文字描述即时生成 | | 稳定性 | 高（同一 voice_id 结果一致） | 中（每次略有差异） | | 灵活性 | 受限于预设音色 | 几乎无限制 | | 适合场景 | 需要稳定一致的品牌声音 | 一次性生成、探索新音色 | --- ## 完整参数说明 ``` --text, -t 要合成的文字（必填） --instruction, -i 音色风格描述（必填） --output, -o 输出 WAV 路径 （默认: ~/.openclaw/workspace/voice_gen_output.wav） --temperature 采样温度，控制随机性（默认: 1.5） --top-p 核采样阈值（默认: 0.6） --top-k Top-K 采样（默认: 50） --api-key, -k 覆盖 MOSI_TTS_API_KEY 环境变量 ``` 调节 `--temperature`：值越高越随机，值越低越保守稳定。 一般保持默认即可，如果觉得音色太随意可以调低至 1.0。 --- ## 环境准备 API Key 配置同 `mosi-tts` skill，读取 `MOSI_TTS_API_KEY` 环境变量。 详见 `mosi-tts` skill 的"环境准备"章节。 依赖：`curl`、`jq`、`base64`（均为标准 Unix 工具，通常已预装） --- ## 常见问题 **Q：生成的音色每次都一样吗？** 不一定。同样的 instruction 每次生成会有轻微差异（由 temperature 控制）。 如果需要完全稳定的音色，建议先用此工具探索满意的风格， 再通过声音克隆（`mosi-tts` skill 的 Voice Clone 功能）固化为 voice_id。 **Q：可以克隆某人的声音吗？** 本工具是根据文字描述生成全新音色，不是克隆真实人声。 克隆真实人声请使用 `mosi-tts` skill 的 Voice Clone 功能。 **Q：输出是什么格式？** WAV（24kHz）。在飞书渠道必须转成语音气泡发送， 参考 `mosi-tts` skill 第 5 节（飞书语音气泡）的 `mosi_feishu_voice.sh` 脚本： ```bash bash ~/.openclaw/skills/mosi-tts/scripts/mosi_feishu_voice.sh \ --wav ~/.openclaw/workspace/voice_gen_output.wav \ --chat-id "oc_xxxxxxxxxxxxxxxx" ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: kushanlk/ss-ss (version 1.0.1)

--- name: aiventures-test-generator version: 1.0.0 description: Analyzes a given URL and automatically generates comprehensive functional, UI, and boundary test cases. author: Kushan Amarasiri --- # Execution Instructions When instructed to generate test cases for a specific URL, you must: 1. Execute the command: `node analyze-dom.js <URL>` 2. Read the JSON output containing the interactive DOM elements. 3. Use your reasoning capabilities to map out logical user journeys based on the extracted elements. 4. Output a strictly formatted Markdown Test Plan with Steps to Reproduce, Expected Results, and Edge Cases.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: whille/ebook-to-md (version 1.0.0)

--- name: ebook-to-md description: Convert PDF/PNG/JPEG/MOBI/EPUB to Markdown. Uses Baidu OCR only. Use when 扫描PDF转Markdown、pdf ocr、图像识别、电子书转Markdown、ebook to markdown. --- # ebook_to_md Skill 将 PDF、图片、MOBI、EPUB 转为 Markdown。仅使用百度 OCR。 ## 输入格式 - **PDF**：扫描版/图像型 PDF - **PNG/JPEG**：单张图片 - **MOBI/EPUB**：需安装 Calibre，先转 PDF 再处理 图片 OCR 输出会自动添加 Markdown 分段：首行若为短标题则转为 `##`，对话段落前插入空行。 ## 输出格式 仅输出 **Markdown**（.md）。 ## 参数 | Parameter | Type | Required | Default | Description | |-----------|------|----------|---------|--------------| | input_path | string | yes | - | 文档路径（pdf/png/jpeg/mobi/epub）或 base64 图片 | | output_path | string | no | - | 输出文件路径 | | ocr_backend | string | no | "baidu" | 保留参数，仅支持百度 | | inline_images | bool | no | true | 图片是否 base64 内联 | ## 快速开始 ```bash # PDF 转 Markdown（百度 OCR） python scripts/ebook_to_md.py --input_path=./scanned.pdf # 图片转 Markdown python scripts/ebook_to_md.py --input_path=./screenshot.png # 指定输出路径 python scripts/ebook_to_md.py --input_path=./report.pdf --output_path=./report.md ``` ## 依赖 ### Python ```bash pip install requests ``` ### 系统 - **Calibre**（mobi/epub）：`brew install calibre` - **百度 OCR**：设置 `BAIDU_OCR_API_KEY`、`BAIDU_OCR_SECRET_KEY` ## 使用示例 ### 百度 OCR（默认） ```python from skills.ebook_to_md import main main(input_path='./report.pdf', output_path='./report.md') main(input_path='./image.png') # 图片识别 ``` ### MOBI/EPUB（需 Calibre） ```python main(input_path='./book.epub', output_path='./book.md') main(input_path='./book.mobi', output_path='./book.md') ``` ## 返回格式 成功：返回字符串，含预览；若指定 output_path 则写入文件。 失败：返回 "错误: ..." ## 相关 - **pdf_to_markdown**：原生文本 PDF 转换（docling）

path: __init__.py
content: # -*- coding: utf-8 -*-
"""ebook_to_md skill: PDF/PNG/JPEG/MOBI/EPUB → Markdown (Baidu OCR)."""

from .scripts.ebook_to_md import main

__all__ = ["main"]


path: fixtures/expected/test_minimal.md
content: # 第一章 测试内容

这是 ebook_to_md 的 EPUB 测试样例。用于验证 MOBI/EPUB 转 Markdown 流程。

Minimal valid EPUB 3.


path: fixtures/expected/test_ocr.md
content: # ebook_to_md 测试

OCR 识别样例


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: durtydhiana/apple-mail-search-safe-5-0-4 (version 1.0.0)

--- name: apple-mail-search description: "Apple Mail search on macOS with fast metadata and full body lookup. Use for finding messages in Mail.app by subject/sender/recipient/date, opening messages, and reading full body text. " homepage: https://clawdhub.com/gumadeiras/apple-mail-search-safe repository: https://github.com/gumadeiras/fruitmail-cli metadata: {"clawdbot":{"emoji":"📧","requires":{"bins":["fruitmail"]},"install":[{"id":"node","kind":"node","package":"apple-mail-search-cli","bins":["fruitmail"],"label":"Install fruitmail CLI (npm)"}]}} --- # Fruitmail (Fast & Safe) Fast SQLite-based search for Apple Mail.app with full body content support. ## Installation ```bash npm install -g apple-mail-search-cli ``` ## Usage ```bash # Complex search fruitmail search --subject "invoice" --days 30 --unread # Search by sender fruitmail sender "@amazon.com" # List unread emails fruitmail unread # Read full email body (supports --json) fruitmail body 94695 # Open in Mail.app fruitmail open 94695 # Database stats fruitmail stats ``` ## Commands | Command | Description | |---------|-------------| | `search` | Complex search with filters | | `sender <query>` | Search by sender email | | `unread` | List unread emails | | `body <id>` | Read full email body (AppleScript) | | `open <id>` | Open email in Mail.app | | `stats` | Database statistics | ## Search Options ``` --subject <text> Search subject lines --days <n> Last N days --unread Only unread emails --limit <n> Max results (default: 20) --json Output as JSON --copy Copy DB before query (safest mode) ``` ## Examples ```bash # Find bank statements from last month fruitmail search --subject "statement" --days 30 # Get unread emails as JSON fruitmail unread --json | jq '.[] | .subject' # Find emails from Amazon fruitmail sender "@amazon.com" --limit 50 ``` ## Performance | Method | Time for 130k emails | |--------|---------------------| | AppleScript (full iteration) | 8+ minutes | | SQLite (this tool) | **~50ms** | ## Technical Details - **Database:** `~/Library/Mail/V{9,10,11}/MailData/Envelope Index` - **Query method:** SQLite (read-only) + AppleScript (body content) - **Safety:** Read-only mode prevents modification; optional `--copy` mode available ## Notes - **macOS only** — queries Apple Mail.app's local database - **Read-only** — can search/read but cannot compose/send - **To send emails:** Use the `himalaya` skill (IMAP/SMTP) ## Source https://github.com/gumadeiras/fruitmail-cli


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)