OpenClaw/clawhub-security-signals huggingface dataset:
Skill: codedao12/community-mod-pack (version 1.0.0)

--- name: community-mod-pack description: Assist community moderation with summaries, spam detection suggestions, and draft replies for Discord or Telegram. Use when a user wants moderation help, rule reminders, or daily summaries without automatic enforcement actions. --- # Community Mod Pack ## Goal Summarize community activity and surface moderation signals with draft responses only. ## Best fit - Use when the user needs daily or weekly channel summaries. - Use when the user wants spam or rule-violation signals. - Use when the user wants draft moderator replies or rule reminders. ## Not fit - Avoid when the user asks to auto-ban, kick, or delete messages. - Avoid when the community rules are missing or unclear. - Avoid when privacy constraints prohibit analysis. ## Quick orientation - `references/overview.md` for workflow and quality bar. - `references/auth.md` for access and token handling. - `references/endpoints.md` for optional integrations and templates. - `references/webhooks.md` for async event handling. - `references/ux.md` for intake questions and output formats. - `references/troubleshooting.md` for common issues. - `references/safety.md` for safety and privacy guardrails. ## Required inputs - Channel logs or message exports within the allowed window. - Community rules and enforcement preferences. - Languages to moderate. - Escalation contacts and severity thresholds. ## Expected output - Activity summary with key topics and notable threads. - Flagged messages with reasons and confidence. - Draft responses or rule reminders. - Suggested follow-up actions for human moderators. ## Operational notes - Provide confidence and cite the rule that was triggered. - Avoid making final enforcement decisions. - Keep outputs in draft form. ## Security notes - Respect privacy and minimize data retention. - Avoid sharing personal data beyond the moderator context. ## Safe mode - Analyze and draft only; no enforcement actions. - Use read-only access to logs when possible. ## Sensitive ops - Muting, banning, deleting messages, or modifying roles is out of scope.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ivangdavila/secretary (version 1.0.1)

--- name: Secretary slug: secretary version: 1.0.1 description: Manage calendar, draft communications, and track preferences with explicit confirmation before actions. changelog: Refined description and boundaries metadata: {"clawdbot":{"emoji":"📋","requires":{"bins":[]},"os":["linux","darwin","win32"]}} --- ## Quick Reference | Topic | File | |-------|------| | Memory system, knowing the boss | `memory-guide.md` | | Calendar, meetings, events | `calendar.md` | | Writing on their behalf | `writing.md` | | Daily operations | `operations.md` | ## Requirements **Data folder:** `~/secretary/` (created on first use) No API keys required. Works with whatever calendar/email tools the user has configured. ## Data Storage ``` ~/secretary/ ├── memory.md # Active preferences (≤100 lines) ├── people.md # Contact notes and relationship context ├── calendar.md # Scheduling preferences └── history.md # Archive of past requests ``` Create on first use: `mkdir -p ~/secretary` ## Scope This skill ONLY: - Drafts messages when explicitly asked - Suggests calendar actions when asked - Stores preferences the user explicitly states - Reads `~/secretary/` files for context This skill NEVER: - Sends emails or messages without user confirmation - Accesses calendar/email APIs directly (uses user's configured tools) - Auto-learns from observation — only from explicit corrections - Modifies its own SKILL.md ## My Role I am your secretary. I handle the administrative details so you focus on what matters. **What I do:** - Draft emails and messages in your voice (you review before sending) - Suggest calendar management (you confirm actions) - Track commitments and deadlines you tell me about - Remember preferences you explicitly share **How I learn:** - From direct statements: "I prefer morning meetings" - From corrections: "Actually, call him Dr. Smith, not John" - From explicit requests: "Remember that client X needs extra lead time" All learned data stored in `~/secretary/memory.md`. See `memory-guide.md` for details. ## Quick Commands - "Draft reply to [person] about [topic]" — see `writing.md` - "What's on my calendar this week?" — see `calendar.md` - "Remember: I don't take calls before 10am" - "Block focus time tomorrow afternoon" - "Remind me about [commitment] on [date]" — see `operations.md`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: bernardtai/digaide-assistant (version 1.0.0)

--- name: digaide-memory-layer description: Persistent identity and memory context layer for AI agents across platforms. version: 1.0.0 metadata: openclaw: requires: env: - DIGAIDE_API_KEY bins: - curl primaryEnv: DIGAIDE_API_KEY homepage: https://digaide.com --- # Digaide Memory Layer Digaide provides a persistent identity and long-term memory layer for AI agents. ## What this skill helps with - Keep one user identity across sessions and platforms. - Enrich context with memory before response generation. - Keep assistant behavior consistent with selected persona. - Improve long task UX with progress-aware workflows. ## Setup 1. Prepare `DIGAIDE_API_KEY`. 2. Set `DIGAIDE_API_BASE` if you use non-production API endpoint. 3. Configure your agent runtime hooks. 4. Use Digaide API endpoints for initialize, enrich, and wrap flows. ## Links - Website: https://digaide.com - API: https://api.digaide.com


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ivanheral/videogames (version 1.0.1)

--- name: videogames slug: videogames display_name: Video Games description: A skill to lookup video game information, prices, compatibility, and duration. author: ivanheral version: 1.0.1 license: MIT --- # Video Game Skill 🎮 This skill allows OpenClaw to search for games, view Steam details, check ProtonDB compatibility, estimate playtime with HowLongToBeat, and find the best prices using CheapShark. ## Tools ### `scripts/game_tool.py` This Python script interacts with multiple game APIs (Steam, CheapShark, ProtonDB). **Usage:** 1. **Search for deals (CheapShark):** ```bash python3 scripts/game_tool.py deals "Game Name" ``` 2. **Check Compatibility (ProtonDB):** ```bash python3 scripts/game_tool.py compatibility <APPID> ``` 3. **Get Game Duration (HLTB):** ```bash python3 scripts/game_tool.py duration "Game Name" ``` 4. **View details & Specs (Steam):** ```bash python3 scripts/game_tool.py details <APPID> ``` ## Notes - The script requires Python 3. - No external library installation required.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: agistack/terminal (version 1.0.2)

--- name: terminal description: Local shell copilot for command planning, safe execution, preview-first workflows, output summarization, privacy-aware history controls, and step-by-step terminal help. Use whenever the user wants to run terminal commands, inspect files, debug shell issues, automate local tasks, or translate natural language into shell actions. Prefer safe preview before mutation. Require explicit confirmation for destructive commands. Local-only. --- # Terminal Local shell copilot. Plan clearly, run carefully. ## Core Philosophy 1. Translate intent into executable shell steps. 2. Prefer preview and inspection before mutation. 3. Require explicit confirmation for destructive operations. 4. Summarize results in human language after execution. 5. Offer privacy-aware history controls for sensitive workflows. ## Runtime Requirements - Python 3 must be available as `python3` - Standard shell utilities should be available in the local environment - No external packages required ## Safety Model - Local-only execution - No external credential requests - No hidden network activity - Destructive operations require explicit confirmation - Prefer read-only inspection first - Blocked and previewed commands are recorded in local history - Risk detection covers destructive, privilege-escalation, remote-fetch, and code-execution patterns ## Privacy Controls - History is stored locally only - History file permissions are restricted to the local user when possible - Use `--preview` to inspect before execution - Use `--no-store-output` to avoid storing stdout/stderr in history for sensitive commands - Use `--redact-display` to mask sensitive-looking values in displayed output - Sensitive-looking tokens are redacted before history is written ## Storage All local data is stored only under: - `~/.openclaw/workspace/memory/terminal/history.json` No cloud sync. No third-party APIs. No telemetry. ## Workflows - **Plan command**: Turn user intent into a safe shell command suggestion - **Preview risk**: Explain command effects before execution - **Execute**: Run a local command and capture stdout/stderr - **Summarize**: Explain what happened in plain language - **History**: Save executed, previewed, and blocked command runs locally ## Scripts | Script | Purpose | |---|---| | `init_storage.py` | Initialize local terminal history storage | | `plan_command.py` | Generate a shell command from user intent | | `run_command.py` | Execute or preview a local command with safety checks and privacy controls | | `summarize_result.py` | Summarize command output in plain language | | `show_history.py` | Show recent command history |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: pipepi/brave-api-free-search (version 1.0.8)

--- name: brave-api-free-search description: Free Brave API alternative for OpenClaw. Completely FREE web search. Secure localhost-only deployment. Supports hidden --dev flag. license: MIT metadata: version: 1.0.8 openclaw: requires: bins: - docker - python3 keywords: - brave - brave api - brave api alternative - free search - web search - no api key - zero cost - secure search - localhost only - searxng --- # 💰 Brave API Free Search (Secure) ✅ 100% FREE ### Python Dependency The runtime scripts require the Python package `requests`. Install if missing: ``` pip install requests ``` ✅ Localhost-only deployment ✅ Limiter + safe_search enabled Dev mode available: python scripts/install.py --dev ⚠ Dev mode disables safe_search and limiter (reduced safety). For local development only. Powered by local-search-pro. ⚠ Installation deploys a persistent Docker container (`searxng-local`) with `--restart unless-stopped`. To remove it: ``` docker rm -f searxng-local ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: kirkraman/kirk-build-healthcare-faq-page (version 1.0.0)

--- name: "Build Healthcare FAQ Page" description: "Generate customer-facing answers for common healthcare questions. Use when working on FAQ content for healthcare operators, clinic teams, patient..." homepage: "https://www.skillboss.co/skills/build-healthcare-faq-page" metadata: {"category":"healthcare","subcategory":"health-content","skill_id":"build-healthcare-faq-page","generated_day":"","seo_keywords":["FAQ generator AI","healthcare FAQ writer","healthcare marketing AI","clinic workflow automation"]} --- # Build Healthcare FAQ Page Generate customer-facing answers for common healthcare questions. Use when working on FAQ content for healthcare operators, clinic teams, patient... ## Use When Use this skill for FAQ content work for healthcare operators, clinic teams, patient educators. ## Workflow 1. Clarify the audience, business goal, constraints, and deliverable. 2. Produce the strongest first draft for the target use case. 3. Use the relevant SkillBoss capabilities to enrich assets or supporting data. 4. Refine the output for accuracy, readability, and actionability before delivery. ## SEO / GEO - Primary keywords: FAQ generator AI, healthcare FAQ writer, healthcare marketing AI, clinic workflow automation - Search intent: FAQ content - Canonical slug: `build-healthcare-faq-page` - Install query: Install Build Healthcare FAQ Page with SkillBoss ## APIs Used - `chat` - `web_search` ## Suggested Prompt [Build Healthcare FAQ Page] for my team ## Notes - Generate customer-facing answers for common healthcare questions - Use human review before sending patient-facing content or relying on regulated medical claims. ## SEO Keywords - FAQ generator AI - healthcare FAQ writer - healthcare marketing AI - clinic workflow automation


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: albionaiinc-del/json2csv (version 1.0.0)

# JSON to CSV Converter Converts JSON files to CSV format with intelligent flattening of nested objects and arrays, making data usable in spreadsheets and analytics platforms. ## Usage ```bash # Convert a JSON file to CSV python json2csv.py data.json output.csv # Example input (data.json): # [ # {"name": "Alice", "info": {"age": 30, "tags": ["engineer", "admin"]}}, # {"name": "Bob", "info": {"age": 25, "tags": ["analyst", "user"]}} # ] # Output (output.csv): # info.age,info.tags.0,info.tags.1,name # 30,engineer,admin,Alice # 25,analyst,user,Bob ``` ## Price $2.00

path: tool.py
content: #!/usr/bin/env python3
import argparse
import json
import csv
import sys
from typing import Any, Dict, List

def flatten_json(nested_json: Dict[Any, Any], separator: str = '.') -> Dict[str, Any]:
    """
    Flatten a nested json object.
    """
    out = {}

    def flatten(obj: Any, name: str = ''):
        if type(obj) is dict:
            for key in obj:
                flatten(obj[key], f"{name}{key}{separator}")
        elif type(obj) is list:
            for i, item in enumerate(obj):
                flatten(item, f"{name}{i}{separator}")
        else:
            out[name[:-1]] = obj

    flatten(nested_json)
    return out

def json_to_csv(json_file: str, csv_file: str):
    try:
        with open(json_file, 'r', encoding='utf-8') as f:
            data = json.load(f)
    except Exception as e:
        print(f"Error reading JSON file: {e}")
        sys.exit(1)

    if isinstance(data, dict):
        data = [data]
    elif not isinstance(data, list):
        print("JSON input must be a list or object")
        sys.exit(1)

    # Flatten all records
    flat_data = [flatten_json(item) for item in data]

    if not flat_data:
        print("No data to write.")
        sys.exit(1)

    # Get all unique headers
    fieldnames = set()
    for item in flat_data:
        fieldnames.update(item.keys())
    fieldnames = sorted(list(fieldnames))

    try:
        with open(csv_file, 'w', newline='', encoding='utf-8') as f:
            writer = csv.DictWriter(f, fieldnames=fieldnames)
            writer.writeheader()
            writer.writerows(flat_data)
    except Exception as e:
        print(f"Error writing CSV file: {e}")
        sys.exit(1)

def main():
    parser = argparse.ArgumentParser(description="Convert JSON file to CSV with flattened nested structures.")
    parser.add_argument("input", help="Input JSON file path")
    parser.add_argument("output", help="Output CSV file path")
    args = parser.parse_args()

    json_to_csv(args.input, args.output)
    print(f"Converted {args.input} to {args.output}")

if __name__ == "__main__":
    main()


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: abreumatheus/discogs-claw (version 1.0.2)

--- name: discogs-claw description: Search for vinyl record prices on Discogs using curl. Retrieves Low, Median, and High price suggestions based on condition. metadata: {"clawdbot":{"emoji":"💿","requires":{"bins":["jq","curl"]}}} --- # Discogs Claw Search for vinyl record prices on Discogs using the Discogs API. ## Setup ### Option 1: Environment Variable (Recommended) ```bash export DISCOGS_TOKEN="your_discogs_token_here" ``` ### Option 2: Config file Located on ~/.openclaw/credentials/discogs.json or /data/.openclaw/credentials/discogs.json ```json { "DISCOGS_TOKEN": "your_discogs_token_here" } ``` ## Usage ### Run the Skill The skill accepts a JSON input containing the search query. ```bash # Example search echo '{"query": "Daft Punk - Random Access Memories"}' | ./scripts/discogs.sh ``` ## Example Output This is an example json output after running the script: ```json { "title": "Daft Punk - Random Access Memories", "prices": { "low": "25.00 USD", "median": "35.00 USD", "high": "60.00 USD" }, "marketplace": { "num_for_sale": 150, "lowest_price": "22.50 USD" } } ``` With this data the agent should output a very objective response containing only the data abvoe and ignoring further historical details about the record. Just the title with artist and pricing information. It should ever use emojis. ## Requirements - `curl` - `jq` - Discogs API Token (`DISCOGS_TOKEN`)


Security scan verdicts — ClawScan: clean | static analysis:  | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mcollina/snipgrapher (version 0.1.0)

--- name: snipgrapher description: Configure and use snipgrapher to generate polished code snippet images metadata: tags: snipgrapher, snippets, images, svg, png, webp, cli --- ## When to use Use this skill when you need to: - Generate image snippets from source code - Configure reusable snippet rendering defaults - Batch-render snippet assets for docs, social posts, or changelogs - Use published `snipgrapher` from npm to generate snippet images ## How to use Read these rule files in order: - [rules/setup-and-configuration.md](rules/setup-and-configuration.md) - Install, select executable, initialize config, and define profiles - [rules/rendering-workflows.md](rules/rendering-workflows.md) - Render single snippets, batch jobs, watch mode, and output practices ## Core principles - **Configure first**: establish a project config before repeated renders - **Reproducible output**: prefer named profiles and explicit output paths - **Portable commands**: use command patterns that work with installed binaries and `npx` - **Automation-friendly**: rely on CLI flags/config/env precedence intentionally


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: mail-eth/crypto-scalper-bot (version 1.0.0)

# Crypto Trading Bot > Automated crypto scalping bot for Binance Futures USDT-M ## Description A complete crypto trading bot with multiple strategies: - **Scalper**: RSI + EMA + Volume based trading - **Bollinger Bands**: Mean reversion strategy - **QA System**: Auto health checks ## Features - 6 trading pairs: BTC, ETH, SOL, BNB, XAU, XAG - Auto SL/TP management - Telegram notifications - System health monitoring - Backtest ready ## Usage ```bash # Setup credentials nano binance.env nano telegram.env # Verify setup bash setup.sh # Run strategies bash run_cycle.sh # Scalper bash run_mean_reversion.sh # Bollinger bash run_qa.sh # QA check ``` ## Requirements - Python 3.8+ - Binance Futures account - VPS (recommended) ## Docs See README.md for full installation guide.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: romainsantoli-web/firm-spec-compliance-pack (version 1.0.0)

--- name: firm-spec-compliance-pack version: 1.0.0 description: > MCP 2025-11-25 specification compliance audit pack. Validates elicitation, tasks, resources/prompts, audio content, JSON Schema 2020-12, SSE transport, and icon metadata compliance. 7 specialized audit tools. author: romainsantoli-web license: MIT metadata: openclaw: registry: ClawHub requires: - mcp-openclaw-extensions >= 3.0.0 tags: - mcp - compliance - spec - audit - protocol --- # firm-spec-compliance-pack > ⚠️ Contenu généré par IA — validation humaine requise avant utilisation. ## Purpose Audit pack ensuring full compliance with MCP specification version **2025-11-25**. Covers all new protocol features introduced since 2025-03-26. ## Tools (7) | Tool | Description | Severity | |------|-------------|----------| | `openclaw_elicitation_audit` | Validate elicitation flow implementation | HIGH | | `openclaw_tasks_audit` | Check tasks/durable requests support | HIGH | | [REDACTED_SECRET] | Verify resources & prompts capabilities | MEDIUM | | `openclaw_audio_content_audit` | Audio content type support validation | MEDIUM | | [REDACTED_SECRET] | JSON Schema 2020-12 dialect compliance | HIGH | | `openclaw_sse_transport_audit` | SSE transport + resumption validation | HIGH | | `openclaw_icon_metadata_audit` | Icon metadata format verification | LOW | ## Usage ```yaml # In your agent configuration: skills: - firm-spec-compliance-pack # Run full compliance check: openclaw_elicitation_audit config_path=/path/to/config.json openclaw_tasks_audit config_path=/path/to/config.json openclaw_resources_prompts_audit config_path=/path/to/config.json openclaw_json_schema_dialect_check config_path=/path/to/config.json openclaw_sse_transport_audit config_path=/path/to/config.json openclaw_icon_metadata_audit config_path=/path/to/config.json ``` ## Spec Coverage - **Elicitation** (SEP-032): Server-initiated user input requests - **Tasks** (SEP-044): Long-running durable operations with status tracking - **Resources/Prompts**: Capability declaration and handler completeness - **Audio Content**: Binary audio type support in messages - **JSON Schema 2020-12**: Dialect URI and vocabulary compliance - **SSE Transport**: Event streaming with Last-Event-ID resumption - **Icons**: URI format, media type validation, and accessibility ## Requirements - `mcp-openclaw-extensions >= 3.0.0` - MCP Protocol Version: `2025-11-25`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: moodsir/moodsir-auto-readme-changelog (version 1.0.0)

\# AI 项目文档生成器 一个智能化的项目文档自动生成工具，支持一键生成符合开源标准的 README.md 和 CHANGELOG.md，支持多平台分发。 \## 功能特性 \- 自动化生成：一键生成专业的项目文档，无需手动编写 \- 智能分析：深度分析代码仓库结构，提取关键信息 \- 双文档支持：同时生成 README 和 Changelog 两种核心文档 \- 多平台兼容：支持 ClawHub、有道龙虾 等全平台分发 \- 零依赖：纯 Python 实现，无额外平台依赖 \## 使用方法 ```bash \# 安装 npx clawhub install ai-doc-generator \# 运行 ai-doc-generator ./your-project

path: requirements.txt
content: # AI Doc Generator

## 依赖说明

本项目为纯 Python 实现，**无任何第三方依赖**。

只需 Python 3.6+ 即可运行。

如需 Web API 版本，可自行添加：
```
# fastapi
# uvicorn
```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: wanng-ide/arxiv-skill-extractor (version 1.0.0)

--- name: arxiv-skill-extractor description: Automates the process of extracting reusable skill code from arXiv papers. Use this skill to turn paper insights into actual OpenClaw skills. --- # ArXiv Skill Extractor This skill wraps `arxiv-paper-reviews` and provides an automated pipeline for: 1. Fetching papers. 2. Extracting key algorithms. 3. Generating skill templates. ## Usage ### Extract Skill from a Paper ```javascript const { extractSkill } = require("./skills/arxiv-skill-extractor/index.js"); async function run() { const result = await extractSkill("4711d67c242a5ecba2751e6b"); console.log(result); } run(); ``` ### Automation Run the default extraction loop (uses `local_task:arxiv_skill_learning` config): ```bash # 自动读取 pending_skill_task.json 中的 paper_key node skills/arxiv-skill-extractor/index.js # 或直接指定 paper_key node skills/arxiv-skill-extractor/index.js 4711d67c242a5ecba2751e6b ``` ## Why? We need to continuously learn from new research. Manual reading is slow. This skill bridges the gap between paper knowledge and executable code.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)