OpenClaw/clawhub-security-signals huggingface dataset:
Skill: gregoryehill/cairn-cli (version 1.0.2)

--- name: cairn description: Project management for AI agents using markdown files. Install and use the cairn CLI to create projects, manage tasks, track status, and coordinate human-AI collaboration through a shared workspace of markdown files. --- # Cairn — AI-Native Project Management Cairn gives you and your AI agent a shared workspace of markdown files for managing projects and tasks. Statuses are the shared language. Any AI that can read files is ready to go. ## Installation ```bash npm install -g cairn-work cairn onboard ``` `cairn onboard` creates `~/cairn/` with auto-generated context files (`AGENTS.md` and `.cairn/planning.md`) that agents read automatically. ## Community - Follow [@letcairnwork](https://x.com/letcairnwork) on X - Visit [letcairn.work](https://letcairn.work/) - [Submit issues](https://github.com/letcairnwork/cairn-cli/issues) - [Join the discussion](https://github.com/letcairnwork/cairn-cli/discussions) ## Core Commands ### Workspace - `cairn status` — Overview with task counts - `cairn my` — Your assigned tasks - `cairn active` — All in-progress tasks - `cairn doctor` — Diagnose workspace health ### Projects & Tasks - `cairn create project "Name" --description "..." --objective "..."` — Create a project with charter - `cairn create task "Name" --project <slug> --description "..." --objective "..."` — Create a task - `cairn list tasks [--status pending,in_progress] [--project slug]` — List tasks with filters - `cairn search "keyword"` — Find tasks by content ### Task Workflow - `cairn start <task-slug>` — Begin work (sets `in_progress`) - `cairn note <task-slug> "Progress update"` — Add a status note - `cairn artifact <task-slug> "Artifact Name"` — Create a linked deliverable - `cairn done <task-slug>` — Finish work (moves to `review` or `completed`) - `cairn block <task-slug> "Reason"` — Mark as blocked ### Maintenance - `cairn update-skill` — Refresh context files after CLI updates - `cairn upgrade` — Update CLI to latest version ## Workspace Structure ``` ~/cairn/ AGENTS.md # Agent context (auto-generated) .cairn/planning.md # Planning guide (auto-generated) projects/ project-slug/ charter.md # Why, success criteria, context artifacts/ # Deliverables (design docs, proposals, etc.) tasks/ # Individual task markdown files inbox/ # Ideas to triage memory/ # Workspace memory ``` ## Statuses `pending` → `next_up` → `in_progress` → `review` → `completed` (or `blocked` at any point) ## Autonomy Levels Set per-task to control how much the agent can do: - **propose** — Agent plans only, finishes in `review` - **draft** — Agent does work, you approve before shipping - **execute** — Full autonomy, finishes as `completed` ## Tips - Run `cairn onboard` first — it sets up everything the agent needs. - Use `cairn my` to see your current workload at a glance. - Artifacts (`cairn artifact`) create linked deliverables stored with the project. - All data is plain markdown with YAML frontmatter — version control friendly.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: zhaozewen0519/1password-local (version 1.0.2)

--- name: 1password description: Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op. homepage: https://developer.1password.com/docs/cli/get-started/ metadata: {"clawdbot":{"emoji":"🔐","requires":{"bins":["op"]},"install":[{"id":"brew","kind":"brew","formula":"1password-cli","bins":["op"],"label":"Install 1Password CLI (brew)"}]}} --- # 1Password CLI (Local) Follow the official CLI get-started steps. Don't guess install commands. ## References - `references/get-started.md` (install + app integration + sign-in flow) - `references/cli-examples.md` (real `op` examples) ## Workflow 1. Check OS + shell. 2. Verify CLI present: `op --version`. 3. Confirm desktop app integration is enabled (per get-started) and the app is unlocked. 4. REQUIRED: create a fresh tmux session for all `op` commands (no direct `op` calls outside tmux). 5. Sign in / authorize inside tmux: `op signin` (expect app prompt). 6. Verify access inside tmux: `op whoami` (must succeed before any secret read). 7. If multiple accounts: use `--account` or `OP_ACCOUNT`. ## REQUIRED tmux session (T-Max) The shell tool uses a fresh TTY per command. To avoid re-prompts and failures, always run `op` inside a dedicated tmux session with a fresh socket/session name. Example (see `tmux` skill for socket conventions, do not reuse old session names): ```bash SOCKET_DIR="${CLAWDBOT_TMUX_SOCKET_DIR:-${TMPDIR:-/tmp}/clawdbot-tmux-sockets}" mkdir -p "$SOCKET_DIR" SOCKET="$SOCKET_DIR/clawdbot-op.sock" SESSION="op-auth-$(date +%Y%m%d-%H%M%S)" tmux -S "$SOCKET" new -d -s "$SESSION" -n shell tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op signin --account my.1password.com" Enter tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op whoami" Enter tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op vault list" Enter tmux -S "$SOCKET" capture-pane -p -J -t "$SESSION":0.0 -S -200 tmux -S "$SOCKET" kill-session -t "$SESSION" ``` ## Guardrails - Never paste secrets into logs, chat, or code. - Prefer `op run` / `op inject` over writing secrets to disk. - If sign-in without app integration is needed, use `op account add`. - If a command returns "account is not signed in", re-run `op signin` inside tmux and authorize in the app. - Do not run `op` outside tmux; stop and ask if tmux is unavailable.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: odrobnik/codex-quota (version 1.2.2)

--- name: codex-quota version: 1.2.2 homepage: https://github.com/odrobnik/codex-quota-skill description: > Check OpenAI Codex CLI rate limit status (daily/weekly quotas) using local session logs. Portable Python script. Reads ~/.codex/sessions/ for quota data. When using --all --yes, it temporarily switches accounts by overwriting ~/.codex/auth.json (restored afterwards) to query each account. Uses the `codex` CLI for --fresh / --all. metadata: openclaw: requires: bins: ["python3", "codex"] --- # Skill: codex-quota Check OpenAI Codex CLI rate limit status. ## Quick Reference ```bash # Run the included Python script ./codex-quota.py # Or if installed to PATH codex-quota ``` ## Options ```bash codex-quota # Show current quota (cached from latest session) codex-quota --fresh # Ping Codex first for live data codex-quota --all --yes # Update all accounts, save to /tmp/codex-quota-all.json codex-quota --json # Output as JSON codex-quota --help # Show help ``` ## Setup See [SETUP.md](SETUP.md) for prerequisites and setup instructions. ## What It Shows - **Primary Window** (5 hours) — Short-term rate limit - **Secondary Window** (7 days) — Weekly rate limit - Reset times in local timezone with countdown - Source session file and age ## When to Use - Before starting heavy Codex work (check weekly quota) - When Codex seems slow (might be rate-limited) - Monitoring quota across multiple accounts


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (HIGH)
Skill: freepengyang/clawhub-gate (version 1.0.3)

--- name: clawhub-gate description: | ClawHub 发布前安全门禁：本地静态分析 + ClawScan 轮询，确保 skill 通过 VirusTotal + ClawScan 再发布。 关键词：clawhub publish pre-publish security gate VirusTotal ClawScan shellcheck bandit triggers: - (.*) clawhub (.*) 发布 (.*) - (.*) clawhub (.*) sync (.*) - (.*) skill (.*) 安全 (.*) 检测 (.*) - (.*) 发布 (.*) clawhub (.*) 前 (.*) - (.*) clawhub (.*) gate (.*) required_environment_variables: [] required_commands: - shellcheck - bandit - jq - python3 - clawhub required_config_paths: - ~/.config/clawhub/config.json --- # ClawHub Pre-Publish Security Gate `clawhub sync` 前自动执行三项检查，全部通过才放行。 ## 流程 ``` clawhub_gate.sh ├── 1. 本地静态分析 (即时) │ ├── shellcheck → .sh 文件 │ └── bandit → .py 文件 │ └── 2. clawhub sync + ClawScan 轮询 (异步，约 30-90s) └── 轮询 clawhub API 直到 scan status != "pending" ├── VT=clean + Static=clean + LLM=clean → 通过 ├── VT=clean + Static=clean + LLM=suspicious → 警告通过（owner 接受 LLM 情境判断） └── VT 或 Static 失败 → 阻断 ## 使用方式 在 skill 目录下运行 gate 脚本： ```bash # 完整 gate：静态分析 + 发布 + ClawScan 轮询 SKILL_DIR=~/.hermes/skills/pg-game-monitor bash clawhub_gate.sh # 仅本地静态分析（快速检查，不需要网络） SKILL_DIR=~/.hermes/skills/pg-game-monitor bash clawhub_gate.sh --local-only ``` **前置条件**：已安装 `shellcheck`、`bandit`、`jq`、Python 3、`clawhub` CLI（已登录）。 **脚本行为**： - 读取 `~/.config/clawhub/config.json` 获取 token（用于轮询 ClawScan API） - 调用 `clawhub sync` **发布** skill（会创建/更新 ClawHub 版本） - 若不需发布，先跑 `--local-only` 确认静态分析通过，再手动 `clawhub sync` ## 退出码 | 码 | 含义 | |----|------| | 0 | 全部通过 | | 1 | 静态分析失败或 ClawScan flagged | | 2 | ClawScan 超时（pending > 120s） | | 3 | 未找到 skill 目录或权限错误 | ## 检查详情 ### 静态分析 | 工具 | 扫描范围 | 严重级别 | |------|---------|---------| | shellcheck | `*.sh` | warning + error | | bandit | `*.py` | medium + high + hidden | - **阈值**：ERROR 数量 = 0；WARNING 数量 ≤ 10（可配置 `WARN_LIMIT`） - **误报忽略**：`SC2154`（未使用变量，常见于条件分支）、`SC2086`（引号去除，常见于 `grep -v`） ### ClawScan 轮询 - **轮询间隔**：15s - **最大等待**：120s（8 次） - **状态判断**： - `clean` → 通过 - `suspicious` → 失败，输出警告 - `malicious` → 失败，阻断 - `pending` → 继续轮询 - `error` → 失败 ## 依赖 ```bash pip install --break-system-packages bandit apt install -y shellcheck ``` ## 参考 - ClawScan 修复指南：`clawhub` skill → `references/clawscan-remediation.md`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: a3273283/vwu-minimax (version 1.0.0)

# minimax Models for vwu.ai vwu.ai 平台上的 minimax 模型调用技能。 ## 支持的模型 - MiniMax-Hailuo-02 - MiniMax-Hailuo-2.3 - MiniMax-Hailuo-2.3-Fast 共 3 个模型。 ## 配置 使用前需要设置 vwu.ai API key: ```bash export VWU_API_KEY="your-key-here" ``` 获取 key: https://vwu.ai 控制台 ## 使用示例 ```bash # 调用模型 vwu-chat --model MiniMax-Hailuo-02 "你的问题" ``` ## API 兼容性 所有模型兼容 OpenAI API 格式，支持标准 chat completions 接口。 ## 额度提示 如果使用时提示"额度不足"或类似错误： 1. 访问 https://vwu.ai 2. 在控制台充值或调整额度 3. 或生成新的 API key --- 由 Claw 自动生成 | 源数据: vwu.ai


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: michaelfeng/clawbrain-pro-doctor (version 1.2.0)

--- name: clawbrain-pro-doctor description: 诊断你的 OpenClaw 配置和运行状态，基于 v1.2 的输出验证、模型健康监控、知识图谱检查、记忆来源标注、降级通知和长对话截断诊断 user-invocable: true command-dispatch: tool command-tool: exec metadata: {"openclaw": {"emoji": "🩺", "requires": {"bins": ["curl"]}}} --- # ClawBrain Doctor 检查你的 OpenClaw 配置和运行状态，告诉你哪里有问题、哪里可以优化。 ## 使用方法 说"诊断一下"或"检查配置"。 ## 常见问题和解决方案 **问题：AI 让它做事，它跟你聊天** - 原因：模型不习惯调用工具 - 方案：ClawBrain Pro 的编排引擎会强制引导模型调用工具 - v1.0 检测：链条完成强制（Chain Completion Enforcement），开始了就必须做完 **问题：出了错就放弃** - 原因：模型不知道该怎么恢复 - 方案：ClawBrain Pro 自动注入恢复策略，甚至请另一个模型帮忙 - v1.0 检测：三级恢复策略 + 双模型共识机制 **问题：多步任务做一半就停了** - 原因：模型不会规划 - 方案：ClawBrain Pro 的编排引擎先规划步骤，再监督执行 - v1.0 检测：主动思考框架（三问：不知道什么/可能出问题/怎么验证） **问题：听不懂模糊的话** - 原因：模型不会联系上下文 - 方案：ClawBrain Pro 自动分析意图，注入"先查什么再做什么"的提示 - v1.0 检测：多维闭环（上游→下游→平行→全局一致性检查） **问题：回答质量不稳定** - 原因：单模型没有自检能力 - 方案：独立模型四维评分（准确性/完整性/逻辑性/格式），低于 70 分自动重来 - v1.0 新增：输出验证器（Output Verifier） **问题：某个后端模型突然变慢或出错** - 原因：模型服务不稳定 - 方案：模型健康监控，5 次失败自动熔断 60s，半开探测后恢复 - v1.0 新增：`GET /v1/health/backends` 查看实时状态 **问题：记忆丢失或不准** - 原因：知识图谱需要检查 - 方案：查看图谱统计，清理过时实体 - v1.0 新增：`GET /v1/graph/stats` 检查图谱健康度 **问题：记忆来源标注不正确** - 原因：记忆条目缺少来源引用或引用了错误的对话 - 方案：检查记忆来源标注是否与原始对话匹配，清理错误标注 - v1.2 新增：记忆来源标注诊断 **问题：降级通知没有工作** - 原因：记忆服务或后端模型降级时用户未收到通知 - 方案：检查降级通知机制是否正常触发，确认用户能看到降级提示 - v1.2 新增：降级通知诊断 **问题：长对话截断后丢失上下文** - 原因：超长对话被截断时关键信息未从记忆恢复 - 方案：检查长对话截断时是否正确从知识图谱恢复关键上下文 - v1.2 新增：长对话截断诊断 ## 模型选择建议 | 你主要做什么 | 最适合的方案 | |------------|-----------| | 简单文件/搜索 | ClawBrain Flash（快且省） | | 复杂多步任务 | ClawBrain Auto（自动升档） | | 经常出错要手动修 | ClawBrain Pro（编排 + 错误恢复） | | 深度推理/代码生成 | ClawBrain Max（深度思考） | | 模糊指令理解 | ClawBrain Pro / Auto（上下文增强） | ## 健康检查命令 ```bash # 检查后端模型健康状态 curl https://api.factorhub.cn/v1/health/backends -H "Authorization: Bearer YOUR_KEY" # 检查知识图谱状态 curl https://api.factorhub.cn/v1/graph/stats -H "Authorization: Bearer YOUR_KEY" # 检查模型列表和能力 curl https://api.factorhub.cn/v1/models -H "Authorization: Bearer YOUR_KEY" ``` 接入 ClawBrain：https://clawbrain.dev/dashboard


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: wimi321/claude-code-claude-settings-editor (version 1.0.0)

--- name: "claude_settings_editor" description: "Use when the user wants to update Claude settings, hooks, permissions, MCP server toggles, or other JSON config safely and with scope awareness." --- # Claude Settings Editor Use this skill for `settings.json`, local overrides, and hook configuration. ## Workflow 1. Choose the correct settings file by scope: user, project, or local. 2. Read the current file before editing. 3. Apply the smallest valid JSON change. 4. Keep permissions, hooks, plugins, and MCP configuration syntactically valid. 5. Explain scope, precedence, and any risky config changes. ## Guardrails - Do not replace a config file wholesale unless necessary. - Preserve unrelated user settings. - Warn before widening permissions or changing automation hooks broadly. ## Source Provenance Derived from `src/skills/bundled/updateConfig.ts`.

path: agents/openai.yaml
content: interface:
  display_name: "Claude Settings Editor"
  short_description: "Edit Claude settings and hook config"
  default_prompt: "Help me update Claude settings with the right file scope and valid JSON structure."


path: references/provenance.md
content: # Provenance

- Skill slug: `claude-settings-editor`
- Source module: `src/skills/bundled/updateConfig.ts`
- Extracted from local Claude Code source analysis


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: johnnywang2001/code-metrics (version 1.0.0)

--- name: code-metrics description: Analyze code quality metrics including lines of code by language, cyclomatic complexity (Python), function/class counts, comment ratios, and largest file rankings. Use when asked to analyze code quality, count lines of code, measure complexity, find the biggest files, get a project overview, or audit code metrics across a codebase. Supports Python, JavaScript, TypeScript, Go, Rust, Ruby, Java, C/C++, C#, Swift, Kotlin, PHP, Shell, Lua, R, and Scala. --- # Code Metrics Analyze code quality and complexity metrics across your project. Supports 17+ languages. ## Quick Start ```bash # Analyze current project python3 scripts/code_metrics.py # Analyze specific directory python3 scripts/code_metrics.py /path/to/project # JSON output python3 scripts/code_metrics.py --json # Skip complexity analysis (faster) python3 scripts/code_metrics.py --no-complexity # Exclude additional directories python3 scripts/code_metrics.py --exclude migrations fixtures ``` ## Metrics Provided - **Lines of Code** — total, code, comments, blank lines per language - **Comment-to-code ratio** — overall documentation density - **Function & class counts** — per language - **Cyclomatic complexity** — per-function for Python files (AST-based) - **Largest files** — top N files ranked by code lines - **High complexity warnings** — flags functions with complexity ≥5 ## Complexity Scale (Python) | Range | Risk | Meaning | |-------|------|---------| | 1-4 | 🟢 Low | Simple, well-structured | | 5-9 | 🟢 Moderate | Acceptable | | 10-14 | 🟡 High | Consider refactoring | | 15+ | 🔴 Very High | Refactor strongly recommended | ## Dependencies - Python 3.8+ (stdlib only, no pip packages needed)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: axelhu/memory-review (version 1.1.0)

--- name: memory-review version: 1.1.0 description: 知识沉淀自动化技能。扫描近期日记，识别可沉淀知识，自动写入知识库。触发时机：cron 定时任务或手动调用。使用方法：加载 skill 后读取 references/spec.md 获取详细规范。 --- # Memory Review 扫描近期日记，生成知识沉淀提案，并自动执行沉淀。 ## 核心流程 1. 读取 references/spec.md 获取详细规范 2. 读取 AGENTS.md/MEMORY.md 获取投递配置 3. 增量扫描近期日记（md5 比对） 4. 识别 5 类可沉淀知识 5. 自动写入知识库 6. 生成报告并投递 ## 敏感信息 **投递配置（如飞书群ID）存储在 AGENTS.md 或 MEMORY.md 中**，skill 里使用占位符。 读取方式： - 读取 `MEMORY.md`（如果存在） - 读取 `AGENTS.md` 中的配置 ## 输出 - 报告位置：`memory/daily/YYYY-MM-DD-memory-review.md` - 知识库：`memory/knowledge/fw-*.md` - 执行日志：`data/exec-logs/memory-review/YYYY-MM-DD.md` ## 触发时机 - cron 定时任务（建议每 2 天） - 用户明确要求时 - 每次会话结束前（可选） ## 自动沉淀规则 | 优先级 | 条件 | 行为 | |--------|------|------| | 高 | 错误/教训类 | 自动写入 post-mortems.md | | 中 | 技术知识类 | 自动写入 knowledge/fw-*.md | | 低 | 配置/偏好类 | 写入 TOOLS.md 或 AGENTS.md | ## 沉淀文件命名规范 ``` fw-{主题}.md - fw = "from work" 工作产出 - 主题：用英文或中文拼音 ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: studyworklife/crayfish-sticker (version 0.1.3)

# crayfish-sticker - 智能表情包技能 ## 功能描述 安装后OpenClaw会根据对话上下文的情绪、内容自动匹配合适的表情包发送，让聊天更有意思！表情包资源托管在GitHub仓库，支持实时更新，不需要重新安装技能就能用到新表情。 ## 表情包分类 - **乏/累/颓废** - 日常状态 - **牛逼/厉害** - 称赞专用 - **不中/不行** - 拒绝专用 ### 通用表情 - **开心/快乐** - 高兴时刻 - **无语/无奈** - 吐槽时刻 - **工作/编程** - 干活时刻 - **思考/灵感** - 脑力时刻 ## 实现原理 1. 对话时自动分析当前上下文的情绪、关键词和场景 2. 请求远程表情包仓库的索引文件（JSON格式，标签对应图片链接） 3. 匹配最合适的表情包，返回图片给用户 4. 本地缓存索引和热门表情，请求更快更省流量 5. **智能匹配**：优先匹配当前对话的关键词和情绪 ## 表情包仓库结构 表情包单独托管在GitHub仓库，结构如下： ``` crayfish-stickers/ ├── index.json # 总索引文件（增强版） ├── happy/ # 开心分类 │ ├── laugh1.png │ └── happy2.png ├── sad/ # 难过分类 │ ├── cry1.png │ └── upset1.png ├── speechless/ # 无语分类 │ ├── eyeroll1.png │ └── speechless1.png ├── working/ # 工作分类 │ ├── coding1.png │ └── debugging1.png └── thinking/ # 思考分类 ├── thinking1.png └── idea1.png ``` ## 配置选项 ```javascript { // 表情包仓库URL "repoUrl": "https://raw.githubusercontent.com/StudyWorkLife/crayfish-stickers/main/index.json", // 缓存时间（毫秒） "cacheTTL": 3600000, // 发送频率（0-1，1表示每次都发） "sendFrequency": 0.3, } ``` ## 与crayfish-uncle技能配合 同时安装`crayfish-uncle`和`crayfish-sticker`食用更佳 ## 技术细节 - 使用语义分析匹配关键词 - 本地缓存减少网络请求 - 支持动态更新（修改GitHub仓库即可） - 自动分类和优先级排序


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: guiguihao/tasktodolist (version 1.0.1)

# tasktodolist Skill ## 描述 一个简单的待办事项管理 Skill，支持以下操作。**可以通过 `-t, --task <name>` 参数来指定不同的任务名称，从而维护多个互相独立的待办列表。** - `tasktodolist --task <name> add <内容>` - `tasktodolist --task <name> list` - `tasktodolist --task <name> done <序号>` - `tasktodolist --task <name> rm <序号>` - `tasktodolist --task <name> clear` - `tasktodolist tasks list`（列出所有任务列表） - `tasktodolist tasks rm <名称>`（删除指定的任务列表） ## 使用方法 在终端运行 `tasktodolist [全局参数] <子命令> [参数]`。数据保存在用户家目录下的 `~/.tasktodolist/<task_name>_tasktodolist.json`，如果未指定任务名称，默认使用 `~/.tasktodolist/default_tasktodolist.json`。 ## 安装 - **本地依赖**: `npm install` - **全局安装 (推荐)**: 在该项目目录下运行 `npm install -g .`。安装后，你可以直接在任何地方运行 `tasktodolist` 命令。 ## 依赖 `commander`（CLI 框架）


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: andresubri/wallet-api (version 0.0.1)

--- name: wallet-api description: Interact with the BudgetBakers Wallet API for personal finance data. Use when the user needs to query accounts, categories, transactions (records), budgets, or templates from their Wallet app via the REST API. Requires WALLET_API_TOKEN environment variable. --- # Wallet API Skill Interact with the BudgetBakers Wallet personal finance API. ## Prerequisites 1. **Premium Wallet plan** required for API access 2. **API Token** from [web.budgetbakers.com/settings/apiTokens](https://web.budgetbakers.com/settings/apiTokens) 3. Set `WALLET_API_TOKEN` environment variable ## Quick Start ```bash export WALLET_API_TOKEN="your_token_here" ./scripts/wallet-api.sh me ``` ## API Reference See [references/api-reference.md](references/api-reference.md) for: - Authentication details - Rate limiting (500 req/hour) - Query filter syntax (text and range filters) - Pagination parameters - Data synchronization behavior - Agent hints ## Available Commands | Command | Description | |---------|-------------| | `me` | Current user info | | `accounts` | List accounts | | `categories` | List categories | | `records` | List transactions | | `budgets` | List budgets | | `templates` | List templates | ## Query Parameters All list endpoints support: - `limit` (default 30, max 100) - `offset` (default 0) ### Filter Examples **Recent transactions:** ```bash ./wallet-api.sh records "recordDate=gte.2025-02-01&limit=50" ``` **Amount range:** ```bash ./wallet-api.sh records "amount=gte.100&amount=lte.500" ``` **Text search:** ```bash ./wallet-api.sh records "note=contains-i.grocery" ``` **Category + date:** ```bash ./wallet-api.sh records "categoryId=eq.<id>&recordDate=gte.2025-01-01" ``` ### Filter Prefixes | Prefix | Meaning | |--------|---------| | `eq.` | Exact match | | `contains.` | Contains (case-sensitive) | | `contains-i.` | Contains (case-insensitive) | | `gt.` | Greater than | | `gte.` | Greater than or equal | | `lt.` | Less than | | `lte.` | Less than or equal | ## Common Workflows ### Get Account Balances ```bash ./wallet-api.sh accounts ``` ### List Categories for Organization ```bash ./wallet-api.sh categories ``` ### Recent Spending ```bash ./wallet-api.sh records "recordDate=gte.2025-02-01&limit=100" ``` ### Filter by Payee ```bash ./wallet-api.sh records "payee=contains-i.amazon" ``` ## Data Sync Considerations - Initial sync returns 409 Conflict — wait and retry - Recent app changes may not appear immediately - Check `X-Last-Data-Change-At` header for freshness ## Rate Limit Handling Watch for: - `429 Too Many Requests` when exceeding 500/hour - `X-RateLimit-Remaining` header - Add `agentHints=true` for rate limit warnings


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: nyetnighy/nuclei-analysis (version 1.0.0)

--- name: nuclei-analysis description: Intelligently analyzes Nuclei scan results, prioritizes real bugs, reduces noise, and enriches findings with context. version: 1.0.0 author: NyetNighy tags: [bugbounty, nuclei, vulnerability-analysis, reporting] metadata: {"openclaw":{"emoji":"🔬","os":["linux","darwin","win32"],"requires":{"bins":["nuclei","python3","node"]}}} --- # Nuclei Analysis Skill Parses raw Nuclei scan output and generates prioritized, actionable bug bounty reports. ## When to Use Use this skill when: - A Nuclei scan has completed and you want to turn raw output into a structured report - You need to separate signal from noise in large scans - You want severity-prioritized findings with business impact context ## Usage ```bash python3 scripts/nuclei_analyzer.py /path/to/nuclei-output.txt python3 scripts/nuclei_analyzer.py /path/to/nuclei-output.txt --min-severity high --output report.md ``` ## Workflow When user says "analyze nuclei results", "review scan", or similar: 1. Read the nuclei output file 2. Parse and categorize by severity and template type 3. Reduce noise (filter common false positives) 4. Enrich high/critical findings with business context 5. Generate a Markdown report ## Severity Levels Nuclei severities (highest to lowest): - `critical` — Immediate action required - `high` — Significant risk, exploit likely - `medium` — Moderate risk, requires context - `low` — Minor risk, informational - `info` — Informational, usually noise ## Noise Reduction Filter out common false positives: - Generic 403 Forbidden (without further context) - Self-signed certificates (info only) - Leaking server/version headers without actual exploit - Template matches on redirect pages ## Output Always produces: - **Summary table** of all findings by severity - **Detailed section** for High+ severity findings - **Attack scenario** for critical/high issues - **Steps to reproduce** for actionable findings Report saved to: `reports/nuclei-analysis/<target>-<date>.md` ## Example Prompts - "Analyze nuclei results for example.com" - "Review scan findings and prioritize" - "Turn nuclei.txt into a bug bounty report" ## Requirements - Python 3.7+ - Nuclei installed and in PATH - nuclei output in text format (newline-delimited JSON also supported)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)