# Skill Allowlist

Only use skills from this list. New skills must be audited before use.

## Audited & Approved Skills

### Built-in (OpenClaw)
- bluebubbles
- coding-agent
- openai-whisper
- skill-creator
- video-frames
- weather

### ClawHub (Audited 2026-02-02)
- ad-creative-generator ✓
- adcp-advertising ✓
- affiliatematic ✓
- ai-meeting-notes ✓
- clawdaddy ✓
- discord-watcher ✓
- email-best-practices ✓
- hn-extract ✓
- humanise-ai-text ✓ (renamed from humanize)
- imagerouter ✓
- jules-cli ✓
- landing-gen ✓
- local-falcon ✓ (local-visibility-skill)
- marketing-mode ✓ (includes 23 sub-skills)
- netlify ✓
- outlook-web ✓
- skill-auditor ✓
- token-saver ✓
- wordpress-pro ✓
- x-trends ✓

### Custom/Local
- pptx-creator ✓
- reddit ✓ (theglove44/reddit - ClawHub, installed 2026-02-06)
- ui-ux-architect ✓ (custom from Rob - Steve Jobs/Jony Ive design philosophy)

### Business/Outreach (ClawHub, Audited 2026-02-07)
- business-development ✓ (oyi77) - Partnership outreach, market research, competitor analysis
- sales ✓ (oyi77) - CRM integration, lead tracking, pipeline management
- lead-hunter ✓ (queen) - Lead generation + enrichment framework
- prospector ✓ (slempiam) - Exa + Apollo lead search (requires API keys)

### Growth & Sales Tools (ClawHub, Installed 2026-02-14)
- apollo ✓ (jhumanj) - Apollo.io REST API (people/org enrichment, search, lists)
- hubspot ✓ (kwall1) - Full HubSpot CRM integration
- kakiyo ✓ (cyberboyayush) - LinkedIn automation campaigns, prospects, AI agents
- exa-plus ✓ (jordyvandomselaar) - Neural web search (LinkedIn, news, research, code)
- twenty-crm ✓ (jhumanj) - Self-hosted Twenty CRM via REST/GraphQL
- gsd ✓ (glittercowboy) - Get Shit Done workflow (planning, research, execution)
- news-aggregator-skill ✓ (cclank) - Multi-source news aggregation with semantic filtering
- web-search-plus ✓ (robbyczgw-cla) - Multi-provider search (Serper, Tavily, Exa, You, SearXNG)
- paperless ✓ (nickchristensen) - Document management (invoices, receipts, filing)
- agent-browser ✓ (thesethrose) - Fast headless browser automation CLI
- personas ✓ (robbyczgw-cla) - Switch between expert personalities mid-conversation

### Productivity & Automation (ClawHub, Installed 2026-02-14)
- clickup ✓ - Full ClickUp project management with nested subtasks
- linear ✓ - GraphQL-based issue/project management
- cal-com ✓ - Meeting scheduling with availability checks
- flowmind ✓ - Chain skills into repeatable workflows
- triple-memory-skill ✓ - Persistent 3-tier memory across sessions
- agentmail ✓ - Programmatic email inboxes for agents
- tweet-writer ✓ - Twitter/X content with viral hooks

### Community Skills (Audited 2026-02-26)
- skill-vetting ✓ (eddygk) - Security scanner for new skills before installation
- deepwiki ✓ (arun-8687) - Query GitHub repo docs via DeepWiki MCP (no auth needed)
- cc-godmode ✓ (cubetribe) - Multi-agent orchestration workflows (docs only, VirusTotal flag was false positive)

### New Skills (Installed 2026-03-08)
- meta-ads ✓ - Meta/Facebook Ads API integration (campaigns, budgets, reporting)
- stripe-api ✓ - Stripe API (payments, subscriptions, invoices, billing)
- invoice-chaser ✓ - Automated invoice follow-up sequences (audited: scripts are clean bash/jq, VirusTotal flag was email dependency false positive)
- seo ✓ - Full SEO suite (site audit, content writer, competitor analysis)
- cold-email ✓ - MachFive cold email outreach
- google-analytics ✓ - GA4 data and reporting
- gsc ✓ - Google Search Console data

## Blocked Skills / Malicious Authors

### moonshine-100rze (BLOCKED AUTHOR)
- browser-agent-ed7 - MALICIOUS (base64 encoded attack payload)
- All skills from this author are permanently blocked

## Audit Process

Before using any new skill:
1. Download to /tmp for review
2. Check SKILL.md for suspicious instructions
3. Scan all scripts for:
   - Base64 encoded content
   - Network requests to unknown domains
   - File system access outside workspace
   - Attempts to modify system files
4. Use skill-auditor if available
5. Add to this list only after approval
