@elizaos/skills 2.0.0-alpha.43 → 2.0.0-alpha.430

package/skills/weather/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: weather
-description: Get current weather and forecasts (no API key required).
+description: Get current weather and forecasts (no API key required). Use when the user asks about the weather, temperature, forecast, wind, humidity, or climate conditions for a city or location. Fetches real-time weather data from free services using curl.
 homepage: https://wttr.in/:help
 metadata: { "otto": { "emoji": "🌤️", "requires": { "bins": ["curl"] } } }
 ---

package/skills/yara-authoring/SKILL.md

@@ -0,0 +1,111 @@
+---
+name: yara-authoring
+description: "Write and test YARA rules for malware detection and threat hunting. Use when creating YARA signatures, detecting malware families, scanning files or memory for indicators of compromise, or building detection rules for threat intelligence."
+allowed-tools:
+  - Bash
+  - Read
+  - Write
+  - Glob
+  - Grep
+---
+
+# YARA Rule Authoring
+
+## When to Use
+
+- Writing YARA rules to detect malware samples or families
+- Creating detection signatures for indicators of compromise (IOCs)
+- Scanning files or directories for known threat patterns
+- Building threat hunting rules from intelligence reports
+- Classifying unknown samples based on behavioral or structural patterns
+
+## When NOT to Use
+
+- Dynamic malware analysis (use sandbox environments)
+- Network traffic analysis (use Suricata/Snort rules)
+- Static analysis of source code (use Semgrep/CodeQL)
+
+## Rule Template
+
+```yara
+rule MalwareFamily_Variant : tag1 tag2 {
+    meta:
+        author = "analyst"
+        description = "Detects MalwareFamily variant based on unique strings"
+        date = "2024-01-01"
+        reference = "https://example.com/report"
+        hash = "abc123..."
+        severity = "high"
+
+    strings:
+        $s1 = "unique_malware_string" ascii
+        $s2 = { 4D 5A 90 00 03 00 }  // hex pattern
+        $s3 = /https?:\/\/[a-z0-9]+\.evil\.com/ nocase  // regex
+
+    condition:
+        uint16(0) == 0x5A4D and  // MZ header (PE file)
+        filesize < 5MB and
+        (2 of ($s*))
+}
+```
+
+## String Types
+
+| Type | Syntax | Use Case |
+|------|--------|----------|
+| Text | `"string"` | ASCII strings |
+| Hex | `{ AA BB CC }` | Byte patterns, shellcode |
+| Regex | `/pattern/` | Flexible text matching |
+
+### Modifiers
+- `ascii` / `wide` — encoding
+- `nocase` — case insensitive
+- `fullword` — word boundary matching
+- `xor` — XOR-encoded strings
+- `base64` — base64-encoded strings
+
+## Condition Operators
+
+```yara
+condition:
+    all of them           // All strings match
+    any of ($a*)          // Any string starting with $a
+    2 of ($s1, $s2, $s3)  // At least 2 of listed strings
+    #s1 > 3               // String $s1 appears more than 3 times
+    @s1 < 0x100           // String $s1 found before offset 0x100
+    filesize < 1MB        // File size constraint
+    uint16(0) == 0x5A4D   // Magic bytes at offset
+```
+
+## Scanning
+
+```bash
+# Scan a file
+yara rule.yar target_file
+
+# Scan directory recursively
+yara -r rules/ /path/to/scan/
+
+# Scan with metadata output
+yara -m -s rule.yar target_file
+
+# Compile rules for faster repeated scanning
+yarac rules/ compiled.yarc
+yara -C compiled.yarc /path/to/scan/
+```
+
+## Best Practices
+
+1. Always include `meta` with author, description, date, and reference
+2. Use `filesize` and magic byte checks to limit scope
+3. Prefer multiple weak indicators over one strong indicator
+4. Test against known samples AND clean files for false positives
+5. Use `private` rules for helper conditions
+6. Avoid overly broad regex patterns that cause performance issues
+7. Version control your rules and track detection rates
+
+## Resources
+
+- YARA Documentation — https://yara.readthedocs.io/
+- YARA Rules Repository — https://github.com/Yara-Rules/rules
+- VirusTotal YARA — https://docs.virustotal.com/docs/yara

package/skills/bear-notes/SKILL.md

@@ -1,107 +0,0 @@
----
-name: bear-notes
-description: Create, search, and manage Bear notes via grizzly CLI.
-homepage: https://bear.app
-metadata:
-  {
-    "otto":
-      {
-        "emoji": "🐻",
-        "os": ["darwin"],
-        "requires": { "bins": ["grizzly"] },
-        "install":
-          [
-            {
-              "id": "go",
-              "kind": "go",
-              "module": "github.com/tylerwince/grizzly/cmd/grizzly@latest",
-              "bins": ["grizzly"],
-              "label": "Install grizzly (go)",
-            },
-          ],
-      },
-  }
----
-
-# Bear Notes
-
-Use `grizzly` to create, read, and manage notes in Bear on macOS.
-
-Requirements
-
-- Bear app installed and running
-- For some operations (add-text, tags, open-note --selected), a Bear app token (stored in `~/.config/grizzly/token`)
-
-## Getting a Bear Token
-
-For operations that require a token (add-text, tags, open-note --selected), you need an authentication token:
-
-1. Open Bear → Help → API Token → Copy Token
-2. Save it: `echo "YOUR_TOKEN" > ~/.config/grizzly/token`
-
-## Common Commands
-
-Create a note
-
-```bash
-echo "Note content here" | grizzly create --title "My Note" --tag work
-grizzly create --title "Quick Note" --tag inbox < /dev/null
-```
-
-Open/read a note by ID
-
-```bash
-grizzly open-note --id "NOTE_ID" --enable-callback --json
-```
-
-Append text to a note
-
-```bash
-echo "Additional content" | grizzly add-text --id "NOTE_ID" --mode append --token-file ~/.config/grizzly/token
-```
-
-List all tags
-
-```bash
-grizzly tags --enable-callback --json --token-file ~/.config/grizzly/token
-```
-
-Search notes (via open-tag)
-
-```bash
-grizzly open-tag --name "work" --enable-callback --json
-```
-
-## Options
-
-Common flags:
-
-- `--dry-run` — Preview the URL without executing
-- `--print-url` — Show the x-callback-url
-- `--enable-callback` — Wait for Bear's response (needed for reading data)
-- `--json` — Output as JSON (when using callbacks)
-- `--token-file PATH` — Path to Bear API token file
-
-## Configuration
-
-Grizzly reads config from (in priority order):
-
-1. CLI flags
-2. Environment variables (`GRIZZLY_TOKEN_FILE`, `GRIZZLY_CALLBACK_URL`, `GRIZZLY_TIMEOUT`)
-3. `.grizzly.toml` in current directory
-4. `~/.config/grizzly/config.toml`
-
-Example `~/.config/grizzly/config.toml`:
-
-```toml
-token_file = "~/.config/grizzly/token"
-callback_url = "http://127.0.0.1:42123/success"
-timeout = "5s"
-```
-
-## Notes
-
-- Bear must be running for commands to work
-- Note IDs are Bear's internal identifiers (visible in note info or via callbacks)
-- Use `--enable-callback` when you need to read data back from Bear
-- Some operations require a valid token (add-text, tags, open-note --selected)

package/skills/bird/SKILL.md

@@ -1,224 +0,0 @@
----
-name: bird
-description: X/Twitter CLI for reading, searching, posting, and engagement via cookies.
-homepage: https://bird.fast
-metadata:
-  {
-    "otto":
-      {
-        "emoji": "🐦",
-        "requires": { "bins": ["bird"] },
-        "install":
-          [
-            {
-              "id": "brew",
-              "kind": "brew",
-              "formula": "steipete/tap/bird",
-              "bins": ["bird"],
-              "label": "Install bird (brew)",
-              "os": ["darwin"],
-            },
-            {
-              "id": "npm",
-              "kind": "node",
-              "package": "@steipete/bird",
-              "bins": ["bird"],
-              "label": "Install bird (npm)",
-            },
-          ],
-      },
-  }
----
-
-# bird 🐦
-
-Fast X/Twitter CLI using GraphQL + cookie auth.
-
-## Install
-
-```bash
-# npm/pnpm/bun
-npm install -g @steipete/bird
-
-# Homebrew (macOS, prebuilt binary)
-brew install steipete/tap/bird
-
-# One-shot (no install)
-bunx @steipete/bird whoami
-```
-
-## Authentication
-
-`bird` uses cookie-based auth.
-
-Use `--auth-token` / `--ct0` to pass cookies directly, or `--cookie-source` for browser cookies.
-
-Run `bird check` to see which source is active. For Arc/Brave, use `--chrome-profile-dir <path>`.
-
-## Commands
-
-### Account & Auth
-
-```bash
-bird whoami                    # Show logged-in account
-bird check                     # Show credential sources
-bird query-ids --fresh         # Refresh GraphQL query ID cache
-```
-
-### Reading Tweets
-
-```bash
-bird read <url-or-id>          # Read a single tweet
-bird <url-or-id>               # Shorthand for read
-bird thread <url-or-id>        # Full conversation thread
-bird replies <url-or-id>       # List replies to a tweet
-```
-
-### Timelines
-
-```bash
-bird home                      # Home timeline (For You)
-bird home --following          # Following timeline
-bird user-tweets @handle -n 20 # User's profile timeline
-bird mentions                  # Tweets mentioning you
-bird mentions --user @handle   # Mentions of another user
-```
-
-### Search
-
-```bash
-bird search "query" -n 10
-bird search "from:steipete" --all --max-pages 3
-```
-
-### News & Trending
-
-```bash
-bird news -n 10                # AI-curated from Explore tabs
-bird news --ai-only            # Filter to AI-curated only
-bird news --sports             # Sports tab
-bird news --with-tweets        # Include related tweets
-bird trending                  # Alias for news
-```
-
-### Lists
-
-```bash
-bird lists                     # Your lists
-bird lists --member-of         # Lists you're a member of
-bird list-timeline <id> -n 20  # Tweets from a list
-```
-
-### Bookmarks & Likes
-
-```bash
-bird bookmarks -n 10
-bird bookmarks --folder-id <id>           # Specific folder
-bird bookmarks --include-parent           # Include parent tweet
-bird bookmarks --author-chain             # Author's self-reply chain
-bird bookmarks --full-chain-only          # Full reply chain
-bird unbookmark <url-or-id>
-bird likes -n 10
-```
-
-### Social Graph
-
-```bash
-bird following -n 20           # Users you follow
-bird followers -n 20           # Users following you
-bird following --user <id>     # Another user's following
-bird about @handle             # Account origin/location info
-```
-
-### Engagement Actions
-
-```bash
-bird follow @handle            # Follow a user
-bird unfollow @handle          # Unfollow a user
-```
-
-### Posting
-
-```bash
-bird tweet "hello world"
-bird reply <url-or-id> "nice thread!"
-bird tweet "check this out" --media image.png --alt "description"
-```
-
-**⚠️ Posting risks**: Posting is more likely to be rate limited; if blocked, use the browser tool instead.
-
-## Media Uploads
-
-```bash
-bird tweet "hi" --media img.png --alt "description"
-bird tweet "pics" --media a.jpg --media b.jpg  # Up to 4 images
-bird tweet "video" --media clip.mp4            # Or 1 video
-```
-
-## Pagination
-
-Commands supporting pagination: `replies`, `thread`, `search`, `bookmarks`, `likes`, `list-timeline`, `following`, `followers`, `user-tweets`
-
-```bash
-bird bookmarks --all                    # Fetch all pages
-bird bookmarks --max-pages 3            # Limit pages
-bird bookmarks --cursor <cursor>        # Resume from cursor
-bird replies <id> --all --delay 1000    # Delay between pages (ms)
-```
-
-## Output Options
-
-```bash
---json          # JSON output
---json-full     # JSON with raw API response
---plain         # No emoji, no color (script-friendly)
---no-emoji      # Disable emoji
---no-color      # Disable ANSI colors (or set NO_COLOR=1)
---quote-depth n # Max quoted tweet depth in JSON (default: 1)
-```
-
-## Global Options
-
-```bash
---auth-token <token>       # Set auth_token cookie
---ct0 <token>              # Set ct0 cookie
---cookie-source <source>   # Cookie source for browser cookies (repeatable)
---chrome-profile <name>    # Chrome profile name
---chrome-profile-dir <path> # Chrome/Chromium profile dir or cookie DB path
---firefox-profile <name>   # Firefox profile
---timeout <ms>             # Request timeout
---cookie-timeout <ms>      # Cookie extraction timeout
-```
-
-## Config File
-
-`~/.config/bird/config.json5` (global) or `./.birdrc.json5` (project):
-
-```json5
-{
-  cookieSource: ["chrome"],
-  chromeProfileDir: "/path/to/Arc/Profile",
-  timeoutMs: 20000,
-  quoteDepth: 1,
-}
-```
-
-Environment variables: `BIRD_TIMEOUT_MS`, `BIRD_COOKIE_TIMEOUT_MS`, `BIRD_QUOTE_DEPTH`
-
-## Troubleshooting
-
-### Query IDs stale (404 errors)
-
-```bash
-bird query-ids --fresh
-```
-
-### Cookie extraction fails
-
-- Check browser is logged into X
-- Try different `--cookie-source`
-- For Arc/Brave: use `--chrome-profile-dir`
-
----
-
-**TL;DR**: Read/search/engage with CLI. Post carefully or use browser. 🐦

package/skills/blogwatcher/SKILL.md

@@ -1,69 +0,0 @@
----
-name: blogwatcher
-description: Monitor blogs and RSS/Atom feeds for updates using the blogwatcher CLI.
-homepage: https://github.com/Hyaxia/blogwatcher
-metadata:
-  {
-    "otto":
-      {
-        "emoji": "📰",
-        "requires": { "bins": ["blogwatcher"] },
-        "install":
-          [
-            {
-              "id": "go",
-              "kind": "go",
-              "module": "github.com/Hyaxia/blogwatcher/cmd/blogwatcher@latest",
-              "bins": ["blogwatcher"],
-              "label": "Install blogwatcher (go)",
-            },
-          ],
-      },
-  }
----
-
-# blogwatcher
-
-Track blog and RSS/Atom feed updates with the `blogwatcher` CLI.
-
-Install
-
-- Go: `go install github.com/Hyaxia/blogwatcher/cmd/blogwatcher@latest`
-
-Quick start
-
-- `blogwatcher --help`
-
-Common commands
-
-- Add a blog: `blogwatcher add "My Blog" https://example.com`
-- List blogs: `blogwatcher blogs`
-- Scan for updates: `blogwatcher scan`
-- List articles: `blogwatcher articles`
-- Mark an article read: `blogwatcher read 1`
-- Mark all articles read: `blogwatcher read-all`
-- Remove a blog: `blogwatcher remove "My Blog"`
-
-Example output
-
-```
-$ blogwatcher blogs
-Tracked blogs (1):
-
-  xkcd
-    URL: https://xkcd.com
-```
-
-```
-$ blogwatcher scan
-Scanning 1 blog(s)...
-
-  xkcd
-    Source: RSS | Found: 4 | New: 4
-
-Found 4 new article(s) total!
-```
-
-Notes
-
-- Use `blogwatcher <command> --help` to discover flags and options.

package/skills/clawhub/SKILL.md

@@ -1,77 +0,0 @@
----
-name: clawhub
-description: Use the ClawHub CLI to search, install, update, and publish agent skills from clawhub.com. Use when you need to fetch new skills on the fly, sync installed skills to latest or a specific version, or publish new/updated skill folders with the npm-installed clawhub CLI.
-metadata:
-  {
-    "otto":
-      {
-        "requires": { "bins": ["clawhub"] },
-        "install":
-          [
-            {
-              "id": "node",
-              "kind": "node",
-              "package": "clawhub",
-              "bins": ["clawhub"],
-              "label": "Install ClawHub CLI (npm)",
-            },
-          ],
-      },
-  }
----
-
-# ClawHub CLI
-
-Install
-
-```bash
-npm i -g clawhub
-```
-
-Auth (publish)
-
-```bash
-clawhub login
-clawhub whoami
-```
-
-Search
-
-```bash
-clawhub search "postgres backups"
-```
-
-Install
-
-```bash
-clawhub install my-skill
-clawhub install my-skill --version 1.2.3
-```
-
-Update (hash-based match + upgrade)
-
-```bash
-clawhub update my-skill
-clawhub update my-skill --version 1.2.3
-clawhub update --all
-clawhub update my-skill --force
-clawhub update --all --no-input --force
-```
-
-List
-
-```bash
-clawhub list
-```
-
-Publish
-
-```bash
-clawhub publish ./my-skill --slug my-skill --name "My Skill" --version 1.2.0 --changelog "Fixes + docs"
-```
-
-Notes
-
-- Default registry: https://clawhub.com (override with CLAWHUB_REGISTRY or --registry)
-- Default workdir: cwd (falls back to Otto workspace); install dir: ./skills (override with --workdir / --dir / CLAWHUB_WORKDIR)
-- Update command hashes local files, resolves matching version, and upgrades to latest unless --version is set

package/skills/eightctl/SKILL.md

@@ -1,50 +0,0 @@
----
-name: eightctl
-description: Control Eight Sleep pods (status, temperature, alarms, schedules).
-homepage: https://eightctl.sh
-metadata:
-  {
-    "otto":
-      {
-        "emoji": "🎛️",
-        "requires": { "bins": ["eightctl"] },
-        "install":
-          [
-            {
-              "id": "go",
-              "kind": "go",
-              "module": "github.com/steipete/eightctl/cmd/eightctl@latest",
-              "bins": ["eightctl"],
-              "label": "Install eightctl (go)",
-            },
-          ],
-      },
-  }
----
-
-# eightctl
-
-Use `eightctl` for Eight Sleep pod control. Requires auth.
-
-Auth
-
-- Config: `~/.config/eightctl/config.yaml`
-- Env: `EIGHTCTL_EMAIL`, `EIGHTCTL_PASSWORD`
-
-Quick start
-
-- `eightctl status`
-- `eightctl on|off`
-- `eightctl temp 20`
-
-Common tasks
-
-- Alarms: `eightctl alarm list|create|dismiss`
-- Schedules: `eightctl schedule list|create|update`
-- Audio: `eightctl audio state|play|pause`
-- Base: `eightctl base info|angle`
-
-Notes
-
-- API is unofficial and rate-limited; avoid repeated logins.
-- Confirm before changing temperature or alarms.

package/skills/food-order/SKILL.md

@@ -1,48 +0,0 @@
----
-name: food-order
-description: "Reorder Foodora orders + track ETA/status with ordercli. Never confirm without explicit user approval. Triggers: order food, reorder, track ETA."
-homepage: https://ordercli.sh
-metadata: {"otto":{"emoji":"🥡","requires":{"bins":["ordercli"]},"install":[{"id":"go","kind":"go","module":"github.com/steipete/ordercli/cmd/ordercli@latest","bins":["ordercli"],"label":"Install ordercli (go)"}]}}
----
-
-# Food order (Foodora via ordercli)
-
-Goal: reorder a previous Foodora order safely (preview first; confirm only on explicit user “yes/confirm/place the order”).
-
-Hard safety rules
-
-- Never run `ordercli foodora reorder ... --confirm` unless user explicitly confirms placing the order.
-- Prefer preview-only steps first; show what will happen; ask for confirmation.
-- If user is unsure: stop at preview and ask questions.
-
-Setup (once)
-
-- Country: `ordercli foodora countries` → `ordercli foodora config set --country AT`
-- Login (password): `ordercli foodora login --email you@example.com --password-stdin`
-- Login (no password, preferred): `ordercli foodora session chrome --url https://www.foodora.at/ --profile "Default"`
-
-Find what to reorder
-
-- Recent list: `ordercli foodora history --limit 10`
-- Details: `ordercli foodora history show <orderCode>`
-- If needed (machine-readable): `ordercli foodora history show <orderCode> --json`
-
-Preview reorder (no cart changes)
-
-- `ordercli foodora reorder <orderCode>`
-
-Place reorder (cart change; explicit confirmation required)
-
-- Confirm first, then run: `ordercli foodora reorder <orderCode> --confirm`
-- Multiple addresses? Ask user for the right `--address-id` (take from their Foodora account / prior order data) and run:
-  - `ordercli foodora reorder <orderCode> --confirm --address-id <id>`
-
-Track the order
-
-- ETA/status (active list): `ordercli foodora orders`
-- Live updates: `ordercli foodora orders --watch`
-- Single order detail: `ordercli foodora order <orderCode>`
-
-Debug / safe testing
-
-- Use a throwaway config: `ordercli --config /tmp/ordercli.json ...`