OpenClaw/clawhub-security-signals huggingface dataset:
Skill: cinience/aliyun-qwen-text-embedding (version 1.0.0)

--- name: aliyun-qwen-text-embedding description: Use when text embeddings are needed from Alibaba Cloud Model Studio models for semantic search, retrieval-augmented generation, clustering, or offline vectorization pipelines. version: 1.0.0 --- Category: provider # Model Studio Text Embedding ## Validation ```bash mkdir -p output/aliyun-qwen-text-embedding python -m py_compile skills/ai/search/aliyun-qwen-text-embedding/scripts/prepare_embedding_request.py && echo "py_compile_ok" > output/aliyun-qwen-text-embedding/validate.txt ``` Pass criteria: command exits 0 and `output/aliyun-qwen-text-embedding/validate.txt` is generated. ## Critical model names Use one of these exact model strings as needed: - `text-embedding-v4` - `text-embedding-v3` - `text-embedding-v2` - `text-embedding-v1` - `qwen3-embedding-8b` - `qwen3-embedding-4b` - `qwen3-embedding-0.6b` ## Quick start ```bash python skills/ai/search/aliyun-qwen-text-embedding/scripts/prepare_embedding_request.py \ --text "Alibaba Cloud Model Studio" \ --output output/aliyun-qwen-text-embedding/request.json ``` ## Notes - Pair this skill with `skills/ai/search/aliyun-dashvector-search/` or other vector-store skills. - For image or multimodal embeddings, add dedicated multimodal embedding coverage separately. ## References - `references/sources.md`

path: agents/openai.yaml
content: interface:
  display_name: "Alibaba Cloud AI Search Text Embedding"
  short_description: "Text embeddings from Model Studio embedding models"
  default_prompt: "Use $alicloud-ai-search-text-embedding to complete this ai/search embedding task on Alibaba Cloud."


path: references/sources.md
content: # Sources

- https://help.aliyun.com/zh/model-studio/embedding
- https://help.aliyun.com/zh/model-studio/newly-released-models


path: scripts/prepare_embedding_request.py
content: #!/usr/bin/env python3
"""Prepare a minimal request payload for Model Studio text embedding."""

from __future__ import annotations

import argparse
import json
from pathlib import Path


def main() -> None:
    parser = argparse.ArgumentParser()
    parser.add_argument("--text", default="Alibaba Cloud Model Studio")
    parser.add_argument("--model", default="text-embedding-v4")
    parser.add_argument(
        "--output",
        default="output/aliyun-qwen-text-embedding/request.json",
    )
    args = parser.parse_args()

    payload = {
        "model": args.model,
        "input": {
            "texts": [args.text],
        },
    }

    output = Path(args.output)
    output.parent.mkdir(parents=True, exist_ok=True)
    output.write_text(json.dumps(payload, ensure_ascii=False, indent=2), encoding="utf-8")
    print(output)


if __name__ == "__main__":
    main()


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dinghaibin/rm-tool (version 1.0.0)

--- name: rm-tool description: Remove files and directories permanently. Use for file deletion, cleanup, and disk space management. --- # RM - File Removal Utility Delete files and directories from the filesystem. Supports recursive directory removal, interactive confirmation, and force deletion. ## Usage ```bash rm-tool [options] <target...> ``` ## Options - `-r`: Recursively remove directories - `-f`: Force removal (ignore nonexistent files) - `-i`: Interactive (prompt before each removal) - `-v`: Verbose (show what is being removed) ## Examples ```bash rm-tool file.txt rm-tool -rf temp_directory/ rm-tool -i *.log ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: daniellummis/github-actions-workflow-hardening-audit (version 1.1.0)

--- name: github-actions-workflow-hardening-audit description: Audit GitHub Actions workflow files for hardening gaps (missing timeouts/permissions/concurrency and floating action refs). version: 1.1.0 metadata: {"openclaw":{"requires":{"bins":["bash","python3"]}}} --- # GitHub Actions Workflow Hardening Audit Use this skill to statically audit `.github/workflows/*.yml` files before risky defaults leak into production CI. ## What this skill does - Scans workflow YAML files and scores hardening risk per file - Flags jobs missing `timeout-minutes` - Flags missing `permissions` declarations (workflow-level or job-level) - Optionally flags missing `concurrency` controls - Flags floating `uses:` refs (`@main`, `@master`, `@latest`, major-only tags like `@v4`) - Supports file/event regex filtering for targeted triage in large monorepos - Raises severity (`ok` / `warn` / `critical`) and can fail CI gates ## Inputs Optional: - `WORKFLOW_GLOB` (default: `.github/workflows/*.y*ml`) - `TOP_N` (default: `20`) - `OUTPUT_FORMAT` (`text` or `json`, default: `text`) - `WARN_SCORE` (default: `3`) - `CRITICAL_SCORE` (default: `7`) - `REQUIRE_TIMEOUT` (`0`/`1`, default: `1`) - `REQUIRE_PERMISSIONS` (`0`/`1`, default: `1`) - `REQUIRE_CONCURRENCY` (`0`/`1`, default: `0`) - `FLAG_FLOATING_REFS` (`0`/`1`, default: `1`) - `ALLOW_REF_REGEX` (regex whitelist for approved refs, optional) - `WORKFLOW_FILE_MATCH` (regex include filter on file path, optional) - `WORKFLOW_FILE_EXCLUDE` (regex exclude filter on file path, optional) - `EVENT_MATCH` (regex include filter on parsed `on:` triggers, optional) - `EVENT_EXCLUDE` (regex exclude filter on parsed `on:` triggers, optional) - `FAIL_ON_CRITICAL` (`0` or `1`, default: `0`) ## Run Text report: ```bash WORKFLOW_GLOB='.github/workflows/*.y*ml' \ bash skills/github-actions-workflow-hardening-audit/scripts/workflow-hardening-audit.sh ``` JSON output + fail gate: ```bash WORKFLOW_GLOB='.github/workflows/*.y*ml' \ OUTPUT_FORMAT=json \ REQUIRE_CONCURRENCY=1 \ FAIL_ON_CRITICAL=1 \ bash skills/github-actions-workflow-hardening-audit/scripts/workflow-hardening-audit.sh ``` Filter to only PR-target workflows: ```bash WORKFLOW_GLOB='.github/workflows/*.y*ml' \ EVENT_MATCH='pull_request_target' \ FAIL_ON_CRITICAL=1 \ bash skills/github-actions-workflow-hardening-audit/scripts/workflow-hardening-audit.sh ``` Run against bundled fixtures: ```bash WORKFLOW_GLOB='skills/github-actions-workflow-hardening-audit/fixtures/*.y*ml' \ bash skills/github-actions-workflow-hardening-audit/scripts/workflow-hardening-audit.sh ``` ## Output contract - Exit `0` in report mode (default) - Exit `1` when `FAIL_ON_CRITICAL=1` and one or more workflows are critical - Text mode prints summary + ranked workflow risks - JSON mode prints summary + ranked workflows + critical workflows


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: sichengchen/1password-cli (version 0.1.0)

# 1Password CLI for Agents This skill allows agents to securely access and manage secrets using the 1Password CLI (`op`) and a Service Account. It provides commands for reading, writing, and managing items within a dedicated vault. ## Prerequisites 1. **Install 1Password CLI:** - macOS: `brew install --cask 1password-cli` - Linux/Windows: See [official docs](https://developer.1password.com/docs/cli/get-started). 2. **Create a Service Account:** - Go to [1Password Developer Portal](https://developer.1password.com/). - Create a Service Account and grant it access to a specific vault (e.g., "Agent Vault"). - Copy the Service Account Token. 3. **Set Environment Variable:** - Set `OP_SERVICE_ACCOUNT_TOKEN` in your environment (e.g., `.env` file or export in shell). - For OpenClaw, you can add `OP_SERVICE_ACCOUNT_TOKEN=...` to `.env`. ## Usage All commands require the `OP_SERVICE_ACCOUNT_TOKEN` to be set. ### 1. Check Authentication Verify the service account is working: ```bash op whoami ``` ### 2. List Vaults List vaults accessible to the service account: ```bash op vault list ``` ### 3. Read an Item Get details of an item (JSON format is best for parsing): ```bash op item get "Item Name" --vault "Vault Name" --format json ``` Or get a specific field (e.g., password): ```bash op read "op://Vault Name/Item Name/password" ``` ### 4. Create an Item Create a login item: ```bash op item create --category login --title "My Service" --url "https://example.com" --vault "Vault Name" username="myuser" [REDACTED_SECRET]" ``` Create a secure note: ```bash op item create --category "Secure Note" --title "API Key" --vault "Vault Name" notes="my-secret-key" ``` ### 5. Edit an Item Update a password: ```bash op item edit "Item Name" [REDACTED_SECRET]" --vault "Vault Name" ``` ### 6. Delete an Item ```bash op item delete "Item Name" --vault "Vault Name" ``` ## Tips for Agents - **Always use JSON output:** Add `--format json` to `op` commands for structured data that is easier to parse. - **Security:** Never print the `OP_SERVICE_ACCOUNT_TOKEN` or retrieved secrets to the console unless explicitly asked. - **Vaults:** If multiple vaults are available, specify the `--vault` flag to avoid ambiguity. - **Rate Limits:** Service accounts have rate limits. Cache results if possible or retry with backoff. ## Troubleshooting - **"You are not currently signed in":** Ensure `OP_SERVICE_ACCOUNT_TOKEN` is set correctly. - **"account is not authorized":** Check that the service account has permission for the specific vault and operation (read/write).


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: arthasking123/ai-data-analysis (version 1.0.0)

# SKILL.md # Data Analysis Service 自动化数据处理和洞察分析服务。 ## 能力 - CSV/Excel 数据处理 - 数据清洗和转换 - 统计分析和可视化 - 趋势识别 - 异常检测 - 报告生成 ## 使用方式 ```bash # 分析CSV数据 openclaw run data-analysis --file data.csv --analysis "sales_trends" # 处理Excel openclaw run data-analysis --file sales.xlsx --output report.md # 数据清洗 openclaw run data-analysis --file data.csv --action "clean" --format "json" # 生成可视化图表 openclaw run data-analysis --file metrics.csv --chart "bar" --output charts/ ``` ## 收费模式 - **单次分析:** $15-50 - **月度订阅:** $100-300 - **企业套餐:** 按需 ## 特性 - ✅ 支持 CSV, Excel, JSON - ✅ 多种分析类型（趋势、对比、预测） - ✅ 自动生成图表（图表库） - ✅ 可导出 PDF/HTML - ✅ 定制化报告模板 ## 开发者 OpenClaw AI Agent License: MIT Version: 1.0.0


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: spideystreet/oc-self-update (version 1.0.2)

--- name: oc-self-update description: Check for OpenClaw updates and self-update the installation. Use when the user asks to update OpenClaw, check for updates, upgrade the bot, install a new version, or says a new release is available. metadata: {"openclaw":{"requires":{"bins":["npm"]}}} --- # OpenClaw Self-Update OpenClaw is distributed as an npm package. Version scheme: `YYYY.M.D` (date-based). ## Workflow ### 1. Check for updates Run the check script: ```json { "tool": "exec", "command": "bash {baseDir}/scripts/check_update.sh" } ``` Report the result to the user clearly: - If already up to date: say so and show current version - If an update is available: show current vs latest and ask for confirmation before updating ### 2. Apply update Only run after user confirms. Use the channel the user configured (default: `latest`): ```json { "tool": "exec", "command": "npm install -g openclaw@latest" } ``` | Channel | Command | |---------|---------| | Stable (default) | `npm install -g openclaw@latest` | | Beta | `npm install -g openclaw@beta` | | Dev | `npm install -g openclaw@dev` | ### 3. Confirm result After a successful install, inform the user that a **gateway restart is required** for changes to take effect. Do not restart automatically — tell the user to run `openclaw restart` or stop/start the daemon. ``` ✅ OpenClaw updated: {old_version} → {new_version} ⚠️ Restart the gateway: openclaw restart ``` ### 4. Error handling - If `check_update.sh` fails → report the error, suggest checking network or npm config - If `npm install` fails → report the error as-is, do not retry without user input - If the user asks for a channel that doesn't exist → show the channel table and ask again ## Examples | User says | Action | |-----------|--------| | "Check for updates" | Run check script, report current vs latest | | "Update openclaw" | Run check script, if update available ask confirmation, then install | | "Switch to beta channel" | Install `openclaw@beta`, remind to restart | | "What version am I on?" | Run check script, report current version |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: ajmwagar/create-dxf (version 0.1.1)

--- name: create-dxf description: Create RFQ-ready 2D DXF (and optional SVG preview) files from a strict, validated JSON spec derived from a natural-language design prompt. Use for sheet/plate parts (waterjet/laser/router) like mounting plates, gussets, brackets, hole patterns, and slots. --- # create-dxf Deterministically generate a **manufacturing-friendly DXF** from a small JSON spec (center-origin, explicit units). Also emits an SVG preview. ## Quick start 1) Convert prompt → JSON (see `references/spec_schema.md`). 2) Validate: ```bash python3 scripts/create_dxf.py validate spec.json ``` 3) Render: ```bash python3 scripts/create_dxf.py render spec.json --outdir out ``` Outputs: - `out/<name>.dxf` - `out/<name>.svg` ## Notes - DXF uses simple entities for compatibility: closed `LWPOLYLINE` outer profile + `CIRCLE` holes. - Default layers are manufacturing-oriented: - `CUT_OUTER` (outer perimeter) - `CUT_INNER` (holes/slots) - `NOTES` (optional) ## Resources - `scripts/create_dxf.py` - `references/spec_schema.md` - `references/test_prompts.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kpaxqin/alpha-vantage-api (version 1.0.0)

--- name: alpha-vantage description: >- Alpha Vantage 金融数据 API。支持股票、外汇、加密货币的实时和历史数据。 免费 API key: demo (限流)，建议申请自己的免费 key。 requirements: - Node.js - 网络连接 - (可选) Alpha Vantage API key from https://www.alphavantage.co/support/#api-key examples: - "查询苹果股票: alpha quote AAPL" - "查询日K线: alpha daily AAPL" - "查询外汇汇率: alpha forex USD/JPY" - "查询加密货币: alpha crypto BTC/USD" - "设置 API key: alpha apikey YOUR_KEY" --- # Alpha Vantage Skill Alpha Vantage 提供股票、外汇、加密货币等金融数据接口。 ## 快速开始 ### 设置 API Key (推荐) ```bash # 使用自己的 API key (免费申请: https://www.alphavantage.co/support/#api-key) node alpha.js apikey YOUR_API_KEY # 或使用演示 key (限流) node alpha.js quote AAPL ``` ### 查询实时报价 ```bash # 股票报价 node alpha.js quote AAPL # 带 API key ALPHA_KEY=your_key node alpha.js quote AAPL ``` ### 获取历史 K 线 ```bash # 日K线 node alpha.js daily AAPL # 周K线 node alpha.js weekly IBM # 月K线 node alpha.js monthly MSFT ``` ### 外汇汇率 ```bash # 美元兑日元 node alpha.js forex USD/JPY # 欧元兑美元 node alpha.js forex EUR/USD ``` ### 加密货币 ```bash # 比特币兑美元 node alpha.js crypto BTC/USD # 以太坊兑比特币 node alpha.js crypto ETH/BTC ``` ## 命令列表 | 命令 | 说明 | 示例 | |------|------|------| | quote | 实时报价 | `alpha quote AAPL` | | daily | 日K线 | `alpha daily AAPL` | | weekly | 周K线 | `alpha weekly AAPL` | | monthly | 月K线 | `alpha monthly AAPL` | | forex | 汇率 | `alpha forex USD/JPY` | | crypto | 加密货币 | `alpha crypto BTC/USD` | | apikey | 设置 API key | `alpha apikey YOUR_KEY` | ## 注意事项 1. **免费 API 限流** - 每分钟 5 次请求，每天 500 次 2. **演示 key** - 使用 `demo` key 可能有严格限流 3. **数据延迟** - 免费版数据可能有 15 分钟延迟 4. **申请免费 key** - https://www.alphavantage.co/support/#api-key


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kostja94/youtube-ads (version 1.0.1)

--- name: youtube-ads description: When the user wants to run YouTube ads, set up TrueView or Bumper campaigns, or optimize video ad creative. Also use when the user mentions "YouTube ads," "TrueView," "Bumper ads," "YouTube Discovery," "video ads," "YouTube campaign," or "in-feed ads." For organic YouTube, use youtube-seo. metadata: version: 1.0.1 --- # Paid Ads: YouTube Ads Guides YouTube advertising: TrueView, Bumper, and Discovery (in-feed) formats. Use this skill when planning or optimizing YouTube ad campaigns. For Google Search/Display/PMax, see **google-ads**. For organic YouTube optimization, see **youtube-seo**. **When invoking**: On **first use**, if helpful, open with 1–2 sentences on what this skill covers and why it matters, then provide the main output. On **subsequent use** or when the user asks to skip, go directly to the main output. ## Initial Assessment **Check for project context first:** If `.claude/project-context.md` or `.cursor/project-context.md` exists, read Sections 3 (Value Proposition), 4 (Audience). Identify: 1. **Goal**: Awareness, consideration, conversion 2. **Budget**: Bumper cheaper; TrueView for scale 3. **Creative**: Existing video or net-new ## Ad Formats | Format | Length | Skippable | Best For | |--------|--------|-----------|----------| | **TrueView Skippable** | 12 sec+ | After 5 sec | Reach; large audiences | | **TrueView Non-skippable** | 15–20 sec | No | Full message; guaranteed view | | **TrueView for Action** | — | — | Conversions; CTA-focused | | **Bumper** | 6 sec or less | No | Brand awareness; memorable; lower cost | | **Discovery (In-Feed)** | Thumbnail + text | — | Search, related videos, homepage; interest targeting | ## Format Selection | Goal | Format | |------|--------| | **Brand awareness** | Bumper | | **Website traffic** | TrueView | | **Conversions** | TrueView for Action | | **Interested audiences** | Discovery | ## Creative Guidelines - **Bumper**: Quick, memorable; brand message in 6 sec - **TrueView**: Hook in first 5 sec (skippable); deliver value before skip - **Discovery**: Thumbnail + headline; appears like organic video ## Output Format - **Format** recommendation - **Creative** specs (length, hook, CTA) - **Targeting** notes - **Pre-launch** checklist ## Related Skills - **google-ads**: Google Ads platform; YouTube runs through Google Ads - **youtube-seo**: Organic YouTube; video optimization - **video-marketing**: Video script, hook structure - **paid-ads-strategy**: When to use video ads; channel selection


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mebusw/hunyuan-text-to-image (version 1.0.0)

--- name: huny-img description: 使用腾讯混元生图 3.0（HunyuanImage 3.0）生成图片。当用户需要调用混元/腾讯云生图、hunyuan 生图、huny-img 生图时，使用此 skill。调用 Python 脚本完成文生图（text-to-image）和图生图（image-to-image）任务，接口风格与 wanx-img skill 保持一致。 author: 申导 allowed-tools: Bash --- ## Overview 本 skill 通过调用腾讯云 AI Art API（混元生图 3.0）实现文生图和图生图功能。采用异步任务模式：先提交（SubmitTextToImageJob），再轮询查询（QueryTextToImageJob）直至完成。 ## Workflow 1. 判断用户意图：文生图（无参考图）还是图生图（提供参考图 URL） 2. 解析图像分辨率：支持比例字符串或像素字符串，转换见下表 3. 若用户提供了参考图 URL/路径，直接将 URL 传入脚本的 `--images` 参数（无需下载） 4. 运行脚本生成图片（异步轮询，约 30–90 秒） 5. 输出：原始 prompt、扩写后 prompt（若开启改写）、分辨率、JobId、图片完整 URL > ⚠️ 生成的图片 URL **有效期仅 1 小时**，务必在输出中完整展示，提醒用户及时保存。 --- ## 分辨率对照表 文生图默认 `1024:1024`；宽高均需在 [512, 2048] 范围内，乘积 ≤ 1024×1024。 | 比例 | 像素尺寸 | |-------|-----------| | 1:1 | 1024:1024 | | 3:4 | 768:1024 | | 4:3 | 1024:768 | | 9:16 | 720:1280 | | 16:9 | 1280:720 | 图生图时若不传分辨率，模型将从 37 种预设尺寸中自动选择。 --- ## Available Scripts - `hunyuan3-text-to-image.py` — 文生图（支持可选参考图实现图生图），使用混元生图 3.0 --- ## Setting Up 首次使用时，进入目录并安装依赖： ```bash cd ~/.claude/skills/huny-img python3 -m venv ~/.pyenv/versions/py312-huny-img source ~/.pyenv/versions/py312-huny-img/bin/activate pip install python-dotenv cp .env.example .env # 编辑 .env，填入 TENCENTCLOUD_SECRET_ID 和 TENCENTCLOUD_SECRET_KEY ``` 后续执行脚本时，优先用： ```bash ~/.pyenv/versions/py312-huny-img/bin/python ./scripts/hunyuan3-text-to-image.py ... ``` 若 venv 不存在，可直接用系统 python3（脚本仅依赖标准库 + python-dotenv）： ```bash pip install python-dotenv --break-system-packages python3 ./scripts/hunyuan3-text-to-image.py ... ``` --- ## Usage Examples **文生图（默认 1:1）** ```bash ~/.pyenv/versions/py312-huny-img/bin/python "./scripts/hunyuan3-text-to-image.py" \ -p "雨中竹林小路，水墨风格" ``` **指定比例** ```bash ~/.pyenv/versions/py312-huny-img/bin/python "./scripts/hunyuan3-text-to-image.py" \ -p "夕阳下的城市天际线，摄影风格" \ -r 16:9 ``` **指定像素尺寸 + 关闭 prompt 改写** ```bash ~/.pyenv/versions/py312-huny-img/bin/python "./scripts/hunyuan3-text-to-image.py" \ -p "可爱的柴犬在草地上奔跑" \ -r 768:1024 \ --no-revise ``` **图生图（提供参考图 URL）** ```bash ~/.pyenv/versions/py312-huny-img/bin/python "./scripts/hunyuan3-text-to-image.py" \ -p "参考图的风格，生成一幅秋日枫林场景" \ --images "http://example.com/ref1.jpg" "http://example.com/ref2.jpg" ``` **固定随机种子（复现结果）** ```bash ~/.pyenv/versions/py312-huny-img/bin/python "./scripts/hunyuan3-text-to-image.py" \ -p "星空下的雪山" \ --seed 42 ``` --- ## Script Arguments | 参数 | 简写 | 说明 | 默认值 | |------|------|------|--------| | `--prompt` | `-p` | 文本描述提示词 | 示例花店 | | `--resolution` | `-r` | 分辨率（比例或像素，如 `16:9` 或 `1024:768`） | `1024:1024` | | `--seed` | — | 随机种子（正整数） | 随机 | | `--logo` | — | 添加水印：0=否，1=是 | `0` | | `--no-revise` | — | 关闭 prompt 改写（开启改写约增加 20s） | 默认开启 | | `--images` | — | 参考图 URL 列表（最多 3 张） | 无 | | `--poll-interval` | — | 轮询间隔秒数 | `5` | | `--timeout` | — | 最长等待秒数 | `300` | --- ## Requirements - Python 3.8+ - `python-dotenv`（其余全为标准库，无需安装 tencentcloud SDK） - 腾讯云账号，已开通「腾讯混元生图」服务 - 在 `.env` 中配置： - `TENCENTCLOUD_SECRET_ID` - `TENCENTCLOUD_SECRET_KEY` - `TENCENTCLOUD_REGION`（可选，默认 `ap-guangzhou`）


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: hahaerer/auto-chatlog (version 1.0.0)

--- name: auto-chatlog version: 1.0.0 description: "自动对话记忆归档 — 每次会话结束时自动将关键信息写入 daily memory 文件，启动时自动加载近期记忆上下文。用于：需要记住跨会话对话内容、自动做对话笔记、无需手动提醒即可回溯之前聊过什么。与 MEMORY.md + memory/YYYY-MM-DD.md 机制配合使用，确保不遗漏任何重要信息。触发词：自动记忆、记住对话、长期记忆、聊天记录自动保存、不用查日子、记忆备份。" --- # Conversation Memory — 自动对话记忆 🐟 ## 核心流程 这个技能的核心是 **两条规则**，不需要额外命令： ### 规则 1：每次回复前 → 加载近期记忆 每次主人说话时，自动读取最近 3 天的 `memory/` 文件，以及 `MEMORY.md`。这样不用主人说"你看我昨天说过什么"，自然就已经知道了。 ```yaml 每次用户消息来时: 1. 扫描 memory/ 目录，读取最近 3 个工作日文件 2. 读取 MEMORY.md（长期记忆） 3. 如果今天是新的一天（当前 memory/YYYY-MM-DD.md 不存在）: - 自动创建当日记忆文件，页首写明日期 ``` ### 规则 2：每次对话关键节点 → 写记忆 在以下时机自动写入记忆： | 时机 | 写什么 | 写到哪里 | |------|--------|----------| | 主人表达了偏好/意见 | 记下偏好 | MEMORY.md + 当日文件 | | 完成了重要任务 | 任务结果、输出路径 | 当日文件 | | 主人给了凭证/配置 | 凭证信息（注意安全） | MEMORY.md（凭证单独标注） | | 改变了配置 | 变更内容 | 当日文件 | | 记录了待办事项 | 待办列表 | 当日文件 | | 会话结束时 | 今日关键摘要 | 当日文件末尾 | ### 写入格式 沿用已有的格式： ```markdown # YYYY-MM-DD - 描述性标题 🐟 ## 关键对话记录 - 主题 X：... - 主题 Y：... ## 重要决定/偏好 - 主人喜欢... ## 待办 - [ ] 事项 ``` ### 更新 MEMORY.md 的时机 - 主人的长期偏好改变时（直接编辑 MEMORY.md 对应章节） - 新增凭证明细时（加到凭证信息章节） - 每周至少回顾一次 daily files，浓缩进 MEMORY.md ## 脚本辅助 ### `scripts/memory_snapshot.js` 当需要手动固化当前会话状态时，调用此脚本： ```bash node scripts/memory_snapshot.js ``` 它会： 1. 抓取当前 session 的关键信息（通过读取最近的 memory 文件） 2. 生成一份结构化的记忆快照 3. 如果今天是新的一天，自动创建当日文件 使用方法：在认为需要"记住此刻"时手动触发，或由 crontab 定时调用。 ## 注意事项 - **不要记录敏感凭证的明文**（密码、token 值）到 memory 文件——已在 MEMORY.md 中的例外 - **每日文件是原始笔记**，MEMORY.md 是精华浓缩，两者并存 - 如果多个会话同时在跑，用 `memory/YYYY-MM-DD.md` 作为共享日记本，不要重复写 - 这个技能不是给主人用的，是给"我"（草鱼）用的——我按这套规则自动做事


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: 52yuanchangxing/collab-offer-polisher (version 1.0.0)

--- name: collab-offer-polisher description: 把合作邀约、商务私信、品牌合作需求和合作条款草稿，改写成更专业、更容易推进合作的版本。 metadata: {"openclaw":{"emoji":"🤝","requires":{"bins":["node","pbpaste"]}}} --- # Collab Offer Polisher 这是一个合作邀约与商务沟通优化 skill。 ## 主要用途 适用于： - 品牌合作邀约 - 场地方合作 - 摄影合作 - 达人邀约 - 甲乙方初次接洽 - 商务私信 - 简版合作方案 - 活动合作说明 ## 调用方式 当用户说： - 读取剪贴板并帮我润色合作邀约 - 帮我把这段商务私信改专业一点 - 用更容易成交的方式重写这段合作话术 - 帮我做一个更有礼貌但更清晰的合作文案 你应运行： ```bash node {baseDir}/scripts/read_clipboard.mjs


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: clean (LOW)