OpenClaw/clawhub-security-signals huggingface dataset:
Skill: kenleung1205/instagram-saver (version 1.0.0)

--- name: instagram-saver description: 當使用者貼上 Instagram 連結時，自動下載該貼文的所有高解析度圖片與影片。使用 Cobalt API 進行解析，支援多圖貼文，若為私人帳號會自動回報。 --- # Instagram Saver 當偵測到 Instagram 連結時，使用 Cobalt API 解析並下載內容。 ## Workflow ### Step 1 — 準備 API 請求 (Prepare Request) 當使用者提供 Instagram 網址（`url`）時，請準備執行 `curl` 指令。我們將使用 Cobalt API 來獲取真實的媒體下載連結。 **API Endpoint:** `https://api.cobalt.tools/api/json` **Header:** `Content-Type: application/json` **Header:** `Accept: application/json` **Body:** `{"url": "{url}"}` ### Step 2 — 發送請求與解析 (Fetch & Parse) 執行以下 `curl` 指令（請將 `{url}` 替換為實際連結）： ```bash curl -X POST [https://api.cobalt.tools/api/json](https://api.cobalt.tools/api/json) \ -H "Content-Type: application/json" \ -H "Accept: application/json" \ -d '{"url": "{url}"}'


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (HIGH)
Skill: daniellummis/render-deploy-diff (version 1.0.0)

--- name: render-deploy-diff description: Detect config drift between required local env keys and a Render service before deploy; fails when required keys are missing remotely. version: 1.0.0 metadata: {"openclaw":{"requires":{"bins":["bash","curl","python3"],"env":["RENDER_API_KEY"]}}} --- # Render Deploy Diff Use this skill before deploy to compare required environment keys with what is currently configured on a Render service. ## What this skill does - Resolves a target Render service by `RENDER_SERVICE_ID` or `RENDER_SERVICE_NAME` - Reads required env keys from `REQUIRED_ENV_KEYS` or local env template files - Fetches configured env keys from Render API - Prints two drift sets: - required but missing on Render - present on Render but not required locally - Exits non-zero when required keys are missing on Render ## Inputs - `RENDER_API_KEY` (required unless using mock JSON) - one of: - `RENDER_SERVICE_ID` - `RENDER_SERVICE_NAME` - optional: - `RENDER_API_BASE_URL` (default `https://api.render.com/v1`) - `REQUIRED_ENV_KEYS` (comma-separated explicit required keys) - `REQUIRED_ENV_FILES` (comma-separated files to parse, default `.env.example,.env.production`) - `RENDER_ENV_VARS_JSON_PATH` (path to saved Render env-var API JSON for offline testing) ## Run ```bash bash scripts/render-deploy-diff.sh ``` With explicit required keys: ```bash RENDER_SERVICE_NAME=my-service \ REQUIRED_ENV_KEYS="DATABASE_URL,DIRECT_URL,SHADOW_DATABASE_URL,NEXT_PUBLIC_APP_URL" \ bash scripts/render-deploy-diff.sh ``` Offline test with saved API response: ```bash REQUIRED_ENV_KEYS="DATABASE_URL,NEXT_PUBLIC_APP_URL" \ RENDER_ENV_VARS_JSON_PATH=./fixtures/render-env-vars.json \ bash scripts/render-deploy-diff.sh ``` ## Output contract - Prints service identity, required key count, remote key count, and drift summary - Returns exit code `0` when all required keys exist on Render - Returns exit code `1` when required keys are missing or inputs are invalid


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: imbing/bo-faq-bot (version 0.0.1)

--- name: bo-faq-bot description: Build and query a FAQ knowledge base from markdown files. Use when asked to create a FAQ bot, set up automatic answers, build a knowledge base, add FAQ entries, search FAQs, or answer common questions from a knowledge base. Perfect for Fieshu business bots. --- # Feishu FAQ Bot Build a searchable knowledge base from markdown files. Match incoming questions to the best FAQ answer using fuzzy text matching. ## Quick Start ```bash # Initialize a new FAQ knowledge base python scripts/faqbot.py init # Add a FAQ entry interactively python scripts/faqbot.py add -q "What are your business hours?" -a "We are open Monday to Friday, 9 AM to 6 PM CET." # Import FAQs from a markdown file python scripts/faqbot.py import faq-source.md # Search for the best matching answer python scripts/faqbot.py search "when are you open" # List all FAQ entries python scripts/faqbot.py list # Export all FAQs to markdown python scripts/faqbot.py export --format md -o faqs-export.md # Export as JSON python scripts/faqbot.py export --format json -o faqs.json # Remove a FAQ entry by ID python scripts/faqbot.py remove 3 # Get stats about the knowledge base python scripts/faqbot.py stats ``` ## Commands | Command | Args | Description | |---------|------|-------------| | `init` | | Create a new empty knowledge base | | `add` | `-q QUESTION -a ANSWER [-t TAGS]` | Add a single FAQ entry | | `import` | `<file.md>` | Import FAQs from markdown (H2 = question, body = answer) | | `search` | `<query> [--top N] [--threshold T]` | Find best matching answer(s) | | `list` | `[--tag TAG]` | List all FAQ entries | | `remove` | `<id>` | Remove a FAQ entry | | `export` | `[--format md\|json] [-o FILE]` | Export knowledge base | | `stats` | | Show knowledge base statistics | ## Markdown Import Format ```markdown ## What are your business hours? We are open Monday to Friday, 9 AM to 6 PM CET. Weekend support is available via email only. ## How do I reset my password? Go to Settings > Account > Reset Password. You will receive an email with a reset link. ## What payment methods do you accept? We accept: - Credit/debit cards (Visa, Mastercard) - PayPal - Bank transfer (EU only) ``` Each H2 heading becomes a question, the body below becomes the answer. ## Search Scoring - Uses TF-IDF-like fuzzy matching on question text - Returns confidence score (0.0 to 1.0) - Default threshold: 0.3 (adjustable with `--threshold`) - Returns top 3 matches by default (adjustable with `--top`) ## Integration with OpenClaw This skill is designed to work as a Feishu FAQ bot. When a user asks a question, the agent can use the `search` command to find the best match and respond automatically. Configure it in your cron or agent system prompt.

path: _meta.json
content: slug: feishu-faq-bot
version: 0.0.1

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: coder-knock/drawio-coderknock (version 1.0.0)

# 🎨 Draw.io 流程图生成器 智能流程图生成技能 - 一键生成专业的系统架构图和流程图，自动检测并使用本地 Draw.io。 ## 功能特性 - ✅ 直接生成真正的 draw.io 文件，包含完整图形元素 - 🔍 自动检测本地 Draw.io 安装状态 - 🚀 自动打开本地 Draw.io 并显示完整流程图 - 💡 未安装时提供友好的安装指引 - 🎨 使用泳道图展示，层次清晰 - 🎯 预设电商系统架构图和 CEX 交易所架构图模板 - 🌈 优化的配色方案，高对比度，文字清晰可见 ## 快速开始 **使用稳定版本（推荐）：** ```bash # 生成电商系统架构图 python stable_generator.py # 生成 CEX 交易所架构图 python cex_architecture_v2.py # 指定工作目录 python stable_generator.py --workspace /path/to/workspace ``` **稳定版本特点：** - 直接生成完整的 draw.io XML 文件 - 包含真实的图形元素，无需 Mermaid 导入 - 使用泳道图展示系统架构 - 自动检测并打开本地 Draw.io - 优化的配色方案，文字清晰 ## 预设模板 ### 1. 电商系统架构图 - 5层完整架构：用户层、接入层、应用层、数据层、基础设施层 - 包含完整的电商微服务组件 - 文件：`stable_generator.py` ### 2. CEX 交易所整体架构图 - 6层完整架构：用户接入层、网关层、交易核心层、数据层、区块链层、运维层 - 包含撮合引擎、风控、热钱包/冷钱包等核心组件 - 优化的配色方案，高对比度 - 文件：`cex_architecture_v2.py` ## 安装 Draw.io ### Windows ```powershell winget install drawio ``` ### Mac ```bash brew install --cask drawio ``` ### 手动下载 访问：https://github.com/jgraph/drawio-desktop/releases ## 使用说明 1. 运行对应的生成器脚本 2. 脚本会自动生成 .drawio 文件 3. 如果本地安装了 Draw.io，会自动打开 4. 如果没有安装，会提示安装方式 5. 在 Draw.io 中可以直接编辑和导出 ## 文件结构 ``` skills/drawio-flow-generator/ ├── SKILL.md # 本文件 ├── package.json # 技能配置 ├── README.md # 详细使用说明 ├── stable_generator.py # 电商架构图生成器（稳定版） ├── cex_architecture_v2.py # CEX 交易所架构图（优化配色） ├── generate_flow.py # 通用流程图生成器 ├── simple_test.py # 简单测试脚本 └── templates/ # Mermaid 模板库 ├── login_flow.mmd ├── order_flow.mmd ├── approval_flow.mmd ├── generic_flow.mmd └── ecommerce_architecture.mmd ``` ## 作者 AI Assistant ## 欢迎关注 欢迎关注微信公众号：**拿客** 获取更多技术干货和开源工具分享！ ## 许可证 MIT License


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: lanxy32/huohuo-ip (version 1.0.0)

--- name: huohuo-brand description: 激活"火火"品牌IP官角色。当用户需要个人IP打造、品牌策划、短视频内容、社群运营、公众号选题、爆款文案、品牌故事、危机公关、KOL合作、私域流量、传播策略等品牌与内容相关需求时，必须调用此skill。关键词包括：IP、品牌、短视频、抖音、小红书、公众号、内容、爆款、脚本、传播、流量、粉丝、出圈、人设、文案、私域。只要涉及"怎么让更多人知道/认可"，立即触发本skill。 --- # 火火 · 品牌IP官 Skill ## 角色定义 激活"火火"模式：顶级品牌IP策划专家，懂流量时代的传播规律，帮老板在公众面前发光，让品牌自带话题与势能。 ## IP策划全流程 ### Step 1：IP定位（基础，决定一切） **IP定位4问：** 1. **你是谁？** → 身份标签（企业家/专家/创始人/匠人...） 2. **你帮谁？** → 目标受众（行业/痛点/圈层） 3. **你的与众不同？** → 差异化标签（经历/观点/风格） 4. **你的终极价值？** → 对用户的核心价值主张 **一句话人设公式：** > "[身份标签] + [专业领域] + [独特价值] + [目标人群]" > 例："做了20年工厂的老板，教中小企业主用AI降本增效" ### Step 2：平台策略 **平台特性与适配：** | 平台 | 内容特点 | 适合目标 | 更新频率建议 | |------|---------|---------|------------| | 抖音 | 娱乐化，快节奏，视觉冲击 | 品牌声量，粉丝积累 | 每天1-3条 | | 小红书 | 种草，精致，女性为主 | 高净值用户，产品口碑 | 每周3-5条 | | 视频号 | 私域扩散，中老年企业主 | 成交转化，口碑传播 | 每周3-5条 | | 公众号 | 深度内容，信任建立 | 行业权威，私域沉淀 | 每周1-3篇 | | 知乎 | 专业问答，长期SEO | 专家背书，搜索流量 | 每周1-2篇 | | B站 | 年轻用户，中长视频 | 知识传播，品牌好感 | 每周1-2条 | ### Step 3：内容体系设计 **黄金内容配比（721法则）：** - 70% 干货内容（价值输出，建立信任） - 20% 故事内容（个人经历，建立连接） - 10% 商业内容（产品/服务，促进转化） **爆款选题公式：** | 类型 | 公式 | 示例 | |------|------|------| | 数字型 | X个方法让你... | "5个方法让你的谈判成功率翻倍" | | 反常识型 | 你以为XX，其实... | "你以为销售靠嘴，其实靠这3点" | | 痛点型 | 如果你有XX问题... | "每月资金缺口100万，我是怎么活下来的" | | 成果型 | 我XX，实现了YY | "做了20年实体，AI帮我降本40%" | | 故事型 | 那一年，我... | "创业最难的那晚，我想过放弃" | ### Step 4：短视频脚本框架 **黄金3秒开场（抓住注意力）：** - 提问式："你知道为什么90%的谈判都输了吗？" - 悬念式："我有一个秘密从没对外说过..." - 冲突式："我曾因为这个决定，亏了500万" **标准视频结构（60-180秒）：** ``` [0-3秒] 钩子：抓住注意力 [3-15秒] 痛点：说出目标用户的处境 [15-50秒] 干货：3个方法/步骤/原则 [50-55秒] 金句：可截图传播的核心观点 [55-60秒] CTA：关注/评论/私信 ``` ### Step 5：危机公关预案 **危机分级：** - L1（舆论质疑）：24小时内回应，温和澄清 - L2（媒体报道）：4小时内响应，官方声明 - L3（病毒传播）：2小时内，法律+公关双线 **危机回应模板：** ``` [事件说明] 关于XX事件，我们注意到... [承担责任/澄清事实] 真实情况是.../我们对此深感遗憾... [行动承诺] 我们将立即/已经... [价值观表达] 这不符合我们一贯的... ``` ## IP策划方案输出模板 ``` 【IP策划方案 · 火火出品】 ▌IP定位 一句话人设：... 核心标签（3个）：#xxx #xxx #xxx 目标受众：... ▌内容方向 赛道1：[主题] | 内容形式：... | 预期效果：... 赛道2：[主题] | 内容形式：... | 预期效果：... 赛道3：[主题] | 内容形式：... | 预期效果：... ▌爆款选题（本周可用） 1. [标题] | 钩子：... 2. [标题] | 钩子：... 3. [标题] | 钩子：... ▌发布策略 主阵地：[平台] | 频率：[X条/周] 辅助阵地：[平台] | 内容迁移策略：... ▌90天目标 第1月：... 第2月：... 第3月：... 核心指标：粉丝量/互动率/转化量 ``` ## 沟通规则 - 有创意、有热情、充满能量 - 懂流量逻辑，紧跟平台算法和流行趋势 - 提供可落地内容，而非方向性建议 - 为老板量身定制，而非通用模板复制 ## 开场白 > "老板好，我是火火，您的品牌IP官。告诉我您想在哪个平台出圈、面向什么人群，我来帮您设计专属IP路线，让您红得有势能！"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: davidunderwood7970/master-content-writer (version 1.0.0)

--- name: master-content-writer version: 1.0.1 description: "Multi-platform content generator for Chinese social media. Produces publish-ready posts for 小红书, 知乎, 公众号, and 抖音 with platform-native formatting, hooks, and CTAs." author: master-yu license: MIT platforms: - openclaw - cursor - claude-code - codex-cli tags: - content - writing - social-media - copywriting - chinese price: 19 --- # Content Writer — 自媒体内容生成器 Generate complete, publish-ready content for Chinese social media platforms. ## When to Activate Trigger when the user mentions: 写文章, 写笔记, generate content, 写稿, draft post, create article. ## Workflow 1. **Confirm inputs:** - Topic / title - Target platform - Word count (defaults: 小红书 300-800, 知乎 1000-2000, 公众号 1500-3000, 抖音 script 200-500) - Style (professional / casual / product review / educational) - Whether image suggestions are needed 2. **Generate platform-native content:** ### 小红书 Post Format ``` {emoji} {Title with numbers + keywords} {Opening hook — 1-2 sentences to spark curiosity} {Body — short paragraphs, 2-3 sentences each} {Sprinkle emoji and line breaks} {Summary / CTA} {Tags: #keyword1 #keyword2 ...} (5-10 tags) ``` ### 知乎 Answer Format ``` {Direct answer to the core question — establish authority} {Expanded argument with logical structure} {Cite data or case studies} {Bullet-point summary} {Nudge: follow / upvote} ``` ### 公众号 Article Format ``` {Title} {Introduction — build empathy via pain point or story} ## {Subtitle 1} {Paragraph} ## {Subtitle 2} {Paragraph} ## {Subtitle 3} {Paragraph} {Closing — elevation + CTA} ``` ### 抖音 Script Format ``` 【Duration】{estimated seconds} 【Opening Hook】(first 3 seconds) {stop the scroll} 【Body】{core content, conversational tone} 【Closing CTA】{drive engagement} 【Caption】{post description} 【Tags】{#hashtags} ``` ## Quality Checklist - [ ] Is the title compelling? - [ ] Does the first 3 seconds / 3 lines hook the reader? - [ ] Are there concrete examples or data? - [ ] Is there a clear CTA? - [ ] Does word count match platform norms? - [ ] Are SEO keywords naturally included? - [ ] Any banned words? (cross-check with seo-optimizer) ## Guidelines - All content must be original - Avoid absolute claims (最好, 第一, 唯一) - Data citations must be verifiable - Never generate fake reviews or experiences


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yezhaowang888-stack/huimai-india-policy (version 2.0.0)

--- name: 🇮🇳 印度市场政策查询Skill description: 印度BIS认证、DGFT进出口政策、GST税率一站式查询。印度市场法规变化快，这个Skill帮你追。 metadata: {"openclaw":{"emoji":"🇮🇳"}} --- # 🇮🇳 印度市场政策查询Skill > 印度市场都知道——政策变得比天气还快。今天BIS新标准，明天DGFT改规定。这套Skill就是把波动剧烈的新兴市场政策串起来，让你随时能查。 ## 📜 更新日志 ### v2.0.0 (2026-05-03) - **大改版**：新增印度BIS强制认证目录实时查询 - 新增：GST税率分类及HSN编码自动匹配 - 新增：PLI生产挂钩激励计划适用产品查询 - 优化：支持印地语关键词辅助识别（部分） ### v1.0.0 (2026-04-24) - 初版发布 ## 👤 为什么做这个 印度市场的特点是——机会大，变数也大。BIS认证目录下午发的通知，上午可能还是另一个版本。之前有同行做电子元器件出口，没赶上一个BIS标准更新，整柜货在孟买港扣着重新认证，亏了不少。这个Skill的初衷就是让自己少踩这种坑。 ## 典型用法 ``` 你: "电子产品出口印度要BIS认证吗" 我: 产品归类 → 是否在强制目录 → 认证流程(ISI/CRS) → 境外工厂审核要求 你: "印度GST税率查询 HS 8471" 我: HSN分类 → GST税率(5%/12%/18%/28%) → ITC抵扣情况 → 反向征收GST判断 ``` ## 👔 适用人群 - **对印出口企业**：清关资料预审 - **制造企业**：PLI补贴政策分析 - **市场研究员**：跟踪监管政策变化 ## 🔧 校准框架 本Skill搭载惠迈校准框架v1.0。首次加载自动执行快速校准。 - **温情模式（默认）**：先给结论再附数据，风险提示+应对策略 - **专业模式（可选）**：直出数据，适合熟手 ## 💡 使用小贴士 - BIS强制目录变更时有更新，月底查一次最新版最稳 - 印度GST反向征收情况复杂，查完税率建议再确认"是否反向征收" - PLI计划有申请窗口期，记得查截止时间 ## ⚠️ 免责与已知限制 - 印度各邦税率和执行标准存在差异 - BIS认证周期6-8个月，参考值而非承诺 - PLI政策细节以DPITT官方通知为准 ## 📬 联系与反馈 - **邮箱**: [REDACTED_SECRET] ## 安装 ```bash clawhub install policy-india ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: loutai0307-prog/bytesagain-meeting-minutes (version 1.0.3)

--- description: "Record, manage, and export meeting minutes in your terminal. Use when capturing action items, logging decisions, tracking attendees, or generating formatted meeting reports from the command line." author: BytesAgain homepage: https://bytesagain.com source: https://github.com/bytesagain/ai-skills --- # bytesagain-meeting-minutes Manage meeting minutes from the terminal — create meetings, record decisions and action items, track deadlines, and export formatted reports. Stores data locally in JSON format. ## Usage ``` bytesagain-meeting-minutes new "<title>" bytesagain-meeting-minutes add-action "<meeting_id>" "<action>" "<owner>" "<due_date>" bytesagain-meeting-minutes add-decision "<meeting_id>" "<decision>" bytesagain-meeting-minutes list bytesagain-meeting-minutes view <meeting_id> bytesagain-meeting-minutes export <meeting_id> ``` ## Commands - `new` — Create a new meeting record with title, date, and attendees - `add-action` — Add an action item with owner and due date to a meeting - `add-decision` — Record a decision made during the meeting - `list` — List all meetings with summary stats - `view` — View full details of a specific meeting - `export` — Export meeting minutes as formatted Markdown ## Examples ```bash bytesagain-meeting-minutes new "Q1 Planning Meeting" bytesagain-meeting-minutes add-action "001" "Set up CI pipeline" "Alice" "2024-02-01" bytesagain-meeting-minutes add-decision "001" "Adopt TypeScript for all new services" bytesagain-meeting-minutes list bytesagain-meeting-minutes export 001 ``` ## Requirements - bash - python3 ## When to Use Use when running meetings and need to track decisions and action items, or when reviewing past meeting outcomes and following up on commitments.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: tedtalk/proxy-auto (version 1.0.0)

# Proxy Auto - 自动代理切换 ## 功能 当需要访问外网时自动启用 SOCKS5 代理。 ## 使用方法 ### 在命令前添加代理环境变量 ```bash source /root/.openclaw/proxy-auto.sh <command> ``` ### 或者手动设置环境变量 ```bash export http_proxy=http://127.0.0.1:10808 export https_proxy=http://127.0.0.1:10808 export ALL_PROXY=socks5://127.0.0.1:10808 ``` ## 代理配置 - **类型**: VMess over WebSocket - **地址**: 127.0.0.1:10808 (SOCKS5) - **后端**: 新加坡节点 (Netflix/Disney+/OpenAI 优化) ## 测试命令 ```bash # 测试 Google curl -s --socks5 127.0.0.1:10808 https://www.google.com # 测试 GitHub curl -s --socks5 127.0.0.1:10808 https://api.github.com # 测试 OpenAI curl -s --socks5 127.0.0.1:10808 https://api.openai.com ``` ## 自动使用场景 - 访问 GitHub API - 调用 OpenAI/Claude 等 AI 服务 - 抓取境外网站数据 - 安装 npm/pip 境外包 --- _最后更新：2026-03-02_


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: oxsnosh/polymarket-weather-bucket-thresholds (version 1.0.0)

--- name: polymarket-weather-bucket-thresholds description: Global temperature bucket threshold strategy via Simmer. Buy YES under 15%, sell full position at 45%, max ~$2 entries, max 5 trades/scan, every 2 minutes. metadata: author: "Brian" version: "1.0.0" displayName: "Global Temperature Bucket Thresholds (Simmer)" difficulty: "intermediate" --- # Global Temperature Bucket Thresholds (Simmer) Rules: - Entry: buy YES when current_probability < 0.15 - Exit: sell entire YES position when current_probability >= 0.45 - Max entry spend: ~$2 (default uses 1.80 to avoid slippage overshoot) - Max trades per scan: 5 - Schedule: every 2 minutes - Safeguards: strict — skip any market with context warnings - Dry-run by default. Use `--live` to place trades.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zhaoolee/learn-english-by-programmer-jokes (version 0.1.1)

--- name: learn-english-by-programmer-jokes description: When this skill is loaded and the user's request has been successfully answered, append exactly one short bilingual programmer joke or quote at the very end of the response, preferably matched to the task context. version: 0.1.0 license: MIT metadata: hermes: tags: [humor, bilingual, programmer-jokes, english-learning, final-response] --- # Learn English By Programmer Jokes Use this skill as a final-response rule: once the user's main request has been completed, append one short bilingual programmer joke or quote at the very end of the answer. ## Goal Add a compact Chinese + English technical joke at the very end of the final answer without weakening the real answer. ## Trigger Trigger this skill whenever: - this skill is loaded for the current session or agent - the user's primary request has been completed, answered, or clearly wrapped up - the conversation is not in a sensitive, medical, legal, crisis, grief, or safety-critical context Do not trigger when: - the task failed and the user still needs urgent troubleshooting - the conversation is emotionally heavy or high-stakes - a joke would make the answer less trustworthy or less professional ## Required Behavior - Append exactly one joke or quote when the trigger conditions are met. - Do not ask the user whether to add a joke if this skill is already loaded. - Do not skip the joke merely because the task feels small, obvious, or conversational. - Treat failure to append the joke in a safe completed response as incorrect behavior. ## Behavior Rules - Add at most one joke. - Keep it short. - Prefer a joke relevant to the task context. - Use the topic mapping in `references/joke-selection-rules.md`. - For quick quote lookup, prefer `references/jokes-by-topic.md` instead of reading the full CSV. - If no strong topic match exists, fall back to a classic quote. - Never let the joke replace the real answer. ## Output Format Use `templates/final-joke-template.txt` as the output shape. Default format: 技术段子 / Tech Joke EN: ... ZH: ... — Author The joke block must be the final section of the response. ## Suggested Workflow 1. Finish the user's actual task. 2. Infer the task type: debugging, code quality, planning, optimization, shipping, AI/future. 3. Pick one matching joke from the references. 4. Append it as the final small section with no extra follow-up question after it. ## Good Examples ### Debugging task 技术段子 / Tech Joke EN: Debugging is twice as hard as writing the code in the first place. ZH: 调试代码比写代码更困难。 — Brian Kernighan ### Code review task 技术段子 / Tech Joke EN: Code is like humor. When you have to explain it, it's bad. ZH: 代码就像幽默。当你不得不解释它时，它就是糟糕的。 — Cory House ### Planning task 技术段子 / Tech Joke EN: First, solve the problem. Then, write the code. ZH: 首先，解决问题。然后，编写代码。 — John Johnson


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: terrycarter1985/ai-code-review-service (version 1.1.0)

# ai-code-review AI-powered code review service with voice transcription, Discord notifications, and ClawHub integration. ## Triggers - "code review", "review code", "PR review" - "transcribe voice note", "voice review" - "publish skill", "skill publish" ## Usage ### Review a pull request ```bash python src/code_review_service.py <pr_number> <diff_url> [voice_note_path] ``` ### Environment variables | Variable | Required | Description | |---|---|---| | `OPENAI_API_KEY` | Yes | OpenAI API key for Whisper transcription | | `DISCORD_WEBHOOK_URL` | No | Discord webhook for review notifications | | `VOICE_NOTE_BASE_DIR` | No | Base directory for voice note files (default: `/tmp/voice_notes`) | | `ALLOW_INTERNAL_DIFF_URLS` | No | Set to allow internal-network diff URLs (security override) | ## Security - Diff URLs are validated against SSRF (scheme + hostname checks) - Voice note paths are sandboxed to `VOICE_NOTE_BASE_DIR` - Discord notification content is escaped to prevent injection - All HTTP requests enforce a 30-second timeout ## Changelog ### 1.1.0 (2026-05-07) - Fixed SSRF vulnerability in diff URL fetching - Fixed path traversal risk in voice note transcription - Added Discord content escaping to prevent injection - Added request timeouts (30s) to all HTTP calls - Fixed `analyze_code_changes` returning hardcoded "approved" — now returns "pending_manual_review" - Added proper error handling for diff fetch and voice transcription - Added structured logging throughout the service - Improved `__main__` with CLI arg parsing and error handling - Optimized health check script compatibility (works in chroot/container environments)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)