OpenClaw/clawhub-security-signals huggingface dataset:
Skill: vincentlau2046-sudo/source-to-architecture (version 1.0.0)

# 源码到架构 (Source to Architecture) 从代码/模块 → 模块关系 → 组件架构 → 部署架构的全链路可视化、可追溯、可版本化技能。 ## 技能核心能力 - 五层DrawIO架构模板（优化版） ### 接入层 (浅蓝色 #ADD8E6) **物理组件**: API Gateway、Client、Web前端、移动App **逻辑组件**: 用户入口、外部接口、协议转换 **输出**: 接入层架构图、外部接口清单 ### 路由/控制层 (浅绿色 #90EE90) **物理组件**: Controller、Service、Manager、路由组件 **逻辑组件**: 业务协调、流程控制、权限验证 **输出**: 控制层拓扑图、服务协调流程图 ### 逻辑层 (浅黄色 #FFFFE0) **物理组件**: Core模块、Logic处理器、Executor执行器 **逻辑组件**: 核心业务规则、领域逻辑、算法实现 **输出**: 逻辑层架构图、业务规则映射表 ### 数据访问层 (浅紫色 #E6E6FA) **物理组件**: DAO、Repository、Cache、数据适配器 **逻辑组件**: 数据抽象、查询优化、缓存策略 **输出**: 数据访问层图、数据契约清单 ### 存储/外部层 (灰色 #D3D3D3) **物理组件**: DB、MQ、Redis、第三方服务、文件存储 **逻辑组件**: 外部依赖、数据持久化、异步通信 **输出**: 存储层拓扑图、外部依赖清单 ## 🎯 优化后的排版规范（严格遵循） ### 一、整体布局规则 - **强制分层布局**: Top-to-Bottom方向（后端/微服务推荐） - **全局网格对齐**: 20px网格，所有节点严格吸附 - **同层级统一尺寸**: 高度60px，宽度120px - **固定间距**: 水平间距80px，垂直间距60px，节点间距≥60px - **模块位置**: 大组件（网关、DB）靠边缘，业务逻辑居中 ### 二、层级划分规则 - **标准五层结构**: 接入层 → 路由/控制层 → 逻辑层 → 数据访问层 → 存储/外部层 - **层间隔离**: 层与层之间用空白区域隔开，禁止跨层穿插 - **分组框约束**: 微服务一个服务一个分组框，分组框内节点不能超出边界 ### 三、节点样式规则 - **形状统一**: - 业务模块: 矩形 - 数据/存储: 圆柱体 - 外部系统: 斜角矩形 - 消息队列: 六边形 - 函数/方法: 圆角矩形 - **颜色体系固定**: - 接入层: 浅蓝 (#ADD8E6) - 路由/控制层: 浅绿 (#90EE90) - 逻辑层: 浅黄 (#FFFFE0) - 数据访问层: 浅紫 (#E6E6FA) - 存储/外部层: 灰色 (#D3D3D3) - **字体统一**: Arial 12px常规，标题14px，文字居中不换行 ### 四、连线规则 - **箭头样式**: - 数据流: 实心箭头 → - 调用: 虚线箭头 ⇢ - 依赖: 简单直线 - **正交连线**: 只允许水平/垂直，禁止斜线 - **减少交叉**: 同层连线走外侧，跨层连线走固定通道 - **标签位置**: 连线文字固定在线上方或中间 ### 五、自动美化约束 - 连线交叉数量 ≤ 5处（复杂图智能路由） - 所有文字完整可见，不被遮挡 - 分组框必须包裹完整模块 - 层与层之间必须有明显空白区 - 不允许孤立节点（除非是独立外部系统） ## 逻辑架构专属规范 - **视觉区分**: 逻辑层元素加虚线边框、虚线箭头，与物理层用灰色虚线关联标注映射 - **分层控制**: 每层新增逻辑子层，支持单独显隐 - **命名规范**: 逻辑层用业务语言命名，剔除纯技术细节 ## 标准化绘制规范 ### 统一形状库 - **矩形**: 业务模块（标名称+路径） - **圆角矩形**: 函数/方法（标名称+参数） - **圆柱体**: 数据/存储（标名称+类型） - **斜角矩形**: 外部系统（标名称+协议） - **六边形**: 消息队列（标名称+主题） - **菱形**: 决策节点 - **箭头**: 依赖（标接口名+调用协议） ### 精准标注 - **元素标识**: 唯一标识+路径+更新时间 - **连接标注**: 接口名+调用协议 ### 智能组织 - **文件结构**: 单项目单文件 - **图层管理**: Layers分层管理（物理层/逻辑层） - **场景分栏**: Tabs按场景分栏（总览/详图/时序） - **版本控制**: 支持Git版本控制和协作 ## 自动化同步机制 ### PR/Commit集成 - 自动标注变更影响模块 - 敏感模块变更告警 - 配套变更日志生成 ### 持续维护 - Git友好，.drawio文件直接纳入版本控制 - 每周自动同步代码变更 - 输出架构-代码一致性报告 ## 多场景交付 - **文档嵌入**: PNG/SVG格式（标版本+时间戳） - **评审会议**: PDF格式（带书签导航） - **团队协作**: 在线链接（权限分级管理） ## 🔧 工具链配置 ### 核心工具集成 - **代码分析**: ripgrep、tree、静态代码分析工具 - **图表生成**: draw.io CLI、Graphviz - **环境固化**: Docker容器化工具版本 - **CI/CD集成**: 支持自动化流水线集成 ### 自动化脚本 - 源码扫描脚本 - 架构图生成脚本 - 一致性验证脚本 - 同步更新脚本 ## 核心输出物清单 ### 架构图表 - 五层架构图（.drawio源文件） - 多格式导出（PNG/SVG/PDF） ### 分析清单 - 各类依赖关系清单 - 接口契约清单 - 资源映射清单 - 逻辑-物理映射表 ## 使用示例 ``` 用户: 为我的GitHub项目生成五层架构图 用户: 分析OpenClaw的接入层到存储层映射 用户: 创建微服务系统的五层架构图和限界上下文图 用户: 生成部署架构图并标注逻辑环境边界 ``` ## 工作流程 1. **源码分析**: 扫描项目目录，提取物理结构和依赖关系 2. **逻辑抽象**: 基于业务域和DDD原则创建逻辑层映射 3. **图表生成**: 按五层模板生成DrawIO架构图（严格遵循排版规范） 4. **标注完善**: 添加唯一标识、路径、接口协议等元数据 5. **多格式输出**: 生成PNG/SVG/PDF等多种交付格式 6. **同步配置**: 设置Git钩子和定期更新机制


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: catplus-eric/oil-price-reminder-china (version 1.0.0)

--- name: oil-price-reminder description: 油价智能提醒技能。自动监控国家发改委油价公告，判断近期油价涨跌趋势，在调价窗口前提早提醒用户加油。（1）未来油价将上调 → 提醒近日安排加油；（2）未来油价将下调 → 提醒等调价后再去加油。支持自定义检查频率、城市配置、状态防重复提醒。触发条件：用户提到"油价提醒"、"什么时候加油"、"油价涨了吗"、"设置油价监控"时激活。 --- # 油价智能提醒技能 > 自动抓取发改委油价公告，判断涨跌，在最佳时机提醒加油 --- ## 核心功能 - 🌿 **油价趋势分析**：抓取发改委（ndrc.gov.cn）最新公告，判断涨跌 - ⏰ **智能时机提醒**：油价涨前提醒加油，跌前提醒等一等再加油 - 🔁 **自定义频率**：支持每 N 天/每天/每周检查（默认每3天） - 🗓️ **调价窗口追踪**：自动估算下次调价日期（每10个工作日规律） - 📁 **状态防重复**：基于本地文件记录，防止同一天重复提醒 --- ## 文件结构 ``` oil-price-reminder/ ├── SKILL.md ← 本文件 └── scripts/ ├── oil_monitor.py ← 核心监控脚本（核心逻辑） └── oil_state.json ← 状态持久化（由脚本自动创建） ``` --- ## 使用方式 ### 用户配置 用户告诉 Nova 需要启用油价提醒后，Nova 会自动： 1. 创建 `memory/oil_state.json` 状态文件 2. 创建 cron job，每 3 天触发一次 3. 记录下次调价窗口时间 ### cron 表达式参考 | 频率 | 表达式（UTC） | 北京时间 | |------|------------|---------| | 每天 8:00 | `0 0 * * *` | 8:00 | | 每3天 8:00 | `0 8 */3 * *` | 16:00 | | 每周一 8:00 | `0 8 * * 1` | 16:00（周一） | ### 提醒消息模板 **涨前提醒：** ``` 🌿 【油价提醒】 预计 X 天后（YYYY-MM-DD 零点）油价将上调，建议近日安排加满油箱！ ``` **跌前提醒：** ``` 🌿 【油价提醒】 预计 X 天后（YYYY-MM-DD 零点）油价将下调，建议调价后再去加油，可节省费用！ ``` **趋势不明时：** ``` 🌿 【油价提醒】 下一轮油价调整窗口约在 YYYY-MM-DD（约X天后），届时油价可能有变动，如需加油请留意。 ``` --- ## oil_monitor.py 核心逻辑 ```python # 主要流程 1. curl https://www.ndrc.gov.cn/xwdt/xwfb/ 获取最新公告 2. 正则匹配含"油价"链接，获取公告正文 3. 判断正文关键词：上调/上涨 → trend=up；下调/下降 → trend=down 4. 估算下次调价窗口（上次调价+10个工作日） 5. 判断距调价天数： - 1~10天内 + trend=up → 发涨前提醒 - 1~10天内 + trend=down → 发跌前提醒 - 1~10天内 + trend=不明 → 发趋势不明提醒 - >10天 → NO_REMINDER 6. 写入 oil_state.json 状态文件 ``` --- ## 状态文件格式 ```json { "last_remind_date": "2026-03-27", "next_adjust_date": "2026-04-06", "trend": "up", "days_left": 9, "last_check": "2026-03-27" } ``` --- ## 依赖 - Python 3 - curl（系统自带） - cron（Gateway 内置） - message tool（推送至用户渠道） --- ## 注意事项 - 数据来源为国家发改委官网，无需 API Key - 调价窗口为估算值，实际以发改委公告为准 - 状态文件自动创建在 `/workspace/memory/oil_state.json` - 建议检查频率不要高于每天 1 次，避免对发改委服务器造成压力


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: bernhmueller/contact-map-bm (version 1.0.0)

--- name: contact-map-bm description: Generate an interactive Germany map of Odoo contacts (click markers to open the record in Odoo). metadata: {"openclaw":{"emoji":"🗺️","requires":{"env":["ODOO_URL","ODOO_DB","ODOO_USERNAME","ODOO_PASSWORD"]},"primaryEnv":"ODOO_PASSWORD","triggers":["show contacts on map","contacts map","map contacts","contact map","show my contacts on a map"]}} --- # Contact Map (contact-map-bm) This skill generates an interactive HTML map (Leaflet) with your Odoo contacts geocoded and shown as clickable markers that open the corresponding res.partner record in Odoo. Features - Reads contacts from Odoo via XML-RPC (res.partner). - Attempts to reuse coordinate fields if present (common x_*/lat/longitude fields). - Geocodes addresses via Nominatim when coordinates are missing (one request/sec respectful usage). - Produces HTML at: ${workspace}/odoo_contacts_germany_map.html - Popups include contact name, address, email, phone and a link "Open in Odoo". Requirements - Environment variables: ODOO_URL, ODOO_DB, ODOO_USERNAME, ODOO_PASSWORD (or ODOO_API_KEY). - Internet access for Nominatim geocoding (optional if your contacts have coordinates). Usage - From the skill folder: python3 scripts/generate_map.py # Generate map for Germany (default) python3 scripts/generate_map.py --city Hamburg # Generate map filtered to a city Integration - The skill declares trigger phrases so OpenClaw can surface it when you ask to see contacts on a map. If you want this to be the *default* handler for that UI action, I can enable the builtin mapping in OpenClaw config (requires confirmation). Security - Do not commit ODOO passwords or API keys. The script reads the environment first and falls back to a local .env in the skill folder if present. Files - scripts/generate_map.py — main generator script.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: romainsantoli-web/firm-advanced-security-pack (version 1.0.0)

--- name: firm-advanced-security-pack version: 1.0.0 description: > Advanced security audit pack covering secrets lifecycle, path canonicalization, exec plan freeze, hook routing, config includes, prototype pollution, safeBins profiles, and group policy defaults. 8 deep security tools. author: romainsantoli-web license: MIT metadata: openclaw: registry: ClawHub requires: - mcp-openclaw-extensions >= 3.0.0 tags: - security - advanced - audit - prototype-pollution - exec-freeze --- # firm-advanced-security-pack > ⚠️ Contenu généré par IA — validation humaine requise avant utilisation. ## Purpose Deep security auditing for OpenClaw configurations — covers external secrets lifecycle, channel path canonicalization, execution plan freeze validation, hook session routing, `$include` directive guards, prototype pollution detection, safeBins profile enforcement, and group policy default audit. ## Tools (8) | Tool | Description | Severity | |------|-------------|----------| | [REDACTED_SECRET] | External Secrets lifecycle audit | CRITICAL | | [REDACTED_SECRET] | Channel path canonicalization | CRITICAL | | [REDACTED_SECRET] | Exec plan freeze validation | CRITICAL | | [REDACTED_SECRET] | Hook session routing audit | HIGH | | `openclaw_config_include_check` | `$include` directive guards | HIGH | | `openclaw_config_prototype_check` | Prototype pollution detection | HIGH | | [REDACTED_SECRET] | safeBins profile enforcement | HIGH | | [REDACTED_SECRET] | Group policy default audit | HIGH | ## Usage ```yaml skills: - firm-advanced-security-pack # Run full advanced security audit: openclaw_secrets_lifecycle_check config_path=/path/to/config.json openclaw_config_prototype_check config_path=/path/to/config.json openclaw_safe_bins_profile_check config_path=/path/to/config.json ``` ## Requirements - `mcp-openclaw-extensions >= 3.0.0`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: smallkeyboy/91-exa-web-search-free (version 1.0.0)

--- name: exa-web-search-free description: Free AI search via Exa MCP. Web search for news/info, code search for docs/examples from GitHub/StackOverflow, company research for business intel. No API key needed. metadata: {"clawdbot":{"emoji":"🔍","requires":{"bins":["mcporter"]}}} --- # Exa Web Search (Free) Neural search for web, code, and company research. No API key required. ## Setup Verify mcporter is configured: ```bash mcporter list exa ``` If not listed: ```bash mcporter config add exa https://mcp.exa.ai/mcp ``` ## Core Tools ### web_search_exa Search web for current info, news, or facts. ```bash mcporter call 'exa.web_search_exa(query: "latest AI news 2026", numResults: 5)' ``` **Parameters:** - `query` - Search query - `numResults` (optional, default: 8) - `type` (optional) - `"auto"`, `"fast"`, or `"deep"` ### get_code_context_exa Find code examples and docs from GitHub, Stack Overflow. ```bash mcporter call 'exa.get_code_context_exa(query: "React hooks examples", tokensNum: 3000)' ``` **Parameters:** - `query` - Code/API search query - `tokensNum` (optional, default: 5000) - Range: 1000-50000 ### company_research_exa Research companies for business info and news. ```bash mcporter call 'exa.company_research_exa(companyName: "Anthropic", numResults: 3)' ``` **Parameters:** - `companyName` - Company name - `numResults` (optional, default: 5) ## Advanced Tools (Optional) Six additional tools available by updating config URL: - `web_search_advanced_exa` - Domain/date filters - `deep_search_exa` - Query expansion - `crawling_exa` - Full page extraction - `people_search_exa` - Professional profiles - `deep_researcher_start/check` - AI research agent **Enable all tools:** ```bash mcporter config add exa-full "https://mcp.exa.ai/mcp?tools=web_search_exa,web_search_advanced_exa,get_code_context_exa,deep_search_exa,crawling_exa,company_research_exa,people_search_exa,deep_researcher_start,deep_researcher_check" # Then use: mcporter call 'exa-full.deep_search_exa(query: "AI safety research")' ``` ## Tips - Web: Use `type: "fast"` for quick lookup, `"deep"` for thorough research - Code: Lower `tokensNum` (1000-2000) for focused, higher (5000+) for comprehensive - See [examples.md](references/examples.md) for more patterns ## Resources - [GitHub](https://github.com/exa-labs/exa-mcp-server) - [npm](https://www.npmjs.com/package/exa-mcp-server) - [Docs](https://exa.ai/docs)

path: _meta.json
content: ownerId: kn76ydv7mt8bj901mgc6tt3ech7zqebg
slug: exa-web-search-free
version: 1.0.1
publishedAt: 1769644357484

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: josephyb97/feishu-doc-long-content (version 1.0.0)

# feishu-doc-long-content > 飞书文档长内容写入实战经验，解决 content 超长截断问题 ## 问题背景 飞书文档工具 `feishu_doc` 的 `write` / `create` action 对单次 `content` 长度有限制（约 1KB），超出后会： - 直接返回 400 错误 - 或部分写入后截断（显示空白） ## 核心要点 ### 1. create 只是创建空白文档 ```json { "action": "create", "title": "新文档" } ``` 返回 `doc_id`，但文档内容是空的。 ### 2. 必须用 write 写入内容 ```json { "action": "write", "doc_token": "ABC123", "content": "# 标题\n内容..." } ``` ### 3. content 必须控制在 1KB 以内 经验值： - **< 800 字节**：安全写入 - **800-1500 字节**：可能失败 - **> 1500 字节**：基本失败 ### 4. 长内容解决方案 **方案A：拆分章节** 将内容拆成多个小文档，每个 < 800 字节： ``` 文档1：第1-2章 文档2：第3-4章 文档3：第5-6章 文档4：第7-8章 ``` **方案B：多次 append** 创建文档后，分多次 append（但 append 也有累积限制） **方案C：先存本地文件** 将内容写入本地 md 文件，让用户自己查看或转换 ## 正确流程 ```json // 1. 创建文档 { "action": "create", "title": "笔记 Ch1" } // → { "doc_id": "ABC123", "url": "..." } // 2. 写入内容（控制 < 800 字节） { "action": "write", "doc_token": "ABC123", "content": "精简版内容..." } // 3. 验证 { "action": "read", "doc_token": "ABC123" } ``` ## 常见错误 | 错误表现 | 原因 | 解决方案 | |---------|------|---------| | 文档创建后空白 | create 后没写 content | 用 write 写入 | | write 返回成功但内容截断 | content 超过 1KB | 拆分内容 | | write 返回 400 错误 | content 过长 | 精简内容或拆分 | ## 判断内容长度 在写入前估算： - 纯文本：约 1 字符 = 1 字节 - Markdown：约 1 字符 = 1 字节（含格式符） - 经验：800 字符约等于 800 字节（中文英文混合时略大） ## 最佳实践 1. **先在本地写 md 文件**，确认内容完整 2. **写入飞书前精简**，移除冗余格式和重复内容 3. **分章节输出**，每章一个文档 4. **写入后立即验证**，用 read 检查 block_count --- *经验来源：2026-02-25 初级会计实务笔记输出实战*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: greapi/choice-emquantcli-skill (version 0.1.1)

--- name: emq-cli description: 使用 emq-cli 命令行进行安装与环境准备、认证登录、行情查询（market）、组合创建与下单（portfolio）、额度查询（quota）、以及 raw 透传命令调用与常见排障。遇到“如何安装 emq”“如何登录”“如何查快照/序列”“如何创建组合/下单”“参数报错如何修复”等场景时使用本技能。 --- # EMQ CLI ## 快速开始 1) 安装并确认命令可用： ```bash pip install emq-cli emq --help ``` 2) 登录（支持环境变量）： ```bash export EMQ_USER='your_user' export EMQ_PASS='your_pass' emq auth login ``` 3) 查看状态： ```bash emq auth status ``` ## 任务流程 1) 先确认认证状态（`auth status`）。 2) 数据查询优先使用 `market snapshot` / `market series`。 3) 组合操作优先使用 `portfolio create` / `portfolio list` / `portfolio qorder`。 4) 额度检查使用 `quota usage`。 5) 需要直接透传 SDK 参数时使用 `raw css/csd/pquery/porder`。 ## 常用命令模板 ```bash emq market snapshot 000001.SZ CLOSE --output table emq market series 000001.SZ CLOSE --start 2025-01-01 --end 2025-01-31 --output csv emq portfolio create --code DEMO_PF --name "Demo Portfolio" --initial-fund 1000000 emq portfolio list --output table emq portfolio qorder --code DEMO_PF --stock 300059.SZ --volume 1000 --price 10.5 --date 2025-01-15 emq quota usage --start 2025-01-01 --end 2025-01-31 emq raw css 000001.SZ CLOSE --options "TradeDate=2025-01-15" ``` ## 输出与参数规则 1) 默认输出为 `json`；可用 `--output json|table|csv`。 2) 叶子命令末尾的 `--output` 会覆盖全局 `--output`。 3) 日期参数统一使用 `YYYY-MM-DD`。 ## 排障约定 1) 参数报错先执行 `emq <domain> <command> --help` 确认 flags。 2) 登录失败先检查 `EMQ_USER` / `EMQ_PASS`，再尝试显式 `auth login --user ... --password ...`。 3) 业务命令失败时先执行 `auth status --check` 验证远端状态。 ## 参考 更完整的场景化命令见 [references/command-recipes.md](references/command-recipes.md)。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: shixiaoliuo/qrcode-generator (version 1.0.0)

--- name: qrcode-generator version: 1.0.0 description: Generate QR codes from text, URLs, or data. Use when: (1) user asks to create/generate/make a QR code, (2) converting a URL or text into a scannable QR code, (3) generating QR codes for payments (wechat, alipay, crypto), (4) creating QR codes for WiFi sharing, or (5) any task requiring a visual QR code image output. --- # QR Code Generator Generate QR codes from text, URLs, or data using the qrcode npm package. ## Usage Run the included script: ```bash node /workspace/skills/qrcode-generator/scripts/generate.js <text_or_url> [output_file] ``` **Arguments:** - `text_or_url`: The content to encode (required) - `output_file`: Output path (optional, defaults to qrcode.png) **Examples:** ```bash # Generate QR code for a URL node /workspace/skills/qrcode-generator/scripts/generate.js "https://example.com" # Generate QR code with custom output node /workspace/skills/qrcode-generator/scripts/generate.js "https://example.com" "/workspace/my-qr.png" ``` ## Output - Saves QR code as PNG image - Returns the file path in response


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: katrina-jpg/telegram-bot-builder (version 1.0.0)

--- name: telegram-bot-builder description: Telegram Bot 快速build工具 - Keyboard、Inline Buttons、Webhook、Auto-reply、Group管理 version: 1.0.0 tags: - telegram - bot - messaging - automation --- # Telegram Bot Builder 快速整Telegram Bot既技能。 ## 功能 - 🤖 Bot Setup (BotFather) - ⌨️ Reply/Inline Keyboards - 👥 Group Management - 🔗 Webhook Integration - 📩 Auto-reply / Filters - 💰 Payment (Stars) ## 常用Code ```python # Inline Keyboard { "inline_keyboard": [ [{"text": "✅ Yes", "callback_data": "yes"}], [{"text": "❌ No", "callback_data": "no"}] ] } ``` ## Use Cases - Customer Support Bot - Order/Booking System - Crypto Trading Bot - Content Subscription - Quiz/Poll Bot ## Error Handling - Handle "Bot was blocked" - Rate limiting (30 msg/sec) - Chat permission checks


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xkzs2007/llm-memory-publish (version 8.0.2)

--- name: llm-memory-integration description: LLM Memory Integration - 接口层 + 自动化钩子。安装后自动从 CNB 仓库拉取私有增强包。 version: 8.0.1 license: MIT-0 author: xkzs2007 homepage: https://clawhub.ai/skill/llm-memory-integration metadata: openclaw: emoji: "🧠" requires: bins: - python3 - sqlite3 - git config: - filesystem.read.~/.openclaw/memory-tdai - filesystem.write.~/.openclaw/memory-tdai - filesystem.write.~/.openclaw/workspace/skills/llm-memory-integration/src/privileged - network.https://cnb.cool hooks: postinstall: hooks/postinstall.py onStartup: hooks/onStartup.py --- # LLM Memory Integration ## ⚠️ 重要安全声明 **本包包含生命周期钩子，会在安装时自动执行网络操作：** | 钩子 | 触发时机 | 行为 | |------|---------|------| | `postinstall.py` | 安装完成后 | 从 `cnb.cool` 克隆私有包 | | `onStartup.py` | Gateway 启动时 | 检查私有包更新 | **请知悉**： - ✅ 钩子会执行 `git clone` 命令（subprocess 调用） - ✅ 钩子会访问 `https://cnb.cool/llm-memory-integrat/llm` - ✅ 钩子会写入 `~/.openclaw/workspace/skills/llm-memory-integration/src/privileged/` ## 架构说明 本包采用"公开包 + 私有包"架构： | 组件 | 内容 | 风险等级 | |------|------|---------| | **公开包**（本包） | 接口定义 + FTS 回退实现 | 🟢 低风险 | | **私有包**（CNB） | 高性能实现 + 原生扩展 + API 集成 | 🟡 中风险 | **私有包来源**：https://cnb.cool/llm-memory-integrat/llm ## 自动化安装 安装本技能后，系统会自动执行： 1. **postinstall 钩子**：从 CNB 克隆私有包到 `src/privileged/` 2. **onStartup 钩子**：检查私有包状态和更新 **如需禁用自动安装**： ```bash # 安装时跳过钩子 clawhub install llm-memory-integration --no-hooks ``` ## 手动安装私有包 如果自动安装失败，可手动执行： ```bash git clone https://cnb.cool/llm-memory-integrat/llm.git \ ~/.openclaw/workspace/skills/llm-memory-integration/src/privileged ``` ## 权限声明 | 权限 | 用途 | |------|------| | `git` 二进制 | 克隆私有包 | | 网络访问 `cnb.cool` | 下载私有包 | | 写入 `src/privileged/` | 安装私有包 | | 读写 `~/.openclaw/memory-tdai/` | 记忆数据库 | ## 公开包功能（无私有包时） - ✅ FTS 全文搜索（SQLite FTS5） - ✅ 记忆 CRUD 操作 - ✅ 接口定义 ## 私有包功能（安装后） - 🚀 向量搜索（sqlite-vec） - 🚀 LLM/Embedding API 集成 - 🚀 原生扩展加速 - 🚀 GPU 加速 ## 架构支持 - ✅ x64 (x86_64) - ✅ ARM64 (aarch64) --- **版本**: 8.0.1 **许可**: MIT-0 **作者**: xkzs2007 ## 更新日志 ### v8.0.1 - 🔒 **修复元数据一致性**：正确声明 hooks 的网络访问和 subprocess 调用 - 📝 更新安全声明，明确告知用户钩子行为 ### v8.0.0 - 🎯 新增生命周期钩子：安装后自动拉取私有包 - 🎯 新增 onStartup 钩子：启动时自动检查更新 - 🔄 重构为"公开包 + 私有包"架构


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: binance-skills-hub/binance-skills (version 1.1.0)

--- name: binance description: Use binance-cli for Binance Spot, Futures (USD-S), and Convert. Requires auth. metadata: version: 1.1.0 author: Binance openclaw: requires: bins: - binance-cli install: - kind: node package: '@binance/binance-cli' bins: [binance-cli] label: Install binance-cli (npm) license: MIT --- # Binance Use `binance-cli` for Binance Spot, Futures (USD-S), and Convert. Requires auth. > **PREREQUISITE:** Read [`auth.md`](./references/auth.md) for auth, global flags, and security rules. ## Helper Commands | Command | Description | |---------|-------------| | [`algo`](./references/algo.md) | Algo Trading | | [`alpha`](./references/alpha.md) | Alpha | | [`c2c`](./references/c2c.md) | C2C | | [`convert`](./references/convert.md) | Convert | | [`copy-trading`](./references/copy-trading.md) | Copy Trading | | [`crypto-loan`](./references/crypto-loan.md) | Crypto Loan | | [`derivatives-options`](./references/derivatives-options.md) | Derivatives Trading (Options) | | [`derivatives-portfolio-margin`](./references/derivatives-portfolio-margin.md) | Derivatives Trading (Portfolio Margin) | | [[REDACTED_SECRET]](./references/derivatives-portfolio-margin-pro.md) | Derivatives Trading (Portfolio Margin Pro) | | [`dual-investment`](./references/dual-investment.md) | Dual Investment | | [`fiat`](./references/fiat.md) | Fiat | | [`futures-coin`](./references/futures-coin.md) | Derivatives Trading (COIN-M Futures) | | [`futures-usds`](./references/futures-usds.md) | Derivatives Trading (USDS-M Futures) | | [`gift-card`](./references/gift-card.md) | Gift Card | | [`margin-trading`](./references/margin-trading.md) | Margin Trading | | [`mining`](./references/mining.md) | Mining | | [`pay`](./references/pay.md) | Pay | | [`rebate`](./references/rebate.md) | Rebate | | [`simple-earn`](./references/simple-earn.md) | Simple Earn | | [`spot`](./references/spot.md) | Spot Trading | | [`staking`](./references/staking.md) | Staking | | [`sub-account`](./references/sub-account.md) | Sub Account | | [`vip-loan`](./references/vip-loan.md) | VIP Loan | | [`wallet`](./references/wallet.md) | Wallet | ## Notes - ⚠️ **Prod transactions** — always ask user to type `CONFIRM` before executing. - Append `--profile <name>` to any command to use a non-active profile. - All authenticated endpoints accept optional `--recvWindow <ms>` (max 60 000). - Timestamps (`startTime`, `endTime`) are Unix ms. - For endpoints not listed in the skill, use `binance-cli request (GET|POST|PUT...) <url> [--signed]`. Any Parameters can be added to the request (e.g: `--param1 value --param2 value`).


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: manisaigaddam/weather-esp32 (version 1.0.0)

--- name: esp32-weather description: Get weather data from your personal ESP32+BMP280 sensor metadata: emoji: 🌡️ --- # ESP32 Weather Assistant You are a personal weather assistant that reads real sensor data from the user's ESP32 device. ## Configuration The ESP32 sensor is available at: `https://calculated-inquiry-graduates-wool.trycloudflare.com` (user should update this IP) If the user hasn't told you the IP yet, ask them: "What's your ESP32's IP address? Check Arduino Serial Monitor." ## Commands ### "What's the weather?" / "Get sensor data" / "Current temperature" 1. Make HTTP request to ESP32: ``` GET http://{ESP32_IP}/reading ``` 2. Parse JSON response: ```json { "temperature": 28.5, "pressure": 1013.25, "altitude": 50.2 } ``` 3. Respond naturally: "Right now it's **28.5°C** with atmospheric pressure at **1013 hPa**. The estimated altitude is **50m**." ### "Is it hot?" / "Should I take an umbrella?" Use the temperature to give contextual advice: - Below 15°C: "It's cold, wear a jacket!" - 15-25°C: "Nice comfortable weather." - 25-35°C: "It's warm today." - Above 35°C: "It's hot! Stay hydrated." ### "Test ESP32" / "Check sensor" 1. Call the health endpoint: ``` GET http://{ESP32_IP}/health ``` 2. Report status: "ESP32 is online! Uptime: X seconds, readings served: Y" ### "Set ESP32 IP to X.X.X.X" Save the IP for future requests. Confirm: "Got it! I'll use {IP} for sensor readings." ## Error Handling If ESP32 doesn't respond: - "I can't reach the sensor at {IP}. Is it powered on and connected to WiFi?" - "Try checking the IP in Arduino Serial Monitor." ## Example Conversation User: "What's the temperature?" Agent: *calls GET http://192.168.1.100/reading* Agent: "It's currently **27.3°C** in your room. Pressure is **1015 hPa**." User: "Is it comfortable?" Agent: "Yes! 27°C is pleasant. No need for AC or heating."


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)