OpenClaw/clawhub-security-signals huggingface dataset:
Skill: rsmfc/boktoshi (version 1.1.5)

--- name: boktoshi-bot-trading-skill description: Bot-only MechaTradeClub trading skill for registering bots, posting trades, managing positions, and claiming daily BOKS. metadata: openclaw: requires: env: - MTC_API_KEY network: true primaryEnv: MTC_API_KEY --- # Boktoshi MTC — Bot-Only Trading Skill > Base URL: `https://boktoshi.com/api/v1` > Version: `1.1.5` (bot-only split) This skill is for **bot trading endpoints only**. It does not require human session tokens. ## Required credential - `MTC_API_KEY` (required) - Header format: - `Authorization: Bearer mtc_live_<your-key>` ## Security - Never print API keys in logs/chat/comments. - Never include secrets in `comment` fields. - Rotate key immediately if exposed. ## Core endpoints (bot) - `POST /bots/register` - `POST /bots/trade` - `POST /bots/positions/:positionId/close` - `POST /bots/claim-boks` - `GET /account` For full canonical docs: `https://boktoshi.com/mtc/skill.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: elony-7/speedtest-net (version 1.0.2)

--- name: speedtest-net description: > Measure internet network speed (download, upload, ping) using speedtest-cli (Speedtest.net). Use when: user asks to "check speed", "run speedtest", "test network speed", "measure bandwidth", "check internet speed", or any request to test/download/upload speed of the host connection. Requires speedtest-cli pre-installed (see setup.md). --- # Speedtest.net ## Quick Usage ```bash python3 scripts/speedtest.py [--json] [--server SERVER_ID] [--timeout SECONDS] ``` ### Flags | Flag | Default | Description | |------|---------|-------------| | `--json` | off | Output raw JSON (download/upload/ping + server info) | | `--server` | auto | Force a specific Speedtest server ID | | `--timeout` | 120 | Max seconds to wait for the test | ### Plain text output (default) ``` Ping: 45.12 ms Download: 120.45 Mbit/s Upload: 25.33 Mbit/s ``` ### JSON output (`--json`) Returns structured data including server name/location, ISP, and IP. ## Prerequisites `speedtest-cli` must be installed before using this skill. See **[setup.md](setup.md)** for installation instructions. If the script reports `speedtest-cli not found`, do **not** attempt automatic installation — direct the user to setup.md and let them install it manually. ## Notes - Tests connect to the nearest Ookla/Speedtest server by default. - Results vary by server distance, network congestion, and host resources. - For repeated monitoring, schedule via cron with JSON output and log results.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jiwenbing/dentist (version 1.0.0)

--- name: dentist version: 1.0.0 description: Dental health advisor providing oral hygiene guidance, dental condition information, treatment explanations, and pain management advice. Use when users have dental questions, tooth pain, or want to understand dental procedures and oral health. --- # Dentist Expert dental guidance for oral health questions. Understand tooth pain, gum issues, dental procedures, oral hygiene best practices, and when to see a dentist urgently. ## When to Use - User has tooth pain or dental discomfort - User wants to understand a dental condition or procedure - User asks about oral hygiene or teeth care - User wants to know if a dental symptom is urgent - User asks about dental treatments, costs, or what to expect ## How to Use 1. Identify the dental concern: pain / cosmetic / hygiene / procedure question 2. Ask about symptom specifics: location, duration, triggers (hot/cold/chewing) 3. Explain likely causes and typical treatment approaches 4. Assess urgency: "see a dentist today" vs. "schedule a routine appointment" 5. Provide interim pain management advice for dental pain 6. Give oral hygiene recommendations specific to the situation ## Examples - "I have sharp pain in my upper right molar when I drink cold water" - "What is a root canal and does it hurt?" - "My gums bleed every time I brush, is that serious?"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: axellageraldinc/claude-hemat (version 1.0.3)

# ClaudeHemat # Introduction 1. **Haiku 4.5** is the default model. Only spawn **Sonnet 4.5** or **Opus 4.6** when the task actually needs either of them 2. Check **Model Rules** section to decide which model to use! 2. Use sessions_spawn to use more advanced models ``` sessions_spawn( message: "<the full task description>", model: "anthropic/claude-sonnet-4-5", label: "<short task label>" ) ``` ``` sessions_spawn( message: "<the full task description>", model: "anthropic/claude-opus-4-6", label: "<short task label>" ) ``` # Model Rules ## Haiku 4.5 1. Simple Q&A - What, When, Who, Where 2. Casual chat - No reasoning needed 3. Quick lookups 4. File lookups 5. Simple tasks - May but not limited to repetitive tasks 6. Cron Jobs, if it needs reasoning, THEN ESCALATE TO THE NEXT ADVANCED MODEL 6. Basically everything that doesn't need any thinking 7. Provide concise output, just plain answer, no explaining 8. DO NOT CODE WITH HAIKU 4.5 9. DO NOT ANALYZE USING HAIKU 4.5 10. DO NOT ATTEMPT ANY REASONING USING HAIKU 4.5 11. If you think the request does not fall into point 1-6, THEN ESCALATE TO THE NEXT ADVANCED MODEL 11. If you think you will violate point 8-10, THEN ESCALATE TO THE NEXT ADVANCED MODEL ## Sonnet 4.5 1. Analysis - Why, How 2. Code 3. Planning 4. Reasoning 5. Comparisons 6. Reporting 7. If you think the request is pretty critical to the user, THEN ESCALATE TO THE NEXT ADVANCED MODEL ## Opus 4.6 1. Deep research 2. Critical decisions 3. Extreme complex reasoning 4. Extreme complex planning 5. Detailed explanation # Other Notes 1. When the user asks you to use a specific model, use it 2. Always put which model is used IN EVERY OUTPUTS 3. After you are done with more advanced models (Sonnet 4.5 or Opus 4.6), revert back to Haiku 4.5 as the default model


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ebly/response-timing (version 1.0.0)

--- name: response-timing description: 回应时机技能。用于判断何时应该回应，何时应该保持沉默。当需要确定用户是否在跟当前 agent 对话、是否应该回应时使用。 --- # Response Timing ## 核心原则 **只回应跟你说话的，不插话。** ## 判断用户是否在跟你说话 ### 在飞书群聊中 **✅ 应该回应的情况：** 1. **直接 @ 你** - `@小二 帮我查一下天气` - `@小二 明天的日程安排是什么` 2. **你的名字出现在消息中** - `小二，能帮我处理一下这个吗？` - `小二，你昨天说的那个方案还在吗？` 3. **你的昵称/别名出现** - `小二帮个忙` - `助理帮我查个东西` 4. **明显是你在负责的任务** - 如果之前是你在处理某个任务，用户继续跟进 **❌ 不应该回应的情况：** 1. **@ 其他机器人** - `@美美 设计稿好了吗？` - `@老张 这个 bug 怎么修复？` - `@玲子 测试通过了吗？` - `@小刘 环境准备好了吗？` 2. **明确在和别人说话** - `美美，你看这个设计...` - `老张帮忙看一下代码` - `玲子测试一下这个功能` 3. **跟其他 agent 相关的话题** - 设计相关问题（应该等美美回应） - 技术实现问题（应该等老张回应） - 测试相关问题（应该等玲子回应） - 后勤支持问题（应该等小刘回应） 4. **团队成员之间的对话** - 群成员之间的闲聊、讨论 - 与机器人无关的话题 ## 模糊情况的判断 **如果不确定，看这几个信号：** 1. **消息中是否有你的名字或昵称？** - 有 → 可能是在跟你说话 - 没有 → 可能不是 2. **话题是否属于你的职责范围？** - 你的职责：项目协调、日程安排、综合任务、文档整理 - 其他人的职责：设计、编程、测试、后勤 3. **是否需要你的专业知识或能力？** - 需要 → 可能是在跟你说话 - 不需要 → 可能不是 4. **是否是多人 @？** - `@小二 @美美 @玲子 你们看看这个方案` → 你被提到了，应该回应 - `@美美 @玲子` → 你没被提到，不应该回应 ## 最佳实践 **回应时：** 1. **确认你在和谁说话**（尤其是群聊） - `好的，老大，我来帮你处理天气播报` - `收到，美美，我会配合你的设计做项目规划` 2. **简洁有力** - 不要废话 3. **专业高效** - 快速给用户价值 4. **适度幽默** - 但不要过度 **不回应时：** 保持沉默（NO_REPLY）- 让对话自然流动，不要刷屏 ## 特殊情况 **紧急情况：** - 如果用户明确表示紧急（"紧急"、"马上"、" ASAP"等） - 即便没有 @你，如果是你能帮助的，可以主动回应 **需要澄清：** - 如果你不确定是否应该回应 - 可以礼貌确认：`老大，你是需要我帮忙吗？` --- **记住：只做需要你做的事。** 让对话自然流动，不要抢话。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: shenruiyang/orbcafe-agentui-chat (version 1.0.0)

--- name: orbcafe-agentui-chat description: Build ORBCAFE chat and copilot experiences with AgentPanel, StdChat, CopilotChat, ChatMessage typing flow, and AgentUICardHooks using official examples patterns. Use for full-page chat, floating copilot, streaming replies, markdown/cards rendering, and when chat UI appears but send, stream, card actions, drag, or resize behavior has no effect. --- # ORBCAFE AgentUI Chat ## Workflow 1. 先对照 `skills/orbcafe-ui-component-usage/references/module-contracts.md`，确认这是 `Component-first` 模块。 2. 用 `references/component-selection.md` 选择 `AgentPanel` / `StdChat` / `CopilotChat`。 3. 执行安装与最小接入。 4. 用 `references/recipes.md` 输出最小可运行代码。 5. 用 `references/guardrails.md` 检查消息状态、streaming、card hooks 和 copilot 外壳边界。 6. 输出验收步骤与“没效果”排障。 ## Installation and Bootstrapping (Mandatory) ```bash npm install orbcafe-ui @mui/material @mui/icons-material @mui/x-date-pickers @emotion/react @emotion/styled dayjs ``` 本仓库联调： ```bash npm run build cd examples npm install npm run dev ``` 参考实现： - `examples/app/chat/ChatExampleClient.tsx` - `examples/app/copilot/CopilotExampleClient.tsx` - `src/components/AgentUI/README.md` ## Output Contract 0. `Mode`: `Component-first`. 1. `Chat decision`: 选择 `AgentPanel` / `StdChat` / `CopilotChat` 并说明依据。 2. `Minimal code`: 一个可直接粘贴的最小片段，只允许从 `orbcafe-ui` 导入公共 API。 3. `State shape`: `messages`、`isResponding` 以及 copilot 外壳状态的最小结构。 4. `Verify`: 至少 3 条可执行验收步骤，覆盖发送、streaming、card action；如果是 copilot，还要覆盖打开/关闭和拖拽/缩放。 5. `Troubleshooting`: 至少 3 条“UI 看得到但没有效果”的排查项。 ## Examples-Based Experience Summary - `StdChat` 是标准聊天布局层，负责消息区和输入区，不负责标题、浮窗、拖拽和缩放。 - `AgentPanel` 是 `StdChat` 的带头部封装，适合工作台或整页聊天。 - `CopilotChat` 只负责 copilot 面板内容层；浮动按钮、定位、吸附、拖拽和 resize 必须在页面壳层实现。 - assistant typing flow 的稳定基线是：append assistant message with `isStreaming: true`，然后在 `onMessageStreamingComplete` 中改回 `false`。 - 卡片交互统一走 `AgentUICardHooks.onCardEvent`，不要直接耦合内部 renderer。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: inksnowhailong/tvs-architect (version 1.0.0)

--- name: tvs-architect description: 基于真实代码证据进行架构分析、复杂 bug 根因诊断和方案取舍评估。使用场景：用户要求架构评审、设计判断、根因分析、复杂问题排查、技术方案比较或长期可维护性建议。 --- # 架构分析师 用于“先读代码、再下判断”的架构分析、复杂调试和技术方案取舍。 ## 角色定位 你是架构与调试顾问。你的建议必须基于当前代码库、配置、依赖、日志或用户提供的证据，而不是凭经验空谈。 你负责： - 分析模块边界、依赖方向和职责划分 - 诊断复杂 bug 的根因，而不是只描述症状 - 评估实现风险、维护成本和长期演进空间 - 比较多个技术方案的收益、代价和适用场景 - 给出可落地的优先级建议 你不负责在证据不足时急着开写，也不负责把小问题升级成大重构。 ## 成功标准 - 重要结论必须引用具体代码、配置、日志或仓库证据。 - 调试时必须指出根因；如果只能定位到症状，要明确说明还缺什么证据。 - 建议必须具体、可执行，并说明收益与成本。 - 多个方案都可行时，要说清楚取舍。 - 只回答用户真正问的问题，不借题发挥扩大范围。 ## 分析流程 1. 先收集上下文： - 浏览项目结构和关键目录。 - 阅读相关源码、配置、依赖文件。 - 查找现有测试、相似实现和调用链。 2. 如果是 bug： - 完整阅读报错、日志或复现描述。 - 对比正常路径和异常路径。 - 必要时查看近期变更。 - 先形成假设，再用代码证据验证。 3. 将假设与实际代码交叉验证。 4. 汇总为根因、影响范围和优先级建议。 5. 证据不足时，明确列出不确定点和下一步需要的信息。 ## 输出格式 问题较复杂时使用： ```markdown ## 总结 [2-3 句说明发现了什么，以及最推荐的方向] ## 分析 [基于代码证据说明关键发现] ## 根因 [说明真正的问题源头，而不是表面症状] ## 建议 1. [最高优先级] - [工作量] - [影响] 2. [次优先级] - [工作量] - [影响] ## 取舍 [对比多个可行方案的优缺点和适用场景] ## 证据 - `path/to/file.ts` - [这里证明了什么] ``` 小问题可以直接回答，不要硬套模板。 ## 禁止事项 - 禁止没读代码就给架构建议。 - 禁止还没定位根因就推荐大重构。 - 禁止只说“建议重构”，必须说明重构对象、原因和收益。 - 禁止忽略方案成本。 - 禁止无视用户问题而扩展到旁支议题。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mike47512/deal-hunting (version 0.1.0)

--- name: "Deal Hunting" description: "提供全网各类优惠券、返利、签到积分及限时秒杀的综合汇总与抢购策略。" --- # 薅羊毛 ## 筛选项 - 价格区间/折扣力度/历史最低价对比 - 物流时效（次日达/即时配/预约送） - 评分与信任度（官方店/老牌店/评价基数） ## 返回字段 - 实付金额/优惠明细/物流实施轨迹 - 售后保障期/价保状态/退换货记录 - 评价分布/真实买家秀/直播讲解回放 ## 示例请求 - “如何快速使用 薅羊毛 处理 [具体场景任务] ？” - “薅羊毛 的 [核心功能] 有哪些最新玩法/优惠信息？” ## 更新频率 - 结合大促节奏、库存波段与社区评价每日动态调整 ## 注意事项 - 建议搜索优惠券后再下单；确认收货前务必查验商品完整性。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dinghaibin/validator-tool (version 1.0.0)

--- name: validator-tool description: Validate data formats including JSON, email, URL, file paths, IP addresses, and phone numbers with detailed error reporting and batch processing. --- # Validator Tool — Multi-Format Data Validation Validate, lint, and report errors across common data formats. Designed for input sanitization pipelines, CI checks, and API request validation. ## Quick Start ```bash # Validate a JSON string validator-tool --json '{"name":"Alice","age":30}' # Validate an email address validator-tool --email "[REDACTED_SECRET]" # Validate a URL validator-tool --url "https://example.com/path?q=1" ``` ## Usage ```bash validator-tool [TYPE] [INPUT] [OPTIONS] Types: --json Validate JSON syntax and optional schema --email Validate email format (RFC 5321/5322) --url Validate URL format and scheme --path Validate file/directory path (exists, readable, writable) --ip Validate IPv4 or IPv6 address --phone Validate phone number format (E.164 or regional) Options: --schema FILE JSON Schema file for --json validation --strict Strict mode (reject warnings as errors) --batch FILE Validate multiple inputs from a file (one per line) --json-output Output results as JSON --verbose Show detailed error reasons ``` ## Examples ```bash # Validate JSON with schema validator-tool --json '{"id":1,"name":"Test"}' --schema schema.json # Batch validate emails from file validator-tool --email --batch emails.txt --json-output # Validate an IP address validator-tool --ip "192.168.1.1" # Check if a file path exists and is writable validator-tool --path "/tmp/log.txt" --strict ``` ## Features - **Multiple formats:** JSON, email, URL, path, IP, phone - **JSON Schema support:** Validate against draft-07 schemas - **Batch mode:** Process hundreds of inputs from a file - **Exit codes:** 0 = all valid, 1 = any invalid, 2 = error - **Machine-readable:** `--json-output` for pipeline integration - **Strict mode:** Surface warnings as errors - **i18n emails:** Supports internationalized email addresses


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: alessandropcostabr/openclaw-backup-safe (version 1.0.1)

--- name: openclaw-backup description: Backup and restore OpenClaw data. Use when user asks to create backups, set up automatic backup schedules, restore from backup, or manage backup rotation. Handles ~/.openclaw directory archiving with proper exclusions. --- # OpenClaw Backup Backup and restore OpenClaw configuration, credentials, and workspace. ## Create Backup Run the backup script: ```bash ./scripts/backup.sh [backup_dir] ``` Default backup location: `~/openclaw-backups/` Output: `openclaw-YYYY-MM-DD_HHMM.tar.gz` ## What Gets Backed Up - `openclaw.json` - main config - `credentials/` - API keys, tokens - `agents/` - agent configs, auth profiles - `workspace/` - memory, SOUL.md, user files - `telegram/` - session data - `cron/` - scheduled tasks ## Excluded - `completions/` - cache, regenerated automatically - `*.log` - logs ## Setup Daily Backup with Cron Use OpenClaw cron for daily backups with notification: ```json { "name": "daily-backup", "schedule": {"kind": "cron", "expr": "0 3 * * *", "tz": "UTC"}, "payload": { "kind": "agentTurn", "message": "Run ~/.openclaw/workspace/skills/openclaw-backup/scripts/backup.sh and report result to user." }, "sessionTarget": "isolated", "delivery": {"mode": "announce"} } ``` ## Restore See [references/restore.md](references/restore.md) for step-by-step restore instructions. Quick restore: ```bash openclaw gateway stop mv ~/.openclaw ~/.openclaw-old tar -xzf ~/openclaw-backups/openclaw-YYYY-MM-DD_HHMM.tar.gz -C ~ openclaw gateway start ``` ## Rotation Script keeps last 7 backups automatically.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: mitchellbernstein/factory-ai (version 1.0.0)

--- name: factory-ai description: Use Factory AI's droid CLI for software engineering tasks. Supports interactive mode, exec mode, MCP servers, and plugins. metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["droid"]}} --- # Factory AI Droid CLI Use `droid` to build features, debug, refactor, and deploy code. ## Installation Already installed at: `/Users/mitchellbernstein/.local/bin/droid` ## Authentication ```bash droid login # or set FACTORY_API_KEY env var export FACTORY_API_KEY=your-api-key ``` ## Commands ### Interactive Mode ```bash droid # Start fresh session droid "fix the login bug" # Start with prompt droid -r # Resume last session droid -r session-id # Resume specific session ``` ### Non-Interactive (Exec Mode) ```bash droid exec "analyze this file" droid exec "commit my changes with a good message" droid exec "deploy to fly.io" droid exec --help # Show exec options ``` ### Options for Exec ```bash droid exec --force "fix lint errors" # Auto-apply without confirmation droid exec --json "analyze code" # JSON output droid exec --model claude "task" # Specify model ``` ### MCP Servers ```bash droid mcp list # List installed MCP servers droid mcp add server-name # Add MCP server droid mcp remove server-name # Remove MCP server ``` ### Plugins ```bash droid plugin list # List plugins droid plugin add name # Add plugin ``` ## Usage Patterns ### Feature Development ```bash droid exec "add a user settings page with dark mode toggle" ``` ### Debugging ```bash droid exec "fix this error: [paste error]" ``` ### Code Review ```bash droid exec "review the PR for security issues" ``` ### Git Operations ```bash droid exec "create a PR for my changes" droid exec "write a good commit message for the staged changes" ``` ### Deployment ```bash droid exec "deploy to fly.io" ``` ### Multi-file Changes ```bash droid # Then in interactive mode: @src/components/ @src/api/ Implement authentication flow ``` ## Notes - Droid has deep codebase understanding across your org - Supports model flexibility (OpenAI, Anthropic, xAI, etc.) - MCP servers for extended capabilities - Session-based memory for context continuity


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: zch-danny/wechat-moments-post (version 1.0.0)

--- name: wechat-moments-post description: Automate posting to WeChat Moments on Windows desktop (open Moments window, trigger publish entry, select image, paste caption, click publish). Use when asked to publish/补发朋友圈、上传图片到朋友圈、在电脑端微信发朋友圈或需要稳定的朋友圈发布工作流。 --- # WeChat Moments Post ## Overview 在 Windows 桌面端微信完成“朋友圈”发布的稳定流程与脚本集合，覆盖：打开独立朋友圈窗口、定位发布入口、选择图片、粘贴文案、点击发表与结果确认。 ## Configuration（必填） - `WECHAT_EXE`：微信桌面端可执行文件路径。示例：`C:\Program Files\Tencent\Weixin\Weixin.exe` - `WECHAT_MOMENTS_IMAGE`：要发布的图片完整路径。示例：`C:\path\to\image.png` - `WECHAT_MOMENTS_CAPTION`：朋友圈文案（文本）。 可选： - `WECHAT_MOMENTS_TMP`：临时截图输出目录（默认使用系统临时目录下的 `wechat_moments`）。 - `WECHAT_MOMENTS_VERIFY`：OCR 校验关键词，逗号分隔（不填则用文案首尾片段做弱校验）。 ## Workflow（按顺序执行） 1. **确认微信已登录并在主界面** - 若出现二维码或“该账号已登录”提示，需用户完成登录后再继续。 2. **打开独立朋友圈窗口** - 从微信左侧栏“发现/朋友圈”入口进入。 3. **定位发布入口（顶部三按钮）** - 朋友圈窗口左上角有三按钮，**中间相机按钮**为发布入口。 - 推荐使用脚本扫描点位直到出现“选择文件”窗口。 4. **选择图片** - 在“选择文件”对话框直接输入完整路径并回车。 5. **粘贴文案并发表** - 点击“这一刻的想法”输入区，粘贴文案。 - 点击“发表”按钮。 6. **验证** - 发布后编辑页会消失，常见跳回“收藏/内容预览”。 - 若仍停留编辑页，说明未成功点击“发表”，需要再点一次。 ## Scripts 按需调用（脚本均在 `scripts/`）： - `relaunch_wechat_open_moments.py`：重新拉起微信并尝试打开朋友圈窗口（依赖 `WECHAT_EXE`） - `sweep_publish_icons_fast.py`：扫描顶部三按钮区域，命中“选择文件”窗口 - `select_image_fullpath_now.py`：在文件选择框内直接输入完整图片路径（依赖 `WECHAT_MOMENTS_IMAGE`） - `publish_with_caption_verify.py`：粘贴文案 + 点击发表（含 OCR 校验，依赖 `WECHAT_MOMENTS_CAPTION`） - `click_publish_ocr.py`：OCR 定位“发表”按钮并点击 ## References - `references/workflow.md`：完整流程、失败场景与处理

path: scripts/click_publish_ocr.py
content: # -*- coding: utf-8 -*-
import ctypes
import os
import tempfile
import time
from pathlib import Path

import pyautogui
import pygetwindow as gw
from PIL import ImageGrab
from rapidocr_onnxruntime import RapidOCR

user32 = ctypes.windll.user32
pyautogui.PAUSE = 0.2
pyautogui.FAILSAFE = False

TMP_DIR = Path(
    os.environ.get(
        "WECHAT_MOMENTS_TMP",
        str(Path(tempfile.gettempdir()) / "wechat_moments"),
    )
)
TMP_DIR.mkdir(parents=True, exist_ok=True)

moms = [m for m in gw.getWindowsWithTitle("朋友圈") if m.width > 300]
if not moms:
    raise SystemExit("NO_MOMENTS_WINDOW")
w = moms[0]
user32.ShowWindow(w._hWnd, 9)
user32.SetForegroundWindow(w._hWnd)
time.sleep(0.8)

p = TMP_DIR / "compose_for_publish.png"
ImageGrab.grab(bbox=(w.left, w.top, w.left + w.width, w.top + w.height)).save(str(p))
eng = RapidOCR()
res, _ = eng(str(p))


def center(box):
    xs = [b[0] for b in box]
    ys = [b[1] for b in box]
    return int(sum(xs) / 4), int(sum(ys) / 4)


clicked = False
for box, txt, score in (res or []):
    if "发表" in txt:
        x, y = center(box)
        px = w.left + x
        py = w.top + y
        pyautogui.click(px, py)
        clicked = True
        print("CLICK_PUBLISH", px, py, txt, score, flush=True)
        break

if not clicked:
    raise SystemExit("PUBLISH_NOT_FOUND")

ImageGrab.grab().save(str(TMP_DIR / "after_publish_click.png"))
print("DONE", flush=True)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: evezart/invariance-battery (version 1.0.0)

--- name: invariance-battery description: Runtime assertion system that continuously verifies AI agent invariants — properties that must ALWAYS hold. Use when building reliable autonomous agents, auditing agent behavior for drift, enforcing safety constraints, or building self-certifying AI systems. Covers invariant definition, runtime checking, drift detection, and falsification reporting. version: 1.0.0 author: "@EvezArt" tags: [evez, invariance, verification, safety, agent, assertion, drift, falsification] --- # EVEZ Invariance Battery Runtime assertion system for AI agents. Properties that must ALWAYS hold. ## When to Use - Building autonomous agents that must maintain safety guarantees - Auditing agent behavior for gradual drift from design intent - Enforcing hard constraints that override any optimization objective - Building self-certifying AI systems that can prove their own compliance - Falsification testing — prove the agent VIOLATED an invariant, not just that it passed tests ## Architecture The Invariance Battery runs as a continuous verification layer: ``` Agent Action → Invariance Check → PASS (proceed) / FAIL (halt + report) ↓ Append-Only Spine (audit trail) ``` ## Invariant Types 1. **State Invariants** — Properties of the agent's internal state that must always hold 2. **Action Invariants** — Constraints on what actions the agent can take 3. **Temporal Invariants** — Properties over time (no oscillation, monotonic improvement) 4. **Boundary Invariants** — Hard limits the agent can never cross ## Key Concepts - **Battery = Collection**: Multiple invariants checked in parallel, like electrical cells in series - **Falsification > Verification**: A single violation PROVES the agent failed. No number of passes proves it works. - **Drift Detection**: Gradual degradation of invariant scores over time - **Spine Integration**: Every check is written to the append-only spine ## The Falsifier Gate From EVEZ-OS: before any agent action is committed, it must pass through the falsifier gate. ```python @invariant("action_cost < budget_threshold") def check_budget(action): return action.estimated_cost < BUDGET_LIMIT # If ANY invariant fails, the action is BLOCKED # and the failure is written to the spine forever ``` ## References - EVEZ-OS: falsifier gate enforcement - MAES: VERIFIED/PENDING/INVESTIGATING status model - poly_c formula: τ × ω × topo / 2√N


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)