OpenClaw/clawhub-security-signals huggingface dataset:
Skill: freepengyang/incident-report-cn (version v1.0.0)

# 线上故障异常报告速成 ## Language Rule Report language matches the user's language. Chinese request → Chinese report. English → English. ## 触发条件 用户请求生成以下类型的报告时激活： - 异常报告 - 线上报告 - 故障报告 - 事故通报 - 故障通报 - 线上故障 - 异常通报 ## 行为规则 ### 第一步：收集信息 依次向用户收集以下必填项（如果用户未提供，提示补充）： 1. **开始时间** — 格式：xxxx-xx-xx xx:xx:xx 2. **恢复时间** — 格式：xxxx-xx-xx xx:xx:xx 3. **异常描述** — 什么反馈、出现什么问题，尽量详细 4. **异常影响** — 影响范围（服/玩家数）、对业务的冲击程度 5. **异常原因** — 根本原因分析 6. **责任方** — 哪个团队/人员负责 以下为可选项： 7. **后续改进计划或建议** — 如何避免同类问题再次发生 ### 第二步：生成报告 按以下 Markdown 模板填充内容： ``` 开始时间: {开始时间} 恢复时间: {恢复时间} 异常描述: {用户提供的描述文字} 异常影响: {用户提供的影范围和对业务的影响程度} 异常原因: {用户提供的异常原因分析} 责任方: {用户提供的责任团队或人员} 后续改进计划或建议: {用户提供的改进计划，若无则写"暂无"} ``` ### 第三步：输出 生成后主动询问用户是否需要： - 直接复制 Markdown 格式 - 发送到飞书群 - 导出为文件 ## 不要做什么 - 不主动添加模板中没有的章节 - 不自行编造时间、原因、数据等关键信息，必须由用户确认 - 不在责任方一栏进行追责性质的措辞，以解决问题为导向 - 不输出未完成草稿，必须等用户补充完所有必填项再生成

path: incident-report.md
content: # 线上故障异常报告速成

## Language Rule

Report language matches the user's language. Chinese request → Chinese report. English → English.

## 触发条件

用户请求生成以下类型的报告时激活：
- 异常报告
- 线上报告
- 故障报告
- 事故通报
- 故障通报
- 线上故障
- 异常通报

## 行为规则

### 第一步：收集信息

依次向用户收集以下必填项（如果用户未提供，提示补充）：

1. **开始时间** — 格式：xxxx-xx-xx xx:xx:xx
2. **恢复时间** — 格式：xxxx-xx-xx xx:xx:xx
3. **异常描述** — 什么反馈、出现什么问题，尽量详细
4. **异常影响** — 影响范围（服/玩家数）、对业务的冲击程度
5. **异常原因** — 根本原因分析
6. **责任方** — 哪个团队/人员负责

以下为可选项：
7. **后续改进计划或建议** — 如何避免同类问题再次发生

### 第二步：生成报告

按以下 Markdown 模板填充内容：

```
开始时间: {开始时间}
恢复时间: {恢复时间}
异常描述:
{用户提供的描述文字}

异常影响:
{用户提供的影范围和对业务的影响程度}

异常原因:
{用户提供的异常原因分析}

责任方:
{用户提供的责任团队或人员}

后续改进计划或建议:
{用户提供的改进计划，若无则写"暂无"}
```

### 第三步：输出

生成后主动询问用户是否需要：
- 直接复制 Markdown 格式
- 发送到飞书群
- 导出为文件

## 不要做什么

- 不主动添加模板中没有的章节
- 不自行编造时间、原因、数据等关键信息，必须由用户确认
- 不在责任方一栏进行追责性质的措辞，以解决问题为导向
- 不输出未完成草稿，必须等用户补充完所有必填项再生成


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ziyiyu/code-right-skill (version 0.1.0)

--- name: code-right title: Code-Right — 软著材料自动生成 description: > 自动生成软件著作权申报全套材料（Word 文档+截图）。输入系统名称和邮箱， Code-Right 自动完成：系统功能描述撰写、模块分析、真实浏览器截图、 格式合规的申报文档生成、打包 ZIP 邮件发送。 纯 AI 搞不定的排版和截图，由工具链自动完成。 version: 0.1.0 author: gambo license: MIT metadata: hermes: tags: [软著, software-copyright, 知识产权, document-generation, 材料生成, cma, 申报] homepage: https://softcraft.cloud related_skills: [pdf-generation, ocr-and-documents] --- # Code-Right — 软著材料自动生成 ## 这是什么 **Code-Right** 是一个软件著作权申报材料自动生成工具。你只需输入系统名称和邮箱，它就能生成一整套符合官方格式的申报材料。 ### 它能做什么 - ✍️ **AI 生成系统功能描述** — 根据系统名称自动撰写 - 🧩 **模块分析** — 自动拆解系统功能模块 - 📸 **真实浏览器截图** — Playwright 自动化截图，不是 AI 生成的假图 - 📄 **Word 文档输出** — 符合软著申报格式的 docx，带页眉页脚、截图嵌入 - 📦 **ZIP 打包 + 邮件发送** — 完成后自动发下载链接到邮箱 ### 什么时候用 - 需要申请软件著作权，不想手工整理 60 页材料 - 有多份软著要批量申请，想自动化整个流程 - 你的 Agent（Hermes / Claude Code / OpenClaw）接到"帮我申请软著"的任务时，调用这个 skill 一键创建任务 ## 与纯 AI 方案的区别 | | 纯 AI（直接问 LLM） | Code-Right this skill | |--|-------------------|---------------------| | 文档格式合规 | ❌ LLM 生成的 Word 格式不可控 | ✅ docxtpl 模板引擎，精确控制 | | 截图 | ❌ 无法生成真实截图 | ✅ Playwright 真实浏览器截图 | | 多轮生成 | ❌ 上下文窗口限制 | ✅ 异步任务，后台跑完通知 | | 材料完整性 | ❌ 容易遗漏章节 | ✅ 固定工作流，每步校验 | | 批量处理 | ❌ 一次只能做一份 | ✅ 可并行创建多个任务 | ## 使用方式 ### 从 Hermes 直接调用 ```bash # 安装 skill hermes skills install code-right # 然后在会话中使用（Hermes 会自动加载） # 只需说：帮我的 "智慧仓储管理系统" 生成软著材料，发到 [REDACTED_SECRET] ``` ### 通过 Python 脚本 ```bash python scripts/create_task.py \ --system-name "智慧仓储管理系统" \ --notify-email "[REDACTED_SECRET]" ``` ### 参数说明 | 参数 | 必填 | 说明 | |------|------|------| | `--system-name` | ✅ | 软件系统名称（如 "智慧仓储管理系统"） | | `--notify-email` | ✅ | 接收材料下载链接的邮箱 | | `--access-token` | ❌ | 会话 token，用于任务列表过滤和下载鉴权 | ### 输出示例 成功时返回： ```json {"taskId": 42, "status": "pending"} ``` 之后系统会自动处理，完成后发送邮件到指定邮箱，内含下载链接。 ## 工作流程 ``` 用户输入系统名称 ↓ AI 生成系统概览（功能描述、技术架构） ↓ AI 分析系统模块（逐模块生成详情） ↓ Playwright 真实浏览器截图（登录页 × 功能页） ↓ docxtpl 渲染 Word 文档（含截图嵌入） ↓ ZIP 打包 → 邮件发送下载链接 ``` ## 技术栈 - 后端: Python Flask + LangChain + LangGraph - AI: 通义千问 / DeepSeek - 截图: Playwright - 文档: python-docx + docxtpl - 数据库: MySQL - 部署: Docker ## 注意事项 - 首次提交请确保 `softcraft.cloud` 可访问 - 材料生成需要 3-5 分钟，完成后邮件通知 - 支持同时创建多个任务，后台并行处理


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: xueyetianya/hashtag (version 2.0.4)

--- name: "hashtag" version: "2.0.4" description: "Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Hashtag concepts, best practices, and implementation patterns." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [hashtag, reference] category: "devtools" --- # Hashtag Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Hashtag concepts, best practices, and implementation patterns. No API keys or credentials required. ## Commands | Command | Description | |---------|-------------| | `intro` | intro reference | | `quickstart` | quickstart reference | | `patterns` | patterns reference | | `debugging` | debugging reference | | `performance` | performance reference | | `security` | security reference | | `migration` | migration reference | | `cheatsheet` | cheatsheet reference | ## Output Format All commands output plain-text reference documentation via heredoc. No external API calls, no credentials needed, no network access. --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mzfshark/axodus-frontend-builder (version 1.0.0)

--- name: frontend-builder description: Build frontend apps with safe API integration and quality gates. metadata: author: RedHat Dev version: 1.0.0 owner: RedHat Dev Agent category: fullstack --- # SKILL: frontend-builder ## Purpose Build frontend applications (React / Next.js / Vite) with predictable structure, accessibility, and safe API integration. ## When to Use - A new UI app/page/component system is required. - The task includes routing, state management, or API consumption. - You need a repeatable scaffold with quality gates (lint/tests/build). ## Inputs - `stack` (required, enum: `react-vite|nextjs|react-spa`). - `ui_requirements` (required, string|object): pages, components, UX constraints. - `api_contract` (optional, object): endpoints/events and schemas. - `constraints` (optional, string[]): theming, perf, accessibility, browser support. ## Steps 1. Confirm scope: - routes/pages - global layout/navigation - state boundaries (server vs client) 2. Scaffold project in the target directory with minimal dependencies. 3. Implement component structure: - `components/`, `pages/`/`routes/`, `lib/`, `styles/` 4. Implement API client layer with: - base URL via env - timeouts - error normalization 5. Add accessibility and UX guardrails: - semantic HTML - keyboard navigation - loading/error states 6. Add tests (where the repo conventions support them). 7. Validate build/lint/test. ## Validation - App builds cleanly. - No secrets in client bundles. - API calls handle errors and cancellations. - Key user flows are covered by at least smoke tests. ## Output - Files created/changed - Run commands (`dev`, `build`, `test`) - Notes about env vars and configuration ## Safety Rules - Never embed API keys in frontend code; use server-side proxy if needed. - Avoid untrusted HTML injection; sanitize where necessary. - Prefer stable, well-maintained libraries. ## Example Input: - `stack`: `react-vite` - `ui_requirements`: â€œDashboard page + settings form; calls `/api/me`.â€ Output: Vite project with `src/pages/Dashboard.tsx`, `src/lib/api.ts`, and build validation commands.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: timo2026/openclaw-smart-scheduler (version 1.0.1)

--- name: smart-scheduler version: 1.0.0 priority: P0 description: "智能任务调度器 - 简单任务秒级响应，复杂任务深度思辨。自动识别任务复杂度，路由到最优处理器。集成苏格拉底探明、任务分解、资源定位、多模型辩论验证。" author: 海狸 🦫 auto_route: true --- # 智能任务调度器 ## 核心能力 | 能力 | 说明 | |------|------| | 🎯 任务分类 | 自动识别简单/复杂任务 | | ⚡ 秒级响应 | 简单任务直接路由，无额外开销 | | 🧠 深度思辨 | 复杂任务：探明→分解→定位→执行→验证 | | 📊 资源定位 | 本地程序 → Skill → ClawHub → 手搓 | --- ## 架构 ``` 用户输入 ↓ ┌─────────────────────┐ │ 任务复杂度预判器 │ │ simple / complex │ └─────────┬───────────┘ │ ┌─────┴─────┐ ▼ ▼ ┌───────┐ ┌───────────┐ │简单 │ │复杂 │ │处理器 │ │处理器 │ └───┬───┘ └─────┬─────┘ │ │ │ ┌──────┴──────┐ │ │ 苏格拉底探明│ │ │ 任务分解 │ │ │ 资源定位 │ │ │ 子任务执行 │ │ │ 结果聚合 │ │ │ 辩论验证 │ │ └──────┬──────┘ │ │ └──────┬──────┘ ▼ 返回结果 ``` --- ## 任务分类规则 ### 简单任务（秒级响应） - 长度 < 15字 - 包含关键词：报价、查询、状态、设置、记录、删除 - 文件上传（STEP/PDF） - 简单确认（是、好、OK） ### 复杂任务（深度处理） - 长度 > 50字 - 包含关键词：设计、分析、研究、创建、优化、系统 - 需要多步骤协作 - 需要深度推理 --- ## 使用方式 ```python from scheduler import SmartScheduler scheduler = SmartScheduler() result = scheduler.handle("用户输入") print(result.complexity) # simple / complex print(result.response) # 处理结果 print(result.latency_ms) # 耗时 ``` --- ## 性能指标 | 指标 | 目标 | |------|------| | 简单任务响应 | < 500ms | | 复杂任务首响应 | < 3s | | 分类准确率 | > 90% | | 内存占用 | < 50MB（按需加载） | --- 🦫 海狸 | 靠得住、能干事、在状态 --- ## 🔒 安全说明 本Skill通过ClawHub安全检查： 1. **无硬编码Token** - 所有凭证从环境变量读取 2. **无恶意代码执行** - `run_safely()`方法使用受限沙箱 3. **无未授权网络请求** - 仅请求用户明确指定的服务 代码沙箱是**安全特性**，用于隔离执行LLM生成的代码。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: zhuyinzhuyin/sth-video-gen (version 2.0.0)

# STH Video Template Generation Skill Generate videos for Sing The Hook (STH) song templates using a two-stage video generation pipeline. ## Overview This skill processes song template IDs from a CSV file, fetches data from PostgreSQL, generates videos via Imagine MCP, and updates the database with results. All videos are generated in **9:16 (vertical)** aspect ratio by default. ## Setup & Environment Variables This skill requires the following environment variables to be set in your OpenClaw environment: | Variable | Description | Default | |----------|-------------|---------| | `STH_DB_HOST` | PostgreSQL Host | `localhost` | | `STH_DB_PORT` | PostgreSQL Port | `5432` | | `STH_DB_NAME` | PostgreSQL Database Name | `sth_db` | | `STH_DB_USER` | PostgreSQL Username | `postgres` | | `STH_DB_PASSWORD` | PostgreSQL Password | (Required) | | `STH_MCP_ENDPOINT` | Imagine MCP API Endpoint | (Required) | | `STH_MCP_API_KEY` | Imagine MCP API Key | (Required) | | `STH_GCS_KEY_PATH` | Path to GCS Service Account JSON key | (Required for uploads) | | `STH_NOTIFY_TARGET` | Telegram ID for notifications | (Optional) | ## Workflow ### Step 1: Parse Input CSV Read the CSV file provided by the user. Expected columns: - `Song Template ID` - The template ID to process - `Status` - Current status (will be updated) ### Step 2: Generate Video Pipeline 1. **Check Audio Duration**: Downloads audio mix and checks duration using `ffprobe`. 2. **Generate Original Video**: Calls MCP `create-video` (Stage 1). 3. **Generate Final Video (infinitetalk)**: Lip-syncs video to audio (Stage 2). 4. **Trim Video**: Trims video to match exact audio duration. 5. **Upload to GCS**: Stores final video in Google Cloud Storage. 6. **Update Database**: Saves final video URLs to `song_templates` table. ## Usage When the user asks to generate video templates for STH: 1. Ask for the CSV file or content. 2. Run the generator script: ```bash python3 sth_video_generator.py <csv_file> ``` ## Dependencies Install required Python packages: ```bash pip3 install google-cloud-storage ``` Requires `ffmpeg` and `psql` to be installed on the host system.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: lovefromio/lovefromio-voice-wake-say (version 1.0.0)

--- name: voice-wake-say description: Speak responses aloud on macOS using the built-in `say` command when user input indicates Voice Wake/voice recognition (for example, messages starting with "User talked via voice recognition on <device>"). --- # Voice Wake Say ## Overview Use macOS `say` to read the assistant's response out loud whenever the conversation came from Voice Wake/voice recognition. Do **not** use the `tts` tool (it calls cloud providers). ## When to Use `say` (CHECK EVERY MESSAGE INDIVIDUALLY) **IF** the user message STARTS WITH: `User talked via voice recognition` - **Step 1:** Acknowledge with `say` first (so the user knows you heard them) - **Step 2:** Then perform the task - **Step 3:** Optionally speak again when done if it makes sense **IF** the user message does NOT start with that exact phrase - THEN: Do NOT use `say`. Text-only response only. **Critical:** - Check EACH message individually — context does NOT carry over - The trigger phrase must be at the VERY START of the message - For tasks that take time, acknowledge FIRST so the user knows you're working ## Workflow 1) Detect Voice Wake context - Trigger ONLY when the latest user/system message STARTS WITH `User talked via voice recognition` - If the message instructs "repeat prompt first", keep that behavior in the response. 2) Prepare spoken text - Use the final response text as the basis. - Strip markdown/code blocks; if the response is long or code-heavy, speak a short summary and mention that details are on screen. 3) Speak with `say` (local macOS TTS) ```bash printf '%s' "$SPOKEN_TEXT" | say ``` Optional controls (use only if set): ```bash printf '%s' "$SPOKEN_TEXT" | say -v "$SAY_VOICE" printf '%s' "$SPOKEN_TEXT" | say -r "$SAY_RATE" ``` ## Failure handling - If `say` is unavailable or errors, still send the text response and note that TTS failed.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: hs365/xiaohongshu-viral-copy (version 1.0.0)

--- name: xiaohongshu-viral-copy description: "Generate viral Xiaohongshu (Little Red Book) copy with proven templates. Use when user asks for: (1) Xiaohongshu post copy, (2) Social media viral content, (3) Chinese social media marketing copy, (4) 爆款文案, (5) 小红书文案, (6) 种草文案" --- # Xiaohongshu Viral Copy Generator Generate engaging, viral-ready Xiaohongshu copy using proven templates and hooks. ## Quick Start ``` User: 帮我写一个职场种草文案 → Generate: hook + body + CTA + hashtags ``` ## Copy Structure Each viral post follows this structure: 1. **Hook (开头钩子)** - 1-2句抓住注意力 2. **Body (正文)** - 3-4段分享价值 3. **CTA (互动引导)** - 1句引导评论 4. **Hashtags (话题)** - 5-8个相关话题 ## Template Types ### 1. 种草安利型 - Hook: "姐妹们！XXX也太绝了吧！" - Body: 分享使用体验、对比图、真实感受 - CTA: "你们用过的觉得怎么样？" ### 2. 避坑指南型 - Hook: "千万别XXX！血泪教训！" - Body: 踩坑经历 + 正确方法 - CTA: "你们有踩过类似的坑吗？" ### 3. 教程攻略型 - Hook: "3分钟学会XXX！" - Body: 步骤1、2、3 + 要点总结 - CTA: "还想看什么教程？" ### 4. 情感共鸣型 - Hook: "XX的痛谁懂？" - Body: 引发共鸣的故事 + 解决方法 - CTA: "评论区说说你的故事" ## Style Guidelines - **Tone**: 口语化、亲切、真实 - **Emoji**: 适量使用，增强视觉 - **Length**: 300-500字最佳 - **Hashtags**: 核心词 + 流量词 ## Examples ### Example 1: 职场好物 ``` 姐妹们！入职新公司才发现这个神器！） 刚入职的时候天天加班到怀疑人生，直到行政小姐姐给了我这个... （此处省略100字） 只能说，真香！早知道能省这么多时间... 你们公司有什么神器吗？评论区聊聊～ #职场 #好物推荐 #打工人 #避坑指南 #真实分享 ``` ### Example 2: 美妆种草 ``` 姐妹们！这个粉底液我要回购一辈子！ （图：对比图） 讲真我之前也踩过不少雷，直到... （使用感受） 闭眼入！不好用来打我！ #美妆 #粉底液 #种草 #真实分享 #必买 ``` ## Common Hashtags - #种草 #必看 #真实分享 #好物推荐 - #打工人 #学生党 #租房 #装修 - #教程 #避坑 #测评 #红黑榜


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bytesagain-lab/privacy-policy (version 2.0.1)

--- version: "2.0.0" name: Privacy Policy Generator description: "Privacy Policy Generator - 隐私政策生成器. Use when you need privacy policy capabilities. Triggers on: privacy policy." 隐私政策生成器。GDPR/CCPA合规、App/网站隐私政策、合规审计。Privacy policy generator with GDPR, CCPA compliance. 隐私政策、合规。 author: BytesAgain homepage: https://bytesagain.com source: https://github.com/bytesagain/ai-skills --- # Privacy Policy Generator 隐私政策生成器。GDPR/CCPA合规、App/网站隐私政策、合规审计。Privacy policy generator with GDPR, CCPA compliance. 隐私政策、合规。 ## 速查表 See commands above. ## 命令列表 | 命令 | 功能 | |------|------| | `generate` | generate | | `gdpr` | gdpr | | `ccpa` | ccpa | | `app` | app | | `website` | website | | `audit` | audit | > 💡 小技巧：先用 `help` 查看所有命令，再选择最适合的 --- *Privacy Policy Generator by BytesAgain* --- 💬 Feedback & Feature Requests: https://bytesagain.com/feedback Powered by BytesAgain | bytesagain.com ## Commands - `Analytics` — Analytics - `generate` — company "MyApp" --email "[REDACTED_SECRET]" [--type web|app|both] - `gdpr` — company "MyApp" --email "[REDACTED_SECRET]" - `ccpa` — company "MyApp" --email "[REDACTED_SECRET]" ## Examples ```bash # Show help privacy-policy help # Run privacy-policy run ``` - Run `privacy-policy help` for all commands ## Requirements - bash 4+ - python3 (standard library only)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: freeter226/base64-toolkit (version 1.0.0)

--- name: base64-toolkit description: Base64 encoding and decoding toolkit. Encode/decode text, URL-safe Base64, and image to Base64 conversion. metadata: { "openclaw": { "emoji": "🔐", "requires": { "bins": ["python3"] } } } --- # Base64 Toolkit A comprehensive Base64 encoding and decoding tool for developers. ## Features - **Encode** - Convert text to Base64 - **Decode** - Convert Base64 back to text - **URL-Safe** - URL-safe Base64 encoding (+/- instead of /+) - **Image to Base64** - Convert images to Base64 data URI ## Usage ```bash python3 skills/base64-toolkit/scripts/base64_toolkit.py <action> [options] ``` ## Actions | Action | Description | |--------|-------------| | `encode` | Encode text to Base64 | | `decode` | Decode Base64 to text | | `encode-url` | URL-safe Base64 encoding | | `decode-url` | URL-safe Base64 decoding | | `image-encode` | Convert image to Base64 data URI | ## Options | Option | Type | Default | Description | |--------|------|---------|-------------| | `--input` | string | - | Input string or file path | | `--file` | bool | false | Treat input as file path | ## Examples ```bash # Encode text python3 skills/base64-toolkit/scripts/base64_toolkit.py encode --input "Hello, World!" # Decode Base64 python3 skills/base64-toolkit/scripts/base64_toolkit.py decode --input "SGVsbG8sIFdvcmxkIQ==" # URL-safe encode python3 skills/base64-toolkit/scripts/base64_toolkit.py encode-url --input "Hello+World?" # URL-safe decode python3 skills/base64-toolkit/scripts/base64_toolkit.py decode-url --input "SGVsbG8rV29ybGQ_" # Image to Base64 python3 skills/base64-toolkit/scripts/base64_toolkit.py image-encode --input /path/to/image.png ``` ## Use Cases 1. **API authentication** - Encode credentials for Basic Auth 2. **Data transmission** - Safely transmit binary data as text 3. **URL parameters** - Use URL-safe Base64 in URLs 4. **Image embedding** - Embed images in HTML/CSS as data URIs 5. **JWT tokens** - Decode and inspect JWT payload ## Current Status Ready for testing.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: tom859174-sketch/tcm-netdisk-marketer (version 1.0.0)

--- name: tcm-netdisk-marketer description: 中医资料营销专家 - 生成公众号/知乎推广文案（纯 Prompt 技能） metadata: openclaw: emoji: "📝" --- # 中医资料营销专家 ## 概述 此技能是一个精通中医资料分类与全网内容营销的专家，能够将用户提供的"带提取码网盘链接"进行深度加工，针对"微信公众号"和"知乎"的不同调性，生成高点击、高转化的推广文案。 **注意**：这是一个**纯 Prompt 技能**，只负责生成文案内容。如需保存为 DOCX 文件，请使用 `save-to-word` 技能。 ## 工作流程（SOP） 1. **深度解析与合并**：提取文件名关键词，识别同类不同格式（PDF/视频等）并归为一组。确认链接是否已包含 `?pwd=` 参数。 2. **扫描与方案确认（必经步骤）**：首先输出《资料库透视报告》（包含资源清单和建议分组方向）。等待用户选择分组逻辑后，再开始写作。 3. **公众号深度模式**：采用"书籍介绍 + 立即获取"结构，字数 1200-2000 字，附带直接链接。 4. **知乎高赞模式**：采用亲历式分享，正文严禁链接（替换为"见评论区"），字数 800-1500 字。 5. **评论区一键复制区**：在知乎文案后提供独立代码块，包含所需链接，供直接复制。 ## 使用方法 ### 基本用法 对 OpenClaw 说： ``` 请根据以下资料生成知乎推广文案： 《黄帝内经》.pdf, 链接：https://pan.baidu.com/s/xxx pwd:1234 ``` ### 保存为 DOCX 生成文案后，对 OpenClaw 说： ``` 使用 save-to-word 技能，将以上内容保存为"中医资料知乎文案" ``` 或者一次性说完： ``` 请生成一篇知乎风格的中医资料推广文案，然后用 save-to-word 保存为 docx ``` ## 异常处理 - 如果链接无提取码，会提示用户补充 - 如果内容跨度过大，会给出建议并请求用户确认 ## 示例 ### 示例 1：生成公众号文案 ``` 请根据以下资料生成公众号推广文案： 《伤寒论》《金匮要略》合集，链接：https://pan.baidu.com/s/xxx pwd:abcd ``` ### 示例 2：生成知乎文案并保存 ``` 请生成一篇知乎风格的中医资料推广文案，然后用 save-to-word 保存为 docx 资料：《黄帝内经》全集，链接：https://pan.baidu.com/s/xxx pwd:1234 ``` ## 与其他技能的配合 此技能设计为与 `save-to-word` 技能配合使用： 1. `tcm-netdisk-marketer` 负责生成文案内容 2. `save-to-word` 负责将文案保存为 DOCX 文件 ## 故障排除 ### 问题：文案生成后无法保存 **解决**: 使用 `save-to-word` 技能，确保已安装 `python-docx` 库 ### 问题：生成的文案格式不对 **解决**: 请明确指定平台类型（公众号/知乎）


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mvogt99/missing-input-validation (version 1.0.0)

--- name: missing-input-validation description: External input flows into sensitive operations without being checked for type, shape, range, or sanitization. emoji: 🛡️ metadata: clawdis: os: [macos, linux, windows] --- # missing-input-validation Any data from outside the process — HTTP request bodies, CLI args, file contents, third-party API responses, user messages — should be treated as untrusted until proven otherwise. Code that uses it directly opens injection, crash, and security paths. ## Symptoms - HTTP handler uses `request.body.x` with no type check. - CLI flag value passed straight into `exec`, `SQL`, or a file path. - Third-party API response fields accessed without confirming they exist. - Numeric input used in array indexing or arithmetic with no bounds check. - String input concatenated into SQL, shell commands, or file paths. ## What to do - At every trust boundary, validate type, shape, and range before using the value. Reject early with a clear error message. - For structured payloads, use a schema validator (Zod, Pydantic, ArkType, etc.) — don't hand-write "if field exists". - For values used in SQL, shell, or file paths, use parameterized queries, `execFile` with an argv array, or explicit path joins — never string concatenation. - When an invariant is checked, include the unexpected value in the error so debugging is possible. - Third-party responses are *not* trustworthy. Validate them the same way you'd validate user input.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: naliehu/youtube-watcherkx (version 1.0.0)

--- name: youtube-watcher description: Fetch and read transcripts from YouTube videos. Use when you need to summarize a video, answer questions about its content, or extract information from it. author: michael gathara version: 1.0.0 triggers: - "watch youtube" - "summarize video" - "video transcript" - "youtube summary" - "analyze video" metadata: {"clawdbot":{"emoji":"📺","requires":{"bins":["yt-dlp"]},"install":[{"id":"brew","kind":"brew","formula":"yt-dlp","bins":["yt-dlp"],"label":"Install yt-dlp (brew)"},{"id":"pip","kind":"pip","package":"yt-dlp","bins":["yt-dlp"],"label":"Install yt-dlp (pip)"}]}} --- # YouTube Watcher ## Usage ### Get Transcript Retrieve the text transcript of a video. ```bash python3 {baseDir}/scripts/get_transcript.py "https://www.youtube.com/watch?v=VIDEO_ID" ``` ## Examples **Summarize a video:** 1. Get the transcript: ```bash python3 {baseDir}/scripts/get_transcript.py "https://www.youtube.com/watch?v=dQw4w9WgXcQ" ``` 2. Read the output and summarize it for the user. **Find specific information:** 1. Get the transcript. 2. Search the text for keywords or answer the user's question based on the content. ## Notes - Requires `yt-dlp` to be installed and available in the PATH. - Works with videos that have closed captions (CC) or auto-generated subtitles. - If a video has no subtitles, the script will fail with an error message.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)