OpenClaw/clawhub-security-signals huggingface dataset:
Skill: jkzfhq/psyvector-pv38 (version 3.0.0)

--- name: "PV_38" slug: "psyvector-pv38" description: "热点追踪、爆款跟进" version: "3.0.0" author: "PsyVector Hub" price: "$9.90" tags: - "PsyVector" - "Digital-Worker" clawdbot: emoji: "⚡" --- ## 热点 AI **中文**: 表情包跟进网络爆点 **English**: Viral content follow ## 配置参数 | 参数 | 值 | 说明 | |------|-----|------| | response_delay | 0.2s | 响应延迟 | | speech_speed | 1.2 | 语速倍率 | | caution_coefficient | 0.1 | 谨慎系数 | | risk_reminder | False | 风险提醒 | ## 使用方法 ```bash clawhub install psyvector-pv38 ``` ## 人格说明 动量型内核 - 快速响应，高频交易，危机处理 --- ## 🧠 长期记忆能力 本数字员工具备持久记忆功能，自动记住用户偏好、决策和重要信息。 ### 记忆存储 (自动调用) ```python import os, json, hashlib from datetime import datetime PALACE_PATH = os.path.expanduser("~/.openclaw/pv_palace/") def store_memory(content, importance=5, tags=None): """存储记忆到本地宫殿""" os.makedirs(PALACE_PATH, exist_ok=True) path = os.path.join(PALACE_PATH, "memories.json") data = {"memories": [], "index": {}} if not os.path.exists(path) else json.load(open(path)) mem_id = hashlib.sha256(f"{content}{datetime.now().isoformat()}".encode()).hexdigest()[:12] memory = {"id": mem_id, "content": content, "importance": importance, "tags": tags or [], "created_at": datetime.now().isoformat()} data["memories"].append(memory) for tag in (tags or []): data["index"].setdefault(tag, []).append(mem_id) json.dump(data, open(path, 'w'), ensure_ascii=False, indent=2) return f"✓ 记忆已存储 ({importance}/10)" ``` ### 记忆搜索 (自动调用) ```python def search_memories(query, limit=5): """搜索记忆""" path = os.path.join(PALACE_PATH, "memories.json") if not os.path.exists(path): return [] data = json.load(open(path)) results = [m for m in data["memories"] if query.lower() in m["content"].lower()] results.sort(key=lambda x: x.get("importance", 0), reverse=True) return results[:limit] ``` ### 获取上下文摘要 ```python def get_context(limit=10): """获取记忆上下文""" path = os.path.join(PALACE_PATH, "memories.json") if not os.path.exists(path): return "暂无记忆" data = json.load(open(path)) memories = sorted(data["memories"], key=lambda x: x.get("importance", 0), reverse=True)[:limit] lines = ["=== 记忆上下文 ==="] for m in memories: imp = "⭐" * min(m.get("importance", 5), 5) tags = ", ".join(m.get("tags", [])[:3]) lines.append(f"{imp} {m['content'][:60]}") if tags: lines.append(f" [{tags}]") return "\n".join(lines) ``` ### 使用场景 | 场景 | AI行为 | |------|--------| | 用户表达偏好 | 自动调用 `store_memory(内容, importance=8, tags=["偏好"])` | | 重要决策 | 自动调用 `store_memory(决策内容, importance=9, tags=["决策"])` | | 用户询问"记得吗" | 自动调用 `search_memories(关键词)` | | 新会话开始 | 自动调用 `get_context()` 加载记忆 | ### 执行命令 ```bash # 存储记忆 python3 -c "from pv_memory import store_memory; store_memory('用户喜欢XX', 8, ['偏好'])" # 搜索记忆 python3 -c "from pv_memory import search_memories; print(search_memories('用户'))" # 查看上下文 python3 -c "from pv_memory import get_context; print(get_context())" ``` --- *本数字员工配备持久记忆系统，基于PsyVector Palace架构*


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: cpppppp7/fluxa-x402-payment (version 1.0.0)

--- name: fluxA-x402-payment description: A FluxA Agent Wallet skill that enables agents to request budgets, sign x402 payments, and call paid endpoints autonomously. It walks through the full flow—from mandate creation to X-PAYMENT execution—so agents can perform paid actions without human intervention. --- ## Quick Start Step 1: Apply for a budget mandate <!-- --> ```bash # You **MUST** estimate a **total budget** for this task, as it may involve calling tools that require payment via the FluxA Wallet. # It is recommended to budget **1.5×** the estimated cost. # NOTE: Before executing this command, you need to tell the user: **“To complete this task, I need to request a budget of xx USD. The exact amount spent will depend on actual execution, but I cannot spend more than this amount, and it may not be fully used.”** node ./scripts/fluxa-cli.bundle.js mandate-create --desc "{what task}" --amount 50000 # - desc: Describe what task this budget is being requested for on behalf of the user # - amount: The USDC amount in the smallest unit (6 decimals). For example, 1_000_000 represents 1 USDC. # NOTE # You need to remember the mandate ID to request the actual payment later, and ask the user to approve the authorization. # You can wait about 10 seconds and then check the status using this method. node ./scripts/fluxa-cli.bundle.js mandate-status --id <mandate-id> ``` Step 2: Use the budget mandate to request a payment signature (payment mandate) ``` node ./scripts/fluxa-cli.bundle.js x402-v3 \ --mandate <MANDATE_ID> \ --payload '<JSON>' # Get `data.xPaymentB64` from response as PAYMENT_MANDATE # This PAYMENT_MANDATE is sent to the server via the **X-Payment HTTP header** to complete the payment. curl -H "X-PAYMENT: $PAYMENT_MANDATE" https://api.example.com/paid-endpoint ``` ## Example ``` node ./scripts/fluxa-cli.bundle.js x402-v3 \ --mandate mand_Yfbpmb9PVZl05VaeR9nvQg \ --payload '{ "x402Version": 1, "accepts": [{ "scheme": "exact", ... "extra": { "name": "USD Coin", "version": "2" } }] }' ## output: { "success": true, "data": { "X-PAYMENT": "base64-encoded-payment-header..." } } ``` ## Others * Error handing during payment flow(fluxa-cli or server error): see ./error-handle.md


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: ivangdavila/mlops (version 1.0.0)

--- name: MLOps slug: mlops version: 1.0.0 description: "Deploy ML models to production with pipelines, monitoring, serving, and reproducibility best practices." metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":[]},"os":["linux","darwin","win32"]}} --- ## Quick Reference | Topic | File | Key Trap | |-------|------|----------| | CI/CD and DAGs | `pipelines.md` | Coupling training/inference deps | | Model serving | `serving.md` | Cold start with large models | | Drift and alerts | `monitoring.md` | Only technical metrics | | Versioning | `reproducibility.md` | Not versioning preprocessing | | GPU infrastructure | `gpu.md` | GPU request = full device | ## Critical Traps **Training-Serving Skew:** - Preprocessing in notebook ≠ preprocessing in service → silent bugs - Pandas in notebook → memory leaks in production (use native types) - Feature store values at training time ≠ serving time without proper joins **GPU Memory:** - `requests.nvidia.com/gpu: 1` reserves ENTIRE GPU, not partial memory - MIG/MPS sharing has real limitations (not plug-and-play) - OOM on GPU kills pod with no useful logs **Model Versioning ≠ Code Versioning:** - Model artifacts need separate versioning (MLflow, W&B, DVC) - Training data version + preprocessing version + code version = reproducibility - Rollback requires keeping old model versions deployable **Drift Detection Timing:** - Retraining trigger isn't just "drift > threshold" → cost/benefit matters - Delayed ground truth makes concept drift detection lag weeks - Upstream data pipeline changes cause drift without model issues ## Scope This skill ONLY covers: - CI/CD pipelines for models - Model serving and scaling - Monitoring and drift detection - Reproducibility practices - GPU infrastructure patterns Does NOT cover: ML algorithms, feature engineering, hyperparameter tuning.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: joeavaib/cxm-neural-memory (version 1.0.3)

--- name: cxm-neural-memory description: Use this skill when you need to understand the architecture of a codebase, perform semantic searches across files, map dependencies before refactoring, or ingest non-code documentation into your context memory. It leverages the CXM (ContextMachine) tool to prevent context collapse. --- # CXM Neural Memory Skill This skill provides you with a localized "Neural Memory" and architectural mapping tool. It allows you to find code semantically and map dependencies using bundled AST-parsing tools. ## 🔒 Security & Transparency (Disclosure) To ensure safe and transparent operation, be aware of the following behaviors: - **Local Indexing:** This skill performs recursive file reads within the project to build a local vector index (FAISS) stored in `~/.cxm`. - **Resource Footprint:** Initial indexing is CPU-intensive. Runtime RAM usage ranges from ~300MB (Mini-BERT) to ~1GB (MPNet). - **Network Access:** On the very first execution, this skill will download a pre-trained model (~80MB to ~400MB) from the HuggingFace Hub. No project data is ever uploaded. - **File Modification:** The tool can patch files. It strictly respects the `allowed_write_paths` and `mode` (e.g., `ask_first`) defined in the project's `.cxm.yaml`. ## 🛠️ Local Engine Usage You are already bundled with the CXM source code. All commands must be executed via the local `src/cli.py` script. **Crucial Instruction:** Always use the `--agent-mode` flag to receive strict, parseable JSON. ## Core Capabilities & Usage ### 1. Semantic Search (Vibe Searching) Use this when you need to find logic by its purpose, even if you don't know the exact file name or variable names. **Command:** ```bash python src/cli.py --agent-mode harvest --semantic "your natural language query" ``` **Interpretation:** The JSON output contains a `results` array with `path`, `content`, and `start_line`/`end_line` for precise targeting. ### 2. Dependency Graphing (Architectural Mapping) Use this before refactoring to see which files or modules depend on your target file. **Command:** ```bash python src/cli.py --agent-mode map path/to/file.py ``` **Interpretation:** The JSON output includes an `edges` list and a `hotspots` array showing the most heavily used modules in the project. ### 3. Architecture Ingestion Force CXM to index non-code files like `README.md`, `docker-compose.yml`, or `package.json` to understand the system's infrastructure. **Command:** ```bash python src/cli.py --agent-mode ingest . ``` ## Workflow for Complex Refactoring 1. **Locate:** Use `semantic search` to find the relevant code sections. 2. **Map:** Run `map` on the identified files to see the blast radius. 3. **Execute:** Apply your changes knowing the full architectural context.


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: 1204tmax/auto-diary (version 1.0.0)

--- name: diary description: 个人日记自动化 skill。用于按天生成日记文本并导出 1080px 图片；支持首次自动初始化、读取 SOUL/MEMORY/每日记忆素材、保持写作风格连续性。适用于用户要求“写日记/生成日记图片/补昨天日记/自动日记归档”等场景。 --- # 日记（Diary）Skill ## 目标 在需要写日记时，一键完成： 1. 自动检查并初始化配置 2. 读取素材（SOUL、MEMORY、daily memory、近几天日记） 3. 生成目标日期日记文本 4. 渲染为 1080px 宽图片 ## 执行流程 ### Step 0：配置检查 - 若 `config.yaml` 存在：进入主流程 - 若不存在：按 `config.template.yaml` 自动初始化并继续 ### Step 1：确定目标日期 - 使用 `environment.timezone` - 默认目标：昨天（当前日期 - 1） ### Step 2：收集素材 必读： - `paths.soul_path` - `paths.memory_root_path` - `paths.daily_memory_dir/YYYY-MM-DD.md` 建议读取： - `paths.diary_text_dir` 最近 7 天日记（避免重复句式） - 可选新闻摘要目录（若存在） ### Step 3：写作 - 第一人称 - 真实、自然、有情绪与想法 - 禁止流水账式罗列 - 不编造不存在的事实 - 保存到 `<diary_text_dir>/YYYY-MM-DD.md` ### Step 4：生成图片 - 使用 `diary-template.html` 渲染 - 输出宽度必须为 `output.image_width`（默认 1080） - 高度自适应内容 - 输出路径：`<diary_text_dir>/diary-YYYY-MM-DD.png` ### Step 5：返回结果 返回： - `date` - `text_path` - `image_path` - `image_size` ## 约束 - 不覆盖已存在的同日期日记（除非用户明确要求） - 声称完成时必须给出实际输出路径 - 仅在缺文件时创建目录，不删除已有内容


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: infniu/notion-to-mindmap (version 1.0.0)

--- name: notion-to-mindmap description: 将 Notion 导出的 HTML 文件转换为可交互的思维导图 HTML。支持右键跳转到 Notion 页面链接、搜索、缩放、展开/折叠等功能。当用户提供 Notion HTML 导出文件、提到"思维导图"、"mindmap"、或希望可视化 Notion 页面结构时使用。 --- # Notion to Mind Map 将用户的 Notion HTML 导出转换为可交互的思维导图。 ## 核心交互功能 | 操作 | 效果 | |------|------| | 空白处拖拽 | 平移画布 | | 鼠标滚轮 | 缩放（每级 5%，右下角显示比例） | | 左键单击节点 | 展开/折叠（位置保持不变） | | Ctrl+左键 | 直接在浏览器打开 Notion 页面 | | 右键节点 | 复制链接 / 聚焦此页面 | | Ctrl+F | 聚焦搜索框，实时高亮跳转 | ## 顶部工具栏 - **重置**：展开到第 2 级，100% 缩放 - **适应屏幕**：自动缩放显示全部展开节点 - **展开全部** / **折叠全部** - **统计**：显示页面总数和最大层级 ## 使用方式 用户只需要发送 Notion 导出的 `index.html` 文件给我，我会自动完成所有转换工作，输出可直接打开的 `mindmap.html`。 ### 工作流程 1. 用户发送 Notion 导出的 `index.html` 2. 我运行 `build_mindmap.py` 解析 HTML → 生成 `mindmap_data.json` 3. 我运行 `generate_html.py` 生成 `mindmap.html` 4. 我将 `mindmap.html` 返回给用户 ### 依赖要求 需要 BeautifulSoup4： ```bash pip install beautifulsoup4 ``` ## Notion 链接说明 生成的 Notion 链接格式为：`https://www.notion.so/<workspace>/<page-id>` 如果用户需要自定义工作空间前缀（默认从 HTML 中解析），可以修改 `build_mindmap.py` 中的 `NOTION_BASE` 常量。 ## 数据结构说明 页面层级对应： - Level 0：根节点（工作空间名称） - Level 1：一级页面（Notion 导出的顶层页面） - Level 2+：逐级展开 脚本会自动跳过 CSV 数据库条目，并从 `<ul id>` 中提取真实的 32 位页面 UUID。 ## 详细参考 - [README.md](README.md) — 完整的 Notion 链接格式、层级定义、交互细节


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: kaiyuelv/form-builder-pro (version 1.0.0)

--- name: form-builder-pro description: 表单构建器专业版 - 支持JSON Schema验证、动态渲染、条件逻辑的表单引擎 | Form Builder Pro - JSON Schema validation, dynamic rendering, conditional logic form engine homepage: https://github.com/kaiyuelv/form-builder-pro category: form tags: - form - jsonschema - validation - builder - dynamic - yaml - template version: 1.0.0 --- # 表单构建器专业版 强大的表单生成与验证工具，支持JSON Schema、YAML配置、条件渲染等高级功能。 ## 概述 本Skill提供完整的表单解决方案： - JSON Schema 表单定义与验证 - YAML 配置文件支持 - 动态表单渲染 - 字段条件显示逻辑 - 多步骤向导表单 - 自定义验证规则 - Jinja2 模板引擎 - 表单数据序列化/反序列化 ## 依赖 - Python >= 3.8 - jsonschema >= 4.19.0 - pyyaml >= 6.0 - jinja2 >= 3.1.0 ## 文件结构 ``` form-builder-pro/ ├── SKILL.md # 本文件 ├── README.md # 使用文档 ├── requirements.txt # 依赖声明 ├── scripts/ │ └── form_engine.py # 表单引擎脚本 ├── examples/ │ └── basic_usage.py # 使用示例 └── tests/ └── test_form.py # 单元测试 ``` ## 快速开始 ```python from scripts.form_engine import FormBuilder, Field # 创建表单 builder = FormBuilder() # 添加字段 builder.add_field(Field( name="email", type="email", label="电子邮箱", required=True, validation={"pattern": r"^[\w\.-]+@[\w\.-]+\.\w+$"} )) # 从YAML加载表单 form = builder.load_from_yaml("form_config.yaml") # 验证数据 result = form.validate({"email": "[REDACTED_SECRET]"}) ``` ## 许可证 MIT --- # Form Builder Pro Powerful form generation and validation tool supporting JSON Schema, YAML config, conditional rendering. ## Overview This Skill provides a complete form solution: - JSON Schema form definition and validation - YAML configuration file support - Dynamic form rendering - Field conditional display logic - Multi-step wizard forms - Custom validation rules - Jinja2 template engine - Form data serialization/deserialization ## Dependencies - Python >= 3.8 - jsonschema >= 4.19.0 - pyyaml >= 6.0 - jinja2 >= 3.1.0 ## File Structure ``` form-builder-pro/ ├── SKILL.md # This file ├── README.md # Usage documentation ├── requirements.txt # Dependencies ├── scripts/ │ └── form_engine.py # Form engine script ├── examples/ │ └── basic_usage.py # Usage examples └── tests/ └── test_form.py # Unit tests ``` ## Quick Start ```python from scripts.form_engine import FormBuilder, Field # Create form builder = FormBuilder() # Add fields builder.add_field(Field( name="email", type="email", label="Email", required=True, validation={"pattern": r"^[\w\.-]+@[\w\.-]+\.\w+$"} )) # Load from YAML form = builder.load_from_yaml("form_config.yaml") # Validate data result = form.validate({"email": "[REDACTED_SECRET]"}) ``` ## License MIT

path: requirements.txt
content: jsonschema>=4.19.0
pyyaml>=6.0
jinja2>=3.1.0


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: hudeven/chichi-speech (version 1.0.2)

--- name: chichi-speech description: A RESTful service for high-quality text-to-speech using Qwen3 and specialized voice cloning. Optimized for reusing a specific voice prompt to avoid re-computation. --- # Chichi Speech Service This skill provides a FastAPI-based REST service for Qwen3 TTS, specifically configured for reusing a high-quality reference audio prompt for efficient and consistent voice cloning. This service is packaged as an installable CLI. ## Installation Prerequisites: `python >= 3.10`. ```bash pip install -e . ``` ## Usage ### 1. Start the Service The service runs on port **9090** by default. ```bash # Start the server (runs in foreground, use & for background or a separate terminal) # Optional: Uudate to your own reference audio and text for voice cloning chichi-speech --port 9090 --host 127.0.0.1 --ref-audio "https://qianwen-res.oss-cn-beijing.aliyuncs.com/Qwen3-TTS-Repo/clone_2.wav" --ref-text "Okay. Yeah. I resent you. I love you. I respect you. But you know what? You blew it! And thanks to you." ``` ### 2. Verify Service is Running Check the health/docs: ```bash curl http://localhost:9090/docs ``` ### 3. Generate Speech Use cURL: ```bash curl -X POST "http://localhost:9090/synthesize" \ -H "Content-Type: application/json" \ -d '{ "text": "Nice to meet you", "language": "English" }' \ --output output/nice_to_meet.wav ``` ## Functionality - **Endpoint**: `POST /synthesize` - **Default Port**: 9090 - **Voice Cloning**: Uses a pre-computed voice prompt from reference files to ensure the cloned voice is consistent and generation is fast. ## Requirements - Python 3.10+ - `qwen-tts` (Qwen3 model library) - Access to a reference audio file for voice cloning. - By default, it uses public sample audio from Qwen3. - **CRITICAL**: You can provide your own reference audio using the `--ref-audio` and `--ref-text` flags.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: axelhu/plane-project-manager (version 1.0.3)

# Plane 项目管理技能 通过 Plane API 管理项目、任务、文档。 ## 凭证设置 创建 `~/.config/plane/credentials.json`： ```json { "PLANE_URL": "http://localhost:8888", "PLANE_EMAIL": "你的 Plane 邮箱", "PLANE_PASSWORD": "你的密码", "PLANE_API_TOKEN": "plane_api_你的实际APIKey" } ``` > ⚠️ **API Token 是敏感信息**，不要明文写在代码或文档里。 ## 快速开始 ### 1. 获取 API Token 登录 Plane 后访问： ``` http://localhost:8888/api/v1/users/me/api-tokens/ ``` ### 2. 测试连接 ```bash curl -s "http://localhost:8888/api/v1/workspaces/" \ -H "X-[REDACTED_SECRET]" ``` ### 3. 常用操作 详见 `references/api-examples.md` ## 注意事项 - 所有 API 请求必须在 `X-API-Key` header 中包含有效的 API Token - 使用前请将代码和文档中的示例 key 替换为实际值 - 项目权限不足时，联系 Workspace Admin 在 Plane UI 中添加你为成员


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: clawdiri-ai/einstein-research (version 1.0.0)

--- name: Einstein Research Suite description: > A complete quantitative market research toolkit for serious traders and investors. Includes 11 specialized skills covering backtesting, breadth analysis, bubble detection, follow-through day signals, options strategy, portfolio risk, macro regime detection, scenario analysis, and market theme tracking. metadata: pack: true includes: - einstein-research-backtest-dv - einstein-research-backtest-engine-dv - einstein-research-breadth-dv - einstein-research-bubble-dv - einstein-research-edge-dv - einstein-research-ftd-dv - einstein-research-options-dv - einstein-research-portfolio-risk-dv - einstein-research-regime-dv - einstein-research-scenario-dv - einstein-research-themes-dv --- # Einstein Research Suite Professional quantitative market research for active traders and investors. ## Included Skills 1. **Backtest Expert** — Methodology for systematic strategy validation 2. **Backtest Engine** — Run backtests on historical data with full metrics 3. **Market Breadth Analyzer** — 0-100 composite breadth health score 4. **Market Bubble Detector** — Quantitative bubble risk assessment 5. **Edge Candidate Generator** — Turn observations into research tickets 6. **Follow-Through Day Detector** — O'Neil FTD market bottom signals 7. **Options Strategy Advisor** — Black-Scholes pricing, Greeks, P&L simulation 8. **Portfolio Risk Analyzer** — VaR, stress testing, correlation matrix 9. **Macro Regime Detector** — Cross-asset regime transition detection 10. **Headline Scenario Analyzer** — 18-month scenario projections from news 11. **Market Theme Detector** — Trending themes with lifecycle scoring ## Quick Start Install all skills in this pack: ```bash clawhub install einstein-research-backtest-dv clawhub install einstein-research-backtest-engine-dv clawhub install einstein-research-breadth-dv clawhub install einstein-research-bubble-dv clawhub install einstein-research-edge-dv clawhub install einstein-research-ftd-dv clawhub install einstein-research-options-dv clawhub install einstein-research-portfolio-risk-dv clawhub install einstein-research-regime-dv clawhub install einstein-research-scenario-dv clawhub install einstein-research-themes-dv ``` ## License MIT


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bovinphang/monorepo-project-standard (version 1.0.0)

--- name: monorepo-project-standard description: Monorepo 项目规范，涵盖 pnpm workspace、Turborepo、Nx 的目录结构、依赖管理、任务编排、包发布。当用户提到 monorepo、workspace、多包、pnpm workspace、Turborepo、Nx 时自动激活。 version: 1.0.0 --- # Monorepo 项目规范 适用于使用 pnpm workspace、Turborepo 或 Nx 的多包前端仓库。 ## 适用场景 - 新建或调整 Monorepo 结构 - 管理多包依赖与任务 - 配置 Turborepo / Nx 任务编排 - 包发布与版本管理 ## 工具选择 | 工具 | 适用 | 特点 | |------|------|------| | **pnpm workspace** | 基础 | 依赖提升、链接、脚本聚合 | | **Turborepo** | 推荐 | 缓存、并行、依赖图 | | **Nx** | 大型 | 增量构建、云缓存、插件生态 | ## 目录结构 ### pnpm + Turborepo ``` ├── package.json # 根 package，workspace 配置 ├── pnpm-workspace.yaml # workspace 包列表 ├── turbo.json # Turborepo 配置 │ ├── apps/ │ ├── web/ # 主应用 │ │ ├── package.json │ │ └── ... │ ├── admin/ # 管理后台 │ └── docs/ # 文档站 │ ├── packages/ │ ├── ui/ # 共享 UI 组件 │ │ ├── package.json │ │ └── src/ │ ├── utils/ # 工具函数 │ ├── config-eslint/ # 共享 ESLint 配置 │ └── config-typescript/ # 共享 TS 配置 │ └── tooling/ # 构建/测试工具（可选） └── scripts/ ``` ### pnpm-workspace.yaml ```yaml packages: - 'apps/*' - 'packages/*' ``` ## 依赖管理 - 内部包使用 `workspace:*` 协议 - 根 `package.json` 统一部分依赖版本，子包可覆盖 - 禁止循环依赖，通过 `pnpm why` 检查 ```json { "dependencies": { "@repo/ui": "workspace:*", "@repo/utils": "workspace:*" } } ``` ## Turborepo 任务编排 ```json { "$schema": "https://turbo.build/schema.json", "tasks": { "build": { "dependsOn": ["^build"], "outputs": ["dist/**", ".next/**"] }, "lint": { "dependsOn": ["^build"] }, "test": { "dependsOn": ["^build"] } } } ``` - `^build` 表示先执行依赖包的 build - `outputs` 用于缓存命中判断 ## Nx 任务编排 ```json { "targetDefaults": { "build": { "dependsOn": ["^build"], "outputs": ["{projectRoot}/dist"], "cache": true } } } ``` ## 包命名 - 内部包：`@org/package-name` 或 `@repo/package-name` - 发布到 npm：遵循 `@scope/name` 规范 ## 强约束 - 子包之间通过 `workspace:*` 引用，不发布到 npm 再安装 - 共享配置（ESLint、TS）放在 `packages/config-*`，子包 extends - 构建顺序由依赖图决定，不手动指定无关依赖 - 根目录执行 `pnpm -r build` 或 `turbo run build` 时，所有包按序构建


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)