OpenClaw/clawhub-security-signals huggingface dataset:
Skill: 0xrag/fund (version 0.1.0)

--- name: fund description: Add money to the wallet. Use when you or the user want to fund, deposit, top up, load, buy USDC, add funds, onramp, or get USDC. Also use when the wallet has insufficient balance for a send or trade operation, or when someone asks "how do I get USDC?" user-invocable: true disable-model-invocation: false allowed-tools: ["Bash(npx awal@latest status*)", "Bash(npx awal@latest show*)", "Bash(npx awal@latest address*)", "Bash(npx awal@latest balance*)"] --- # Funding the Wallet Use the wallet companion app to fund the wallet with USDC via Coinbase Onramp. This supports multiple payment methods including Apple Pay, debit cards, bank transfers, and funding from a Coinbase account. ## Confirm wallet is initialized and authed ```bash npx awal@latest status ``` If the wallet is not authenticated, refer to the `authenticate-wallet` skill. ## Opening the Funding Interface ```bash npx awal@latest show ``` This opens the wallet companion window where users can: 1. Select a preset amount ($10, $20, $50) or enter a custom amount 2. Choose their preferred payment method 3. Complete the purchase through Coinbase Pay ## Payment Methods | Method | Description | | --------- | ---------------------------------------------- | | Apple Pay | Fast checkout with Apple Pay (where available) | | Coinbase | Transfer from existing Coinbase account | | Card | Debit card payment | | Bank | ACH bank transfer | ## Alternative You can also ask your human to send usdc on Base to your wallet address. You can find your wallet address buy running the following: ```bash npx awal@latest address ``` ## Prerequisites - Must be authenticated (`npx awal@latest status` to check) - Coinbase Onramp is available in supported regions (US, etc.) ## Flow 1. Run `npx awal@latest show` to open the wallet UI 2. Instruct the user to click the Fund button 3. User selects amount and payment method in the UI 4. User completes payment through Coinbase Pay (opens in browser) 5. USDC is deposited to the wallet once payment confirms ## Checking Balance After Funding ```bash # Check updated balance npx awal@latest balance ``` ## Notes - Funding goes through Coinbase's regulated onramp - Processing time varies by payment method (instant for card/Apple Pay, 1-3 days for bank) - Funds are deposited as USDC on Base network - If funding is not available, users can also send USDC on Base directly to the wallet address


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: noahcraft-open/invoice-generator-jp (version 1.0.0)

# Invoice Generator Create professional invoices in Markdown format. Supports multiple currencies, tax calculations, and standard invoice fields. Perfect for freelancers, consultants, and small businesses. ## When to use Use this skill when the user needs to: - Create a professional invoice for a client - Generate recurring invoices - Calculate totals with tax, discounts, and multiple line items - Format an invoice in a printable Markdown layout - Convert invoice details into a structured document ## How it works 1. Ask for sender details (business name, address, email, payment info) 2. Ask for recipient details (client name, company, address) 3. Ask for line items (description, quantity, unit price) 4. Ask for currency, tax rate, discount, and payment terms 5. Generate a complete professional invoice in Markdown ## Invoice Template ```markdown # INVOICE **Invoice #:** [AUTO-INCREMENT or USER-PROVIDED] **Date:** [CURRENT DATE] **Due Date:** [DATE + PAYMENT TERMS] --- **From:** [Business Name] [Address Line 1] [Address Line 2] [Email] | [Phone] **Bill To:** [Client Name] [Client Company] [Client Address] [Client Email] --- ## Items | # | Description | Qty | Unit Price | Amount | |---|-------------|-----|-----------|--------| | 1 | [Service/Product] | [Qty] | [Price] | [Total] | | 2 | [Service/Product] | [Qty] | [Price] | [Total] | --- | | | |---|---| | **Subtotal** | [CURRENCY] [AMOUNT] | | **Tax ([RATE]%)** | [CURRENCY] [AMOUNT] | | **Discount** | -[CURRENCY] [AMOUNT] | | **TOTAL DUE** | **[CURRENCY] [AMOUNT]** | --- ## Payment Details **Payment Method:** [Bank Transfer / PayPal / Stripe / etc.] **Bank:** [Bank Name] **Account:** [Account Number] **Routing:** [Routing Number] **Payment Terms:** [Net 30 / Due on Receipt / etc.] --- *Thank you for your business!* ``` ## Supported Currencies USD ($), EUR (€), GBP (£), JPY (¥), CAD (C$), AUD (A$), CHF, INR (₹), BRL (R$), KRW (₩), and more. Format amounts according to locale conventions. ## Calculation Rules - Subtotal = Sum of (quantity × unit price) for all line items - Tax = Subtotal × tax rate - Discount can be percentage or fixed amount - Total = Subtotal + Tax - Discount - Round to 2 decimal places (0 for JPY/KRW) ## Output Generate a clean Markdown invoice that: - Is print-ready when rendered - Uses proper currency formatting - Includes all required fields - Has clear visual hierarchy with horizontal rules - Can be easily copied and converted to PDF


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: homeofe/openclaw-docker (version 0.2.0)

--- name: openclaw-docker description: "Manage Docker containers and Compose projects via OpenClaw tools" --- # @elvatis_com/openclaw-docker OpenClaw plugin for Docker container operations and Docker Compose project control. ## Features - Docker daemon connection via unix socket or TCP - Optional TLS for remote daemon access - Read and write container tools - Docker Compose integration via `docker compose` CLI - Safety controls with `readOnly` and `allowedOperations` - Configurable command timeout ## Prerequisites - **Docker Engine** installed and running on the host - **Docker CLI** (`docker` command) available in PATH (required for Compose operations) - Access to the Docker socket (`/var/run/docker.sock`) or a remote Docker daemon via TCP ## Installation ```bash npm install @elvatis_com/openclaw-docker ``` ## Security Notes - **Use `readOnly: true`** if you only need observation (ps, logs, inspect). This limits the blast radius. - **TLS keys:** If using TCP with TLS, keep your PEM files protected. Only configure trusted certificate paths. - **Compose directories:** The plugin runs `docker compose` commands in whichever directories you configure as `composeProjects`. Only configure trusted project paths. - **Least privilege:** Run the plugin in an environment with minimal Docker permissions when possible. ## Configuration ### Local socket (default) ```json { "plugins": { "openclaw-docker": { "socketPath": "/var/run/docker.sock", "readOnly": false, "allowedOperations": ["ps", "logs", "inspect", "start", "stop", "restart", "compose_up", "compose_down", "compose_ps"], "composeProjects": [ { "name": "aegis", "path": "/opt/aegis" } ], "timeoutMs": 15000 } } } ``` ### Remote Docker daemon with TLS ```json { "plugins": { "openclaw-docker": { "host": "10.0.0.20", "port": 2376, "tls": { "caPath": "/etc/openclaw/docker/ca.pem", "certPath": "/etc/openclaw/docker/cert.pem", "keyPath": "/etc/openclaw/docker/key.pem", "rejectUnauthorized": true }, "readOnly": true, "composeProjects": [] } } } ``` ## Available Tools - `docker_ps` - `docker_logs` - `docker_inspect` - `docker_start` - `docker_stop` - `docker_restart` - `docker_compose_up` - `docker_compose_down` - `docker_compose_ps` ## Usage Examples - "List all running containers" - "Show the last 200 lines from api-gateway logs" - "Inspect redis container" - "Restart identity-service" - "Bring aegis compose project up" - "Show status of aegis compose services" ## Safety and Permissions - `readOnly: true` allows only `ps`, `logs`, `inspect`, and `compose_ps` - `allowedOperations` limits which tools can be executed - Compose operations are limited to projects in `composeProjects` - Commands use timeout protection via `timeoutMs` ## Development ```bash npm install npm run build npm test ``` ## License MIT


Security scan verdicts — ClawScan: clean | static analysis:  | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: kostja94/tiktok-ads-paid-ads (version 1.0.1)

--- name: tiktok-ads description: When the user wants to set up, optimize, or manage TikTok Ads. Also use when the user mentions "TikTok Ads," "TikTok for Business," "TikTok Pixel," "Events API," "TikTok Spark Ads," or "TikTok video ads." For organic TikTok, use tiktok-captions. metadata: version: 1.0.1 --- # Paid Ads: TikTok Ads Guides TikTok Ads setup, creative strategy, and optimization. TikTok excels at younger demographics (18–34) and viral-style video; use when your audience skews young and you have video creative capacity. **When invoking**: On **first use**, if helpful, open with 1–2 sentences on what this skill covers and why it matters, then provide the main output. On **subsequent use** or when the user asks to skip, go directly to the main output. ## Why TikTok - **Demographics**: 18–34; Gen Z and younger millennials - **Creative velocity**: Short-form; native feel; UGC-style performs well - **Cost**: Often lower CPM than Meta for reach - **Engagement**: High watch time; sound-on culture ## Ad Formats | Format | Use | |--------|-----| | **In-Feed** | Native video; 9–15s or longer; primary format | | **TopView** | First impression; premium; awareness | | **Spark Ads** | Boost organic posts; native; creator partnership | | **Collection** | Product catalog; e-commerce | ## Creative Best Practices - **Hook (0–3s)**: Pattern interrupt; question; bold statement - **Vertical**: 9:16 for feed; native to platform - **Sound**: Music and captions matter; many watch with sound - **UGC-style**: Authentic; less polished often outperforms - **First 3 seconds**: Determine if they watch ## Targeting | Type | Use | |------|-----| | **Interest** | Broad; algorithm-driven | | **Demographics** | Age; gender; location | | **Lookalike** | Based on converters or engagers | | **Retargeting** | Website visitors; video viewers | ## Tracking - **TikTok Pixel** + **Events API**: Server-side for better attribution - **UTM**: Consistent parameters for cross-platform comparison ## Budget & Bidding - **Minimum**: Varies by objective - **Bidding**: Start manual; switch to automated with conversion volume - **Creative volume**: Plan for high refresh cadence; creative is main lever ## Pre-Launch Checklist - [ ] Pixel installed; Events API configured - [ ] Vertical video creative (9:16) - [ ] Hook in first 3 seconds - [ ] Captions included - [ ] Conversion events defined ## Related Skills - **tiktok-captions**: Organic TikTok content; Spark Ads boost organic posts; video specs (9:16, captions) align - **paid-ads-strategy**: Channel selection; creative frameworks; budget allocation - **landing-page-generator**: LP for paid traffic - **analytics-tracking**: Conversion tracking; ROAS


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: hanxiao-bot/triple-memory-lake (version 1.1.0)

--- name: triple-memory-lake version: 1.1.0 description: Quad-layer memory system integration - unifies OpenClaw, Claude Code, and self-improving agent memories into a single knowledge lake --- # Triple Memory Lake 基于三个记忆系统整合的统一知识湖，已升级为四层结构。 ## 四层记忆系统 | Layer | 内容 | 更新频率 | |-------|------|----------| | L1 MEMORY.md | 铁律/人物/项目/教训 | 重大决策后 | | L2 Daily Logs | 每日工作日志 | 每日 | | L3 Sources+Patterns+Domain+Tools | 原始数据+提炼模式+领域知识+工具配置 | 定期同步 | | L4 Reviews | 自审+质量评分 | 每周一/触发时 | ## 核心功能 ### 1. 三源数据同步 - Claude Code JSONL → memory/sources/claude-code/ - self-improving metrics → memory/sources/self-improving/ - OpenClaw daily logs → memory/sources/mine/ ### 2. 模式提炼 - 错误模式汇总 → memory/patterns/error-patterns.md - 工作流模式 → memory/patterns/workflow-patterns.md - 用户偏好 → memory/patterns/user-preferences.md ### 3. 知识沉淀 - 长期记忆 → MEMORY.md - 领域知识 → memory/domain/ - 工具知识 → memory/tools/ ### 4. 自省机制 - 质量评分标准 → memory/reviews/memory-quality.md - 自审模板 → memory/reviews/self-review-template.md - 自审报告 → memory/reviews/self-review-YYYY-MM-DD.md ## 目录结构 ``` memory/ ├── index.md # 统一入口 ├── MEMORY.md # Layer 1: 长期记忆 ├── YYYY-MM-DD.md # Layer 2: 每日日志 ├── sources/ # Layer 3a: 原始数据来源 │ ├── claaude-code/ # Claude Code JSONL 日志 │ ├── self-improving/ # self-improving 指标 │ └── mine/ # OpenClaw 每日日志（预留） ├── patterns/ # Layer 3b: 提炼模式 │ ├── error-patterns.md # 错误模式汇总 │ ├── workflow-patterns.md # Captain工作流模式 │ └── user-preferences.md # 用户行为偏好 ├── domain/ # Layer 3c: 领域知识 │ ├── openclaw.md # OpenClaw配置/铁律/调度规则 │ └── stock-system.md # 股票分析系统详情 ├── tools/ # Layer 3d: 工具配置 │ ├── skills.md # Skills状态一览 │ ├── git-workflow.md # Git工作流配置 │ └── hook-system.md # Hook系统配置 └── reviews/ # Layer 4: 自省机制 ├── memory-quality.md # 记忆质量评分标准 ├── self-review-template.md # 自审报告模板 └── self-review-YYYY-MM-DD.md # 历次自审报告 ``` ## 自审触发条件 满足任一即触发自审： 1. 每周一自动自审 2. MEMORY.md 超过30天未更新 3. 发现新错误模式时 4. 用户指出记忆错误时 5. 重大系统变更后（如 OpenClaw 升级） ## 质量评分 评估维度：完整性(25%) / 准确性(30%) / 时效性(25%) / 可检索性(20%) 评分：9-10优秀 / 7-8良好 / 5-6及格 / 3-4危险 / 1-2失效 ## 使用方式 ### 查看知识湖状态 ```bash cat memory/index.md ``` ### 执行自审 ```bash # 参考 memory/reviews/self-review-template.md 生成报告 # 保存为 memory/reviews/self-review-YYYY-MM-DD.md ``` ### 同步数据源 ```bash # Claude Code cp ~/.claude/projects/*/sessions/*.jsonl memory/sources/claude-code/ # Self-improving cp ~/.openclaw/agents/*/metrics.json memory/sources/self-improving/ ``` --- _Last updated: 2026-04-03_


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: yanfenliu9014-spec/ai-writing-craft (version 1.0.0)

# AI 协作写作方法论（材料撰写篇） > 用多个 AI 协作完成高质量材料撰写。核心思想：不让 AI 替你思考，而是用它放大你的判断力。 ## 触发词 "AI 写材料"、"多 AI 写作"、"用 AI 写报告"、"怎么用 AI 写材料" ## 适用场景 - 工作材料撰写（方案、报告、PPT 文字、发言稿） - 需要深度思考而非简单输出的内容 - 高质量要求、有明确观点要输出的场景 --- ## 四步流程 ### Step 1：思想对齐与延深 **目标**：先让 AI 理解背景和目标，再让它帮你检视观点、查漏补缺 **操作**： 1. **对齐背景**：告诉 AI 这份材料的核心目标、读者是谁、要解决什么问题 2. **对齐观点**：抛出你已有的思考碎片（哪怕是大纲或几个关键词） 3. AI 做判断：哪些角度偏离目标、哪些重要维度被遗漏、逻辑上有什么漏洞 4. 你做决策：接纳还是保留自己的判断 **提示词模板**： > 背景：这份材料的目标是[读者]，[要解决什么问题/传达什么核心信息] > 我的初步想法是：[你的核心观点或大纲，哪怕不完整] > 请帮我做两件事： > 1. 检查我的想法是否偏离了目标？ > 2. 找出我忽略的重要角度或逻辑漏洞（不要直接帮我写） **原则**：AI 是裁判和镜子，不是执笔者。你先定义目标和观点，AI 才能有效检视。 --- ### Step 2：脑暴与讨论 **目标**：多 AI 对比，汇聚论据和观点雏形 **操作**： 1. 用 DeepResearch 或强推理 AI 做信息检索和初步整理 2. 调起第二个 AI（用不同的模型），对它说："我需要你帮我做批判性分析" 3. 具体任务：对比不同信息源、PUA 你的初稿、聚类相似观点、做反向提问 4. 输出：论据列表 + 初步观点雏形 **提示词模板**： > 我有一份初步观点：[粘贴你的观点] > 请从以下几个角度批判： > 1. 最大的逻辑漏洞是什么？ > 2. 哪些论据不够扎实？ > 3. 有什么重要角度被遗漏了？ > 4. 如果我要反驳这个观点，会怎么攻？ **原则**：用 AI 的多样性弥补单一 AI 的盲区。不要只问一个 AI。 --- ### Step 3：分段完成（可并行） **目标**：多 AI 并行工作，各自负责一个模块 **操作**： 1. 把完整材料拆成独立段落/模块（每个模块有明确的观点 + 事实/目标输入） 2. 每个模块分配给一个 AI，让它：对比、关联前后文、补充、纠偏 3. 最终输出：各段落内容初稿 **提示词模板**： > 你现在负责撰写材料中的"[模块名称]"部分。 > 背景：这个材料的目标读者是[读者]，要达成[目标]。 > 我希望传达的核心观点是：[本段观点]。 > 已有初步草稿：[粘贴草稿]。 > 请帮我：对比补充、关联前后文、纠正偏差、形成完整段落。 > 注意：保留我的核心观点，不要过度发挥。 **原则**：并行能节省时间，但每个模块的输入（观点+目标）必须清晰。AI 不知道你想说什么，除非你告诉它。 --- ### Step 4：整体一致性 **目标**：确保全文逻辑自洽、语言一致 **操作**： 1. 把所有段落合并，发给 AI 2. 让它检查：段落与标题逻辑是否自洽、前后语言风格是否一致、过渡是否流畅 3. 不要让它重写，只做诊断和微调 **提示词模板**： > 这是我撰写的完整材料，请帮我检查： > 1. 各段落观点是否与标题核心主题一致？ > 2. 语言风格是否统一（术语、人称、语气）？ > 3. 段落之间的过渡是否自然？ > 4. 有没有重复或矛盾的地方？ > 请标出具体问题，不要直接修改。 **原则**：这一步放在初稿完成后，目的是一致性检查，而不是重新生成。 --- ### Step 5：润色 **目标**：让人读起来像人，增加人味和可读性 **操作**： 1. 把全文发给 AI（用强调"人味"的提示词） 2. 同时考虑配图建议和文风调整 3. 最终输出：可直接使用的成稿 **提示词模板**： > 请帮我润色这份材料，要求： > 1. 读起来像有经验的人类写的，不要有 AI 痕迹（避免过度使用连接词、三段式列举、"-ing"形式开头的肤浅分析） > 2. 语言简洁有力，避免宣传性语言 > 3. 段落长短有节奏，不要均匀分布 > 4. 哪些地方可以配图或用数据可视化来增强说服力？ **原则**：润色是最后一步，做完就定稿。润色不改观点，只改表达。 --- ## 核心心法 | 原则 | 说明 | |------|------| | **你主思维，AI 放大** | 先有观点，AI 才能放大。不能让 AI替你想。 | | **多视角校验** | 用不同 AI 做对比和批判，避免单一 AI 的盲区 | | **输入决定输出** | 给 AI 的输入（观点、目标、背景）越清晰，输出越可用 | | **AI 是镜子和陪练** | 批判性提问比接受 AI 输出更重要 | | **分段并行效率高** | 拆解后并行，各段独立完成，最后统一检查一致性 | --- ## 相关技能 - `humanizer`：去除 AI 痕迹，用于 Step 5 润色 - `miaoda-web-search`（DeepResearch）：用于 Step 2 信息收集


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jackdark425/aigroup-market-mcp (version 0.1.3)

--- name: aigroup-market-mcp description: Use `aigroup-market-mcp` for China-market and Tushare-oriented data. Supported request types: A-share, index, sector, fund-flow, margin, block-trade, fund, convertible-bond, macro, and finance-news data. homepage: https://github.com/jackdark425/aigroup-market-mcp --- # Market MCP Use `aigroup-market-mcp` for China-market datasets. ## Operations - `stock_data` - `stock_data_minutes` - `basic_info` - `company_performance` - `company_performance_hk` - `company_performance_us` - `index_data` - `csi_index_constituents` - `money_flow` - `margin_trade` - `block_trade` - `dragon_tiger_inst` - `fund_data` - `fund_manager_by_name` - `convertible_bond` - `macro_econ` - `finance_news` - `hot_news_7x24` ## Dependency - Server name: `aigroup-market-mcp` - Launch pattern: `npx -y aigroup-market-mcp` - Required environment variable: `TUSHARE_TOKEN`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jorgermp/task-monitor (version 1.0.0)

--- name: task-monitor description: Real-time web dashboard for OpenClaw sessions and background tasks. Mobile-responsive with auto-refresh. version: 0.1.0 --- # Task Monitor v0.1 Real-time monitoring dashboard for OpenClaw with web interface. ## Features - 🌐 **Web Dashboard** - Beautiful, responsive UI accessible from any device - 📱 **Mobile-First** - Optimized for phones and tablets - 🔄 **Auto-Refresh** - Updates every 60 seconds - 🎨 **Modern Design** - Gradient UI with dark theme - 📊 **Live Data** - Main session, Discord, sub-agents, cron jobs - 🚀 **Fast API** - JSON endpoint with intelligent caching (30s TTL) - ⚡ **Performance** - <100ms response time (cached), ~15s cold cache ## Installation ```bash cd skills/task-monitor npm install ``` ## Usage ### Start Web Server ```bash ./scripts/start-server.sh ``` Server will run on port **3030** (accessible on LAN). **Access URLs:** - Local: `http://localhost:3030` - LAN: `http://<your-ip>:3030` ### Stop Server ```bash ./scripts/stop-server.sh ``` ### API Endpoint ```bash curl http://localhost:3030/api/status ``` Returns JSON with: - Main session stats - Discord session stats - Active sub-agents (with descriptions) - Recent cron job history ### Generate Markdown (v0.1) Legacy markdown generator still available: ```bash ./scripts/generate-dashboard.js ``` Updates `DASHBOARD.md` in workspace root. ## Automation CRON job runs every 5 minutes to update markdown dashboard: `*/5 * * * *` -> Executes `generate-dashboard.js` ## Architecture - **Backend:** Node.js + Express - **Frontend:** Pure HTML/CSS/JS (no frameworks) - **Data Source:** `openclaw sessions list --json` + `openclaw cron list --json` - **Caching:** In-memory cache with 30-second TTL - Pre-warmed on server startup - Async background refresh when expired - Stale-while-revalidate pattern for optimal UX - **Refresh:** Client-side polling (60s interval) ## Performance **Without cache:** - API response time: ~15 seconds (blocking) - Problem: Each request blocks Node.js event loop **With cache:** - Cache hit: <100ms (~365x faster) - Cache miss: ~15s (first request only) - Stale cache: <100ms while refreshing in background - Cache TTL: 30 seconds The caching system ensures: - Lightning-fast responses for most requests - No blocking of concurrent requests - Graceful degradation when cache expires


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: 377739442/hipc-config-manager (version 1.0.0)

# 技能名称：hipc_config_manager HIPC 配置管理 ## 技能描述 此技能是 HIPC 系列技能的**核心前置组件**，用于管理 API 密钥（`hipc_secret`）的生命周期。 它具备**检查**、**设置**和**格式校验**三种能力，确保在执行任何业务查询前，系统拥有合法且格式正确的访问凭证。 ## ⚠️ 强制前置检查 (Critical Pre-check) **在调用任何 HIPC 业务技能（如查询电脑列表、统计数据）之前，你必须先调用本技能！** 1. **第一步**：调用 `hipc_config_manager`，设置参数 `action="check"`。 2. **判断**： - 如果返回 `status: "error"`（即密钥缺失），**立即停止**后续业务操作，**直接向用户发送一条消息**，提示需要配置密钥。 - **严禁**在密钥缺失的情况下调用其他 HIPC 技能。 - **严禁**陷入死循环检查，检查失败一次后必须反馈给用户。 - 只有当返回 `status: "success"` 时，才允许继续执行用户请求的业务逻辑。 ## 核心逻辑与依赖 本技能通过读写本地文件 `hipc_config.json` 来持久化存储密钥。 1. **检查模式 (`check`)**： - 读取 `hipc_config.json` 文件。 - 验证 `hipc_secret` 字段是否存在且非空。 2. **设置模式 (`set`)**： - 接收用户提供的 `secret` 和 `env`。 - **格式校验**：在保存前，脚本会自动校验密钥格式（必须符合 `数字_字符串` 的格式，例如 `35097_y2GX...`）。 - 如果格式错误，脚本将返回错误信息，**不会**写入文件。 - 如果格式正确，将其写入 `hipc_config.json` 文件，覆盖旧值。 ## 参数定义 - **action** (String, 必填): - 操作类型，决定脚本的行为。 - 可选值：`"check"`（检查配置）或 `"set"`（保存配置）。 - **secret** (String, 可选): - 仅在 `action="set"` 时**必填**。 - 用户提供的 HIPC API 密钥字符串。 - **env** (String, 可选): - 环境，决定脚本用哪个环境 - 仅在 `action="set"` 时使用，指定要配置的环境。 - 默认值为 "prod"。 - 可选值："prod"（生产环境）或 "dev"（开发环境/测试环境）。 ## 调用示例 **场景 A：业务前置检查（配置存在）** - 用户：“查一下电脑列表” - AI 思考：先检查环境配置是否就绪。 - 动作：调用 `hipc_config_manager`，参数 `action="check"`。 - 结果：返回 `status: "success"`。 - 后续：AI 继续调用 `hipc_computer_list` 技能。 **场景 B：业务前置检查（配置缺失）** - 用户：“昨天的运行时长是多少” - AI 思考：先检查环境配置。 - 动作：调用 `hipc_config_manager`，参数 `action="check"`。 - 结果：返回 `status: "error"`。 - 后续：AI **不调用**统计技能，**直接回复用户**：“检测到您尚未配置 HIPC 密钥，无法查询数据。请提供您的密钥。” **场景 C：用户主动配置密钥（格式正确）** - 用户：“我的密钥是 35097_y2GX52eDGNdgaM，帮我保存一下” - AI 思考：用户提供了密钥，需要调用设置模式。 - 动作：调用 `hipc_config_manager`，参数 `action="set"`, `[REDACTED_SECRET]"`, `env="prod"`。 - 结果：密钥被写入文件，返回 `status: "success"`。 - 后续：AI 回复用户：“密钥已保存！现在可以开始查询了。” **场景 D：用户配置密钥（格式错误）** - 用户：“帮我保存密钥，是 sk-123456” - AI 思考：用户提供了密钥，调用设置模式。 - 动作：调用 `hipc_config_manager`，参数 `action="set"`, `[REDACTED_SECRET]"`, `env="prod"`。 - 结果：脚本检测到格式错误（缺少 `数字_` 前缀），返回 `status: "error"`。 - 后续：AI 回复用户：“您提供的密钥格式不正确。HIPC 密钥通常以 `数字_` 开头（例如 `35097_xxxxx`），请检查后重新提供。” ## 执行命令 ```bash python scripts/main.py --action={{action}}{{#if secret}} --[REDACTED_SECRET] env}} --env={{env}}{{/if}} ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)