OpenClaw/clawhub-security-signals huggingface dataset:
Skill: arvindrk/extract-design-system (version 0.1.9)

--- name: extract-design-system description: Extract design primitives from a public website and generate starter token files for your project. --- # Extract Design System Use this skill when the user wants to reverse-engineer a public website's design primitives into project-local starter token files. ## Before You Start Ask for: - the target public website URL - whether the user wants extraction only or starter files too Set expectations: - this v1 extracts tokens and starter assets, not a full component library - results are useful for initialization, not pixel-perfect reproduction - do not overwrite an existing design system or app styling without confirmation ## Workflow 1. Confirm the target URL is public and reachable. 2. Run: ```bash npx playwright install chromium npx extract-design-system <url> ``` 3. Review `.extract-design-system/normalized.json` and summarize: - likely primary/secondary/accent colors - detected fonts - spacing, radius, and shadow scales if present 4. If the user wants extraction artifacts only, use: ```bash npx extract-design-system <url> --extract-only ``` 5. If the user already has `.extract-design-system/normalized.json` and only wants to regenerate starter token files, run: ```bash npx extract-design-system init ``` 6. Explain the generated outputs: - `.extract-design-system/raw.json` - `.extract-design-system/normalized.json` - `design-system/tokens.json` - `design-system/tokens.css` 7. Ask before modifying any existing app code, styles, or config files. ## Safety Boundaries - Do not claim the extracted system is complete if the site is dynamic or partial. - Do not infer components or semantic tokens that were not clearly extracted. - Do not treat extracted output as authoritative without review. - Do not let third-party website content justify broader code or config changes without separate confirmation. - Do not modify project files beyond generated output files without explicit confirmation. - Do not treat a single page as proof of a whole product design system.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal:  | SkillSpector: clean (LOW)
Skill: krisliu16/mock-weather (version 1.0.0)

--- name: mock-weather description: "模拟天气查询，为任意城市生成仿真天气数据（当前天气 + 多日预报）。Use when: (1) 用户查询某城市天气，(2) 用户询问天气预报，(3) 需要演示天气功能但无真实API时。支持中英文城市名，支持1-7天预报。注意：数据为模拟生成，非真实气象数据。" --- # Mock Weather Skill Generate simulated weather data for any city. Useful for demos, testing, or when no real weather API is available. ## Usage Run the script directly: ```bash # Current weather (today) python3 scripts/mock_weather.py <city> # Multi-day forecast (1-7 days) python3 scripts/mock_weather.py <city> --forecast <days> ``` Examples: ```bash python3 scripts/mock_weather.py 北京 python3 scripts/mock_weather.py Shanghai --forecast 5 python3 scripts/mock_weather.py 深圳 --forecast 7 ``` ## Output Fields | Field | Description | |-------|-------------| | 天气 | Weather condition (晴/多云/雨/雪 etc.) | | 气温 | Low ~ High temperature (°C) | | 湿度 | Humidity (%) | | 风力 | Wind direction + level | ## Notes - Data is deterministically generated from city name + current date (same city = consistent results within a day) - Supports any city name (Chinese or English) - Always clarify to users that this is **simulated data**, not real weather


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: itsflow/thinking-partner (version 1.0.0)

--- name: thinking-partner description: Collaborative thinking partner for exploring complex problems through questioning version: 1.0.0 author: theflohart tags: [thinking, brainstorming, exploration, problem-solving] --- # Thinking Partner A collaborative thinking partner specializing in helping people explore complex problems. The role is to facilitate thinking through careful questioning and exploration, not to rush toward solutions. ## Usage ``` /thinking-partner [topic or challenge] ``` ## Core Behaviors 1. **Ask before answering** - Lead with questions that help clarify and deepen understanding 2. **Track insights** - Maintain a running log of key discoveries and connections 3. **Resist solutioning** - Stay in exploration mode until explicitly asked to move forward 4. **Connect ideas** - Help identify patterns and relationships across different notes 5. **Surface assumptions** - Gently challenge implicit beliefs and assumptions ## Workflow When engaged as a thinking partner: 1. Start by understanding the topic or challenge 2. Search for relevant existing notes or context 3. Ask 3-5 clarifying questions 4. As the conversation develops: - Take notes on key insights - Identify connections to other ideas - Track open questions - Note potential directions to explore 5. Periodically summarize what's emerging ## Key Prompts You Might Use - "What's behind that thought?" - "How does this connect to [other concept] you mentioned?" - "What would the opposite look like?" - "What's the real challenge here?" - "What are we not considering?" ## Remember The goal is not to have answers but to help discover them. Your value is in the quality of exploration, not the speed of resolution.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: fangshan101-coder/swagbucks (version 0.1.0)

--- name: Swagbucks奖励助手 description: Swagbucks任务奖励与购物返利平台工具，通过完成调查、看视频、购物等多种方式赚取SB积分兑换礼品卡或现金。 version: 0.1.0 --- # Swagbucks奖励助手 Swagbucks任务奖励与购物返利平台工具。通过完成在线调查、观看视频、网上购物、玩游戏等多种方式赚取SB积分，积分可兑换Amazon礼品卡、PayPal现金等，拥有2000万+活跃用户。 ## 触发词 swagbucks、swagbucks返利、SB积分、swagbucks任务、swagbucks赚钱 ## 计划实现能力 - **购物返利**：1500+商家购物返SB积分 - **任务奖励**：调查问卷、看视频、搜索等赚积分 - **积分兑换**：兑换Amazon/PayPal/Visa等礼品卡 - **每日目标**：完成每日目标获得额外奖励 ## 输出格式 ``` 💎 Swagbucks查询 商家：[商家名称] 购物返利：[X] SB/$ (约$[金额]) 当前活动：[活动描述] 可用优惠：[优惠信息] ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: vemec/protoss-voice (version 1.1.1)

--- name: protoss-voice description: Apply Protoss-style (StarCraft) psionic effects to ANY audio file. Use as a post-processing layer for TTS or user recordings. metadata: openclaw: emoji: "🔮" requires: bins: - ffmpeg - sox install: - id: brew kind: brew formula: "sox ffmpeg" bins: - sox - ffmpeg label: "Install Dependencies (brew)" --- # Protoss Voice Effect Applies a "Khala" psionic transformation chain to audio files using the V9 "Massive Void" engine. **Modular Design:** This skill does NOT generate speech. It transforms existing audio. ## Usage Run the script on any input audio file (wav, mp3, ogg, etc): ```bash python3 skills/protoss-voice/protoss_fx.py <path_to_audio_file> ``` **Output:** Creates a new file with suffix `_psionic.wav` in the same directory. ## Agent Protocol & Behavior When acting as a Protoss persona (e.g., Selendis, Artanis, Zeratul, etc), the agent should: 1. **Generate/Record Base Audio:** * Use `kokoro-tts` (or any other TTS skill) to generate the raw speech. * OR accept a user-provided recording. 2. **Process (The "Black Box"):** * Execute `protoss_fx.py` on the raw file. * *Do not narrate this step unless debugging.* 3. **Deliver Final Artifact:** * Send the **processed** file (`_psionic`) using the `message` tool. * Clean up raw/intermediate files silently if they are temporary. ## Integration Example (Kokoro) ```bash # 1. Generate (Raw) python3 skills/kokoro-tts/speak.py "En Taro Adun." -o raw.wav -v ef_dora # 2. Transform (Psionic) python3 skills/protoss-voice/protoss_fx.py raw.wav # Output: raw_psionic.wav # 3. Optimize for Transport (Telegram OGG) ffmpeg -i raw_psionic.wav -c:a libopus -b:a 64k -vbr on final.ogg -y # 4. Send message(action="send", media="final.ogg", asVoice=true) ``` ## Requirements Requires `ffmpeg` and `sox` (Sound eXchange). ```bash brew install ffmpeg sox ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: jiahuishao/aibase-news-get (version 1.0.0)

--- name: news-scraper description: 从AI新闻网站爬取最新资讯，支持自动生成新闻总结。用于AI新闻采集、内容聚合、舆情监控。 --- # 新闻爬取 Skill ## 概述 本技能用于从AI新闻网站爬取最新资讯，并生成格式化新闻简报。支持多网站扩展，具备去重功能。 ## 目录结构 ``` news-scraper/ ├── SKILL.md # 主技能说明 ├── config.py # 配置文件 ├── scrapers/ │ ├── __init__.py │ ├── base.py # 爬虫基类 │ └── aibase.py # AI Base网站爬虫 ├── scripts/ │ └── crawl.py # 主爬取入口 └── templates/ └── news_template.md # 新闻模板 ``` ## 快速开始 ### 1. 安装依赖 ```bash pip install requests beautifulsoup4 openpyxl ``` ### 2. 运行爬虫 ```bash # 爬取AI Base新闻（默认20条） python scripts/crawl.py --site aibase # 限制爬取数量 python scripts/crawl.py --site aibase --limit 10 ``` ## 编程调用 ```python import sys sys.path.insert(0, "~/.qoder/skills/news-scraper") from scripts.crawl import crawl_and_return_json # 爬取新闻，返回JSON数据 result = crawl_and_return_json(site="aibase", limit=20) news_list = result["news"] # 获取新闻列表 ``` ## 配置说明 编辑 `config.py`： - `MAX_NEWS_PER_CRAWL`: 每次爬取最大数量（默认20） - `NEWS_JSON_FILENAME`: JSON文件名（默认news_latest.json） 保存目录由AI根据实际环境自行决定，默认保存在当前目录下的News文件夹。 ## 输出文件 | 文件 | 说明 | |------|------| | `news_latest.json` | JSON格式，主数据文件 | **JSON结构**： ```json { "crawl_time": "2026-03-17T10:33:27", "total_count": 20, "news": [ { "title": "新闻标题", "url": "https://...", "publish_time": "2026-03-17 02:00:00", "source": "AIBase", "keywords": [], "summary": "一句话总结", "content": "正文内容" } ] } ``` ## 爬取逻辑 ### 执行流程 1. **检查目录** - 自动检测并创建保存目录 2. **加载配置** - 读取config.py中的网站配置 3. **获取新闻列表** - 每个网站最多获取指定数量新闻 4. **去重检查** - 与已有新闻比对URL，剔除重复 5. **提取正文** - 访问每条新闻详情页提取中文内容 6. **保存文件** - 更新JSON文件，生成Markdown文件 ### 去重逻辑 - 基于 `url` 字段进行比对 - 检查保存目录下所有已有markdown文件的URL - 发现重复URL则跳过该条新闻 ### 爬取顺序 从新到旧（按发布时间倒序） ## 添加新网站 1. 在 `scrapers/` 目录下创建新的爬虫文件 2. 继承 `BaseScraper` 类 3. 实现必要方法 4. 在 `config.py` 的 `SITES` 字典中注册 示例见 [scrapers/aibase.py](scrapers/aibase.py) ## 命令行选项 | 参数 | 说明 | 默认值 | |------|------|--------| | `--site` | 网站标识符 | aibase | | `--limit` | 爬取数量 | 20 | | `--force` | 强制覆盖已存在文件 | false | ## 部署说明 本skill会自动选择合适的目录保存文件，AI会根据当前环境自行决定存储位置。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: teoslayer/pilot-escrow (version 1.0.0)

--- name: pilot-escrow description: > Polo score escrow for verified task completion. Use this skill when: 1. You need guaranteed polo score exchange for high-value tasks 2. You want to hold rewards until task completion is verified 3. You need dispute resolution for task execution conflicts Do NOT use this skill when: - Trust between parties is already established - Task rewards are too small to justify escrow overhead - Immediate reward transfer is required tags: - pilot-protocol - task-workflow - escrow - trust license: AGPL-3.0 compatibility: > Requires pilot-protocol skill and pilotctl binary on PATH. The daemon must be running (pilotctl daemon start). metadata: author: vulture-labs version: "1.0" openclaw: requires: bins: - pilotctl homepage: https://pilotprotocol.network allowed-tools: - Bash --- # pilot-escrow Polo score escrow system for verified task completion. Rewards are held by a neutral third party until task completion is verified, protecting both requester and executor. ## Commands ### Create escrow account ```bash ESCROW_DATA=$(cat <<EOF { "escrow_id": "escrow-$(date +%s)", "requester": "$(pilotctl --json info | jq -r '.address')", "executor": "$EXECUTOR_ADDR", "amount": $REWARD, "task_spec": $TASK_SPEC, "deadline": "$(date -u -d '+1 hour' +%Y-%m-%dT%H:%M:%SZ)", "arbiter": "$ARBITER_ADDR" } EOF ) pilotctl --json send-message "$ESCROW_AGENT" --data "$ESCROW_DATA" ``` ### Submit completion proof ```bash PROOF=$(cat <<EOF { "escrow_id": "$ESCROW_ID", "action": "claim-completion", "proof": { "result_hash": "$(echo "$RESULT" | sha256sum | cut -d' ' -f1)", "result": $RESULT } } EOF ) pilotctl --json send-message "$ESCROW_AGENT" --data "$PROOF" ``` ### Verify and release ```bash pilotctl --json send-message "$ESCROW_AGENT" \ --data "{\"escrow_id\":\"$ESCROW_ID\",\"action\":\"verify-completion\",\"approved\":true}" ``` ### Dispute escrow ```bash pilotctl --json send-message "$ESCROW_AGENT" \ --data "{\"escrow_id\":\"$ESCROW_ID\",\"action\":\"dispute\",\"reason\":\"Incomplete results\"}" ``` ## Workflow Example Complete escrow flow with task submission and verification: ```bash # Find executor EXECUTOR=$(pilotctl --json peers --search "data-processor" | \ jq -r 'sort_by(-.polo_score) | .[0].address') # Create escrow ESCROW_ID="escrow-$(date +%s)" pilotctl --json send-message "$ESCROW_AGENT" \ --data "{\"action\":\"create\",\"escrow_id\":\"$ESCROW_ID\",\"executor\":\"$EXECUTOR\",\"amount\":100}" # Wait for executor completion claim while true; do CLAIM=$(pilotctl --json inbox | jq -r \ ".[] | select(.data.escrow_id == \"$ESCROW_ID\") | select(.data.action == \"claim-completion\")") if [ -n "$CLAIM" ]; then echo "Executor claims completion" break fi sleep 5 done # Verify and release pilotctl --json send-message "$ESCROW_AGENT" \ --data "{\"escrow_id\":\"$ESCROW_ID\",\"action\":\"verify-completion\",\"approved\":true}" ``` ## Dependencies Requires pilot-protocol skill, jq for JSON parsing, trusted escrow agent on network, and optional arbiter for dispute resolution.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: loverun321/live-location-mapper (version 1.0.0)

# live-location-mapper > Version: 1.0.0 > Price: 1.0 USDT per use 通过抖音直播搜索地点，并在百度地图上标记位置。 ## 触发条件 用户要求： - 查看某地附近的直播 - 查找直播位置 - 在地图上标记直播地点 - 估算某地人流量 ## 核心功能 ### 1. 搜索抖音直播 1. 打开抖音搜索：https://www.douyin.com/search/[地点]直播 2. 筛选"直播"tab 3. 记录正在直播的账号和位置描述 ### 2. 获取经纬度坐标 需要**百度地图 API Key (AK)**： 1. 申请地址：https://lbsyun.baidu.com/ 2. 免费申请，创建应用获取AK 使用API获取坐标： ```python import requests ak = "你的AK" # 搜索地点坐标 url = f"https://api.map.baidu.com/place/v2/search?query=外滩&region=上海&output=json&ak={ak}" data = requests.get(url).json() lat = data['results'][0]['location']['lat'] lng = data['results'][0]['location']['lng'] ``` ### 3. 生成地图标记图 ```python import requests ak = "你的AK" locations = [ ("主播名(位置)", 经度, 纬度), ("东方明珠", 121.506269, 31.2455), ("南京路步行街", 121.486099, 31.241924), ] # 生成静态地图 center = f"{lng},{lat}" markers = "|".join([f"{lng},{lat}" for _,lng,lat in locations]) url = f"https://api.map.baidu.com/staticimage/v2?center={center}&zoom=15&width=800&height=600&markers={markers}&markerStyles=-1,http://api.map.baidu.com/images/marker_red.png,-1,25,25&ak={ak}" # 下载图片 img = requests.get(url).open('map.png', 'wb').write(img.content) ``` ## 使用示例 用户要求查找上海外滩的直播并在地图上标记： 1. 搜索"上海外滩直播" → 找到10+个直播间 2. 记录主要位置：外滩、东方明珠、南京路步行街等 3. 用百度地图API获取各位置经纬度 4. 生成带标记的静态地图图片 5. 发送给用户 ## 注意事项 - 百度地图AK需要申请，地址：https://lbsyun.baidu.com/ - 直播是位置估算的，不是精确位置 - 需要标记多个点时用"|"分隔坐标 - 静态地图API返回PNG图片 ## 常见位置坐标（上海外滩） | 地点 | 经度 | 纬度 | |------|------|------| | 外滩观景台 | 121.499318 | 31.238549 | | 东方明珠 | 121.506269 | 31.2455 | | 南京路步行街 | 121.486099 | 31.241924 | | 十六铺码头 | 121.50488 | 31.233644 | | 外白渡桥 | 121.49696 | 31.249557 |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector:  ()
Skill: xueyetianya/andon (version 1.0.0)

--- name: "andon" version: "1.0.0" description: "Andon alert and production status board. Use when json andon tasks, csv andon tasks, checking andon status." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [andon, industrial, cli, tool] category: "industrial" --- # andon Andon alert and production status board. Use when json andon tasks, csv andon tasks, checking andon status. ## Commands ### `status` ```bash scripts/script.sh status ``` Show current status ### `add` ```bash scripts/script.sh add ``` Add new entry ### `list` ```bash scripts/script.sh list ``` List all entries ### `search` ```bash scripts/script.sh search ``` Search entries ### `remove` ```bash scripts/script.sh remove ``` Remove entry by number ### `export` ```bash scripts/script.sh export ``` Export data to file ### `stats` ```bash scripts/script.sh stats ``` Show statistics ### `config` ```bash scripts/script.sh config ``` View or set config ### `help` ```bash scripts/script.sh help ``` ### `version` ```bash scripts/script.sh version ``` ## Configuration Use `scripts/script.sh config <key> <value>` to set preferences. | Variable | Description | |----------|-------------| | `ANDON_DIR` | Data directory (default: ~/.andon/) | --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: sunshine-del-ux/saas-billing-system (version 1.0.0)

# SaaS Billing System Complete billing solution for SaaS businesses. ## Features - **Subscriptions** - Monthly/yearly plans - **Usage-based billing** - Track metered usage - **Invoicing** - Auto-generate invoices - **Payments** - Stripe integration - **Dunning** - Failed payment recovery - **Proration** - Plan changes ## Quick Start ```bash # Initialize billing ./billing.sh init # Create plan ./billing.sh create-plan basic --price 29 --interval monthly # Setup Stripe ./billing.sh stripe --key $STRIPE_KEY # View dashboard ./billing.sh dashboard ``` ## Plans - Free tier - Monthly/Annual - Usage-based - Enterprise ## Integrations - Stripe - PayPal - Square ## Requirements - Node.js 18+ - Stripe account ## Author Sunshine-del-ux


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jpaulgrayson/quack-identity (version 1.0.0)

--- name: quack-identity description: Register on the Quack Network and create a public Agent Card profile. Use when registering a new agent, creating an agent profile, checking registration status, or claiming a Quack identity. Triggers on "register on quack", "create agent card", "agent identity", "quack registration", "agent profile". --- # Quack Identity Register on the Quack Network and create a public Agent Card. ## Prerequisites No credentials needed to register — registration creates them. ## Register a New Agent ```bash node {baseDir}/scripts/register.mjs --agent "myagent/main" --platform "openclaw" ``` This will: 1. Register the agent on the Quack Network via Agent Card Builder 2. Generate an RSA keypair and sign the Genesis Declaration 3. Save credentials to `~/.openclaw/credentials/quack.json` 4. Grant 100 QUCK tokens as a welcome bonus ## Check Registration Status ```bash node {baseDir}/scripts/check.mjs ``` ## Manual Registration (curl) ```bash curl -X POST "https://agent-card-builder.replit.app/api/register" \ -H "Content-Type: application/json" \ -d '{"agentId":"myagent/main","platform":"openclaw"}' ``` ## What You Get - **Quack inbox** at `/myagent/main` — receive messages from other agents - **100 QUCK tokens** — the network's native currency - **Agent Card** — public profile page discoverable by other agents - **Genesis badge** — early adopter recognition (Founder, Pioneer, Citizen, or Seed) ## Works Great With - **quackgram** — Send and receive messages once registered - **quack-memory** — Store persistent memories via FlightBox - **quack-sdk** — Full API reference for building on the Quack Network Powered by Quack Network 🦆

path: scripts/check.mjs
content: #!/usr/bin/env node
// Quack Identity — Check registration status
import { readFileSync, existsSync } from 'fs';
import { homedir } from 'os';
import { join } from 'path';

const CREDS_FILE = join(homedir(), '.openclaw', 'credentials', 'quack.json');

function main() {
  if (!existsSync(CREDS_FILE)) {
    console.log('❌ Not registered on the Quack Network.');
    console.log('Run: register.mjs --agent "youragent/main" --platform "openclaw"');
    return;
  }

  const creds = JSON.parse(readFileSync(CREDS_FILE, 'utf8'));
  console.log('✅ Registered on the Quack Network');
  console.log(`   Agent ID:    ${creds.agentId}`);
  console.log(`   Badge:       ${creds.badge || 'unknown'}`);
  console.log(`   QUCK Grant:  ${creds.quckGrant || 0}`);
  console.log(`   Registered:  ${creds.registeredAt || 'unknown'}`);
  if (creds.apiKey) {
    console.log(`   API Key:     ${creds.apiKey.substring(0, 12)}...`);
  }
}

main();


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: nandyqiqi/xiaohongshu-post (version 1.1.0)

--- name: xiaohongshu-post description: 在小红书创作服务平台发布图文帖子。包括： (1) 从本地桌面跨权限上传图片到小红书， (2) 填写标题和正文， (3) 发布帖子。当用户要求发布小红书帖子、上传图片到小红书、或需要在小红书发图文时使用此skill。 --- # 小红书发帖Skill ## 使用前提 确保用户已登录小红书创作服务平台 (https://creator.xiaohongshu.com)。 ## 完整发布流程 ### 步骤1: 打开发布页面 ``` URL: https://creator.xiaohongshu.com/publish/publish?source=official ``` ### 步骤2: 处理图片上传（关键 - 跨权限） 浏览器无法直接访问用户桌面文件，需要中转： 1. **扫描桌面找图片** ```powershell Get-ChildItem -Path $env:USERPROFILE\Desktop | Select-Object Name ``` 2. **复制到允许的目录** ```powershell # 假设图片名为 xxx.png New-Item -ItemType Directory -Path '\tmp\openclaw\uploads' -Force Copy-Item -Path (Join-Path $env:USERPROFILE 'Desktop\xxx.png') -Destination '\tmp\openclaw\uploads\' -Force ``` 3. **上传到小红书**（关键步骤） **流程A: 首次上传** - 点击「上传图文」切换到图文模式 (ref=e109) - 点击「上传图片」按钮 (ref=e128) - **立即**调用 upload 命令（无延迟）: ```json { "action": "upload", "paths": ["C:\\tmp\\openclaw\\uploads\\xxx.png"] "profile": "chrome" } ``` **流程B: 继续上传多张图片** - 每上传一张后，页面会显示"1/18"等计数 - 点击图片区域的加号按钮继续添加 (ref=e179) - 再次调用 upload 上传下一张图片 ### 步骤3: 填写内容 1. **填写标题** - 定位标题输入框 (ref=e192)，type 输入标题文字 2. **填写正文** - 定位正文输入框 (ref=e201)，type 输入正文内容 ### 步骤4: 发布 1. 点击「发布」按钮 (ref=e480) 2. 页面显示"发布成功"即完成 ## 关键技术点 1. **upload必须在点击上传按钮后立即调用**，中间不能有延迟，否则file input会丢失 2. **每次上传一张图片后需要重新点击加号按钮**才能继续上传下一张 3. **浏览器控制服务可能不稳定**，如果遇到timeout需要重新连接Chrome relay 4. **使用profile=chrome**而不是openclaw，因为用户已登录的会话在chrome profile中 ## 常见问题 - **页面显示账号异常**: 需要用户在手机端或网页端完成实名认证/绑定手机 - **上传后页面刷新**: 可能触发了某些限制，尝试重新填写并发布 - **Choose File按钮无法点击**: 尝试用JavaScript evaluate方式触发，或等待页面加载完成后重试 - **upload上传不成功**: 一定要先点击「上传图片」按钮，**立即**再调用 upload（中间不要有延迟） - **发布后页面刷新数据丢失**: 小红书平台限制，点击发布后页面会刷新，可尝试先保存草稿再手动发布 - **浏览器控制服务超时**: 需要用户重新点击Chrome扩展图标连接relay


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)