OpenClaw/clawhub-security-signals huggingface dataset:
Skill: johnnywang2001/color-toolkit (version 1.0.0)

--- name: color-toolkit description: Convert, analyze, and generate colors from the CLI. Supports HEX, RGB, HSL, HSV, CMYK conversion, WCAG contrast ratio checking (AA/AAA compliance), palette generation (complementary, analogous, triadic, split-complementary, monochromatic), color manipulation (lighten/darken/saturate/desaturate), mixing, random generation, and CSS named color lookup. Use when the user needs color conversions, accessibility contrast checks, palette generation, or color manipulation. Zero external dependencies. --- # Color Toolkit Convert colors, check WCAG contrast, generate palettes, and manipulate colors. Pure Python, no dependencies. ## Quick Start ```bash # Convert between formats (accepts #hex, rgb(), hsl(), CSS names, or r,g,b) python3 scripts/color_toolkit.py convert '#ff6347' python3 scripts/color_toolkit.py convert tomato python3 scripts/color_toolkit.py convert 'rgb(52, 152, 219)' # WCAG contrast check python3 scripts/color_toolkit.py contrast '#333333' '#ffffff' # Generate palettes python3 scripts/color_toolkit.py palette '#3498db' -s triadic python3 scripts/color_toolkit.py palette '#e74c3c' -s monochromatic -n 7 # Modify colors python3 scripts/color_toolkit.py modify '#3498db' --op lighten --amount 20 python3 scripts/color_toolkit.py modify coral --op darken --amount 15 # Mix colors python3 scripts/color_toolkit.py mix '#ff0000' '#0000ff' --weight 0.5 # Random colors python3 scripts/color_toolkit.py random -n 5 # Search CSS named colors python3 scripts/color_toolkit.py lookup green ``` ## Commands | Command | Description | |---------|-------------| | `convert` | Convert any color to HEX, RGB, HSL, HSV, and CMYK. | | `contrast` | WCAG contrast ratio between foreground and background. Reports AA/AAA compliance. | | `palette` | Generate palettes: `complementary`, `analogous`, `triadic`, `split-complementary`, `monochromatic`. | | `modify` | Adjust color: `lighten`, `darken`, `saturate`, `desaturate`. `--amount 0-100`. | | `mix` | Blend two colors. `--weight` controls the ratio (0.0 = all color1, 1.0 = all color2). | | `random` | Generate random colors. `-n` sets count. | | `lookup` | Search CSS named colors by partial name. | All commands support `--json` for structured output. ## Accepted Color Formats `#hex` (3 or 6 digit), `rgb(r, g, b)`, `hsl(h, s%, l%)`, `r,g,b`, or any CSS color name (e.g., `tomato`, `steelblue`, `coral`).


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: gxw975/clawhub-publish-146156 (version 0.2.0)

# Agent Browser A fast Rust-based headless browser automation CLI with Node.js fallback that enables AI agents to navigate, click, type, and snapshot pages via structured commands. ## When to use - Automating web interactions (login, form fill, scraping) - Extracting structured data from pages - Testing web UIs or workflows - Filling forms programmatically ## Prerequisites - Node.js ≥ 18 - `npm install -g agent-browser` (run once to install CLI) ## How it works 1. `agent-browser open <url>` → launch browser & navigate 2. `agent-browser snapshot -i` → get interactive elements with stable refs (e.g., `@e1`) 3. Use refs to interact: `click @e1`, `fill @e2 "text"`, `wait @e3` 4. `agent-browser close` → clean up ## Key capabilities - Snapshot with accessibility tree or interactive-only mode - Precise element interaction (click/fill/hover/drag/upload) - Wait conditions (element visible, URL change, network idle) - Screenshot, PDF export, video recording - Cookie/storage/network control - Tab/window/frame management - JSON output for programmatic parsing ## Example ```bash agent-browser open https://example.com/login agent-browser snapshot -i agent-browser fill @e1 "[REDACTED_SECRET]" agent-browser fill @e2 "password123" agent-browser click @e3 agent-browser wait --url "/dashboard" ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: aznikline/project-deep-analyzer (version 1.0.0)

--- name: "project-deep-analyzer" description: "深度分析项目的系统边界、核心概念、模块架构、关键算法、技术选型以及错误排查。当用户需要深入理解代码库或定位疑难问题时调用。" --- # Project Deep Analyzer 本技能提供了一套结构化的方法论，用于深度剖析和理解任何规模的软件项目。它通过六个核心维度引导用户或 AI 进行全方位的项目审计。 ## 核心分析流程 ### 1. 系统边界分析 (System Boundary) 明确项目的外部交互和运行环境。 - **项目目标**：核心解决什么问题？ - **运行环境**：支持哪些平台（macOS/Linux/Windows）？ - **对外接口**：提供哪些 CLI、API 或 SDK？ - **技术栈**：核心语言、框架、数据库及外部服务。 - **安装与使用**：前置条件、依赖项及启动步骤。 ### 2. 核心概念体系 (Core Concept System) 提取项目中的关键领域模型和术语。 - **术语清单**：列出项目中的所有关键术语。 - **定义与动机**：每个概念的定义及其存在的原因。 - **关系图谱**：层级、依赖或组合关系。 - **核心 vs 辅助**：区分核心业务逻辑和周边支持工具。 - **代码映射**：概念在代码结构中的具体位置。 ### 3. 模块架构分析 (Module Architecture) 拆解项目的物理和逻辑组织。 - **目录结构**：模块的物理划分。 - **职责划分**：每个模块的核心职责和边界。 - **依赖关系**：模块间的耦合度和调用链。 - **代码度量**：行数、文件数及其揭示的开发重心。 - **解耦建议**：识别可独立拆分的模块和强耦合点。 ### 4. 核心算法分析 (Core Algorithm) 深入理解项目的逻辑心脏。 - **算法清单**：项目使用的关键算法及其作用。 - **性能评估**：时间/空间复杂度及限制。 - **数据结构**：算法的输入输出及核心数据流动。 - **源码定位**：算法的具体实现文件和函数。 ### 5. 技术选型评估 (Technical Selection) 反思设计决策的合理性。 - **自研 vs 第三方**：哪些部分是自研的？是否有更好的替代方案？ - **必要性审查**：自研部分是否存在过度设计？ - **重构建议**：如果重新设计，哪些组件应该保留或替换？ - **知识沉淀**：项目中值得吸收的技术亮点或算法。 ### 6. 错误排查与分析 (Error Handling) 结构化定位和修复问题。 - **日志定位**：通过错误日志定位具体的文件和函数。 - **链路追溯**：分析完整的调用栈（Stack Trace）。 - **根本原因**：解释错误发生的深层原因。 - **修复方案**：提供具体的修复代码或配置建议。 ## 使用场景 - **新项目接手**：快速建立对陌生代码库的全局视野。 - **架构审计**：识别现有项目中的设计缺陷或优化空间。 - **技术调研**：分析开源项目的实现原理，评估其是否适合集成。 - **复杂 Bug 定位**：通过结构化的调用链路分析解决疑难杂症。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: nesquitmx/pr-code-reviewer (version 1.0.1)

name: pr-code-reviewer description: > Revisa automáticamente Pull Requests en Bitbucket detectando errores de sintaxis, malas prácticas, vulnerabilidades de seguridad y violaciones de estándares de código del equipo. Genera comentarios detallados con sugerencias de corrección. Soporta JavaScript, TypeScript, Node.js, PHP y Python. version: 1.0.0 tags: - code-review - pull-request - quality - bitbucket - linting - nodejs - php --- # PR Code Reviewer ## Rol Eres un Senior Code Reviewer exigente pero constructivo. Tu trabajo es revisar cada línea de código en un Pull Request y detectar problemas ANTES de que lleguen a develop o master. ## Comportamiento General ### Cuando recibas un diff o código de un PR: 1. **Lee TODO el diff completo** antes de emitir cualquier comentario 2. **Entiende el contexto**: qué intenta hacer el PR, no solo línea por línea 3. **Detecta el lenguaje** de cada archivo y aplica las reglas correspondientes 4. **Clasifica cada hallazgo** por severidad: - 🔴 **BLOCKER** — No se puede mergear. Errores, vulnerabilidades, bugs claros - 🟡 **WARNING** — Debería corregirse. Malas prácticas, code smells - 🔵 **SUGGESTION** — Mejora opcional. Estilo, legibilidad, optimización - 💡 **NIT** — Detalle menor. Convenciones, formato 5. **Siempre sugiere la corrección**, no solo señales el problema 6. **Agrupa comentarios** por archivo 7. **Da un veredicto final**: ✅ APROBAR, ⚠️ APROBAR CON CAMBIOS, ❌ RECHAZAR ## Detección de Lenguaje Aplica las reglas del lenguaje según la extensión del archivo: - .js, .mjs, .cjs → references/javascript-typescript.md + references/nodejs.md - .ts, .tsx → references/javascript-typescript.md + references/nodejs.md - .jsx → references/javascript-typescript.md + references/nodejs.md - .php → references/php.md - .py → references/python.md - .css, .scss, .html → references/css-html.md - Todos los archivos → references/general.md + references/security.md + references/team-conventions.md ## Formato de Respuesta Siempre responde con este formato exacto: ## 📋 Resumen de Revisión del PR **Veredicto:** [✅ | ⚠️ | ❌] [APROBAR | APROBAR CON CAMBIOS | RECHAZAR] **Archivos revisados:** X **Hallazgos:** X 🔴 | X 🟡 | X 🔵 | X 💡 --- ### 📁 ruta/al/archivo.ext **Línea X-Y:** [🔴|🟡|🔵|💡] **[Categoría]**: Descripción del problema ❌ Código actual: (mostrar el código problemático) ✅ Corrección sugerida: (mostrar el código corregido) **¿Por qué?** Explicación breve de por qué es un problema. --- ### 🏁 Resumen Final - Lo bueno: ... - Lo que debe corregirse antes del merge: ... - Sugerencias para el futuro: ... ## Reglas Importar y aplicar TODAS las reglas de: - references/general.md (siempre) - references/security.md (siempre) - references/team-conventions.md (siempre) - references/javascript-typescript.md (según extensión) - references/nodejs.md (según extensión) - references/php.md (según extensión) - references/python.md (según extensión) - references/css-html.md (según extensión)


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ray1012/suanming (version 1.0.0)

--- name: suanming version: "1.0.0" description: | 六爻八卦算命术。根据用户提供的出生年月日时，运用六爻排盘系统进行命理分析。 适用于：(1) 用户询问算命 (2) 用户想知道命运/运势 (3) 用户提供生辰八字要求分析 (4) 六爻排盘 --- # 六爻八卦算命 Skill ## 触发条件 当用户提及以下关键词时激活： - 算命 - 六爻 - 八卦 - 命理 - 运势 - 生辰八字 - 算一算 ## 输入要求 必须获取用户的完整信息： - 出生年份（如 1990） - 出生月份（如 8） - 出生日期（如 15） - 出生时辰（可选，如 子时、丑时、寅时 等） ## 排盘原理 ### 1. 确定用神 根据用户出生年份计算： - 奇数年（尾数1,3,5,7,9）：阳爻为主 - 偶数年（尾数0,2,4,6,8）：阴爻为主 ### 2. 八卦对应 | 卦名 | 符号 | 五行 | 方位 | |------|------|------|------| | 乾 | ☰ | 金 | 西北 | | 兑 | ☱ | 金 | 西 | | 离 | ☲ | 火 | 南 | | 震 | ☳ | 木 | 东 | | 巽 | ☴ | 木 | 东南 | | 坎 | ☵ | 水 | 北 | | 艮 | ☶ | 土 | 东北 | | 坤 | ☷ | 土 | 西南 | ### 3. 命理分析输出格式 ``` 🎯 六爻八卦命理分析 📅 生辰：{年}年{月}月{日}日 🌟 主卦：{卦名}卦（{五行}属{方位}） 💫 命理解读： {根据八卦五行给出性格分析} 📊 运势预测： - 事业：{分析} - 财运：{分析} - 感情：{分析} - 健康：{分析} ⚠️ 温馨提示：本分析仅供娱乐参考 ``` ## 注意事项 - 必须先询问获取完整的出生信息 - 每次分析都必须包含免责声明 - 语气温和亲切，带有神秘感 - 给出正向积极的建议为主


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: smallkeyboy/competition-assistant (version 1.0.2)

--- name: competition-assistant description: 大学生竞赛助手 — 提供赛事月历生成与组队匹配服务。触发场景：(1) 用户询问比赛信息、赛事日程、近期竞赛、"汇总比赛"、"赛事月历"、"有哪些比赛"等；(2) 用户需要组队找队友、"匹配比赛队伍"、"找队友"、"帮我匹配"、描述组队需求如"我想找互联网+的队友"或"有没有人在做挑战杯缺人"。功能包括：实时获取教育部认可84项学科竞赛的报名时间、比赛时间；跨会话持久化的组队需求管理与智能匹配推荐。 --- # 大学生竞赛助手 我已经准备好为你收集比赛资料了。 ## 核心能力 ### 一、📅 赛事月历生成 **触发条件** - "汇总比赛信息"、"近期有哪些比赛"、"赛事月历" - "接下来有什么竞赛"、"比赛日程"等 **执行流程** 1. **读取竞赛清单** - 参考 `references/competitions.md` 获取84项竞赛基础信息 - 识别用户关注的时间范围（默认未来3个月） 2. **实时获取赛事信息** - 访问竞赛官网或权威通知页面 - 通过搜索引擎补充官网缺失的信息 - 提取：报名时间、比赛时间、竞赛类型 3. **筛选与排序** - 以当前系统时间为基准 - 筛选未来3个月内的比赛 - 按月份由近及远排序 4. **输出格式** ``` 📅 X月赛事指南 | 序号 | 比赛名称 | 报名时间 | 比赛时间 | 竞赛类型 | 官方链接 | |------|----------|----------|----------|----------|----------| | 1 | 中国国际大学生创新大赛 | 4-6月 | 10-12月 | 创新创业 | [链接] | | 2 | 全国大学生数学建模竞赛 | 5-9月 | 9月 | 学科竞赛 | [链接] | 💡 参与建议：[简要建议] --- （若无赛事）本月暂无符合条件的赛事。 ``` **数据验证规则** - 严禁虚构赛事信息 - 官网无法访问时，明确标注"官网暂不可访问" - 时间信息不确定时标注"待定"或"以官网为准" --- ### 二、🧑‍🤝‍🧑 组队匹配 **触发条件** - "匹配比赛队伍"、"找队友"、"帮我匹配" - 用户描述组队需求："我想找互联网+的队友"、"挑战杯缺人" **数据存储** - 文件路径：`~/.openclaw/workspace/memory/teaming-requests.json` - 跨会话持久化存储 **执行流程** **步骤1：需求收集** 从用户消息中提取以下信息（一次性询问缺失项）： | 字段 | 必填 | 示例 | |------|------|------| | 比赛名称 | 是 | 中国国际大学生创新大赛 | | 角色 | 是 | 队长/队员/均可 | | 具备技能 | 是 | 前端开发、UI设计 | | 需要技能 | 否 | 后端开发、算法 | | 空闲时间 | 否 | 周末、工作日晚间 | | 联系方式 | 是 | 微信号/手机/QQ | | 当前人数 | 否 | 已有2人 | | 目标人数 | 否 | 需要5人 | | 备注 | 否 | 已有项目思路 | **步骤2：存储需求** 调用 `scripts/teaming-manager.py` 存储需求： - 自动生成唯一ID - 自动遮蔽联系方式（存储原始值+遮蔽值） - 自动设置组队截止日期（报名截止前3天，默认30天后） **步骤3：匹配推荐** 匹配规则（详见 `references/teaming-schema.md`）： 1. **比赛匹配**（必须）：比赛名称一致 2. **技能互补**：我需要的 = 对方有的；对方需要的 = 我有的 3. **时间匹配**：空闲时间有交集 4. **截止日期**：未过期 匹配评分： - 比赛匹配：50分 - 技能互补：每项+10分，上限30分 - 时间匹配：完全+20分，部分+10分 **步骤4：输出推荐** ``` 🤝 组队推荐 @[当前用户昵称] | 推荐对象 | 比赛名称 | 匹配理由 | 联系方式 | |----------|----------|----------|----------| | 李同学 | 中国国际大学生创新大赛 | 技能互补：擅长后端开发，需要前端 | 微信：abc****xyz | | 王同学 | 中国国际大学生创新大赛 | 时间匹配：周末可协作 | QQ：123***78 | 💡 匹配成功后请主动联系对方确认。 --- ⏳ 暂无合适的队友，可尝试补充技能或比赛信息后再试。 ``` --- ## 通用规则 ### 隐私保护 - 所有联系方式对外展示时必须遮蔽 - 手机：保留前3后4位 → `138****5678` - 微信：保留前3后3位 → `wxi****yz` - QQ：保留前3后2位 → `123***78` - 邮箱：保留前2字符 → `zh******@qq.com` ### 信息验证 - 严禁虚构赛事信息或编造联系方式 - 官网信息不确定时明确标注 - 推荐链接优先使用官方渠道 ### 温馨提示 每次输出末尾附加： > 更多赛事动态请关注各赛事官网，参与竞赛请遵守各校具体通知安排。 --- ## 参考文件 - `references/competitions.md` — 教育部认可84项竞赛清单 - `references/teaming-schema.md` — 组队数据结构与匹配规则 ## 工具脚本 - `scripts/teaming-manager.py` — 组队需求管理（增删改查、匹配计算）


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal:  | SkillSpector: suspicious (CRITICAL)
Skill: sheepxux/somnia (version 0.4.3)

--- name: somnia description: Run overnight skill health reviews, replay-case availability checks, feedback triage, and proposal-only maintenance reports for OpenClaw agents. Use when the user asks for nightly review, sleep-time skill maintenance, skill bug scanning, replay regression checks, or safe skill-maintenance proposals. --- # Somnia ## Overview Somnia is the sleep-cycle maintenance layer for OpenClaw skills. It provides a repeatable review workflow that checks installed skills during quiet hours, summarizes health risks, and writes proposal artifacts without silently mutating runtime skills. Current version: `v0.4.3 "Standalone Safety"`. ## Trigger Cues Use this skill when the user mentions: - `nightly skill review` - `sleep-time maintenance` - `skill health report` - `skill bug scanning` - `replay regression check` - `feedback-driven upgrade` - `proposal-based update` - `Somnia` ## Default Workflow 1. Confirm the review scope: managed skills, feedback-related skills, or all installed skills. 2. Run lightweight package validation, feedback summary, and replay-case availability checks for each selected skill. 3. Write JSON and Markdown health reports under the configured learning/report directory. 4. Write proposal artifacts only when feedback or quality gates justify the change. 5. Hand proposal artifacts to Skill Forge or a human maintainer before any install decision. 6. Keep simulated evaluation details hidden from user-facing reports. ## Output Contract The final answer or artifact should include: - Review scope and schedule assumption - Skills checked and health summary - Issues found, grouped by skill - Update candidates proposed or blocked - Replay and hidden-evaluation pass/fail summary - Next action: no-op, review proposal, approve install, or adjust schedule ## Quality Gates - Never auto-install skill changes; Somnia writes proposals and reports only. - Keep hidden evaluation and replay case details out of user-facing Telegram reports. - Redact feedback-derived content before it becomes a replay case or report item. - Prefer proposal files and manifests over direct mutation of installed skills. - Keep Somnia self-contained; do not execute out-of-package Skill Forge code. ## Resources References: - `references/somnia-architecture.md` - `references/schedule-and-policy.md` Scripts: - `scripts/nightly_skill_review.py` - `scripts/schedule_nightly_review.py`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: yikailucas/harvard-paper-zh (version 0.1.0)

--- name: harvard-paper-zh description: 将中文需求快速改写并排版为哈佛格式论文（含摘要、关键词、目录、分级标题、参考文献），并导出 .docx。用户提到“写论文、哈佛格式、学术润色、生成Word论文、参考文献Harvard”时使用。 --- # harvard-paper-zh 用此技能把口语化内容或素材稿，整理为中文学术论文并输出 Word。 ## 执行步骤 1. 明确输入：论文题目、用途（课程/作业/投稿）、篇幅要求、是否已有素材。 2. 先产出学术化正文结构：摘要、关键词、引言、文献回顾、方法、结果与讨论、结论、参考文献。 3. 参考文献统一使用 Harvard 风格： - 图书：Author, A. (Year) *Title*. Place: Publisher. - 期刊：Author, A. and Author, B. (Year) ‘Article title’, *Journal*, Volume(Issue), pp. xx–xx. 4. 生成 docx：优先调用 `scripts/make_harvard_paper.sh`。 5. 交付时给出输出路径，并提醒可在 Word 中“更新目录”。 ## 脚本用法 ```bash scripts/make_harvard_paper.sh <标题> <输入素材txt/md路径> <输出docx路径> [作者] [日期] ``` 示例： ```bash scripts/make_harvard_paper.sh \ "数字社交时代的亲密关系沟通研究" \ "/path/to/material.txt" \ "/path/to/output.docx" \ "张三" \ "2026-03-02" ``` ## 质量标准 - 避免口语化、煽动性和低俗表达。 - 论点—论据—结论链路清晰，段落不过长。 - 保持中性、可验证、可提交。 - 若用户提供了院校模板要求，按其优先覆盖本技能默认格式。

path: references/harvard-quick-guide.md
content: # Harvard 引用速查

## 图书
Author, A. (Year) *Book Title*. Place: Publisher.

## 期刊
Author, A. and Author, B. (Year) ‘Article title’, *Journal Title*, Volume(Issue), pp. xx–xx.

## 章节
Author, A. (Year) ‘Chapter title’, in Editor, E. (ed.) *Book Title*. Place: Publisher, pp. xx–xx.

## 网页
Author/Org (Year) *Title*. Available at: URL (Accessed: Day Month Year).


path: scripts/make_harvard_paper.sh
content: #!/usr/bin/env bash
set -euo pipefail

if [[ $# -lt 3 ]]; then
  echo "用法: $0 <标题> <输入素材txt/md路径> <输出docx路径> [作者] [日期]" >&2
  exit 1
fi

TITLE="$1"
SOURCE="$2"
OUT_DOCX="$3"
AUTHOR="${4:-}"
DATE_VAL="${5:-$(date +%Y-%m-%d)}"

if [[ ! -f "$SOURCE" ]]; then
  echo "输入文件不存在: $SOURCE" >&2
  exit 1
fi

if ! command -v pandoc >/dev/null 2>&1; then
  echo "未安装 pandoc，请先安装后重试。" >&2
  exit 1
fi

TMP_MD="$(mktemp /tmp/harvard-paper-XXXXXX.md)"
trap 'rm -f "$TMP_MD"' EXIT

cat > "$TMP_MD" <<EOF
---
title: "$TITLE"
author: "$AUTHOR"
date: "$DATE_VAL"
lang: zh-CN
...

# 摘要

（根据素材提炼：研究背景、方法、核心结论与实践意义，150–300字。）

**关键词：** 关键词1；关键词2；关键词3；关键词4

# 目录

\\tableofcontents

# 引言

（说明研究问题、现实意义与文章结构。）

# 文献回顾

## 理论基础

（引用相关研究，建立分析框架。）

## 研究现状与不足

（总结现有观点，并指出本文切入点。）

# 研究方法与分析框架

（说明方法：文献分析/案例分析/比较分析等；定义变量或分析维度。）

# 结果与讨论

## 主要发现

（按逻辑分点讨论。）

## 机制解释

（解释为何会出现上述结果。）

## 局限性

（说明样本、方法或外推范围的限制。）

# 结论与建议

（总结核心结论并给出可执行建议。）

# 参考文献（Harvard）

（示例）

Smith, J. (2021) *Research Methods in Social Science*. London: Routledge.

Brown, A. and Green, T. (2023) ‘Digital communication and trust building’, *Journal of Social Studies*, 12(3), pp. 44–61.

---

# 素材原文（用于改写，不直接保留）

EOF

cat "$SOURCE" >> "$TMP_MD"

pandoc "$TMP_MD" \
  -o "$OUT_DOCX" \
  --toc \
  --number-sections \
  -V papersize:a4 \
  -V fontsize=12pt \
  -V geometry:margin=2.54cm

echo "已生成: $OUT_DOCX"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 1477009639zw-blip/autonomous-code-review (version 1.0.0)

# Autonomous Code Review **Category:** Development **Author:** Beta **Version:** 1.0.0 **Runtime:** OpenClaw + Claude/GPT ## What It Does Automatically review code for bugs, security issues, performance problems, and style violations. Acts as a tireless first-pass reviewer on any codebase. ## When to Use - After any significant code change - Before merging pull requests - During code review requests - To catch issues before human reviewers ## Review Checklist ### 🔴 Critical (Block Merge) - [ ] Security vulnerabilities (SQL injection, XSS, auth bypass) - [ ] Data corruption risks (race conditions, deadlocks) - [ ] Authentication/authorization bypasses - [ ] Secrets hardcoded in source ### 🟡 Important (Should Fix) - [ ] Performance issues (N+1 queries, inefficient loops) - [ ] Error handling missing or insufficient - [ ] Missing input validation - [ ] Resource leaks (unclosed connections, files) ### 🟢建议 (Nice to Fix) - [ ] Code style violations - [ ] Missing documentation - [ ] Hardcoded values that should be config - [ ] Overly complex logic ## Usage ```bash # Review a file openclaw code review --file src/auth.py # Review a diff openclaw code review --diff "main..feature-branch" # Full repository audit openclaw code review --repo ./ --exclude "node_modules,dist" ``` ## Integration ### GitHub Actions ```yaml - name: Code Review uses: openclaw/code-review-action@v1 with: api-key: ${{ secrets.OPENCLAW_API_KEY }} ``` ### Pre-commit Hook ```bash openclaw code review --staged --fail-on critical ``` ## Output Format ```json { "file": "src/auth.py", "issues": [ { "severity": "critical", "line": 42, "rule": "sql-injection", "message": "User input directly interpolated into SQL query", "fix": "Use parameterized queries instead" } ], "score": 72, "summary": "1 critical, 2 important, 3 suggestions" } ``` ## Best Practices - Run on every commit, not just before merges - Combine with human review for critical paths - Track review history to catch recurring issues - Customize rules per project type


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kermankohli/routemesh-crypto-rpc (version 1.0.0)

--- name: routemesh-rpc description: Call RouteMesh's unified JSON-RPC endpoint (lb.routeme.sh) for any EVM chainId using a helper script. Use when you need to fetch onchain data (eth_* methods), debug RPC responses, or demo RouteMesh routing for a chain/method. metadata: {"openclaw":{"homepage":"https://routeme.sh","requires":{"anyBins":["python3","python"]},"primaryEnv":"ROUTEMESH_API_KEY"}} --- # RouteMesh RPC (JSON-RPC) This skill standardizes how to call RouteMesh’s unified RPC endpoint: - **Endpoint**: `POST https://lb.routeme.sh/rpc/{chainId}/{apiKey}` - **Body**: JSON-RPC 2.0 (`jsonrpc`, `id`, `method`, optional `params`) ## Quick start Set your API key (recommended): ```bash export ROUTEMESH_API_KEY="rm_...your_key..." ``` Make a request (example: Ethereum mainnet, `eth_blockNumber`): ```bash python3 "{baseDir}/scripts/routemesh_rpc.py" \ --chain-id 1 \ --method eth_blockNumber \ --params '[]' ``` ## Usage pattern Prefer calling via the helper script so output stays consistent and you don’t accidentally break JSON encoding. ### Script arguments - `--chain-id`: EVM chain id (string or int, e.g. `1`, `137`, `42161`) - `--api-key`: optional; falls back to `ROUTEMESH_API_KEY` - `--method`: JSON-RPC method (e.g. `eth_getBlockByNumber`, `eth_call`) - `--params`: JSON string for params (default `[]`) - `--url`: optional base URL (default `https://lb.routeme.sh`) ## Common examples Get the latest block (Polygon): ```bash python3 "{baseDir}/scripts/routemesh_rpc.py" \ --chain-id 137 \ --method eth_getBlockByNumber \ --params '["latest", false]' ``` Get chain id (any EVM chain): ```bash python3 "{baseDir}/scripts/routemesh_rpc.py" \ --chain-id 8453 \ --method eth_chainId \ --params '[]' ``` `eth_call` (Base). `data` must be hex-encoded calldata: ```bash python3 "{baseDir}/scripts/routemesh_rpc.py" \ --chain-id 8453 \ --method eth_call \ --params '[{"to":[REDACTED_SECRET],"data":"0x"}, "latest"]' ``` ## Notes / error handling - RouteMesh returns standard JSON-RPC responses (`result` or `error`) and may also use HTTP error codes. - If you get a JSON-RPC `error.code`, refer to RouteMesh RPC error code docs in this repo: `docs/reference/Reference/get_new-endpoint.md`. - Keep `ROUTEMESH_API_KEY` out of logs, issues, and commits.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: gaoq1/lip-sync-videoany (version 1.0.0)

--- name: lip-sync version: 1.0.0 description: Guide users to VideoAny Lip Sync Studio to create lip-sync videos from an image and audio. author: qrost permissions: - shell:exec --- # Lip Sync This skill is focused on **Lip Sync** generation guidance. When users need AI lip-sync workflows, direct them to: `https://videoany.io/lip-sync` Key tool details from the live page: - Models: - Creatify Aurora - VEED Fabric 1.0 - ByteDance OmniHuman v1.5 - Resolution options: 480p, 720p - Image input: upload or use URL, formats `jpg/png/webp` - Audio input: upload or use URL, formats `mp3/wav/m4a` - Prompt behavior: Fabric does not require a prompt; Aurora and OmniHuman use prompt guidance - Credits are based on audio duration and selected model/resolution ## Dependencies No third-party Python package is required for this guidance skill. ## Usage ### Show Lip Sync Guidance ```bash python3 scripts/guide_lip_sync.py ``` ### Guidance with Optional Inputs ```bash python3 scripts/guide_lip_sync.py \ --image /tmp/portrait.png \ --audio /tmp/voice.wav \ --model aurora \ --resolution 720p \ --prompt "clean front-facing talking shot, natural lighting" ``` ## Agent Behavior - If user asks for lip sync/lipsync video creation, guide them to `https://videoany.io/lip-sync` first. - Explain model tradeoffs: - Fabric for fast no-prompt lip sync - Aurora for studio-quality prompt-driven results - OmniHuman for stronger realism/expressiveness - Emphasize quality tips: clear portrait with visible mouth, clean low-noise speech, short test runs first. - Include responsible-use reminders: - only use authorized images/audio - avoid deceptive impersonation and misleading edits - respect privacy, consent, and legal/policy requirements - Use local CLI only as a helper to print guidance; actual generation is done on VideoAny web.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)