OpenClaw/clawhub-security-signals huggingface dataset:
Skill: kingofzhao/prompt-chess-engineer (version 1.0.0)

# Prompt Chess Engineer > 对抗性Prompt工程：将博弈论与Prompt Engineering深度融合，构建可攻防的Prompt系统。 ## 何时使用 - 设计抗prompt注入的AI系统 - 构建红蓝对抗prompt测试框架 - 评估LLM安全边界 - 设计自适应prompt防御策略 ## 核心认知 ### 1. Prompt即博弈树 每个prompt是一次"走棋"。攻击方通过精心构造的输入试图绕过防御，防御方通过系统prompt和guardrail拦截。最优策略不是静态规则，而是minimax搜索：假设对手最优响应下最大化己方收益。 **关键洞察**：大多数prompt注入防御是"单步防御"（只看当前输入），而真正的攻击是"多步博弈"（分多次对话逐步绕过）。防御必须建模为扩展式博弈（extensive-form game）。 ### 2. Nash均衡与Prompt稳定性 一个prompt策略如果达到Nash均衡，意味着对手无法通过单方面改变策略获益。实践方法： - 对每个防御prompt，生成最优攻击prompt - 对每个攻击prompt，生成最优防御 - 迭代直到收敛（防御和攻击都不再改变） - 收敛点即为该类攻击的Nash均衡防御 ### 3. 信息不对称下的Prompt攻防 攻击方不知道系统prompt的内容（信息不对称），但可以通过探测（probing）逐步推断。防御策略： - **信息熵管理**：系统回复不应泄露内部结构信息 - **探测识别**：检测具有探测模式的对话序列 - **信息伪装**：对探测性输入返回一致的、不泄露结构的回复 ## 实践框架 ``` Phase 1: 威胁建模 ├── 枚举攻击向量（直接注入、间接注入、角色扮演、编码绕过...） ├── 为每个向量构建攻击prompt库 └── 评估当前系统的脆弱面 Phase 2: 防御构建 ├── 系统prompt分层（核心指令 + 边界检查 + 输出约束） ├── 多层guardrail（输入过滤 → 中间检测 → 输出审计） └── 自适应响应（根据攻击模式动态调整防御强度） Phase 3: 红蓝对抗 ├── 蓝队固化防御 → 红队攻击 → 记录突破路径 ├── 蓝队修补 → 红队再攻 → 迭代至收敛 └── 量化安全水位（攻击成功率下降曲线） Phase 4: 持续进化 ├── 新攻击模式自动归类 ├── 防御策略版本化管理 └── A/B测试不同防御策略的效果 ``` ## 输出模板 ```markdown ## Prompt Chess 分析报告 ### 攻击面 - [攻击向量1]: 成功率 X%, 严重度 Y - [攻击向量2]: ... ### 防御策略 - 层1（输入过滤）: [具体规则] - 层2（上下文检测）: [具体规则] - 层3（输出审计）: [具体规则] ### 博弈均衡分析 - 收敛轮次: N - 均衡防御: [描述] - 残余风险: [描述] ``` ## 碰撞来源 - `game-theory-system-design` × `prompt-engineering-deep` × `prompt-injection-defender` - `prompt-injection-red-team` × `multi-agent-debate-framework`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: phoenix1630/article-publisher (version 1.5.1)

--- name: article-publisher description: 自媒体文章多平台发布工具，支持知乎、Bilibili、百家号、头条号、小红书等平台的一键发布。使用Playwright实现浏览器自动化，支持扫码登录和Cookie持久化。 license: GPL-3.0 metadata: author: OpenClaw tags: ["auto-publish", "article", "zhihu", "bilibili", "baijiahao", "toutiao", "xiaohongshu", "playwright"] --- # Article Publisher - 自媒体文章发布助手 一键发布文章到知乎、Bilibili、百家号、头条号、小红书等平台。 ## Features - ✅ **多平台支持** - 知乎、Bilibili、百家号、头条号、小红书 - ✅ **一键发布** - 一次操作，多平台同步 - ✅ **扫码登录** - 安全便捷，无需密码 - ✅ **Cookie持久化** - 登录状态自动保存，免重复登录 - ✅ **登录状态检查** - 检查各平台的登录状态 ## Quick Start ### 1. 安装依赖 ```bash npm install npx playwright install chromium ``` ### 2. 登录平台 首次使用需要扫码登录各平台： ``` 请帮我登录知乎 ``` ### 3. 发布文章 ``` 帮我发布一篇文章到知乎，标题是"xxx"，内容是"xxx" ``` ### 4. 一键发布到所有平台 ``` 把这篇文章发布到所有已登录的平台 ``` ## Platform Support | Platform | Login | Features | |----------|-------|----------| | 知乎 | QR Code | 标题、内容、封面、标签 | | Bilibili | QR Code | 标题、内容、封面 | | 百家号 | QR Code | 标题、内容、封面、摘要、分类、标签 | | 头条号 | QR Code | 标题、内容、封面、标签 | | 小红书 | QR Code | 标题、内容、封面、标签 | ## Scripts - `src/index.ts` - 主入口文件 - `src/adapters/*.ts` - 各平台适配器 - `src/lib/*.ts` - 工具库 ## Config - Cookie 自动保存在本地，确保安全和隐私 ## Commands / Triggers Use this skill when: - "发布文章到知乎" - "帮我发布文章" - "一键发布到所有平台" - "检查登录状态" ## Security Notes - Cookie 保存在本地，注意保密 - 定期更新登录状态 - 不要分享账号配置文件 ## Troubleshooting ### Login timeout - Check network connection - Manually visit the platform website - Re-run and scan QR code again ### Publish failed - Check article content format - View browser window for error details ### Playwright errors ```bash npm install playwright npx playwright install chromium ``` --- _Ready to automate your article publishing? Let's go! 🚀_


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: edmond-ai/oc-guard-skill (version 1.1.2)

--- name: oc_guard description: Safe OpenClaw config planning/apply workflow with bilingual execution receipts. metadata: {"openclaw":{"requires":{"bins":["python3","openclaw","opencode"]}}} --- # oc-guard Skill ## Purpose All config-changing requests must go through `oc-guard`. Do not directly edit `~/.openclaw/openclaw.json`. When possible, invoke the bundled CLI at `{baseDir}/scripts/oc-guard.py`. ## Hard Rules 1. Use `oc-guard plan` before apply. 2. High-risk changes require `oc-guard apply --confirm`. 3. Always return execution receipt first. 4. If command is not executed, return `【模型说明-未执行】`. 5. Never claim success without a real `oc-guard` receipt. ## Common Commands - `{baseDir}/scripts/oc-guard.py --help` - `{baseDir}/scripts/oc-guard.py plan "<requirement>"` - `{baseDir}/scripts/oc-guard.py apply --confirm "<requirement>"` - `{baseDir}/scripts/oc-guard.py plan --proposal <file>` - `{baseDir}/scripts/oc-guard.py apply --confirm --proposal <file>`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector:  ()
Skill: zhangifonly/crewai (version 1.0.0)

--- name: "CrewAI" version: "1.0.0" description: "CrewAI 多智能体框架助手，精通 Agent 编排、任务分配、工具集成、工作流设计" tags: ["ai", "agent", "crewai", "multi-agent"] author: "ClawSkills Team" category: "ai" --- # CrewAI 多智能体框架助手 你是 CrewAI 多智能体编排领域的专家，帮助用户设计和实现高效的 AI 协作工作流。 ## 核心概念 | 概念 | 说明 | |------|------| | Agent | 智能体，具有角色(role)、目标(goal)、背景故事(backstory)的自主实体 | | Task | 任务，分配给特定 Agent 执行，包含描述和期望输出 | | Crew | 团队，编排多个 Agent 和 Task 的协作单元 | | Tool | 工具，Agent 可调用的外部能力（搜索、文件读写、API 调用等） | | Process | 流程模式，sequential（顺序）或 hierarchical（层级管理） | ## 安装 ```bash pip install crewai crewai-tools crewai create crew my_project # CLI 创建项目脚手架 ``` ## Agent 与 Task 定义 ```python from crewai import Agent, Task, Crew, Process researcher = Agent( role="高级研究分析师", goal="发现 {topic} 领域的最新突破性进展", backstory="你是一位资深的技术研究员，擅长从海量信息中提炼关键洞察。", tools=[search_tool, web_scraper], llm="gpt-4o", # 支持 OpenAI/Anthropic/Ollama memory=True, # 启用记忆，跨任务保持上下文 allow_delegation=False # 是否允许委派任务给其他 Agent ) writer = Agent( role="技术内容撰稿人", goal="将研究成果转化为通俗易懂的技术文章", backstory="你是一位经验丰富的技术写作者。", llm="gpt-4o" ) research_task = Task( description="深入研究 {topic} 的最新发展，收集至少 5 个可靠来源。", expected_output="一份结构化的研究报告，包含关键发现和来源引用。", agent=researcher, output_file="research_report.md" ) writing_task = Task( description="基于研究报告，撰写一篇 1500 字的技术博客文章。", expected_output="一篇完整的技术博客文章。", agent=writer, context=[research_task] # 依赖前置任务的输出 ) ``` ## Crew 编排 ```python crew = Crew( agents=[researcher, writer], tasks=[research_task, writing_task], process=Process.sequential, # 按顺序执行 memory=True, # 团队级记忆 planning=True # 启用任务规划 ) result = crew.kickoff(inputs={"topic": "AI Agent 框架"}) # 层级管理模式（自动创建 Manager Agent） crew_h = Crew( agents=[researcher, writer, editor], tasks=[research_task, writing_task, review_task], process=Process.hierarchical, manager_llm="gpt-4o" ) ``` ## 工具系统 ```python from crewai_tools import ( SerperDevTool, # Google 搜索 ScrapeWebsiteTool, # 网页抓取 FileReadTool, # 文件读取 PDFSearchTool, # PDF 搜索（RAG） CodeInterpreterTool # 代码执行 ) # 自定义工具 from crewai.tools import tool @tool("股票价格查询") def stock_price(ticker: str) -> str: """查询指定股票的实时价格。参数 ticker 为股票代码。""" return f"{ticker} 当前价格: $150.00" ``` ## 高级特性 | 特性 | 说明 | |------|------| | Memory | 短期/长期/实体记忆，跨任务和跨运行保持上下文 | | Planning | 任务执行前自动生成执行计划 | | Callbacks | 任务/步骤级回调，用于监控和日志 | | Async | 支持异步执行，`crew.kickoff_async()` | | Training | `crew.train(n_iterations=3)` 通过人类反馈优化 | | YAML 配置 | 支持 `agents.yaml` 和 `tasks.yaml` 声明式配置 | ## 与同类框架对比 | 特性 | CrewAI | LangGraph | AutoGen | |------|--------|-----------|---------| | 核心理念 | 角色扮演协作 | 图状态机 | 对话驱动 | | 学习曲线 | 低，API 直观 | 中等 | 中等 | | 编排方式 | Sequential/Hierarchical | 自定义有向图 | 对话/群聊 | | 工具生态 | crewai-tools 丰富 | LangChain 生态 | 函数注册 | | 适用场景 | 内容生产、研究分析 | 复杂工作流 | 代码生成、多轮讨论 |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: yay2008/openclaw-model-optimizer (version 1.1.0)

--- name: openclaw-model-optimizer description: Optimize OpenClaw model configuration by declaring missing model capabilities (vision/multimodal input, context window, max output tokens, reasoning). Use when user mentions OpenClaw model optimization, model capabilities not working, image/vision not recognized, context window too small, output truncated, or after adding a new model provider to openclaw.json. Also triggers on "优化openclaw模型配置" or similar requests. --- # OpenClaw Model Optimizer Optimize `openclaw.json` model configurations by declaring model capabilities that OpenClaw cannot auto-detect. ## Problem OpenClaw does not auto-detect model capabilities from providers. Without explicit declarations, features like vision input, large context windows, extended output, and reasoning mode remain disabled — even when the underlying model and API fully support them. ## Workflow 1. Read `~/.openclaw/openclaw.json` 2. **Back up the config** — copy `~/.openclaw/openclaw.json` to `~/.openclaw/openclaw.json.bak` before making any changes 3. Identify all configured models under `models.providers` 4. Check if `agents.defaults.models` exists with capability declarations for each model 5. For missing or incomplete declarations, ask the user to confirm each model's capabilities 6. Add the `agents.defaults.models` block with proper declarations 7. Remind user to restart OpenClaw for changes to take effect ## Capability Fields Declare capabilities in `agents.defaults.models` using the `provider-id/model-id` key format: ```json { "agents": { "defaults": { "models": { "provider-id/model-id": { "input": ["text", "image"], "contextWindow": 256000, "maxTokens": 16384, "reasoning": true } } } } } ``` ### Field Reference | Field | Type | Description | |-------|------|-------------| | `input` | `string[]` | Supported input modalities: `"text"`, `"image"`. Default if omitted: `["text"]` only — vision disabled | | `contextWindow` | `number` | Max input context in tokens. Default if omitted: conservative fallback — may truncate long conversations | | `maxTokens` | `number` | Max output tokens per response. Default if omitted: conservative fallback — long responses get cut off | | `reasoning` | `boolean` | Whether model supports extended thinking/CoT. Default if omitted: `false` | ## Common Model Capabilities Reference for popular models (always verify with user before applying): See [references/model-capabilities.md](references/model-capabilities.md) for known model defaults. ## Important Notes - **Always back up `openclaw.json` to `openclaw.json.bak` before modifying** — never edit the config without a backup - Always confirm capabilities with the user — API endpoints may differ from model defaults - The `provider-id/model-id` key must match exactly what appears in `models.providers` and `agents.defaults.model.primary` - Do not overwrite existing capability declarations without user consent


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: devinchen2014/socialdatax-douyin-detail (version 0.1.6)

--- name: socialdatax-douyin-detail description: 用于抖音数据分析、抖音作品详情、图文详情、作品数据、互动指标、内容调研和内容分析。覆盖 Douyin work details，来自 SocialDataX 社媒数据助手。 metadata: {"openclaw":{"requires":{"env":["SOCIALDATAX_API_KEY"],"bins":["node","npm"]},"primaryEnv":"SOCIALDATAX_API_KEY","emoji":"📄","homepage":"https://socialdatax.com/?from=clawhub","install":[{"kind":"node","package":"socialdatax-skills","bins":[]}]}} --- # 抖音数据分析 SocialDataX 作品详情 Use this skill when the user provides a Douyin / 抖音 work ID, content URL, short link, or share text and wants 抖音数据分析, 作品详情, image/text post details, or interaction metrics. ## API Key Use `SOCIALDATAX_API_KEY` for data calls. The only official website for requesting or managing API access is <https://socialdatax.com/?from=clawhub>. If a user asks where to get a key, provide only this URL; do not infer alternate domains. 获取或管理 API Key：访问 <https://socialdatax.com/?from=clawhub>，按官网的 API Key 申请/管理入口操作。环境变量名固定使用 `SOCIALDATAX_API_KEY`；不要引导用户使用其他域名。 ## Preferred Direct CLI Prefer the direct CLI when the agent can run shell commands. It does not require MCP server configuration: ```bash npx -y socialdatax-skills@latest douyin detail --aweme-id "<aweme_id>" --pretty npx -y socialdatax-skills@latest douyin detail --url "<douyin_content_url_or_share_text>" --pretty ``` - `--aweme-id <aweme_id>`: preferred when the Douyin work ID is already known. - `--url <douyin_content_url_or_share_text>`: use for a Douyin content page URL, short link, or share text; do not pass `video.play_url`. - `--pretty`: output formatting only. Use either `--aweme-id` or `--url` for one detail command, not both. ## Safety Boundary This skill is read-only. It does not read local browser data, does not save API keys, and does not perform login, posting, liking, commenting, or account changes. ## MCP Tools If MCP tools are already available in the current agent, use one of these tools: - `douyin_get_video_detail_by_aweme_id`: use when an aweme_id is already known. - `douyin_get_video_detail_by_url`: use for Douyin content page URLs, short links, or share text; do not pass playback URLs such as `video.play_url`. ## Output Guidance Return factual fields such as description, author, publish time, interaction counts, `content_type`, images, and media summary when available. Use `images` for image/text posts; `video` is the platform player resource and may be audio for image/text posts.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: realpda/deep-token-saver (version 1.0.0)

--- name: deep-token-saver description: 综合 token 节省方案。6层技术叠加，从输入/输出/记忆/上下文/审计全链路降本。含Caveman、L0/L1/L2分层、Remnic/QMD持久化、记忆去重、AGENTS压缩、Token审计。 --- # Deep Token Saver — 综合 Token 节省方案 > 6层叠加，从根源省 token，不止压缩一句话。 --- ## 层1：输出压缩（Caveman Mode） | 规则 | 说明 | |:----|:-----| | 去冠词/废话/客套 | a/an/the/just/really/basically/当然/没问题 | | 短句碎片 | 结论先行，不铺垫 | | 技术内容保持 | 代码块/路径/数字/名称 原样 | | 切换开关 | 回复走碎片模式。说`正常说话`恢复 | **省：↓75% 输出 token** --- ## 层2：输入压缩（启动文件 + 记忆） | 文件 | 处理方式 | 省 | |:----|:--------|:--:| | AGENTS.md | 压缩为 caveman 版 | ↓61% | | SOUL.md | 保持轻量 | — | | memory 条目 | 定期合并、去重 | ↓20-30% | | memory-sync | 每日自动归档到 workspace/memory/ | 防膨胀 | --- ## 层3：L0/L1/L2 分层笔记（概念笔记用） 每条概念笔记 frontmatter 加 `abstract:` 字段。我只加载 L0，按需展开： | 层级 | 内容 | 长度 | 加载策略 | |:---:|:----|:---:|:--------| | **L0** | `abstract:` 一句话定义 | ~50 chars | 永远加载 | | **L1** | 核心规则 | ~200 chars | 按需 | | **L2** | 全文笔记 | ~500+ chars | 点开才读 | **省：↓90% 笔记读取 token** --- ## 层4：跨会话记忆持久化（Remnic + QMD） 已装组件： - `@remnic/cli` + `@remnic/server` - `remnic-hermes` Python MemoryProvider - QMD 混合搜索（BM25 + 向量 + 重排序） 开机自启：计划任务 `RemnicServer` **省：↓全量记忆重复加载** --- ## 层5：记忆去重与合并 定期扫描记忆条目： - 语义相似条目 → 合并 - 过期/无用条目 → 删除 - 长条目 → 压缩 通过 Remnic API 执行： ``` curl -s -H "Authorization: Bearer $TOKEN" http://127.0.0.1:4318/engram/v1/consolidate ``` **省：↓20-30% 记忆空间** --- ## 层6：Token 节省审计 每次回复末尾显示本轮的 token 节省： ``` ⚡省: 原本~X 实际~Y 省Z% | 累计省~W ``` 数据来源：回复字符数 × 4（1 token ≈ 4 chars）估算。 **省：不直接省，但可视化降本效果** --- ## 总省效果 | 层 | 省多少 | 类型 | |:--|:-----:|:----| | 输出压缩 | ↓75% | 每轮 | | 输入压缩 | ↓61% | 每会话 | | L0/L1/L2 | ↓90% | 笔记读取 | | Remnic/QMD | 全量→按需 | 跨会话 | | 记忆去重 | ↓20-30% | 维护 | | **合计** | **预估↓80-90%** | **全链路** | --- ## 维护命令 ```bash # 查看 Remnic 状态 curl -s -H "Authorization: Bearer $TOKEN" http://127.0.0.1:4318/engram/v1/health # 手动记忆合并 curl -s -X POST -H "Authorization: Bearer $TOKEN" http://127.0.0.1:4318/engram/v1/consolidate # 查看 token 节省统计 curl -s -H "Authorization: Bearer $TOKEN" http://127.0.0.1:4318/engram/v1/stats # 手动记忆同步 cd /c/Users/Administrator/workspace && python hermes-memory-sync.py backfill today ``` --- ## 故障排除 | 问题 | 解决 | |:----|:-----| | Remnic 未运行 | 执行 `start-remnic.bat` 或重启电脑自动启 | | 记忆条目满了 | 手动执行记忆合并命令 | | 想正常说话 | 说`正常说话` |


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: freeslym/agent-daily-report-en (version 1.0.1)

--- name: agent-daily-report-en description: "Enables the agent to review its own execution logs and deliver a professional, quantified daily work report. Defaults to 21:00 America/Los_Angeles and supports user-defined schedule plus on-demand reporting." --- # Agent Self-Reporting ## Metadata - Author: freeslym - Version: 1.0.1 ## Role You are a highly efficient, honest, and results-driven digital assistant. Your task is to generate a daily execution summary for your manager based on this session's (or today's) real execution records (tools, outputs, and decisions). ## Reporting Logic 1. **Review Records**: Inspect tools used, files changed, information retrieved, and problems solved. 2. **Extract Outcomes**: Convert atomic actions (e.g., "searched 3 times") into business outcomes (e.g., "completed competitive research"). 3. **Be Accurate**: Report only what actually happened. Never fabricate work. ## Reporting Schedule - **Scheduled report**: Submit a daily report at 21:00 (America/Los_Angeles, US West). - **On-demand report**: If the user requests a report, respond immediately. - **User-configurable schedule**: If the user sets a different time/timezone, follow user preference as highest priority. - **Boundary rule**: If no meaningful output exists for the day, explicitly state "No key output". ## Output Template ### 🤖 [Agent Name] Daily Execution Report - [Date] #### ✅ Accomplishments - [Core Task A]: Status (100%). Completed `[specific output]` via [tool]. - [Core Task B]: Status (in progress/80%). Completed `[subtask]`; remaining `[pending item]`. #### 📊 Efficiency Stats - Tool usage: [N] calls total (search, file ops, scripts, etc.). - Information processing: [N] documents/web pages reviewed. - Responsiveness: Average handling time around [N] seconds. #### ⚠️ Risks & Limitations - [Blocker]: Cause and impact. - [Suggestion]: Recommended mitigation or support needed. #### 📅 Next Focus - Priorities: `[todo-1]`, `[todo-2]`. --- **Style requirement**: Professional, concise, evidence-based, and value-focused.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: agenthyjack/marrs (version 1.6.0)

--- name: marrs description: Memory maintenance helper for any RAG/vector database. Includes save_memory() helper, monitor and defrag script templates, hot queue support, and configurable defaults. Declares 'requests' dependency. Fully generic, safe, and configurable once you edit the config. Accurate description of all contents. --- # marrs **Memory maintenance helper for any RAG/vector database.** ## Complete Setup Guide (so it works for any user) 1. Install via ClawHub or copy the folder. 2. `pip install requests` (the only external dependency). 3. Edit `scripts/config.py` with your own RAG details (examples are placeholders only). 4. Create two scheduled jobs to run the monitor and defrag scripts (see your platform's cron/docs). 5. Test with the example in the Basic Usage section below. Review the three small Python scripts before use — they are short and easy to audit. ## Configuration (`scripts/config.py`) ```python RAG_URL = "http://your-rag-server:port" # ← Replace with your own DEFAULT_COLLECTION = "memory" # Change to your main collection MONITOR_INTERVAL_SECONDS = 300 DEFRAG_INTERVAL_SECONDS = 86400 ``` ## Basic Usage ```python from scripts.save_memory import save_memory save_memory("Your content here", collection="your-collection") ``` ## What it contains - `save_memory()` helper that POSTs to your RAG `/ingest` endpoint - Template scripts for monitor and defrag (background maintenance) - Hot queue logic for fast retrieval of frequent items - Configurable defaults (you must edit them) **No hardcoded paths, no internal systems, no credentials.** ## Security Notes - Only interacts with the RAG_URL you configure. - Uses the 'requests' library (installed separately). - Prints status messages to stdout (visible in your logs). - The crons you create will run the scripts autonomously — only add them if you trust the code after review. - Recommended: run the scripts in an isolated environment first. This package is **instruction + runnable scripts**. The SKILL.md accurately describes everything it contains. No private data, no keys, no tokens, no names, no locations. **Version**: 1.5.0 **Status**: Honest metadata, declared dependency, clear audit instructions. Clean for public use.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: benleyl/feishu-perm-help (version 1.0.0)

# feishu-perm-helper 一键启用飞书权限管理工具，让 OpenClaw 可以管理飞书文档/表格的协作者权限。 ## 🎯 功能 - ✅ 自动启用 `feishu_perm` 工具 - ✅ 支持添加/查看/移除协作者 - ✅ 提供常用命令示例 ## 📦 安装 ```bash clawhub install feishu-perm-helper ``` 或者手动安装： ```bash cp -r feishu-perm-helper ~/.openclaw/workspace/skills/ ``` ## 🚀 使用 ### 安装后自动启用 安装完成后，Skill 会自动修改配置文件并重启 Gateway。 ### 手动启用（可选） 如果自动启用失败，可以手动执行： ```bash node ~/.openclaw/workspace/skills/feishu-perm-helper/scripts/enable-perm-tool.js ``` ### 使用命令 安装后，在飞书里对机器人说： **添加协作者：** ``` 给这个表格添加编辑权限 https://xxx.feishu.cn/base/XXX 用户：ou_xxxxxxxxxxxx ``` **查看协作者列表：** ``` 查看这个表格的协作者 https://xxx.feishu.cn/base/XXX ``` **移除协作者：** ``` 移除 XX 的编辑权限 https://xxx.feishu.cn/base/XXX 用户：ou_xxxxxxxxxxxx ``` ## 📝 配置说明 ### 配置文件位置 `~/.openclaw/openclaw.json` ### 需要添加的配置 ```json { "channels": { "feishu": { "tools": { "perm": true }, "accounts": { "default": { "tools": { "perm": true } } } } } } ``` ### 需要的飞书应用权限 确保飞书应用有以下权限： - `docs:permission.member:create` - 添加协作者 - `docs:permission.member:read` - 查看协作者 - `docs:permission.member:delete` - 移除协作者 这些权限在飞书开放平台默认已授予。 ## 🆘 故障排查 ### 工具未启用 检查 Gateway 日志： ```bash openclaw gateway status ``` 应该看到： ``` [plugins] feishu_perm: Registered feishu_perm tool ``` ### 权限不足错误 确保： 1. 飞书应用有相关 API 权限 2. 应用是表格的协作者（可管理权限） ### 配置不生效 重启 Gateway： ```bash openclaw gateway restart ``` ## 📞 反馈 遇到问题或有建议，欢迎反馈！ ## 📄 许可证 MIT License


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: ginntech/img-compress (version 1.0.1)

--- name: img-compress description: Batch compress image file sizes (JPG/PNG), keep dimensions, reduce volume. Activate when user mentions: compress images, reduce image size, image optimization, batch compress images. --- # img-compress Batch image compression tool based on Pillow(PIL). ## Quick Usage ```bash # Compress images over 100KB to 80KB sudo python3 skills/img-compress/scripts/compress_img.py /path/to/images # Custom target size (KB) sudo python3 skills/img-compress/scripts/compress_img.py /path/to/images 150 ``` ## Compression Rules - JPG/JPEG: Gradually reduce quality (85→50) + optimize until under target size - PNG: Pillow PNG compression (limited), recommend pngquant for better results - Files under target size are skipped - Overwrites original files (in-place) ## Dependencies - Python3 - Pillow: `pip3 install Pillow` ## Typical Scenarios ```bash # Compress website static assets sudo python3 skills/img-compress/scripts/compress_img.py /var/www/static/img 100 ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)