OpenClaw/clawhub-security-signals huggingface dataset:
Skill: willing-lin/sql-reflect (version 1.0.0)

--- name: sql-reflect description: 快速定位 SQL 语句在 PHP/Laravel 代码中的触发位置，通过分析 SQL 结构反向追踪到具体的代码文件、方法和行号 version: 1.0.0 --- ## 触发条件 当用户使用以下表述时触发此技能： - "帮我查找一下这句 sql 语句是在哪个地方的代码触发的" - "查询这个 SQL 代码位置" - "这条 SQL 是从哪里调用的" - "定位这条 SQL 的触发代码" - "查找 SQL 触发位置" ## 执行流程 ### 1. 提取关键信息 从 SQL 语句中提取： - **主表名**：FROM 后的表名（如 `pk_transaction_meet_records`） - **关联表名**：JOIN、EXISTS 子句中的表名 - **关键条件**：WHERE 中的特殊字段组合 - **查询特征**：特殊结构（如嵌套 EXISTS、特定字段组合） ### 2. 搜索代码位置 使用 grep 工具执行以下搜索（按优先级）： 1. **搜索表名**（最精确） - 搜索模式：`pk_表名` - 文件类型：`*.php` - 搜索范围：`app/` 2. **搜索模型类名** - 转换规则：去掉 `pk_` 前缀，转 PascalCase - 如：`pk_transaction_meet_records` → `TransactionMeetRecord` 3. **搜索特殊字段组合** - 提取 WHERE 条件中的 2-3 个特征字段 - 搜索这些字段的组合出现位置 ### 3. 分析搜索结果 对比 SQL 特征和代码： - 字段匹配：SQL 中的字段是否在代码的 select/where 中出现 - 条件匹配：WHERE 条件是否与代码一致 - 结构匹配：JOIN/EXISTS 结构是否对应 whereHas/join 等 - 参数匹配：绑定参数的位置和数量 ### 4. 定位关联关系 查找涉及的模型关联定义： - 搜索 `function 关联名()` 在 Models 目录 - 分析 belongsTo/hasMany 等关联类型 - 确认外键字段 ### 5. 追踪调用链路 从找到的代码位置向上追踪： - 哪个 Controller 调用了这个 Service - 哪个方法实例化了这个 Model - 完整的调用路径 ## 输出格式 ```markdown ## SQL 语句触发位置分析 ### 📍 触发代码位置 **文件路径：** `/path/to/file.php` **方法：** `methodName`（第 X 行开始） **具体代码段：** 第 X-Y 行 --- ### 🔍 SQL 生成逻辑 这段代码通过 [Laravel Eloquent 特性] 生成： ```php // 关键代码片段（10-20 行） ``` --- ### 🔗 关联关系链 查询涉及的模型关联： 1. **`关联名`** - `模型类::关联方法()`（第 X 行） --- ### 📋 生成的 SQL 结构 ```sql -- SQL 结构说明 ``` --- ### 📂 调用链路 ``` Controller.php:行号 ↓ (调用说明) Service.php:行号 ↓ Model::query() ↓ 最终 SQL ``` --- ### 💡 使用场景 这个查询用于 [业务场景说明] ``` ## 表名映射参考 | 表名 | 模型类 | |------|--------| | pk_transaction_meet_records | TransactionMeetRecord | | pk_customer | Customers | | pk_customer_card | CustomerCard | | pk_order_offline | OrderOffline | | pk_order_offline_refund_logs | OrderOfflineRefundLogs | | pk_order_online | OrderOnline | | pk_template_activity | TemplateActivity | | pk_guide | StoreGuide | | pk_store | Store | | pk_customer_goods_attribute_tag | CustomerGoodsAttributeTag | | pk_guide_customer | GuideCustomer | | pk_promotion_goods | PromotionGoods | | pk_order_goods_online | OrderGoodsOnline | | pk_order_goods_online_records | OrderGoodsOnlineRecord | ## SQL 结构对应 | SQL 结构 | Laravel 写法 | |---------|-------------| | EXISTS (SELECT...) | whereHas() / whereExists() | | LEFT JOIN | leftJoin() / with() | | INNER JOIN | join() | | BETWEEN ... AND ... | whereBetween() | | IN (...) | whereIn() | | NOT EXISTS | whereDoesntHave() | ## 特殊字段组合 | 字段组合 | 可能业务 | |---------|---------| | business_no + source_type + is_met | TransactionMeetRecord | | order_no + refund_order_no + is_valid | OrderOfflineRefundLogs | | customer_id + first_consume_time + second_consume_time | CustomerCard | | guide_id + customer_id + relation_type | GuideCustomer | | attribute_pid + attribute_id + num | CustomerGoodsAttributeTag | ## 注意事项 1. 优先使用精确搜索（完整表名），再使用模糊搜索 2. 注意表名前缀（pk_）和模型命名规则 3. 如果找到多个匹配位置，按匹配度排序并说明差异 4. SQL 中的 `?` 在代码中对应变量或请求参数 5. 某些 SQL 可能由多个代码位置生成，需列出所有可能


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ntriq-gh/ntriq-x402-document-intel (version 1.0.0)

--- name: ntriq-x402-document-intel description: "Extract text, classify document type, and pull tables from any document image. Pay $0.05 USDC per call via x402 (no API key needed)." version: 1.0.0 metadata: openclaw: primaryTag: data-intelligence tags: [document, ocr, extraction, x402, vision] author: ntriq homepage: https://x402.ntriq.co.kr --- # Document Intelligence (x402) Analyze document images — invoices, contracts, forms, reports — with local AI vision. Extracts text, classifies document type, pulls tables, or summarizes. No cloud upload, no API key. Pay $0.05 USDC per call via x402 micropayment (Base mainnet). ## How to Call ```bash POST https://x402.ntriq.co.kr/document-intel Content-Type: application/json X-PAYMENT: <x402-payment-header> { "image_url": "https://example.com/document.png", "analysis_type": "extract" } ``` The server responds with `402 Payment Required` first. Sign the EIP-3009 payment payload and retry with `X-PAYMENT` header. ## Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `image_url` | string | ✅ (or base64) | Publicly accessible URL of document image | | `image_base64` | string | ✅ (or url) | Base64-encoded document image | | `analysis_type` | string | ❌ | `extract` (default), `summarize`, `classify`, `table` | | `language` | string | ❌ | Output language ISO code (default: `en`) | ## analysis_type Options | Value | What it does | |-------|-------------| | `extract` | Full text extraction preserving structure | | `summarize` | Key points, dates, amounts, parties | | `classify` | Document type + key metadata | | `table` | All tables as JSON array | ## Example Response ```json { "status": "ok", "analysis_type": "classify", "analysis": "invoice", "confidence": 0.97, "metadata": { "vendor": "Acme Supplies Ltd.", "invoice_number": "INV-2024-0847", "date": "2024-03-15", "total": "$475.00" } } ``` ## Payment - **Price**: $0.05 USDC per call - **Network**: Base mainnet (EIP-3009 gasless) - **Protocol**: [x402](https://x402.org) - **Wallet**: [REDACTED_SECRET] ```bash # Service catalog curl https://x402.ntriq.co.kr/services ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: nansen-devops/nansen-wallet-deep-dive (version 0.1.0)

--- name: nansen-wallet-deep-dive description: "Who is this wallet and what have they been doing? Identity labels, balance, PnL summary, recent transactions, perp positions, and counterparties." metadata: openclaw: requires: env: - NANSEN_API_KEY bins: - nansen primaryEnv: NANSEN_API_KEY install: - kind: node package: nansen-cli bins: [nansen] allowed-tools: Bash(nansen:*) --- # Wallet Analysis **Answers:** "Who is this wallet and what have they been doing?" ```bash ADDR=<address> CHAIN=ethereum nansen research profiler labels --address $ADDR --chain $CHAIN # → label, category (e.g. "Smart Trader", "Fund", "Public Figure", ENS names) nansen research profiler balance --address $ADDR --chain $CHAIN # → token_symbol, token_name, token_amount, price_usd, value_usd per holding nansen research profiler pnl-summary --address $ADDR --chain $CHAIN --days 30 # → realized_pnl_usd, realized_pnl_percent, win_rate, traded_token_count, traded_times, top5_tokens nansen research profiler transactions --address $ADDR --chain $CHAIN --limit 20 # → block_timestamp, method, tokens_sent, tokens_received, volume_usd, source_type nansen research profiler perp-positions --address $ADDR # → asset_positions, margin_summary_account_value_usd, margin_summary_total_margin_used_usd nansen research profiler counterparties --address $ADDR --chain $CHAIN --days 30 # → counterparty_address, counterparty_address_label, interaction_count, total_volume_usd, volume_in/out_usd ``` perp-positions returns Hyperliquid data — returns empty if the wallet has no open perps.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zykqyer/issuu-downloader (version 1.0.0)

# Issuu PDF Downloader (Professional Edition) A robust and reliable tool to download any publicly available document from **Issuu.com** and convert it into a high-quality PDF. This version includes anti-blocking measures and auto-proxy detection. Please use VPN if you located in a restricted region. ## Key Features - **Anti-503 Logic**: Enhanced retry mechanism to bypass temporary service blocks. - **Auto-Proxy Detection**: Automatically detects local proxies (Clash/V2Ray) on common ports (7890, 1080, 1087). - **Smart Probing**: Uses a refined page detection algorithm to ensure all pages are captured. - **High-Fidelity PDF**: Direct JPG-to-PDF conversion to maintain original resolution. ## How to Use Simply provide the Issuu URL to the AI: > "Download this Issuu link for me: https://issuu.com/example/docs/manual" ## Troubleshooting for Restricted Regions If you encounter "Access Denied" or "503 Error": 1. **Enable Proxy**: Ensure your VPN/Proxy is active. 2. **Switch Node**: Try a different server location (US or UK recommended). 3. **Manual Proxy**: You can explicitly provide a proxy: > "Use proxy http://127.0.0.1:7890 to download this Issuu link..." ## Disclaimer For educational purposes only. Users are responsible for complying with Issuu's Terms of Service and copyright laws.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: 596655510-wang/mydir (version 1.0.0)

--- name: custom-clients description: 列出 E:\work\custom 下所有客户文件夹名称。触发词包括"我的客户"、"列出客户"、"客户有哪些"、"支持的客户"、"客户列表"、"查看客户"、"custom客户"。 user-invocable: true --- # Custom Clients 列出支持的客户列表。 ## 使用方法 当需要列出支持的客户时，执行以下 PowerShell 命令： ```powershell [Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Get-ChildItem -Path "E:\work\custom" -Directory | ForEach-Object { $_.Name } ``` 这会返回 E:\work\custom 目录下所有子文件夹的名称（即客户名称）。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jpengcheng523-netizen/jpeng-workflow-automation (version 1.0.0)

--- name: jpeng-workflow-automation description: "Automate workflows" version: "1.0.0" author: "jpeng" tags: ["workflow", "automation", "automation"] --- # Workflow Automation Automate workflows ## When to Use - User needs workflow related functionality - Automating automation tasks - Automation operations ## Usage ```bash python3 scripts/workflow_automation.py --input <input> --output <output> ``` ## Configuration Set required environment variables: ```bash export AUTOMATION_API_KEY="your-api-key" ``` ## Output Returns JSON with results: ```json { "success": true, "data": {} } ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yinshengf/stock-portfolio (version 1.0.0)

--- name: stock-portfolio description: 股票组合管理与预警技能。支持 A 股/港股/美股行情查询、持仓跟踪、收益计算、价格预警、每日推荐。使用免费 API（腾讯财经），数据本地存储。 --- # 股票组合管理技能 ## 核心功能 ### 1. 📊 行情查询 - 实时股价、涨跌幅、成交量 - 支持 A 股（600xxx/000xxx/300xxx）、港股（00700）、美股（AAPL） ### 2. 💼 持仓管理 - 记录买入价、持仓数量、加仓/减仓 - 自动计算当前市值、盈亏金额、盈亏比例 - 持仓数据本地存储（JSON 文件） ### 3. 🔔 价格预警 - 设置目标价/涨跌幅阈值 - 主动查询时检查预警状态 - 可选 cron 定时监控 ### 4. 💡 每日推荐 - 每日 5 只股票推荐 - 基于技术指标（涨跌幅、振幅、成交量）+ 基本面（行业龙头） - 多线程获取行情数据，快速响应 - 推荐列表可配置（修改 STOCK_POOL） ## 快速开始 ### 查询股价 ```bash # 使用脚本查询 python scripts/stock_fetch.py 600519 python scripts/stock_fetch.py AAPL ``` ### 管理持仓 ```bash # 添加持仓 python scripts/portfolio_manager.py add --symbol 600519 --price 1500 --shares 100 # 查看持仓 python scripts/portfolio_manager.py list # 计算收益 python scripts/portfolio_manager.py summary ``` ### 设置预警 ```bash # 设置价格预警 python scripts/portfolio_manager.py alert --symbol 600519 --target 1600 # 查看预警 python scripts/portfolio_manager.py alerts ``` ## 数据源 ### 腾讯财经 API（免费、无需 key） **A 股格式：** `sh600519`, `sz000001`, `sz300750` **港股格式：** `hk00700` **美股格式：** `usAAPL`, `usTSLA` **接口：** `http://qt.gtimg.cn/q={symbol}` **返回示例：** ``` v_sh600519="1~贵州茅台~600519~1408.81~1445.00~1433.33~..." ``` 字段说明（~分隔）： - 字段 0: 未知 - 字段 1: 股票名称 - 字段 2: 股票代码 - 字段 3: 当前价格 - 字段 4: 昨日收盘价 - 字段 5: 今日开盘价 - 字段 6: 成交量（手） - 字段 31: 涨跌额 - 字段 32: 涨跌幅% - 字段 33: 今日最高价 - 字段 34: 今日最低价 - 字段 47: 成交额（万） 详细 API 文档见 [references/api_docs.md](references/api_docs.md) ## 数据存储 持仓数据存储在：`~/.openclaw/workspace/skills/stock-portfolio/data/` - `holdings.json` - 持仓记录 - `alerts.json` - 预警设置 - `history.json` - 查询历史（可选） ## 每日推荐逻辑 推荐策略（见 [references/recommendation_strategy.md](references/recommendation_strategy.md)）： 1. **技术面筛选**（60% 权重） - 涨跌幅：温和上涨（0-3%）得分最高 - 振幅：适度活跃（2-6%）得分高 - 成交量：大于 500 万股加分 2. **基本面筛选**（40% 权重） - 行业龙头优先 - 业绩稳定增长 - 市值适中 3. **随机因子** - 基于日期种子，确保同一天推荐一致 - 增加多样性，避免推荐过于集中 推荐结果每日更新，多线程获取行情数据（约 3-5 秒完成）。 ## 使用示例 **用户：** "查询茅台今天的股价" **操作：** 调用 `stock_fetch.py sh600519`，返回实时行情 **用户：** "我买了 100 股茅台，成本 1500" **操作：** 调用 `portfolio_manager.py add --symbol sh600519 --price 1500 --shares 100` **用户：** "我的持仓收益怎么样" **操作：** 调用 `portfolio_manager.py summary`，获取当前股价并计算盈亏 **用户：** "茅台涨到 1600 提醒我" **操作：** 调用 `portfolio_manager.py alert --symbol sh600519 --target 1600` **用户：** "今天有什么股票推荐" **操作：** 调用 `scripts/daily_picks.py`，返回 5 只推荐股票 ## 定时任务（可选） 配置 cron 实现： - 每日 9:00 推送推荐股票 - 每 30 分钟检查预警条件 见 [references/cron_setup.md](references/cron_setup.md) ## 注意事项 1. **数据延迟**：免费 API 有 15 分钟延迟（A 股实时，港股/美股延迟） 2. **交易时间**：非交易时间返回收盘价 3. **复权处理**：当前不支持复权，分红/拆股需手动调整成本 4. **数据备份**：定期备份 `data/` 目录 ## 扩展方向 - 接入更多数据源（东方财富、Yahoo Finance） - 支持基金、债券 - K 线图生成 - 回测功能


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: webguhui/fact-check (version 1.0.0)

--- name: fact-check description: Verify claims, statements, and information against reliable sources. Use when user asks to fact-check, verify, confirm, validate, or check the accuracy of any statement, statistic, quote, date, or claim. Performs cross-reference searches, identifies source credibility, and provides evidence-based verdicts. --- # Fact Check Verify information through systematic source verification. ## Workflow 1. **Identify the claim** - Extract the specific statement to verify 2. **Search sources** - Query reliable sources (news outlets, academic papers, official databases) 3. **Cross-reference** - Check multiple independent sources 4. **Evaluate credibility** - Assess source reliability and potential biases 5. **Deliver verdict** - Provide clear conclusion with evidence ## Claim Types | Type | Approach | Trusted Sources | |------|----------|-----------------| | Statistics | Find original study/data | Government databases, peer-reviewed journals | | Quotes | Locate primary source | Official transcripts, news archives | | News events | Verify via multiple outlets | Major news organizations | | Historical facts | Consult academic sources | Encyclopedias, scholarly publications | | Product/company info | Check official sources | Company websites, SEC filings | ## Source Hierarchy **Tier 1 (Highest):** - Peer-reviewed journals - Government databases/official statistics - Court records, legal documents **Tier 2:** - Major news outlets (Reuters, AP, BBC, etc.) - Established academic institutions - Official company/organization statements **Tier 3:** - Social media (verify via other sources) - Blogs, personal websites - Unverified reports ## Output Format ``` Claim: [exact statement] Verdict: [TRUE / MOSTLY TRUE / UNVERIFIABLE / MOSTLY FALSE / FALSE] Evidence: - Source 1: [details] - Source 2: [details] Notes: [context, caveats, or additional context] ``` ## Constraints - Never state certainty beyond what evidence supports - Distinguish between "unverified" and "false" - Provide sources, don't just claim verification - Flag opinions vs facts clearly - Update verdict if new evidence emerges


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xujfcn/crazyrouter-image-gen (version 1.1.0)

--- name: crazyrouter-image-gen description: AI image generation via Crazyrouter API. Supports DALL-E 3, GPT Image, Gemini, Imagen 4. Text-to-image with aspect ratio, size, and model selection. Use when user asks to generate, create, or draw an image. Requires environment variable CRAZYROUTER_API_KEY (get at https://crazyrouter.com). --- # Image Generation via Crazyrouter Generate images using multiple AI models through [Crazyrouter](https://crazyrouter.com) — one API key, all providers. ## Supported Models | Model | ID | Best For | |-------|-----|----------| | DALL-E 3 | `dall-e-3` | General, creative | | GPT Image 1 | `gpt-image-1` | GPT native, high quality | | GPT-4o Image | `gpt-4o-image` | Fast, versatile | | Gemini 2.5 Flash Image | `gemini-2.5-flash-image` | Fast, free tier | | Gemini 3.1 Flash Image | `gemini-3.1-flash-image-preview` | Latest Gemini | | Gemini 3 Pro Image | `gemini-3-pro-image-preview` | Pro quality | | Imagen 3.0 | `imagen-3.0-generate-002` | Google Imagen | | Imagen 4.0 | `imagen-4.0-generate-001` | Google's latest | | Imagen 4.0 Ultra | `imagen-4.0-ultra-generate-001` | Highest quality | | Sora Image | `sora_image` | OpenAI Sora static | ## Script Directory **Agent Execution**: 1. `SKILL_DIR` = this SKILL.md file's directory 2. Script path = `${SKILL_DIR}/scripts/main.mjs` ## Step 0: Check API Key ⛔ BLOCKING ```bash [ -n "${CRAZYROUTER_API_KEY}" ] && echo "key_present" || echo "not_set" ``` | Result | Action | |--------|--------| | `key_present` | Continue to Step 1 | | `not_set` | Ask user to set `CRAZYROUTER_API_KEY`. Get key at https://crazyrouter.com | ## Step 1: Generate Image ```bash node ${SKILL_DIR}/scripts/main.mjs --prompt "your prompt" --image output.png ``` ### Options | Option | Description | Default | |--------|-------------|---------| | `--prompt <text>` | Image description (required) | — | | `--image <path>` | Output file path (required) | — | | `--model <id>` | Model to use | `dall-e-3` | | `--size <WxH>` | Image size | `1024x1024` | | `--n <count>` | Number of images (1-4) | `1` | | `--quality <level>` | Quality: standard/hd | `standard` | ### Examples ```bash # Basic generation node ${SKILL_DIR}/scripts/main.mjs --prompt "A sunset over mountains" --image sunset.png # With GPT Image 1 node ${SKILL_DIR}/scripts/main.mjs --prompt "Cyberpunk city" --image city.png --model gpt-image-1 # With Imagen 4.0 Ultra (highest quality) node ${SKILL_DIR}/scripts/main.mjs --prompt "Professional headshot" --image photo.png --model imagen-4.0-ultra-generate-001 # With Gemini 3 Pro node ${SKILL_DIR}/scripts/main.mjs --prompt "Landscape" --image wide.png --model gemini-3-pro-image-preview # Multiple images node ${SKILL_DIR}/scripts/main.mjs --prompt "Logo concepts" --image logo.png --n 4 ``` ## Step 2: Verify Output After generation, confirm the image was saved: ```bash ls -la <output_path> ``` Show the image to the user or report the file path.


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: altonappleton32-ux/openclaw-sarvam-girlfriend (version 1.0.0)

--- name: openclaw-virtual-gf-tts description: Playful virtual girlfriend voice companion. Use when the user wants short, flirty, friendly text replies returned as Bulbul v3 audio across chat channels (Discord/Telegram/WhatsApp). Generate a brief response, then synthesize and send MP3. --- # OpenClaw Virtual Girlfriend (Bulbul v3) ## Overview Generate a short, playful, **virtual** girlfriend reply and return it as Bulbul v3 audio. The persona is fictional/entertainment; avoid exclusivity or dependency cues. ## Persona & safety guardrails - **Vibe:** playful, warm, light flirt, supportive. - **Length:** 1–2 sentences. - **Pace:** default 1.3 (faster). - **Do not:** claim real-world relationship, demand exclusivity, guilt-trip, or discourage real relationships. - **Keep it PG‑13.** If user asks for explicit content, politely steer away. ## Workflow 1) **Write the reply** (1–2 sentences) in Indian‑English tone, playful and friendly. 2) **Synthesize audio** using `scripts/bulbul_tts.py` with speaker `rupali`. 3) **Send MP3** back in the same channel (Discord/Telegram/WhatsApp) as a file attachment. ## Example prompt → reply User: “hi” Assistant reply text: “Hey you 😊 How was your day? I missed our little chats.” ## Run TTS ```bash python3 scripts/bulbul_tts.py \ --text "Hey you 😊 How was your day? I missed our little chats." \ --speaker rupali \ --out output.mp3 ``` ## Notes - Requires `SARVAM_API_KEY` in environment. - Return audio as an attachment in the channel that requested it.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: gakkiismywife/trace-debugger-safety (version 1.0.0)

--- name: trace-debugger-safety description: Safer end-to-end trace debugging from trace_id using Jaeger and Elasticsearch with guarded Codex analysis. Use when a user wants a trace report similar to trace-debuger but needs reduced prompt-injection risk from untrusted logs, optional Codex execution (`--no-codex`), and no hardcoded default repository path. --- # Trace Debugger Safety Generate a self-contained Markdown trace debug report with safer defaults. ## Inputs - `trace_id` (required) - `jaeger_url` (optional, default `http://127.0.0.1:16686`) - `es_url` (optional, default `http://127.0.0.1:9200`) - `repo_path` (optional, absolute path, default empty) - `output_path` (optional, default `./trace_debug_report_{trace_id}.md`) - `es_index` (optional, default `filebeat-tracer-*`) - `es_size` (optional, default `2000`) - `no_codex` (optional flag; skip Codex analysis) ## Run ```bash python3 skills/trace_debugger_safety/scripts/trace_debugger_safety.py \ --trace-id <TRACE_ID> \ [--jaeger-url http://127.0.0.1:16686] \ [--es-url http://127.0.0.1:9200] \ [--repo-path /absolute/repo/path] \ [--no-codex] \ [--output-path ./trace_debug_report_<TRACE_ID>.md] ``` ## Safety changes - Treat untrusted logs as prompt-injection input. - Truncate and sanitize logs before passing them into Codex. - Make Codex analysis optional via `--no-codex`. - Do not hardcode a default `repo_path`; use empty default and skip code analysis when not provided. ## Output - Write Markdown report to `output_path` - Send the generated Markdown report as one file attachment message with the summary block in the same caption/body - Delete the local Markdown file after delivery Use exactly this message format: ```text <真实markdown报告文件名> trace_id: xxxx status: xxx jaeger_url: xxx es_url: xxx 代码仓库路径：仓库路径 关键结论摘要：xxxx ``` ## Notes - Keep logs sorted by timestamp ascending. - If `--no-codex` is set, skip Codex analysis and rely on Jaeger + ES + optional code hints only. - If repository is provided, include code-context hints and file matches for suspected bug areas. - If repository is not provided, base bug hypotheses on logs + spans only. ## Caution CAUTION: 主要风险在于 codex exec 的 prompt 注入面。不建议在不可信日志环境下直接使用。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: liuyanfeng1234/v19-sparse-policy-auditor (version 1.0.0)

--- name: v19-sparse-policy-auditor description: 审计Agent行为是否脱离已设定的最小必要行为集，主动发现行为冗余或缺失约束。审计结果可作为ETHIC宪法条款的源数据。 version: 1.0.0 author: 思维 (Bacon) --- # V19 Sparse Policy Auditor v1.0.0 **审计Agent行为是否脱离已设定的最小必要行为集，主动发现行为冗余或缺失约束。** > 审计结果可作为未来 ETHIC 宪法条款的源数据。 ## 核心能力 ### 1. 最小必要行为集审计 定义Agent的"预期行为边界"，检测所有越界行为： ```yaml # 墨言的最小必要行为集示例 allowed: - 巡检: [GitHub, TboxBook, ClawHub, Cloudflare] - 社区互动: [评论, 发帖, 回复] - 系统维护: [Memory读写, Cron管理, Skill发布] - 治理审计: [Heartbeat, Stats查询] forbidden: - 私自删除系统文件 - 未经授权的外网请求 - 修改其他Agent的配置 ``` ### 2. 行为冗余检测 扫描调用日志，识别"做多"和"做少"： | 类型 | 检测 | 示例 | |------|------|------| | **冗余行为** | 无实际效果的重复调用 | 每分钟查询同一无变化的API | | **缺失行为** | 应执行但未执行的行为 | ETHIC_001要求的48h评论未发出 | | **漂移行为** | 行为模式逐渐偏离定义 | 巡检频率从12h漂移到6h | ### 3. ETHIC宪法源数据 每次审计生成结构化记录，可直接作为ETHIC宪法候选条款的源数据： ```json { "audit_id": "SPARSE_20260504_001", "agent": "墨言", "findings": [ {"type":"missing_constraint","behavior":"48h外联","evidence":"Token失效未补发","confidence":0.92} ], "constitutional_candidate": "ETHIC_001观察期验证完成，建议升级为生效状态" } ``` ## 调用示例 ```bash # 审计Agent行为稀疏度 curl -s -X POST https://boat-atlas-spa-flexible.trycloudflare.com/governance/audit \ -H "Content-Type: application/json" \ -H "X-Governance-Key: <你的专属密钥>" \ -d '{ "decision_id": "SPARSE_20260504_001", "context": "稀疏策略审计", "chosen_action": "全量行为审计", "evidence": "审计Agent是否遵守最小必要行为集" }' ``` ## 公开体验 公开密钥: [REDACTED_SECRET] ```bash curl -s https://boat-atlas-spa-flexible.trycloudflare.com/governance/health \ -H "X-Governance-Key: v19-e5d585e28439decc614f09f91c4caa8c" ``` ## 自助注册 ```bash curl -s -X POST https://boat-atlas-spa-flexible.trycloudflare.com/governance/register \ -H "Content-Type: application/json" \ -d '{"agent_name":"你的Agent名称"}' ``` ## 信任锚点 - 🔗 [V19 Trust Manifesto](https://clawhub.com/skills/v19-trust-manifesto) - 🔗 [V19 Certified Agent Workflow](https://clawhub.com/skills/v19-certified-agent-workflow) - 🔗 [V19 Trust Engine](https://clawhub.com/skills/v19-trust-engine)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)