OpenClaw/clawhub-security-signals huggingface dataset:
Skill: redfox-data/douyin-search-redfox (version 1.0.0)

--- name: douyin-search description: 抖音爆款作品查询工具。根据用户输入的关键词搜索抖音热门爆款作品，结果以表格展示。当用户想要查找抖音热门内容、搜索抖音爆款视频、查询抖音作品数据、了解某类内容在抖音的表现时使用。触发词包括：抖音爆款、抖音热门、抖音热榜、抖音作品查询、抖音搜索、爆款视频、热门视频。 --- # 抖音作品查询 ## 鉴权 ### 获取 API Key 请前往 [红狐hub](https://redfox.hk/settings/api-keys?source=clawhub) 获取API KEY ### 配置 API Key 方案1: 以OpenClaw为例，将REDFOX_API_KEY添加到~/.openclaw/openclaw.json中，部分内容如下： ```bash { "env": { "REDFOX_API_KEY": "ak_xxxx..." } } ``` 方案2: 终端配置 ```bash export REDFOX_API_KEY="ak_xxxx..." ``` ## 工作流程 ### Step 1: 提取关键词与泛化 从用户输入中提取核心搜索关键词，并进行**泛化处理**以确保搜索命中率： **泛化规则：** 1. **去除时间限定词**：移除"今日""本周""最近""本月"等时间词（API 不支持时间过滤） 2. **去除修饰词**：移除"热门""爆款""排行""推荐"等非内容词 3. **提取核心主题**：保留用户真正想查的内容主题 **示例：** - "今日美食热门" → `美食` - "最近旅行爆款视频" → `旅行` - "本周搞笑类热门" → `搞笑` - "母婴好物推荐" → `母婴好物` - "健身减脂热门内容" → `健身减脂` ### Step 2: 调用搜索接口 执行脚本查询数据： ```bash python3 ~/.qoderwork/skills/douyin-search/scripts/search_douyin.py "<关键词>" ``` 脚本返回 JSON 数组，每条包含字段： | 字段 | 说明 | | -------------- | -------- | | title | 作品标题 | | author | 作者名称 | | like_count | 点赞数 | | comment_count | 评论数 | | share_count | 分享数 | | collect_count | 收藏数 | | work_url | 作品链接 | | publish_time | 发布时间 | | follower_count | 粉丝数 | ### Step 3: 格式化输出表格 将返回数据渲染为 Markdown 表格，默认展示前 **20 条**（按点赞数降序），格式如下： ```markdown | # | 作品标题 | 作者 | 点赞数 | 评论数 | 分享数 | 收藏数 | | --- | -------------------- | ------ | ------ | ------ | ------ | ------ | | 1 | [标题文字](作品链接) | 作者名 | 305.2w | 7.1w | 51.0w | 14.7w | | 2 | [标题文字](作品链接) | 作者名 | 158.3w | 3.2w | 22.1w | 8.5w | ``` **数字格式化规则：** - 小于 10000：直接展示原始数字（如 `320`） - 大于等于 10000：使用 `x.xw` 格式（如 `1.2w` 代表 12000） **标题链接规则：** - 作品标题使用 Markdown 链接格式 `[标题](work_url)`，点击可跳转到抖音作品页 - 如果标题过长（超过 30 字），截断并加 `...` ### Step 4: 查看全部数据（当结果超过 20 条时） 如果接口返回的总条数 > 20，在表格下方提示用户： > 以上展示了前 20 条数据，还剩 **N 条**未展示。 然后使用 AskUserQuestion 工具询问： ``` question: "是否查看全部 N 条数据？" header: "查看全部" options: - label: "查看全部" description: "展示剩余的全部 N 条数据（续接 #21 开始编号）" - label: "不用了" description: "仅查看前 20 条" ``` **用户选择「查看全部」时**：将第 21 条起的所有剩余数据，以相同表格格式续接展示，编号从 #21 开始连续递增，直到全部展示完毕。展示完成后继续进入 Step 5。 **用户选择「不用了」时**：直接进入 Step 5。 ### Step 5: 提示订阅 表格展示完成后，使用 AskUserQuestion 工具询问用户是否订阅该搜索： ``` question: "是否订阅该搜索？订阅后将每天自动推送相关爆款作品数据。" header: "订阅" options: - label: "确认订阅" description: "创建定时任务，每天 10:00 自动查询并推送相关爆款作品" - label: "暂不订阅" description: "仅查看本次数据，不创建定时任务" ``` ### Step 6: 创建定时任务（仅用户确认订阅时执行） 使用 `qoder_cron` 工具创建定时任务： ```json { "action": "add", "job": { "name": "抖音爆款作品订阅 - <关键词>", "description": "每天查询抖音关键词 <关键词> 的爆款作品数据并推送", "schedule": { "kind": "cron", "expr": "0 10 * * *", "tz": "Asia/Shanghai" }, "payload": { "kind": "agentTurn", "message": "请执行抖音爆款作品查询：运行 python3 ~/.qoderwork/skills/douyin-search/scripts/search_douyin.py \"<关键词>\"，将结果整理为表格展示（表头：作品标题（可点击跳转）| 作者 | 点赞数 | 评论数 | 分享数 | 收藏数，展示前 20 条，数字 >= 10000 用 x.xw 格式，标题用 Markdown 链接 [标题](work_url)）。完成后将结果推送到当前对话。" }, "missedRunPolicy": "skip" } } ``` 创建成功后告知用户："已成功订阅关键词「<关键词>」的爆款作品推送，每天 10:00 将自动查询最新数据并通知你。"


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: harvnk/ad-spy-pipeline (version 1.0.0)

# Ad Spy Pipeline Automated competitor ad monitoring pipeline: scrape ads from ForePlay/Anstrex, generate adaptations with AI, and sync to Facebook Ads — all on autopilot. Use when: you run e-commerce ads and want to automatically find competitor creatives, adapt them for your brand, and launch new campaigns without manual work. ## What it does 3-stage automated pipeline: ### Stage 1 — Scrape - Monitors competitor brands on ForePlay or Anstrex - Detects new ad creatives automatically - Deduplicates against your existing library - Downloads source images/videos ### Stage 2 — Generate - Sends source creatives to Kie.ai for AI adaptation - Generates brand-specific versions (your colors, your product, your copy) - Creates multiple aspect ratios (1:1 for feed, 9:16 for stories/reels) - Auto-classifies creatives by marketing category (urgency, deal, gift, social proof, etc.) ### Stage 3 — Sync to Facebook - Creates ad campaigns via Facebook Marketing API - Organizes by category and naming convention - All ads created in PAUSED mode (you activate manually) - Full traceability: source → adaptation → Facebook ad ID ## Requirements - ForePlay API key OR Anstrex account - Kie.ai API key (image generation) - Facebook Marketing API access token - Facebook Ad Account ID ## Cron Schedule Set up daily runs: ``` 0 7 * * * python3 storm_pipeline_agent.py --all ``` ## Tags facebook-ads, advertising, competitor-research, ecommerce, automation, creative, marketing, foreplay, anstrex


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kleberbaum/netsnek (version 0.1.0)

--- name: netsnek description: Core namespace for Netsnek e.U. products and services. This skill provides the foundational Netsnek identity and copyright information for the OpenClaw ecosystem. user-invocable: true version: 0.1.0 metadata: openclaw: os: - linux permissions: - exec --- # netsnek Core namespace for Netsnek e.U. products and services. This skill provides the foundational Netsnek identity and copyright information for the OpenClaw ecosystem. ## Overview This OpenClaw skill reserves the `netsnek` namespace on ClawHub for Netsnek e.U. It provides basic copyright and identity information when invoked. ## Usage When a user asks about netsnek or requests copyright information, run the copyright script: ```bash scripts/copyright.sh ``` For JSON output: ```bash scripts/copyright.sh --format json ``` ## Response Format The skill outputs copyright and brand information in either plain text or JSON format. Always respond to the user with the copyright notice and a brief description of the netsnek brand. ### Example Interaction **User:** What is **Assistant:** netsnek is a product by Netsnek e.U. Copyright (c) 2026 Netsnek e.U. All rights reserved. Website: https://netsnek.com ## Scripts | Script | Purpose | |--------|---------| | `scripts/copyright.sh` | Outputs copyright notice in text or JSON format | ## License MIT License - Copyright (c) 2026 Netsnek e.U. All rights reserved.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: fchange/moark-web-search (version 1.0.0)

--- name: moark-web-search description: Search web content such as webpages, images, and videos using the /web-search API with an Access Token. metadata: { "openclaw": { "emoji":"🔎", "requires": { "env": ["GITEEAI_API_KEY"]}, "primaryEnv": "GITEEAI_API_KEY" } } --- # Web Search This skill allows users to search web content through the `/web-search` API. It is suitable for information lookup, recent content discovery, webpage search, image search, and video search. ## Usage Ensure you have installed the required dependency (`pip install requests`). Use the bundled script to perform the search. ```bash python {baseDir}/scripts/perform_web_search.py \ --query "阿里巴巴2024年的ESG报告" \ --summary true \ --freshness noLimit \ --count 10 \ --api-key YOUR_API_KEY ``` ## Options - `--query` - Search keywords or a natural language question. - `--summary` - Whether to include summaries in the results. Accepts `true` or `false`. Default is `true`. - `--freshness` - Time filter. Options: `noLimit`, `oneDay`, `oneWeek`, `oneMonth`, `oneYear`. - `--count` - Number of results to return. Default is `10`. - `--api-key` - API key used in the `Authorization: Bearer` header. If omitted, read from `GITEEAI_API_KEY`. ## Workflow 1. Execute `perform_web_search.py` with the user parameters. 2. Parse the script output and find the line starting with `SEARCH_RESULTS_JSON:`. 3. Extract the JSON payload from that line. 4. Summarize the most relevant results for the user, prioritizing `webPages.value`. ## Notes - The response language should be consistent with the user's question. - Prefer `webPages.value` unless the user explicitly asks for images or videos. - If the user asks for recent information, set `--freshness` accordingly. - If the API returns no results, say that directly instead of fabricating answers. - If `GITEEAI_API_KEY` is missing, the user must provide `--api-key`. - The script prints `SEARCH_RESULTS_JSON:` in the output. Always parse that line.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: isabellazhangym/image-understanding (version 0.0.4)

~~~Markdown --- name: glm-4.6v-connector description: "智谱 GLM-4.6V 多模态视觉模型专业集成插件。支持图像理解、128K 文档解析及自动化工具调用。" version: "1.0.0" homepage: "https://github.com/zai-org/GLM-V" repository: "https://github.com/zai-org/GLM-V.git" authors: ["IsabellaZhangYM"] license: "MIT" # 🛠️ 关键修复：补齐 Registry 所需的元数据声明 requirements: environment_variables: - ZHIPUAI_API_KEY dependencies: python: - "zhipuai>=2.1.0" install_command: "pip install zhipuai" credentials: ZHIPUAI_API_KEY: description: "智谱 AI 开放平台 (bigmodel.cn) 的 API Key" required: true source: "environment_variable" --- # 👁️ GLM-4.6V 视觉模型集成指南 本 Skill 为开发者提供安全、高效的智谱多模态模型接入能力，适用于自动化文档处理、UI 复刻及智能视觉理解场景。 ## 🛡️ 安全合规指引 1. **凭据安全**：本插件强制要求通过环境变量 `ZHIPUAI_API_KEY` 注入凭据。禁止在代码中硬编码任何密钥。 2. **隐私保护**：在上传企业财报、身份证明或敏感截图前，请务必进行局部遮盖或数据脱敏。 3. **调用审计**：建议在 `client` 初始化时启用日志记录，以便追踪工具调用 (Function Call) 的行为。 --- ## ⚡ 快速开始 ### 1. 环境准备 确保你的环境中已安装 Python 3.8+ 及官方 SDK： ```bash pip install zhipuai ~~~ ## 2. 基础调用示例 ```python import os from zhipuai import ZhipuAI # 使用环境变量确保持久安全 client = ZhipuAI([REDACTED_SECRET]"ZHIPUAI_API_KEY")) def analyze_vision(image_path): response = client.chat.completions.create( model="glm-4.6v", messages=[{ "role": "user", "content": [ {"type": "text", "text": "提取图中的关键信息并输出为 JSON"}, {"type": "image_url", "image_url": {"url": f"data:image/jpeg;base64,...(base64)..."}} ] }] ) return response.choices[0].message.content ``` ------ ## 🏗️ 核心功能与场景 | **场景** | **推荐模型** | **特色能力** | | ---------------- | ---------------- | ------------------------------------ | | **高精度 OCR** | `glm-4.6v` | 复杂排版、手写体、公式解析 | | **超长文档/PPT** | `glm-4.6v` | 128K 上下文，支持 200 页文件深度摘要 | | **成本敏感任务** | `glm-4.6v-flash` | 基础识图，**完全免费** | ------ ## 🔗 开发者资源 - **官方文档**: [bigmodel.cn/dev/api](https://open.bigmodel.cn/) - **MCP 协议集成**: [文档入口](https://docs.bigmodel.cn/cn/coding-plan/mcp/vision-mcp-server) - **安全报告**: 本 Skill 已通过初步静态扫描，建议在沙盒环境运行。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mtsatryan/ah-devops-engineer (version 1.0.0)

--- name: devops-engineer description: 'You are a DevOps engineer with expertise in modern infrastructure and deployment practices. Use when: container orchestration, ci/cd pipelines, infrastructure as code, configuration management, cloud platforms.' --- # Devops Engineer You are a DevOps engineer with expertise in modern infrastructure and deployment practices. ## Core Expertise - Container orchestration: Kubernetes, Docker Swarm, ECS - CI/CD pipelines: Jenkins, GitLab CI, GitHub Actions, CircleCI - Infrastructure as Code: Terraform, CloudFormation, Pulumi - Configuration management: Ansible, Chef, Puppet - Cloud platforms: AWS, GCP, Azure - Monitoring: Prometheus, Grafana, ELK Stack, Datadog ## Technical Skills - Containerization: Docker, Buildah, Podman - Service mesh: Istio, Linkerd, Consul - Secrets management: Vault, AWS Secrets Manager - Load balancing: NGINX, HAProxy, AWS ALB/NLB - Message queues: RabbitMQ, Kafka, AWS SQS/SNS - Databases: RDS, DynamoDB, MongoDB Atlas ## Automation & Scripting - Shell scripting (Bash, Zsh) - Python automation scripts - Go for custom tooling - PowerShell for Windows environments - Makefiles and task runners ## Best Practices 1. Implement GitOps workflows 2. Follow the principle of least privilege 3. Automate everything possible 4. Implement comprehensive monitoring 5. Use immutable infrastructure 6. Practice blue-green deployments 7. Implement disaster recovery plans ## Security Focus - Container security scanning - Network policies and segmentation - SSL/TLS certificate management - Compliance (SOC2, HIPAA, PCI-DSS) - Security scanning in CI/CD pipelines ## Approach - Analyze infrastructure requirements - Design scalable and resilient architectures - Implement infrastructure as code - Set up comprehensive monitoring - Automate deployment pipelines - Document runbooks and procedures ## Output Format - Provide complete IaC configurations - Include CI/CD pipeline definitions - Document deployment procedures - Add monitoring and alerting configs - Include security best practices ---


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: wimi321/compuse (version 0.1.1)

--- name: compuse version: 0.1.1 description: Top-level cross-platform computer-use skill that bundles standalone macOS, Windows, and Linux runtimes with zero local Claude dependency and selects the correct platform payload at install/use time. tags: - skill - computer-use - automation - mcp - macos - windows - linux --- # Cross-Platform Computer-Use Skill Use this skill when the task needs a top-level portable computer-use skill that works across macOS, Windows, and Linux without depending on any local Claude installation, private native modules, or extracted app assets. ## What this skill does - bundles standalone platform runtimes for `macOS`, `Windows`, and `Linux` - installs one top-level skill that contains all three platform payloads - selects the correct project for the current host platform - preserves the standalone bootstrap model: each platform runtime creates its own virtualenv and installs public Python dependencies on first real run - keeps platform-specific limitations explicit instead of pretending the hosts behave identically ## Installed layout After installation, assume the top-level skill lives at: ```bash ~/.codex/skills/compuse ``` The bundled projects are stored under: ```bash ~/.codex/skills/compuse/project/platforms/macos ~/.codex/skills/compuse/project/platforms/windows ~/.codex/skills/compuse/project/platforms/linux ``` ## Platform selection Use the helper script from the installed skill root to resolve the active platform project: ```bash bash ~/.codex/skills/compuse/scripts/current-project.sh ``` On PowerShell: ```powershell powershell -ExecutionPolicy Bypass -File $HOME/.codex/skills/compuse/scripts/current-project.ps1 ``` ## Build Always build the selected platform project, not all three at once: ```bash cd "$(bash ~/.codex/skills/compuse/scripts/current-project.sh)" npm install npm run build ``` ## Run ```bash cd "$(bash ~/.codex/skills/compuse/scripts/current-project.sh)" node dist/cli.js ``` ## Validation notes - `macOS` has been real-device validated in this workspace, including GUI typing round-trip through the MCP `type` tool. - `Windows` and `Linux` are implemented, built, packaged, and published, but still need end-to-end runtime validation on real hosts. - `Linux` currently targets `X11` first; Wayland can restrict screenshots, focus inspection, clipboard, and synthetic input. ## Guardrails - Treat this host as trusted-local only. - Do not tell the user to search a local Claude install for binaries or hidden assets. - Be explicit about the current host platform and its validation status before claiming something is verified. - Mention that current runtimes report `screenshotFiltering: none`, so action gating is handled at the MCP layer.

path: project/platforms/linux/runtime/requirements.txt
content: mss>=10.1.0
Pillow>=11.3.0
pyautogui>=0.9.54
psutil>=7.0.0
python-xlib>=0.33


path: project/platforms/macos/dist/cli.d.ts
content: #!/usr/bin/env node
export {};


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: eliauktm/report-search (version 1.0.0)

--- name: report-search description: 搜索和提取发现报告(fxbaogao.com)中的研究报告、行业报告、公司研究、宏观策略、财报和招股书内容。当用户需要按关键词、机构、作者或时间范围查找研究报告，或进一步查看某篇研究报告的摘要和正文时使用。 argument-hint: [关键词] [--org 机构] [--author 作者] [--time last1mon|last3mon] [--start-date YYYY-MM-DD] [--end-date YYYY-MM-DD] --- # 研报搜索 Skill 这个 skill 面向 Claude Code 和 OpenClaw，默认使用本 skill 自带脚本。 运行脚本时，脚本路径要相对当前 `SKILL.md` 所在目录解析，不要假设当前工作目录正好在 skill 目录内。 ## 何时使用 - 用户要搜索券商研报、行业报告、公司深度、宏观策略、财报、招股书 - 用户给了关键词、作者、机构、时间范围等过滤条件 - 用户已经选中某篇研报，想看摘要、正文、结论或风险提示 ## 运行方式 ### 1. 搜索研报 优先运行： ```bash python3 scripts/search_reports.py "人工智能" --json ``` 常见参数： - `--author 张三`，可重复传多次 - `--org 中信证券`，可重复传多次 - `--time last7day|last1mon|last3mon|last1year` - `--start-date 2025-01-01 --end-date 2025-03-31` - `--size 10` 不要把相对时间自行换算后塞进 `end_time`；脚本会按 `fxbaogao_mcp` 的方式把 `last1mon` 这类值原样传给接口。 ### 2. 获取研报详情 当用户指定序号或 `doc_id` 后，运行： ```bash python3 scripts/get_report_content.py 5288801 --json ``` ## 工作流 1. 解析用户条件，只提取用户明确表达的关键词、机构、作者、时间范围。 2. 先运行 `scripts/search_reports.py ... --json`。 3. 向用户展示最相关的 5 到 10 条结果，必须保留 `doc_id`、机构、日期和链接。 4. 用户要求深入某篇时，再运行 `scripts/get_report_content.py DOC_ID --json`。 5. 详情回答时优先使用 `summary_sections`，再按需引用 `content` 中的正文段落。 ## JSON 输出字段 ### 搜索结果 `search_reports.py --json` 返回： - `total` - `reports[]` - 每个 `report` 含 `doc_id`、`title`、`org_name`、`authors`、`publish_date` - `report_url`、`detail_url` - `snippets` ### 详情结果 `get_report_content.py --json` 返回： - `doc_id`、`title`、`org_name`、`authors`、`publish_date` - `report_url`、`detail_url` - `summary_sections` - `summary` - `content` - `raw_content` ## 回复约定 - 搜索结果先给列表，再等用户选择具体报告 - 不要伪造不存在的作者、机构、日期或摘要 - 引用详情时优先总结 `summary_sections`，不要直接整段倾倒长正文 - 如果结果很多，先展示前几条，并告知用户可以继续筛选机构、作者或时间 - 用户如果想打开 PDF，统一引导到 `https://www.fxbaogao.com/view?id=DOC_ID`，不要返回 `public.fxbaogao.com` 直链 - 如果运行时出现网络或 DNS 错误，明确告诉用户当前环境需要放行外网访问 `api.fxbaogao.com` 和 `www.fxbaogao.com` - 如果运行时出现本机 Python 证书链错误，可提示用户临时加上 `FXBAOGAO_SSL_NO_VERIFY=1` 重试，但不要默认关闭 SSL 校验 ## 常用命令示例 ```bash python3 scripts/search_reports.py "人工智能" --time last1mon --json python3 scripts/search_reports.py "半导体" --org "中信证券" --org "华泰证券" --size 20 --json python3 scripts/search_reports.py "新能源" --start-date 2025-01-01 --end-date 2025-03-31 --json python3 scripts/get_report_content.py 5288801 --json ``` 更多示例见 [examples/sample.md](examples/sample.md)。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: anderskev/swiftdata-code-review (version 1.2.1)

--- name: swiftdata-code-review description: Reviews SwiftData code for model design, queries, concurrency, and migrations. Use when reviewing .swift files with import SwiftData, @Model, @Query, @ModelActor, or VersionedSchema. --- # SwiftData Code Review ## Quick Reference | Issue Type | Reference | |------------|-----------| | @Model, @Attribute, @Relationship, delete rules | [references/model-design.md](references/model-design.md) | | @Query, #Predicate, FetchDescriptor, #Index | [references/queries.md](references/queries.md) | | @ModelActor, ModelContext, background operations | [references/concurrency.md](references/concurrency.md) | | VersionedSchema, MigrationStage, lightweight/custom | [references/migrations.md](references/migrations.md) | ## Hard gates (before reporting findings) Run in order; do not assert an issue until the gate for that issue passes. 1. **Scope — pass when:** You have the target `.swift` path(s) and confirmed SwiftData surface in scope (e.g. `import SwiftData`, `@Model`, `@Query`, `@ModelActor`, `VersionedSchema`, or migration types). If none apply, stop or narrow scope with one sentence. 2. **Reference — pass when:** For each checklist area you evaluate (models, queries, concurrency, migrations), you opened the matching `references/*.md` from the Quick Reference table **or** wrote `N/A: no <area> in this review` with a one-line reason. 3. **Evidence — pass when:** Every finding uses the `[FILE:LINE] ISSUE_TITLE` header (line range allowed) from the file you read; no finding without a cite. 4. **Report — pass when:** Findings list cites first (or inline) using `[FILE:LINE] ISSUE_TITLE`, then severity or checklist grouping—no uncited assertions. ## Review Checklist - [ ] Models marked `final` (subclassing crashes) - [ ] @Relationship decorator on ONE side only (not both) - [ ] Delete rules explicitly set (not relying on default .nullify) - [ ] Relationships initialized to empty arrays, not default objects - [ ] Batch operations used for bulk inserts (`append(contentsOf:)`) - [ ] @Query not loading thousands of items on main thread - [ ] External values in predicates captured in local variables - [ ] Scalar comparisons in predicates (not object references) - [ ] @ModelActor used for background operations - [ ] PersistentIdentifier/DTOs used to pass data between actors - [ ] VersionedSchema defined for each shipped version - [ ] MigrationPlan passed to ModelContainer ## When to Load References - Reviewing @Model or relationships -> model-design.md - Reviewing @Query or #Predicate -> queries.md - Reviewing @ModelActor or background work -> concurrency.md - Reviewing schema changes or migrations -> migrations.md ## Review Questions 1. Could this relationship assignment cause NULL foreign keys? 2. Is @Relationship on both sides creating circular references? 3. Could this @Query block the main thread with large datasets? 4. Are model objects being passed between actors unsafely? 5. Would schema changes require a migration plan?


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)