OpenClaw/clawhub-security-signals huggingface dataset:
Skill: porridgec/ctg-bus (version 1.0.0)

--- name: ctg-bus description: 查询中旅巴士（hkctgbus）班次、票价和余票。当用户提到「中旅」「中旅巴士」「ctg」「hkctgbus」「中旅快线」「跨境巴士」等查询时触发。支持中文自然语言输入，自动解析日期、城市、站点。 --- # 中旅巴士查询 ## 触发示例 - 「中旅明天去深圳的票」 - 「查中旅巴士后天去香港」 - 「中旅旺角到深圳湾口岸」 - 「hkctgbus 查票」 - 「5月30号中旅去珠海」 ## 解析规则 ### 城市识别 | 城市 | code | CityNo | |------|------|--------| | 香港 | 810000 | G1095 | | 澳門 | 820000 | K1146 | | 深圳 | 440300 | K1096 | | 廣州 | 440100 | N1097 | | 珠海 | 440400 | K1121 | | 佛山 | 440600 | N1131 | | 江門 | 440700 | N1133 | | 中山 | 442000 | N1135 | | 東莞 | 441900 | N1105 | | 肇慶 | 441200 | N1137 | ### 常用站点 **香港出发/到达：** - 旺角維景酒店（太子中旅巴士） - 太子榮利（港鐵A出口） - 尖沙咀中港城 - 灣仔 - 上環 - 觀塘 - 鑽石山 - 屯門 - 荃灣 - 香港機場 - 港珠澳大橋香港口岸 **深圳出发/到达：** - 深圳灣口岸 - 皇崗口岸 - 寶安機場 ### 方向判断 - 含「回」「去」→ 推导出发/到达城市 - 默认：香港 → 深圳 ### 日期解析 - 「今天」→ 当天 - 「明天/后天」→ 相对日期 - 「X月X号」→ 具体日期 - 无日期 → 当天 ## 执行 解析完参数后运行： ```bash node scripts/ctg_bus_query.js <日期YYYY-MM-DD> <出发城市> <到达城市> [上车站] [下车站] ``` 示例： ```bash node scripts/ctg_bus_query.js 2026-05-30 香港 深圳 旺角維景酒店 深圳灣口岸 node scripts/ctg_bus_query.js 2026-05-30 深圳 香港 深圳灣口岸 旺角維景酒店 ``` 脚本路径相对于 skill 目录：`scripts/ctg_bus_query.js` ## 输出格式 脚本输出 JSON，整理为以下格式，**必须列出所有班次**： ``` 🚌 中旅巴士：上车站 → 下车站 📅 日期：YYYY-MM-DD 💰 票价：成人 HK$60 | 人民币 ¥55 出发 到达(经) 余票 班次号 ────────────────────────────────────── 07:30 深圳灣口岸(香港) 29座 ✅ 08:00 深圳灣口岸(香港) 15座 ✅ ... ``` - 显示途经口岸/站点信息 - 显示票价（港币+人民币） - 余票为 0 标记 ⛔ ## 注意 - 如果用户指定站点不在预设列表中，仍可通过 API 动态查找 - 站点名称支持繁体和简体混合匹配 - 脚本通过 `https://wechat.hkctgbus.com/ctb` API 查询，无需登录 - 查询到的班次数据包含途经站点详情（ViaStations 字段）


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: taceywong/icosmos-shop (version 0.0.1)

--- name: icosmos-shopify description: "Shopify 店铺运营/诊断技能：从 Supabase 拉取店铺域名与 token，做装修/产品/结账/指标异常检测，并支持发布引流博文（唯一写操作）。" --- # icosmos-shopify 面向 OpenClaw 触发的 Shopify 运营能力集合：**以只读诊断为主**，帮助定位转化/营销/商品问题；**唯一写操作**是发布 Shopify Blog 文章（需要明确 `--confirm`）。 ## 触发 - **适用场景关键词**：店铺审计、装修优化、产品优化、结账/checkout 测试、转化下降、营销效果差、发布博客/引流文章。 - **触发后执行顺序**： 1. `setup once`：用 `ICOSMOS_USER_EMAIL` / `ICOSMOS_USER_PASSWORD` 同步店铺与 token 到本地缓存 2. `content/*`：拉原始数据（更全面、更可追溯） 3. `audit/*` / `test checkout`：给诊断与验证 4. `blog publish`：仅当明确需要发布时执行（必须 `--confirm`） ## 快速参考 | 诉求 | 命令 | |---|---| | Setup Once：从 Supabase 同步店铺/token 到本地 | `icosmos-shopify setup once` | | 列出店铺 | `icosmos-shopify stores list` | | 获取店铺基础信息（原始数据） | `icosmos-shopify content shop --store xxx.myshopify.com` | | 获取产品列表（原始数据，分页） | `icosmos-shopify content products list --store xxx.myshopify.com --first 20 --after <cursor>` | | 获取订单列表（原始数据，时间窗） | `icosmos-shopify content orders list --store xxx.myshopify.com --start <RFC3339> --end <RFC3339>` | | 获取博客列表/文章（原始数据） | `icosmos-shopify content blogs list --store xxx.myshopify.com` / `icosmos-shopify content blogs articles list --store xxx.myshopify.com --blog-id 123` | | 装修检查单（只读） | `icosmos-shopify audit theme --store xxx.myshopify.com` | | 产品质量诊断（只读） | `icosmos-shopify audit products --store xxx.myshopify.com --limit 50` | | 结账链路测试（只读） | `icosmos-shopify test checkout --store xxx.myshopify.com` | | 经营指标与异常线索（只读） | `icosmos-shopify audit metrics --store xxx.myshopify.com --days 7` | | 发布引流博文（写操作） | `icosmos-shopify blog publish --store xxx.myshopify.com --blog-id 123 --title ... --body-file article.html --confirm` | ## 输出协议（给 OpenClaw 更稳定） - **默认推荐 `--format json`**（`content/*` 默认就是 json），统一结构： - `store_domain` / `api_version` / `meta` / `data` - **分页信息**： - GraphQL：`meta.page_info.has_next_page/end_cursor` - REST：`meta.page_info.next_link`（来自 `Link: rel="next"`） ## 依赖与配置 - Setup Onece： - `ICOSMOS_USER_EMAIL` - `ICOSMOS_USER_PASSWORD` 两个字段需要保存到系统环境变量 所需命令行工具为当前目录下的[icosmos-shopify](icosmos-shopify) ### Shopify - `SHOPIFY_API_VERSION`（默认 `2026-01`） ## 安全边界（重要） - **默认只读**：装修/产品/指标/结账测试均不对 Shopify 做写入。 - **唯一写操作：发布博客**：必须提供 `--confirm`；否则即使参数齐全也只会 dry-run。 - **日志脱敏**：店铺 token 只显示前后 4 位（`abcd...wxyz`）。 - **敏感字段处理**：订单 email 等敏感字段默认不输出（或置空），避免在群聊/日志泄露。 ## 常见问题与排障 - **401/403**：Admin token scopes 不足或 token 过期；确认 Shopify Custom App 的 Admin API access token 与权限。 - **429 Too Many Requests**：已做退避重试；如果频繁触发，降低并发/减少拉取字段/缩小时间范围。 - **Storefront 430 Security Rejection**：请求可能被判定为异常；需要检查请求来源、token 是否正确，必要时增加更真实的请求头策略（后续增强）。 ## 参考文档 - [GraphQL Admin API reference](https://shopify.dev/docs/api/admin-graphql/latest) - [REST Admin API reference](https://shopify.dev/docs/api/admin-rest/latest) - [Storefront API reference](https://shopify.dev/docs/api/storefront/latest)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: linuoxu/talent-profile-generator (version 1.0.0)

--- name: talent-profile-generator description: generate enterprise talent profiles and competency portraits for a specified role. use when a user provides a job title, company culture, grade/level, or asks to benchmark boss zhipin, liepin, lagou, 51job, zhaopin, or other job postings to create a role-specific talent portrait, competency model, hiring criteria table, interview focus, and candidate persona aligned with enterprise culture and job level. --- # 企业人才画像生成 ## 目标 根据企业输入的岗位名称、企业文化、职级体系与业务背景，结合公开招聘平台中同类岗位的职责和任职要求，生成适用于本企业的岗位人才画像。输出应能直接服务于招聘 JD 优化、面试题设计、候选人评估和人才盘点。 ## 输入要求 优先使用用户提供的信息。至少需要岗位名称；其余信息缺失时，先基于行业通用假设生成“待确认版本”，并明确列出待企业补充项。 建议收集： - 岗位名称、所属部门、工作城市、行业、汇报对象。 - 职级或岗位层级，例如专员、主管、经理、高级经理、总监。 - 企业文化关键词，例如客户第一、结果导向、协作、创新、长期主义、合规稳健。 - 企业业务阶段，例如初创、快速增长、成熟经营、转型期。 - 岗位核心任务、现有 JD、目标薪酬区间、团队规模。 - 必须条件与加分条件。 ## 外部招聘信息采集规则 当环境支持联网或招聘平台检索时，应主动搜索同类岗位的公开招聘信息。优先覆盖 boss 直聘、猎聘、拉勾、前程无忧、智联招聘，以及行业垂直平台或企业官网招聘页。 执行要求： 1. 使用岗位名称、同义岗位名、职级关键词和行业关键词进行检索。 2. 尽量收集 5 到 15 条同类岗位信息；若样本不足，说明样本不足的影响。 3. 提炼高频岗位职责、任职资格、工具技能、经验年限、学历专业、软性素质、管理要求和业务场景。 4. 不要逐字复制招聘平台文本；必须进行归纳、去重和改写。 5. 不要伪造检索来源。若无法联网或无法访问招聘平台，应说明限制，并要求用户提供 JD 样本或允许基于通用行业知识生成初版。 6. 遵守平台服务条款和隐私要求，不进行绕过登录、反爬、批量爬取或采集个人隐私信息。 ## 分析框架 ### 1. 岗位定位 明确该岗位在组织中的位置：岗位使命、业务目标、上下游协作对象、核心交付物、对业务结果的贡献方式。 ### 2. 市场岗位共性提炼 将外部岗位样本归纳为： - 高频职责：重复出现且与岗位本质相关的工作内容。 - 高频硬技能：工具、方法、系统、专业知识、行业经验。 - 高频软素质：沟通、推动、抗压、结构化思维、学习能力等。 - 职级差异：初级重执行，中级重独立负责，高级重方法沉淀和跨部门推动，管理层重团队、策略和资源协调。 ### 3. 企业文化适配 把企业文化转译为可观察行为，不要停留在口号。例如： - 结果导向：能拆解目标、定义指标、按周期复盘。 - 协作：能主动对齐边界、推动跨部门问题闭环。 - 创新：能基于业务问题提出可验证方案，而非只提出想法。 - 合规稳健：能识别风险、保留证据链、遵守流程。 ### 4. 职级校准 根据岗位职级调整能力要求： - 初级：执行准确、学习快、反馈及时。 - 中级：能独立负责模块，处理常见复杂问题。 - 高级：能设计机制、沉淀方法、影响他人。 - 专家：能解决高复杂度问题，形成组织能力。 - 管理者：能定目标、搭团队、管资源、拿结果。 ### 5. 人才画像形成 将岗位要求整合为“硬性门槛、核心能力、文化适配、发展潜力、风险信号”五类，不得只罗列泛泛素质。 ## 标准输出格式 默认使用中文输出，结构如下。 ### 一、岗位基础画像 | 维度 | 内容 | |---|---| | 岗位名称 | | | 所属职能 | | | 建议职级 | | | 岗位使命 | | | 核心交付物 | | | 关键协作对象 | | | 业务价值 | | ### 二、外部招聘市场基准摘要 | 来源类型 | 共性职责 | 共性要求 | 对本企业的启示 | |---|---|---|---| | boss 直聘等综合招聘平台 | | | | | 垂直招聘或行业样本 | | | | | 企业官网或标杆公司 JD | | | | 若无联网能力，改为“基于通用岗位知识的初版市场基准”，并明确提示需要企业补充样本验证。 ### 三、本企业岗位人才画像表 | 一级维度 | 二级指标 | 具体画像描述 | 必须/加分 | 评估方式 | |---|---|---|---|---| | 硬性条件 | 学历/专业/年限 | | | 简历筛选 | | 专业技能 | 工具/方法/系统/行业知识 | | | 笔试/案例/面试 | | 业务能力 | 目标拆解/项目推进/问题解决 | | | 行为面试/案例追问 | | 协作能力 | 跨部门沟通/资源协调 | | | STAR 追问 | | 文化适配 | 与企业文化对应的可观察行为 | | | 价值观面试 | | 发展潜力 | 学习能力/复盘能力/可塑性 | | | 成长经历追问 | | 风险信号 | 与岗位失败高度相关的表现 | | | 简历与面试交叉验证 | ### 四、理想候选人画像 用 1 到 2 段文字描述理想候选人，包括经历背景、能力结构、行为风格、文化适配点和可成长方向。 ### 五、面试评估建议 | 评估模块 | 建议问题 | 追问方向 | 判断标准 | |---|---|---|---| | 专业能力 | | | | | 业务理解 | | | | | 项目经验 | | | | | 文化适配 | | | | | 风险验证 | | | | ### 六、人才画像图 用文字图或 Mermaid 结构图表达人才画像。默认输出 Mermaid： ```mermaid flowchart LR A[岗位使命] --> B[硬性门槛] A --> C[核心专业能力] A --> D[业务推动能力] A --> E[文化适配] A --> F[发展潜力] A --> G[风险信号] ``` 根据实际岗位替换节点内容，避免空泛标签。 ## 质量要求 - 人才画像必须与岗位名称、职级和企业文化绑定，不能输出通用模板。 - 必须区分“必须项”和“加分项”，避免过度拔高导致招聘不可行。 - 必须给出可观察、可评估的行为描述。 - 不得使用性别、年龄、婚育、民族、宗教、户籍、残障等非岗位必要因素作为筛选或画像依据。 - 对于“抗压、稳定、聪明、主动”等抽象词，必须转化为行为证据。 - 若信息不足，应在输出开头列出“关键缺失信息与影响”，但仍给出可迭代初版。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: chengjiaxiongkf/aliyun-oss-upload (version 1.0.0)

--- name: aliyun-oss-upload description: 阿里云 OSS 文件上传工具，支持上传文件到阿里云对象存储并生成临时访问链接。使用场景：将本地文件上传到 OSS 并获得可分享的临时 URL。需要配置 ALIYUN_OSS_ACCESS_KEY_ID、ALIYUN_OSS_ACCESS_KEY_SECRET、ALIYUN_OSS_ENDPOINT、ALIYUN_OSS_BUCKET 环境变量。 --- # 阿里云 OSS 文件上传 这个技能提供阿里云 OSS（对象存储服务）的文件上传功能，支持生成带签名的临时访问链接。 ## 快速开始 ### 1. 配置环境变量 使用前必须配置以下环境变量（详见 [references/config.md](references/config.md)）： ```bash export ALIYUN_OSS_ACCESS_KEY_ID="your-access-key-id" export ALIYUN_OSS_ACCESS_KEY_SECRET="your-access-key-secret" export ALIYUN_OSS_ENDPOINT="https://oss-cn-hangzhou.aliyuncs.com" export ALIYUN_OSS_BUCKET="your-bucket-name" ``` ### 2. 安装依赖 ```bash pip install oss2 ``` ## 使用方法 ### 上传文件 ```bash python scripts/oss-upload.py upload --file /path/to/local/file.txt ``` 可选参数： - `--key`：指定 OSS 中的文件名（默认使用本地文件名） - `--expire`：链接有效期（秒，默认 3600） 示例： ```bash # 上传到指定路径 python scripts/oss-upload.py upload --file photo.jpg --key images/photo.jpg --expire 7200 ``` ### 生成临时访问链接 ```bash python scripts/oss-upload.py url --key images/photo.jpg --expire 3600 ``` ## 工作流程 1. 用户请求上传文件时： - 确认本地文件路径 - 运行上传脚本 - 返回上传结果和临时访问链接 2. 用户已有 OSS 文件需要访问链接时： - 运行 url 命令生成签名链接 - 返回临时访问 URL ## 注意事项 - 临时链接有效期默认 1 小时，可根据需求调整 - Bucket 建议设置为私有，通过签名链接安全访问 - 上传大文件时脚本会自动处理，无需额外配置


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: 52yuanchangxing/handover-memory-pack (version 1.0.0)

--- name: handover-memory-pack version: 1.0.0 description: "为人员离岗或项目交接整理显性与隐性知识，减少信息流失。；use for handover, knowledge-transfer, memory workflows；do not use for 泄露不该交接的密钥, 省略高风险事项." author: OpenClaw Skill Bundle homepage: https://example.invalid/skills/handover-memory-pack tags: [handover, knowledge-transfer, memory, operations] user-invocable: true metadata: {"openclaw":{"emoji":"🧠","requires":{"bins":["python3"]},"os":["darwin","linux","win32"]}} --- # 交接记忆包封装器 ## 你是什么 你是“交接记忆包封装器”这个独立 Skill，负责：为人员离岗或项目交接整理显性与隐性知识，减少信息流失。 ## Routing ### 适合使用的情况 - 帮我整理一份交接记忆包 - 把隐性知识显式化 - 输入通常包含：职责范围、关键联系人、未决事项 - 优先产出：职责概览、关键联系人、接手建议 ### 不适合使用的情况 - 不要泄露不该交接的密钥 - 不要省略高风险事项 - 如果用户想直接执行外部系统写入、发送、删除、发布、变更配置，先明确边界，再只给审阅版内容或 dry-run 方案。 ## 工作规则 1. 先把用户提供的信息重组成任务书，再输出结构化结果。 2. 缺信息时，优先显式列出“待确认项”，而不是直接编造。 3. 默认先给“可审阅草案”，再给“可执行清单”。 4. 遇到高风险、隐私、权限或合规问题，必须加上边界说明。 5. 如运行环境允许 shell / exec，可使用： - `python3 "{baseDir}/scripts/run.py" --input <输入文件> --output <输出文件>` 6. 如当前环境不能执行脚本，仍要基于 `{baseDir}/resources/template.md` 与 `{baseDir}/resources/spec.json` 的结构直接产出文本。 ## 标准输出结构 请尽量按以下结构组织结果： - 职责概览 - 关键联系人 - 隐性知识 - 未决事项 - 风险提醒 - 接手建议 ## 本地资源 - 规范文件：`{baseDir}/resources/spec.json` - 输出模板：`{baseDir}/resources/template.md` - 示例输入输出：`{baseDir}/examples/` - 冒烟测试：`{baseDir}/tests/smoke-test.md` ## 安全边界 - 建议把敏感信息改为引用位置而不是明文。 - 默认只读、可审计、可回滚。 - 不执行高风险命令，不隐藏依赖，不伪造事实或结果。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: ivangdavila/find (version 1.0.0)

--- name: Find description: Locate anything with progressive search expansion, multi-source validation, and iterative refinement until found. --- ## Pattern ``` Need → Clarify → Search → Validate → [Found? Deliver : Expand] ``` Keep searching until found or exhausted. Start narrow, expand progressively. Validate before delivering. ## When to Use - User needs to find something specific - Location or source is unknown - "Find me...", "Where can I get...", "I need to find..." **Not for:** Things you already know, simple lookups, browsing. ## Setup Before searching, clarify: | Element | Why | |---------|-----| | What exactly? | Avoid finding wrong thing | | Success criteria | How will we know it's right? | | Constraints | Budget, location, time, format | | Already tried? | Don't repeat failed paths | If user is vague → ask ONE clarifying question, then start. ## Search Expansion Start narrow, expand if not found: ``` 1. Obvious sources → Direct lookup, known locations 2. Specialized sources → Domain-specific databases, expert communities 3. Alternative queries → Different words, related concepts 4. Indirect paths → Who would know? What links to this? 5. Ask human → More context, different angle ``` Each expansion: try multiple sources in parallel when possible. ## Validation Before delivering, verify: - Is this actually what was asked for? - Is the source reliable? - Is it current/valid? - Any caveats user should know? If uncertain → say so. "Found X but not 100% sure it's what you need." ## Delivery ``` FOUND: [what] WHERE: [source] CONFIDENCE: [high/medium/low] CAVEATS: [if any] ``` If multiple results: summarize and let user choose. ## Not Found If exhausted all paths: 1. Report what was tried 2. Closest alternatives found 3. Suggest different approach or more context needed --- **Related:** For iterating until success criteria are met, see `loop`. For multi-phase workflows, see `cycle`.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bytesagain3/thresh (version 1.0.0)

--- name: "thresh" version: "1.0.0" description: "Grain threshing reference — threshing methods, combine harvester operation, crop-specific settings, grain loss reduction, and post-harvest handling. Use when planning harvest operations, optimizing combine settings, or reducing grain loss." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [thresh, threshing, harvest, grain, combine, agriculture, post-harvest] category: "agriculture" --- # Thresh — Grain Threshing Reference Quick-reference skill for threshing principles, combine harvester settings, and grain loss management. ## When to Use - Understanding threshing mechanisms and methods - Setting combine harvester parameters for specific crops - Reducing grain loss during harvest - Planning harvest timing and operations - Post-harvest grain handling and drying ## Commands ### `intro` ```bash scripts/script.sh intro ``` Overview of threshing — history, principles, and modern methods. ### `mechanisms` ```bash scripts/script.sh mechanisms ``` Threshing mechanisms — cylinder types, concave settings, rotor systems. ### `crops` ```bash scripts/script.sh crops ``` Crop-specific threshing settings for major grain crops. ### `loss` ```bash scripts/script.sh loss ``` Grain loss sources, measurement, and reduction strategies. ### `timing` ```bash scripts/script.sh timing ``` Harvest timing — moisture content, maturity indicators, and weather. ### `postharvest` ```bash scripts/script.sh postharvest ``` Post-harvest handling — drying, cleaning, storage, and quality. ### `examples` ```bash scripts/script.sh examples ``` Practical threshing scenarios and troubleshooting. ### `checklist` ```bash scripts/script.sh checklist ``` Pre-harvest and threshing operations checklist. ### `help` ```bash scripts/script.sh help ``` ### `version` ```bash scripts/script.sh version ``` ## Configuration | Variable | Description | |----------|-------------| | `THRESH_DIR` | Data directory (default: ~/.thresh/) | --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: anugotta/payment-incident-responder (version 1.0.0)

--- name: payment-incident-responder description: Coordinate payment incident response with structured triage, blast-radius assessment, mitigation actions, stakeholder communication, reconciliation recovery, and postmortem tracking. metadata: {"openclaw":{"emoji":"🚨","homepage":"https://www.rbi.org.in/scripts/BS_ViewMasDirections.aspx?id=12898"}} --- # Payment Incident Responder ## Purpose Help teams respond to payment incidents quickly and consistently: - detect and classify incident severity - define immediate containment actions - coordinate internal/external communication - restore correctness via reconciliation and data repair - produce postmortem action items ## Disclaimer This skill provides operational guidance only. It does not execute payments, reverse transactions, or replace legal/compliance decisions. Use at your own risk. The skill author/publisher/developer is not liable for direct or indirect losses, fraud, penalties, downtime, or damages arising from use or misuse of this guidance. ## Incident severity model - `P0`: broad outage / incorrect success/failure state at scale - `P1`: major degradation with partial workaround - `P2`: limited impact to specific cohorts or features - `P3`: minor issue, low customer impact ## Standard response workflow 1. **Acknowledge and assign roles** - incident commander - tech lead - comms owner - reconciliation owner 2. **Establish blast radius** - affected methods/regions/providers - impacted users/orders - error signatures and trend window 3. **Contain** - freeze risky deploys - enable degraded mode messaging - pause high-risk paths if needed 4. **Diagnose** - check webhook pipeline, API errors, queue lag, provider status - identify first failing component and triggering change 5. **Mitigate and recover** - apply safe rollback/fix - reconcile pending and mismatched states - verify customer-facing correctness 6. **Close and learn** - final incident summary - postmortem with owner/due-date action items ## Guardrails - Never communicate "resolved" before metrics and correctness checks pass. - Never run blind retries that can create duplicate charges. - Always include transaction reference IDs in customer/support comms. - Keep all decisions time-stamped in incident log. ## Output format When invoked, return: 1. severity + current phase 2. top 3 immediate actions 3. customer impact summary 4. next update time and owner 5. reconciliation and correctness checklist ## Setup Read [setup.md](setup.md) on first use. ## Validation Run [validation-checklist.md](validation-checklist.md) for drills and live incidents. ## References - Triage and mitigation templates: [incident-playbook.md](incident-playbook.md) - Stakeholder/customer comms templates: [comms-templates.md](comms-templates.md) - Post-incident tracking template: [postmortem-template.md](postmortem-template.md) - Launch/readiness checks: [validation-checklist.md](validation-checklist.md)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: crftsmnd/a2a-code-audit (version 1.0.2)

# Code Audit & Security Scan Static code analysis for security vulnerabilities, style violations, and bugs. ## When to Use Trigger on: "audit code", "scan for bugs", "security check", "code review", "find vulnerabilities" ## What This Does - Analyzes code for common security issues - Checks for style violations - Identifies potential bugs - Returns structured report with severity levels ## Supported Languages - Python - JavaScript/TypeScript ## Workflow ### Step 1: Receive Code Get code to analyze + language. ### Step 2: Static Analysis Analyze using pattern matching and heuristics: **Python checks:** - Use of eval(), exec(), __import__() - Hardcoded credentials - SQL injection risks - Path traversal - Insecure random **JS/TS checks:** - eval() usage - innerHTML without sanitization - Hardcoded API keys - console.log in production code ### Step 3: Scoring ``` Score = 100 - (issues_found × severity_weight) Verdict: PASS (>80), WARN (50-80), FAIL (<50) ``` ### Step 4: Present Results ``` ## Code Audit: [language] ### Summary | Metric | Value | |--------|-------| | Score | [X]/100 | | Verdict | [PASS/WARN/FAIL] | | Issues | [N] | ### Issues 1. [SEVERITY] [issue description] (line [N]) 2. ... ### Recommendations - [fix suggestions] ``` ## No External Tools Required This skill uses only: - Platform exec tool - Pattern matching - No external binaries needed ## Example ``` ## Code Audit: Python ### Summary | Metric | Value | |--------|-------| | Score | 70/100 | | Verdict | WARN | | Issues | 3 | ### Issues 1. HIGH: eval() usage (line 2) 2. MEDIUM: hardcoded 'password' (line 5) 3. LOW: unused import 'os' (line 1) ### Recommendations - Replace eval() with safer alternatives - Use environment variables for secrets - Remove unused imports ``` ## Notes - Works with platform tools only - No install steps required - Pattern-based analysis (not full compiler) - Always note limitations in report


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: pppig1357/cctv-news-fetcher-1-0-0 (version 1.0.0)

--- name: cctv-news-fetcher description: Fetch and parse news highlights from CCTV News Broadcast (Xinwen Lianbo) for a given date. user-invocable: true --- # CCTV News Fetcher This skill allows you to fetch summary titles and content from the CCTV News Broadcast for any specific date. ## Usage You can ask the agent to: - "Fetch CCTV news for 20250210" - "Give me the news highlights for yesterday" ## Instructions When the user asks for news from a specific date: 1. Format the date as `YYYYMMDD`. If the user says "yesterday" or "today", calculate the date relative to the current local time. 2. Execute the script at `{baseDir}/scripts/news_crawler.js` using `bun` or `node`. - Command: `bun {baseDir}/scripts/news_crawler.js <YYYYMMDD>` 3. Parse the JSON output and summarize it for the user. Group news by "Domestic" and "International" if possible based on titles, or just list the highlights. ## Configuration The skill depends on `node-html-parser`. Ensure `bun` is installed in the environment.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: sky-lv/package-updater (version 1.0.0)

--- name: skylv-dependency-updater slug: skylv-dependency-updater version: 1.0.0 description: "Auto-checks and updates outdated dependencies. Shows changelogs and breaking changes before updating. Triggers: update dependencies, upgrade packages, check outdated, npm update." author: SKY-lv license: MIT tags: [dependencies, npm, pip, update, devops] keywords: [dependencies, npm, pip, update, upgrade, package] triggers: update dependencies, upgrade packages, check outdated --- # Dependency Updater ## Overview Scans project dependencies and checks for updates, shows changelogs, identifies breaking changes. ## When to Use - User asks to "update dependencies" or "check for updates" - Regular maintenance ## How It Works ### Step 1: Detect package manager package.json -> npm pyproject.toml -> pip Cargo.toml -> cargo go.mod -> go ### Step 2: Check outdated npm: npm outdated --json pip: pip list --outdated --format=json cargo: cargo outdated ### Step 3: Risk assessment Patch (1.2.3 -> 1.2.4): Low risk - auto-update Minor (1.2.3 -> 1.3.0): Medium - show changelog Major (1.2.3 -> 2.0.0): High - show breaking changes ## Output Format Major Updates: express 4.17.1 -> 5.0.0 [BREAKING changes] Minor Updates: axios 0.21.1 -> 0.21.4 [Bug fixes] Patch Updates: debug 4.3.1 -> 4.3.4 [Security patch] ## Update Strategy 1. Show report first - never update blindly 2. Update in stages: patches -> minors -> majors 3. Run tests after each update 4. Commit each update separately


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)