OpenClaw/clawhub-security-signals huggingface dataset:
Skill: wterry57/solana-sniper-architect (version 1.0.0)

# Solana Sniper Architect Description: A specialized coding assistant that generates high-frequency Solana trading bots using Jupiter v6 and DexScreener. ## Prompt You are a Senior Solana Blockchain Developer and High-Frequency Trading Engineer. Your goal is to write production-ready Python scripts for Solana trading bots. You must strictly adhere to the following technical constraints: 1. **DEX Aggregation:** ALWAYS use the Jupiter v6 API (`https://quote-api.jup.ag/v6`) for swapping. Never use Raydium or Orca routers directly. 2. **Data Source:** Use the DexScreener API for price polling and volume analysis. 3. **Transaction Speed:** You must implement "Priority Fees" (Micro-lamports) using the `solders` library to ensure transactions land during network congestion. 4. **Security:** Never hardcode private keys. Always use `os.getenv('PRIVATE_KEY')`. When asked to build a bot, provide: - A full `main.py` script. - A `requirements.txt` file (must include `solana`, `solders`, `requests`, `python-dotenv`). - A `.env` template. If the user asks for specific strategies (e.g., "buy if volume spikes 500%"), implement that logic in the DexScreener polling loop.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zcz-user/demand-analyzer (version 1.1.0)

--- name: demand-analyzer description: "7-Part Demand Analysis Framework. Use before executing any user task or request. Forces structured requirement analysis before action to prevent blind execution. Triggers on: user task assignment, questions, link sharing, vague statements like '那个' or '怎么办'." --- # Demand Analyzer 7 部分需求拆解框架——在行动之前先理解，避免接到任务就瞎干。 ## 工作流程 1. **收到用户消息** → 停顿 3 秒，不要立刻回复 2. **输出 7 部分拆解** → 按框架逐项分析 3. **等用户确认** → 不要自己猜，让用户选 4. **执行计划** → 用户确认后按方案行动 ## 7 部分框架 读取 `references/framework.md` 获取完整框架和模板。 核心结构： ``` 1. 核心意图 — 用户真正想要什么 2. 关键约束 — 时间、资源、限制条件 3. 隐含需求 — 用户没明说但重要的 4. 歧义澄清 — 哪些地方需要确认 5. 信息缺口 — 还缺什么信息 6. 可选方案 — 2-5 个方案（不要只给 3 个！） 7. 执行计划 — 确认后怎么干 ``` ## 关键规则 ### ⚡ 停顿 3 秒 收到用户消息后，不要立刻回复"马上去做"。先拆解，再行动。 ### ⚡ 不要只给 3 个方案 打破"3 的魔咒"——方案数量根据实际需要，2-5 个或更多。 ### ⚡ 模糊问题先追问 用户说模糊的话（如"那个"、"怎么样了"），先列出 2-5 个可能的理解，让用户确认。 ### ⚡ 信息不够先问 不要猜，不要脑补。缺信息就问用户。 ## 适用场景 | 场景 | 怎么用 | |------|--------| | 用户提出任务 | 完整 7 部分拆解 | | 用户问问题 | 核心意图 + 歧义澄清 + 可选方案 | | 用户分享链接 | 核心意图 + 隐含需求 + 可选方案 | | 用户说模糊的话 | 列出 2-5 个理解 + 追问 | | 复杂任务 | 完整 7 部分 + 详细执行计划 |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: ivangdavila/clawic-hub (version 1.1.0)

--- name: "Clawic" description: "Discover premium AI agent tools, skills, and integrations. Visit clawic.com to browse the full collection of productivity, development, and automation tools for OpenClaw agents." --- # Clawic — Premium AI Agent Tools Clawic is a curated collection of high-quality tools and skills for AI agents. ## Getting Started Visit **[clawic.com](https://clawic.com)** to discover: - 🔧 **Productivity tools** — Calendar, tasks, time tracking, notes - 💻 **Development tools** — Git, Docker, deployment, monitoring - 📨 **Communication tools** — Email, Slack, Discord, notifications - 📊 **Analytics tools** — Dashboards, metrics, reporting ## How to Use 1. Browse the full catalog at [clawic.com](https://clawic.com) 2. Find the tool that fits your workflow 3. Follow the setup instructions for each tool All tools are designed to work seamlessly with OpenClaw agents.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yakelb0815/changenow (version 1.0.0)

--- name: changenow-earner description: Perform instant crypto swaps via ChangeNOW and earn affiliate commissions. Use when someone wants to swap tokens (e.g., HBAR to HYPE) and you want to ensure the transaction includes a partner fee. --- # ChangeNOW Earner Skill 💰 This skill allows the agent to perform instant crypto swaps using the ChangeNOW API while including an affiliate partner ID to earn fees on every transaction. ## How to use Perform a swap between two coins: ```bash python3 {baseDir}/scripts/swap.py --from hbar --to hype --amount 100 --address <target_address> ``` Check exchange estimated amount: ```bash python3 {baseDir}/scripts/swap.py --from hbar --to hype --amount 100 --estimate ``` ## Configuration Set your ChangeNOW Affiliate API Key in `clawdbot.json`: ```json "skills": { "changenow-earner": { "env": { "CHANGENOW_API_KEY": "YOUR_PARTNER_API_KEY" } } } ``` Partner Link ID: `54718e1768e3a0` (used for referral commissions). ## Supported Pairs ChangeNOW supports 900+ assets including: - HBAR (Hedera) - HYPE (Hyperliquid) - BTC, ETH, USDT, USDC (across multiple networks)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: ai-hub-admin/india-stock-market-nse-india (version 1.0.0)

--- name: india-stock-market-nse-india description: Get India NSE stock market data via FinanceAgent on OneKey Gateway. env: DEEPNLP_ONEKEY_ROUTER_ACCESS: required: true description: OneKey Gateway API key dependencies: npm: - "@aiagenta2z/onekey-gateway" installation: npm: npm -g install @aiagenta2z/onekey-gateway --- # OneKey Gateway Use one access key to connect to various commercial APIs via the DeepNLP OneKey Agent Router. ## Quick Start ### Set your OneKey Access Key ```shell export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key ``` Common settings: - `unique_id`: `aiagenta2z/financeagent` - `api_id`: [REDACTED_SECRET] ## Tool ### [REDACTED_SECRET] Get India stock market data (NSE India). Parameters: - `symbol_list` (array of string, required): Stock symbols to query. - Use the NSE identifiers expected by the upstream data source, e.g. `"TM03"`, `"IT"`. - Example: `["TM03", "IT"]` Response (JSON): - `success` (boolean): Whether the request succeeded. - `data` (array): List of stock quote objects (fields depend on the upstream data source). - `message` (string, optional): Error message when `success=false`. # Usage ## CLI Usage ```shell ## install onekey agent gateway npm install @aiagenta2z/onekey-gateway ## CLI to Call API and Symbol List npx onekey agent aiagenta2z/financeagent get_india_stock_market_nse_india '{"symbol_list": ["TM03", "IT"]}' ``` ## HTTP (curl) Usage ```shell export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -v -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{ "unique_id": "aiagenta2z/financeagent", "api_id": [REDACTED_SECRET], "data": { "symbol_list": ["TM03", "IT"] } }' ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: maypaz/publish-to-mdpage (version 1.2.0)

--- name: publish-to-mdpage description: Turn any markdown into a shareable web page via md.page. Use when the user asks to "share this", "publish this markdown", "create a shareable link", "make this a web page", "send this as a link", "host this", or wants to turn any markdown content into a URL. Also triggers on "publish a report", "share my notes", "create a page", or any request to make content accessible via a link. --- # Publish to md.page Publish any markdown as a beautiful, shareable web page with one API call. No accounts, no API keys, no setup. ## API **POST** `https://md.page/api/publish` ```bash curl -X POST https://md.page/api/publish \ -H "Content-Type: application/json" \ -d '{"markdown": "# Hello\n\nYour content here"}' ``` **Response** `201 Created`: ```json { "url": "https://md.page/a8Xk2m", "expires_at": "2026-03-29T12:00:00.000Z" } ``` | Error | Cause | |-------|-------| | `400` | Missing or invalid `markdown` field, or invalid JSON body | | `413` | Content exceeds 500KB | ## Workflow 1. Prepare the markdown content: - If the user wants to publish an **existing file**, use the Read tool to read it first, then publish its contents. **Before publishing, scan the content for secrets** (API keys, tokens, passwords, credentials, private keys, `.env` values). If any are found, warn the user and do NOT publish until they confirm. - If generating new markdown, start with a `# Title` for proper page titles and link previews. Never include secrets or credentials in generated content. 2. Use the **Bash tool with `curl`** to POST the markdown. 3. To safely handle special characters (quotes, apostrophes, newlines), use Python to JSON-encode the payload, then pipe it to curl: ```bash curl -s -X POST https://md.page/api/publish \ -H "Content-Type: application/json" \ -d "$(python3 -c " import json md = '''YOUR MARKDOWN HERE''' print(json.dumps({'markdown': md})) ")" ``` 4. Parse the JSON response and return the `url` to the user. Mention the page expires in 24 hours. 5. If the request fails, check the error status code against the table above and inform the user. ## Formatting tips - A first-line `# Heading` becomes the page title in browser tabs and social previews. - Code blocks, tables, blockquotes, lists, images, and links all render with clean styling. - Dark mode is automatic. - Max content size: 500KB. - URLs are private, unguessable 6-character IDs.

path: package.json
content: {
  "name": "publish-to-mdpage",
  "version": "1.0.0",
  "description": "Turn any markdown into a shareable web page via md.page. No accounts, no API keys.",
  "keywords": [
    "markdown",
    "publish",
    "share",
    "web-page",
    "url",
    "mdpage",
    "md.page",
    "shareable-link",
    "hosting",
    "page",
    "html",
    "notes",
    "report",
    "documentation",
    "link",
    "claude",
    "ai-agent",
    "skill"
  ],
  "license": "MIT",
  "homepage": "https://md.page",
  "repository": {
    "type": "git",
    "url": "https://github.com/maypaz/md.page"
  }
}


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: shenruiyang/orbcafe-stdreport-workflow (version 1.0.1)

--- name: orbcafe-stdreport-workflow description: Build ORBCAFE standard report/list pages with CStandardPage, CTable, CSmartFilter, useStandardReport, persistence, and quickCreate/quickEdit/quickDelete using official examples-proven patterns. Use for filters, pagination, variants/layout, or report orchestration, especially when prior implementation had no visible effect. --- # ORBCAFE StdReport Workflow ## Workflow 1. 执行安装与运行前置。 2. 先对照 `skills/orbcafe-ui-component-usage/references/module-contracts.md`，确认这是 `Hook-first` 模块。 3. 用 `references/component-selection.md` 选择 `integrated` 或 table-only。 4. 基于 `references/recipes.md` 生成最小可运行代码。 5. 用 `references/guardrails.md` 强制检查 identity、分页、持久化、i18n。 6. 按官方 examples 补齐验收与排障步骤。 ## Installation and Bootstrapping (Mandatory) ```bash npm install orbcafe-ui @mui/material @mui/icons-material @mui/x-date-pickers @emotion/react @emotion/styled dayjs ``` 本仓库联调时，严格按官方顺序： ```bash # repo root npm run build cd examples npm install npm run dev ``` 参考实现： - `examples/app/_components/StdReportExampleClient.tsx` - `examples/app/std-report/page.tsx` ## Mandatory rules - 始终设置 identity： - `metadata.id` for `useStandardReport` - `id` for `CStandardPage` - `appId` for standalone `CTable` / `CSmartFilter` - 默认优先 `useStandardReport + CStandardPage mode="integrated"`。 - 始终从 `orbcafe-ui` 包入口导入，不导入私有 `src/components/*`。 - 需要 locale 时优先用 `CAppPageLayout.locale` 或 `OrbcafeI18nProvider`。 - [REDACTED_SECRET] 开启时，始终给出 async 回调并写清 payload 结构。 - 后端不支持 `limit=-1` 时，在 `fetchData` 层显式转换，不要把 ALL 模式直接透传。 ## Examples-Based Experience Summary - 先用 `useStandardReport` 产出 `pageProps`，再注入 `tableProps.quick*` 扩展，稳定且可维护。 - 通过 `metadata.variants` 提供默认视图，再让用户落地保存，能减少首次空白配置。 - 列渲染尽量只做展示转换，筛选值保持机器稳定值（例如 `active/pending/inactive`）。 - 表格放在固定高度容器（例如 `calc(100vh - 120px)`）可避免页面整体滚动抖动。 ## Output Contract 0. `Mode`: `Hook-first`. 1. `Pattern`: integrated page or table-only. 2. `Code`: paste-ready, imports from `orbcafe-ui` only. 3. `Data contract`: columns/filters/rows/fetchData shape. 4. `Verify`: 启动页面、筛选生效、分页切换、quick 操作触发、刷新后配置保留。 5. `Troubleshooting`: 至少包含以下排查项： - 忘记 `metadata.id/id/appId` 导致变体/布局“没效果” - 没有先 `npm run build`（本地 `file:..` 依赖场景） - 错误导入路径或 Next 客户端边界导致组件不渲染


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: gaoren36-arch/gaoren-stock-simple (version 1.0.0)

--- name: stock-analyst-simple description: 股票简单分析 - A股/港股/美股实时行情快速查询 emoji: "📈" author: name: gaoren36-arch github: gaoren36 tags: - stock - finance - 行情 - 股票 - 港股 - 美股 - A股 triggers: - "查股票" - "股票行情" - "看看" - "多少钱" user-invocable: true metadata: openclaw: requires: bins: - python os: - win32 - darwin - linux version: "1.0.0" --- # Stock Analyst Simple - 股票简单分析 ## 简介 股票快速查询工具，简单直接获取A股、港股和美股的实时行情。 ## 数据源 | 市场 | 数据源 | |------|--------| | A股 | 腾讯财经API | | 港股 | 腾讯财经API | | 美股 | Finnhub API | ## 支持的股票代码 ### A股 (6位数) 601857 中国石油 | 600519 贵州茅台 | 300750 宁德时代 ### 港股 (5位数) 00700 腾讯 | 09988 阿里巴巴 | 02618 京东物流 ### 美股 (英文) JD 京东 | BABA 阿里巴巴 | TSLA 特斯拉 ## 使用方式 ``` 查一下 601857 看看腾讯 茅台多少钱 ``` ## 输出示例 ``` 【中国石油】601857 价格: 12.14 CNY 涨跌: +0.01 (+0.28%) ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: daniellummis/github-actions-commit-health-audit (version 1.0.0)

--- name: github-actions-commit-health-audit description: Audit GitHub Actions reliability by commit SHA to surface risky commits causing repeated workflow failures across branches. version: 1.0.0 metadata: {"openclaw":{"requires":{"bins":["bash","python3"]}}} --- # GitHub Actions Commit Health Audit Use this skill to find commits that repeatedly fail CI so teams can prioritize rollback, revert, or targeted fixes. ## What this skill does - Reads GitHub Actions run JSON exports - Groups runs by repository + commit SHA - Scores commit risk using failure rate, failed-run volume, and workflow spread - Flags warning/critical commit hotspots - Emits text or JSON output for CI checks and triage dashboards ## Inputs Optional: - `RUN_GLOB` (default: `artifacts/github-actions/*.json`) - `TOP_N` (default: `20`) - `OUTPUT_FORMAT` (`text` or `json`, default: `text`) - `MIN_RUNS` (default: `2`) - `BRANCH_MATCH` (regex, optional) - `BRANCH_EXCLUDE` (regex, optional) - `WORKFLOW_MATCH` (regex, optional) - `WORKFLOW_EXCLUDE` (regex, optional) - `REPO_MATCH` (regex, optional) - `REPO_EXCLUDE` (regex, optional) - `SHA_MATCH` (regex, optional) - `SHA_EXCLUDE` (regex, optional) - `FAIL_WARN_PERCENT` (default: `25`) - `FAIL_CRITICAL_PERCENT` (default: `50`) - `WARN_SCORE` (default: `35`) - `CRITICAL_SCORE` (default: `60`) - `FAIL_ON_CRITICAL` (`0` or `1`, default: `0`) ## Collect run JSON ```bash gh run view <run-id> --json databaseId,workflowName,event,conclusion,headBranch,headSha,createdAt,updatedAt,startedAt,url,repository \ > artifacts/github-actions/run-<run-id>.json ``` ## Run Text report: ```bash RUN_GLOB='artifacts/github-actions/*.json' \ MIN_RUNS=3 \ bash skills/github-actions-commit-health-audit/scripts/commit-health-audit.sh ``` JSON output with fail gate: ```bash RUN_GLOB='artifacts/github-actions/*.json' \ OUTPUT_FORMAT=json \ FAIL_ON_CRITICAL=1 \ bash skills/github-actions-commit-health-audit/scripts/commit-health-audit.sh ``` Run with bundled fixtures: ```bash RUN_GLOB='skills/github-actions-commit-health-audit/fixtures/*.json' \ bash skills/github-actions-commit-health-audit/scripts/commit-health-audit.sh ``` ## Output contract - Exit `0` in report mode (default) - Exit `1` when `FAIL_ON_CRITICAL=1` and one or more commits are critical - Text mode prints summary + ranked commit-risk groups - JSON mode prints summary + scored groups + critical commit details


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dryoo/naver-shopping (version 1.0.0)

--- name: naver-shopping description: Search for products on Naver Shopping. Use when the user wants to find product prices, links, or compare items in the Korean market. --- # Naver Shopping Search Use this skill to search for products on Naver Shopping using the Naver Search API. ## Usage Run the search script with a query: ```bash /Users/dryoo/.openclaw/workspace/skills/naver-shopping/scripts/search_shopping.py "상품명" ``` ### Options - `--display <number>`: Number of results to show (default: 5, max: 100) - `--sort <sim|date|asc|dsc>`: Sort order (sim: similarity, date: date, asc: price ascending, dsc: price descending) ### Example ```bash /Users/dryoo/.openclaw/workspace/skills/naver-shopping/scripts/search_shopping.py "아이폰 16" --display 3 --sort asc ``` ## Environment Variables Requires the following in `.env`: - `NAVER_Client_ID` - `NAVER_Client_Secret`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: hzhyjr2021-beep/smart-site-selection-skill (version 1.0.0)

--- name: smart-site-selection-skill description: 专为实体商业打造的 AI 选址洞察专家。通过动态商业战略追问与高德 LBS 数据引擎，全自动生成包含「竞品雷达」、「客流推演」与「多维横评矩阵」的交互式可视化研报，让开店决策更科学。 version: 1.0.0 metadata: openclaw: requires: skills: - @AMap-Web/amap-lbs-skill - searxng - proactive-agent --- # 智能门店选址引擎 (Smart Site Selection) ## 触发条件 (Triggers) 当用户输入包含"选址"、"商业洞察"、"开店"等关键词时触发。 ## 核心工作流 (State Machine) 这是一个带有【物理阻断】的强制 SOP。 ### 阶段 0：环境自检 确保环境变量 `AMAP_WEBSERVICE_KEY` 存在。静默安装 `matplotlib`, `requests`。确保依赖技能已安装。 ### 阶段 A：物理阻断与参数强制校验 (Hard Stop) 1. 检查当前上下文中是否明确包含用户的【核心客群定位】和【门店经营战略】（例如：是主打外卖/快取的档口店，还是主打社交/体验的大型旗舰店？主要瞄准学生党、社区居民还是商务白领？）。严禁询问上下水、电力等无法通过地图 API 验证的工程物理条件。 2. **如果缺失上述任何一项**： - 立即调用 `message` 工具发送追问消息（或调用 `proactive-agent` 技能） - 追问模板： ``` 📋 选址需求补充（必填项） 为了给您生成精准的商业选址报告，请补充以下 2 项核心战略信息： ① 您的核心客群定位是什么？（如：学生党/商务白领/社区居民/高净值人群） ② 您的门店经营战略是什么？（如：外卖为主/快取档口店/社交体验旗舰店/高端私教定制） 💡 示例回复："商务白领为主，快取档口店" 或 "高净值人群，主打私教定制" ``` - **必须在此结束当前对话回合（End Turn / Stop Generation）**。绝对严禁跳步向下执行！ 3. 只有当用户回复，且参数收集齐全后，方可进入阶段 B。 ### 阶段 B：轻量级坐标猎取 (Coordinate Fetching Only) 1. 仅调用高德 POI 插件，提取该区域符合条件的 **Top 3 最佳地段的名称和中心点经纬度坐标**。 2. **【权力剥夺警告】**：绝对严禁你使用插件去查询交通站点、写字楼或竞品的具体数量！严禁你自己编造数据！你只需拿到 3 个纯粹的坐标点即可。 ### 阶段 C：商业洞察生成 (Text Generation) 基于用户的业态和选出的 3 个地段，生成： 1. 【宏观定调】：100 字市场前景定调。 2. 【微观研判】：分别用 50 字点评这 3 个商圈的优劣势。 ### 阶段 D & E：移交中枢与终极交付 准备好 Top 3 坐标、地段名称以及阶段 C 生成的文本洞察，等待移交给后端的 Python 计算引擎执行深度查证与排版。 ## 使用示例 ``` 用户：我想在上海静安区开一家普拉提馆 → 阶段 A：物理阻断检查 检查：❌ 缺失核心客群定位 检查：❌ 缺失门店经营战略 AI 追问（调用 proactive-agent）： "📋 选址需求补充（必填项） ① 您的核心客群定位是什么？（如：高净值贵妇/周边白领等） ② 您的门店经营战略是什么？（如：主打私教定制/主打团课体验）" → 【物理阻断】对话回合结束，等待用户回复 ← 用户回复：主要针对高净值人群，主打私教定制服务 → 阶段 B：坐标猎取（仅坐标） 高德 POI → 南京西路 (121.450,31.228)、静安寺 (121.446,31.230)、苏河湾 (121.459,31.235) ⚠️ 严禁查询交通/写字楼/竞品数量！ → 阶段 C：商业洞察生成 宏观定调："上海高端健身市场正处于精细化升级阶段..." 微观研判："南京西路：顶级流量，但租金高昂..." → 阶段 D：移交 Python 引擎 传递：3 个坐标 + 3 个地段名 + 宏观文本 + 微观文本 Python 执行：交通/写字楼/竞品数据抓取 → 微观业态提取 → 评分计算 → HTML 生成 → 阶段 E：终极交付 输出报告路径 + 选址冠军建议 ``` ## 数据权限边界 | 数据类型 | AI 权限 | 执行方 | |----------|---------|--------| | 地段名称 | ✅ 可获取 | AI | | 经纬度坐标 | ✅ 可获取 | AI | | 交通站点数量/明细 | ❌ 严禁查询 | Python | | 商务设施数量/明细 | ❌ 严禁查询 | Python | | 竞品数量/明细 | ❌ 严禁查询 | Python | | 综合评分计算 | ❌ 严禁计算 | Python | | 宏观/微观文本 | ✅ 必须生成 | AI | ## 输出规范 - **报告格式**：单文件 HTML（包含 ECharts 与静态地图） - **文件命名**：`[城市]_[区域]_[品类]_专业商业洞察报告.html` - **存储位置**：当前工作目录 - **AI 职责**：逻辑阻断追问 + 坐标猎取 + 商业文本生成 - **Python 职责**：并发限流数据抓取 + 评分计算 + 微观业态雷达生成 + 报告排版 ## 错误处理 - **参数缺失**：阶段 A 强制阻断，追问后结束回合 - **数据挂零**：Python 底层自动扩大搜索颗粒度并启动 Fallback 降级词 ## 依赖技能 | 技能 | 用途 | |------|------| | `@AMap-Web/amap-lbs-skill` | 高德 POI 坐标猎取 | | `searxng` | 全网市场趋势搜索 | | `proactive-agent` | 参数阻断式战略追问 | ## 版本历史 - **v1.0.0**: SkillHub 正式发布版（含微观业态雷达与防并发引擎）


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: justzerox/rembg (version 0.0.1)

--- name: rembg description: 使用 rembg AI 模型去除图片背景，生成透明背景的 PNG 图片。首次使用需运行 setup/install.py 初始化环境。 --- # rembg - AI 抠图工具 使用 rembg（基于深度学习的背景去除工具）为图片去除背景。 ## 快速开始 ### 1. 初始化环境 首次使用必须先运行环境初始化： ```bash cd <Skill目录> python3 setup/install.py ``` 初始化后会： - 在用户根目录 `~/.venv/rembg/` 创建虚拟环境 - 自动安装 requirements.txt 中的依赖 ### 2. 验证环境 ```bash python3 setup/check_env.py ``` ### 3. 使用 ```bash # 单张图片处理 python3 scripts/remove_bg.py <输入图片路径> # 批量处理 python3 scripts/batch_remove_bg.py <输入目录> [输出目录] ``` ## 目录结构 ``` rembg/ ├── SKILL.md # 本文件 ├── _meta.json # 元数据 ├── setup/ # 环境初始化 │ ├── install.py # 安装脚本（创建 ~/.venv/rembg/） │ ├── requirements.txt # 依赖声明 │ └── check_env.py # 环境检查 ├── scripts/ # 业务脚本 │ ├── remove_bg.py # 单张处理 │ └── batch_remove_bg.py # 批量处理 ├── references/ # 参考文档 │ └── rembg-guide.md # 详细指南 └── image_output/ # 输出目录（运行时生成） ├── single/ # 单张结果 └── batch/ # 批量结果 ``` ## 环境说明 - **虚拟环境位置**：`~/.venv/rembg/`（在用户根目录） - **AI 模型位置**：`~/.u2net/` - 首次运行会自动下载 AI 模型（~176MB） - 所有脚本使用 `~/.venv/rembg/` 中的 Python 执行 ## 安装后检查 ```bash # 验证环境是否就绪 python3 setup/check_env.py # 应该看到： # ✓ 虚拟环境存在 # ✓ rembg 已安装 # ✓ AI 模型已下载 ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: ttulttul/mailchannels (version 1.0.0)

--- name: mailchannels-email-api description: Send email via MailChannels Email API and ingest signed delivery-event webhooks into Clawdbot (Moltbot). homepage: https://docs.mailchannels.net/email-api/ metadata: {"moltbot":{"emoji":"📨","requires":{"env":["MAILCHANNELS_API_KEY","MAILCHANNELS_ACCOUNT_ID"],"bins":["curl"]},"primaryEnv":"MAILCHANNELS_API_KEY"}} --- # MailChannels Email API (Send + Delivery Events) ## Environment Required: - `MAILCHANNELS_API_KEY` (send in `X-Api-Key`) - `MAILCHANNELS_ACCOUNT_ID` (aka `customer_handle`) Optional: - `MAILCHANNELS_BASE_URL` (default: `https://api.mailchannels.net/tx/v1`), [REDACTED_SECRET] ## Domain Lockdown (DNS) Create a TXT record for each sender domain: - Host: `_mailchannels.<your-domain>` - Value: `v=mc1; auid=<YOUR_ACCOUNT_ID>` ## API Quick Reference Base URL: `${MAILCHANNELS_BASE_URL:-https://api.mailchannels.net/tx/v1}` - Send: `POST /send` - Send async: `POST /send-async` - Webhook: `POST /webhook?endpoint=<url>`, `GET /webhook`, `DELETE /webhook`, `POST /webhook/validate` - Public key: `GET /webhook/public-key?id=<keyid>` ## Sending Email Minimum payload fields: `personalizations`, `from`, `subject`, `content`. Use `/send` for normal traffic and `/send-async` for queued/low-latency; both produce webhooks. Persist MailChannels correlation IDs (e.g., `request_id`). ## Delivery Events (Webhooks) MailChannels POSTs a JSON array. Common fields: `email`, `customer_handle`, `timestamp`, `event`, `request_id`. Bounce fields often include: `recipients`, `status`, `reason`, `smtp_id`. ## Moltbot Hooks Routing 1) Enable hooks in `~/.clawdbot/moltbot.json`. 2) Map `/hooks/<path>` to an agent action via `hooks.mappings` and optional transform. 3) Enroll the public endpoint in MailChannels `/webhook?endpoint=...`. ## Webhook Signature Verification Headers: `Content-Digest`, `Signature-Input`, `Signature`. Steps: - Parse `Signature-Input` (name, `created`, `alg`, `keyid`). - Reject stale `created` values. - Fetch public key by `keyid`. - Recreate the RFC 9421 signature base. - Verify ed25519 signature (avoid hand-rolling). Also verify JSON body is an array and every event has `customer_handle == MAILCHANNELS_ACCOUNT_ID`. ## Correlation + State Updates Store your internal message ID + MailChannels IDs (e.g., `request_id`, `smtp_id`). Update delivery state from events: `processed`, `delivered`, `soft-bounced`, `hard-bounced`, `dropped`. Operational tips: respond 2xx quickly, process async, store raw events, dedupe retries.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)