OpenClaw/clawhub-security-signals huggingface dataset:
Skill: austindixson/cron-health-check (version 1.0.0)

--- name: cron-health-check displayName: Cron Health Check | OpenClaw Skill description: Monitors OpenClaw cron job health, identifies failures, timeouts, and delivery issues. version: 1.0.0 --- # Cron Health Check | OpenClaw Skill ## Description Monitors OpenClaw cron job health, identifies failures, timeouts, and delivery issues. # Cron Health Check | OpenClaw Skill Monitors the health of OpenClaw cron jobs by analyzing run history and identifying patterns of failures, timeouts, and delivery issues. ## Usage - As a scheduled cron job to monitor job health proactively - Manually to check current cron job status - After fixing cron job errors to verify improvements ```bash # Check health of all cron jobs (last 24 hours) python3 /Users/ghost/.openclaw/workspace/skills/cron-health-check/scripts/check_cron_health.py # Check last 48 hours python3 /Users/ghost/.openclaw/workspace/skills/cron-health-check/scripts/check_cron_health.py --hours 48 # Output JSON format python3 /Users/ghost/.openclaw/workspace/skills/cron-health-check/scripts/check_cron_health.py --json ``` ## What this skill does - **Analyzes** cron job run history from the last N hours - **Identifies** jobs with consecutive failures, timeouts, or delivery issues - **Reports** health status (healthy/warning/critical) for each job - **Suggests** fixes (e.g., adding --best-effort-deliver for delivery failures) - **Detects** OpenRouter API limit issues ## Integration as a Cron Job This skill can run periodically to monitor cron job health: ```json { "payload": { "kind": "agentTurn", "message": "Run cron-health-check skill to analyze cron job health.", "model": "openrouter/google/gemini-2.5-flash", "thinking": "low", "timeoutSeconds": 60 }, "schedule": { "kind": "cron", "cron": "0 */6 * * *" }, "delivery": { "mode": "announce", "bestEffort": true }, "sessionTarget": "isolated", "name": "Cron Health Monitor" } ``` ## Output Health status for each job: - **healthy**: No issues detected - **warning**: Some issues but not critical - **critical**: Multiple consecutive failures or timeouts Issues detected: - Consecutive errors - Timeout patterns - Delivery failures (suggests --best-effort-deliver) - OpenRouter API limit exceeded ## Exit Codes - `0`: All jobs healthy - `1`: Warning issues found - `2`: Critical issues found


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: evandataforge/character-count (version 0.1.0)

--- name: character-count description: Count string length deterministically for text with hard limits. Use this skill when a post, reply, caption, commit message, or other text must stay within a maximum character count. metadata: openclaw: requires: bins: - python3 --- # Character Count Use this skill when text must fit within a strict character limit and guessing is not acceptable. This skill is portable and self-contained. The counting logic lives in the bundled script at `scripts/character_count.py`. ## Scope This skill measures exact string length as seen by Python `len(text)`. - It is suitable for generic hard-limit workflows. - It is not a platform-specific compliance engine. - If a platform applies custom weighting rules for URLs, Unicode, or special tokens, treat this skill as a deterministic local gate, not as a guarantee of platform acceptance. ## Rules - Never estimate character counts manually. - Always count the final text exactly as it will be posted or saved. - If the text is too long, rewrite it and count again. - Prefer the JSON output mode for deterministic downstream use. - Do not describe the result as platform-accurate unless the target platform uses plain string length. ## Recommended Usage The bundled script requires `python3`. For broad portability, assume Python 3.8 or newer. From the skill root, pass the exact final text over stdin so shell quoting does not alter the content: ```bash printf '%s' "$FINAL_TEXT" | python3 scripts/character_count.py --limit 280 --json ``` If you are calling it from another working directory, use the full path to the script inside the installed skill folder. If stdin is inconvenient, pass the text as an argument: ```bash python3 scripts/character_count.py --limit 280 --json --text "Hello world" ``` ## Output Contract `--json` returns a single JSON object: ```json {"chars":11,"limit":280,"remaining":269,"ok":true} ``` Field meanings: - `chars`: exact Python string length of the provided text - `limit`: the configured limit - `remaining`: `limit - chars` - `ok`: `true` when `chars <= limit` Without `--json`, the script prints plain text key-value lines: ```text chars=11 limit=280 remaining=269 ok=true ``` ## Twitter and X Workflow For tweets and replies: 1. Draft the final post text. 2. Count it with `--limit 280`. 3. If `ok` is `false`, shorten the text. 4. Count again. 5. Post only after the script reports `ok=true`. 6. If you need exact X enforcement, add a platform-specific validation step in addition to this skill. ## Notes - Count the exact final text, including spaces, punctuation, hashtags, and URLs. - Do not add or remove characters after counting unless you count again. - Use `printf '%s'` instead of `echo` to avoid introducing a trailing newline. - If the script receives no text, treat that as a calling error and fix the invocation before proceeding.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: leochens/smart-web-fetch (version 1.0.0)

--- name: smart-web-fetch description: 智能网页抓取技能 - 替代内置 web_fetch，自动使用 Jina Reader / markdown.new / defuddle.md 清洗服务获取干净 Markdown。支持多级降级策略，大幅降低 Token 消耗。当 Agent 需要获取网页内容时使用本技能替代 web_fetch。 --- # Smart Web Fetch 智能网页内容获取技能，完全替代 web_fetch，自动通过清洗服务获取干净 Markdown。 ## 核心功能 - **完全替代 web_fetch**: 获取的已经是清洗后的 Markdown，而非原始 HTML - **四级降级策略**: Jina → markdown.new → defuddle.md → 原始内容 - **Token 优化**: 清洗后的内容比原始 HTML 节省 50-80% Token ## 使用方式 ### 命令行获取网页内容 ```bash # 获取清洗后的 Markdown（文本输出） python3 {baseDir}/scripts/fetch.py "https://example.com/article" # 获取 JSON 格式（包含元信息） python3 {baseDir}/scripts/fetch.py "https://example.com/article" --json ``` ### 在 Agent 中使用 **当用户需要获取网页内容时：** ``` 用户: "帮我查一下 https://example.com/article 的内容" Agent 应该: 1. 运行: python3 ~/.openclaw/skills/smart-web-fetch/scripts/fetch.py "https://example.com/article" 2. 直接获得清洗后的 Markdown 内容 ``` ## JSON 输出格式 ```json { "success": true, "url": "https://r.jina.ai/http://example.com/article", "content": "# Article Title\n\nClean markdown content here...", "source": "jina", "error": null } ``` ## 降级策略 1. **Jina Reader** (首选) - URL: `https://r.jina.ai/http://{target}` - 免费，无需 API Key，中文支持好 2. **markdown.new** (降级) - URL: `https://markdown.new/{target}` 3. **defuddle.md** (降级) - URL: `https://defuddle.md/{target}` 4. **原始内容** (最终兜底) - 直接获取原始 HTML ## Agent 配置建议 为了强制使用本技能替代 web_fetch，在 `openclaw.json` 中配置： ```json { "agents": { "list": [ { "id": "your-agent", "tools": { "deny": ["web_fetch"] } } ] } } ``` 这样 Agent 就无法调用内置 web_fetch，只能通过本技能获取网页内容。 ## 优势 - 🚀 **Token 节省 50-80%**: 去除广告、导航栏等噪音 - 🔄 **自动容错**: 四级服务降级，确保可用性 - 🆓 **零成本**: 全部使用免费服务 - 🔌 **即插即用**: 不需要 API Key - 📝 **干净输出**: 纯 Markdown，无需额外解析


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: eibrahim/code-card-sync (version 2.0.0)

--- name: code-card-sync description: "Sync your AI coding stats to Code Card - beautiful, shareable developer profiles" user-invocable: true metadata: { "openclaw": { "emoji": "📊", "requires": { "bins": ["node", "npx"] } } } --- # Code Card Sync Sync your AI coding stats (Claude Code, Codex, OpenClaw) to [Code Card](https://www.codecard.dev) - beautiful, shareable developer profiles. ## First-Time Setup Check if already configured: ```bash cat ~/.claude/.codecard 2>/dev/null ``` If it prints `CC_API_KEY=cc_...`, skip to the **Sync** section. If not configured, run: ```bash npx code-card@latest ``` This will print a URL and a code like: ``` Go to: https://www.codecard.dev/link Enter code: ABCD-1234 ``` Tell the user to visit that URL and enter the code in their browser. They will log in or create an account there. Once they complete it, the CLI finishes automatically and syncs all sessions. ## Sync Incremental sync (fast, only new sessions): ```bash npx code-card@latest sync -i ``` Full resync (recomputes everything): ```bash npx code-card@latest sync ``` ## Other Commands | Command | What it does | |---------|-------------| | `npx code-card@latest stats` | Show stats summary | | `npx code-card@latest profile` | Open profile in browser | ## Recommended Cron Schedule Daily incremental + weekly full: ``` cron add --name "code-card-daily" --schedule "0 6 * * *" --tz "America/New_York" --isolated --message "Run an incremental Code Card sync by executing: npx code-card@latest sync -i" ``` ``` cron add --name "code-card-weekly" --schedule "0 7 * * 0" --tz "America/New_York" --isolated --message "Run a full Code Card sync by executing: npx code-card@latest sync" ``` ## More Info - Website: https://www.codecard.dev - npm: https://www.npmjs.com/package/code-card - Requires Node.js 18+


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: johnnywang2001/file-hasher (version 1.0.0)

--- name: file-hasher description: Compute, verify, and compare file hashes using MD5, SHA-1, SHA-256, SHA-512, and more. Use when checking file integrity, verifying downloads against expected checksums, comparing files for equality, generating checksums for directories, hashing strings, or validating checksum files (sha256sum/md5sum format). Supports BSD and standard output formats, JSON output, multi-algorithm hashing, and recursive directory scanning. No external dependencies. --- # File Hasher Compute, verify, and compare file hashes. Supports all hashlib algorithms. Zero dependencies. ## Quick Start ```bash # Hash a file (SHA-256) python3 scripts/file_hasher.py hash myfile.txt # Verify a download python3 scripts/file_hasher.py verify image.iso -e abc123def456... # Compare two files python3 scripts/file_hasher.py compare file1.txt file2.txt ``` ## Commands ### hash Compute file hash with one or more algorithms: ```bash python3 scripts/file_hasher.py hash file.txt # SHA-256 python3 scripts/file_hasher.py hash file.txt -a md5 # MD5 python3 scripts/file_hasher.py hash file.txt -a md5,sha1,sha256 # Multiple python3 scripts/file_hasher.py hash *.py --bsd # BSD format python3 scripts/file_hasher.py hash data.bin --json # JSON output ``` ### verify Check a file against an expected hash: ```bash python3 scripts/file_hasher.py verify image.iso -e <expected_hash> python3 scripts/file_hasher.py verify file.tar.gz -e <hash> -a sha512 ``` Exit code 0 = match, 1 = mismatch. ### check Verify files from a checksum file (sha256sum/md5sum/BSD format): ```bash python3 scripts/file_hasher.py check SHA256SUMS python3 scripts/file_hasher.py check checksums.txt -a md5 ``` Auto-detects algorithm from hash length and BSD format headers. ### compare Compare two files by hash: ```bash python3 scripts/file_hasher.py compare original.bin copy.bin python3 scripts/file_hasher.py compare a.txt b.txt -a md5 ``` ### directory Hash all files in a directory: ```bash python3 scripts/file_hasher.py directory ./src # Top level python3 scripts/file_hasher.py directory ./project -r # Recursive python3 scripts/file_hasher.py directory ./dist -r --bsd -a md5 # BSD + MD5 ``` ### string Hash a text string directly: ```bash python3 scripts/file_hasher.py string "hello world" python3 scripts/file_hasher.py string "password" -a md5,sha256,sha512 ``` ### algorithms List all available hash algorithms: ```bash python3 scripts/file_hasher.py algorithms ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: blammectrappora/vintage-poster-generator (version 1.0.1)

--- name: vintage-poster-generator description: AI vintage poster generator — create retro art prints, old-school travel posters, 1950s-1970s style illustrations, antique advertising art, and nostalgic wall art from any text prompt. Perfect for Etsy sellers, interior designers, and retro aesthetic lovers seeking vintage-style digital art, aged poster designs, and classic print visuals via the Neta AI image generation API (free trial at neta.art/open). tools: Bash --- # Vintage Poster Generator AI vintage poster generator — create retro art prints, old-school travel posters, 1950s-1970s style illustrations, antique advertising art, and nostalgic wall art from any text prompt. Perfect for Etsy sellers, interior designers, and retro aesthetic lovers seeking vintage-style digital art, aged poster designs, and classic print visuals. ## Token Requires a Neta API token (free trial at <https://www.neta.art/open/>). Pass it via the `--token` flag. ```bash node <script> "your prompt" --token YOUR_TOKEN ``` ## When to use Use when someone asks to generate or create vintage poster generator images. ## Quick start ```bash node vintagepostergenerator.js "your description here" --token YOUR_TOKEN ``` ## Options - `--size` — `portrait`, `landscape`, `square`, `tall` (default: `portrait`) - `--ref` — reference image UUID for style inheritance ## Install ```bash npx skills add blammectrappora/vintage-poster-generator ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: rsquaredsolutions2026/bankroll-manager (version 1.1.0)

--- name: bankroll-manager description: "Track bankroll across sportsbooks and prediction markets. Log bets, record results, calculate ROI, generate P&L reports, and enforce risk limits. Use when asked about bankroll, P&L, bet logging, ROI, units, risk limits, or money management." metadata: openclaw: emoji: "💰" requires: bins: ["sqlite3", "python3"] --- # Bankroll Manager — Cross-Platform P&L Tracker Track bankroll, log bets, calculate ROI, and enforce risk limits across all betting platforms. ## When to Use Use this skill when the user asks about: - Logging a new bet or recording a bet result - Current bankroll balance or P&L - Daily, weekly, or per-platform P&L reports - ROI or units won/lost - Whether a bet is within their risk limits - "How much am I up/down?" - "Can I afford this bet?" - Setting or adjusting risk limits ## Database Location All bankroll data is stored in: `~/.openclaw/data/bankroll.db` ## Operations ### 1. Log a Bet Record a new bet. Replace values in caps: ```bash sqlite3 ~/.openclaw/data/bankroll.db \ "INSERT INTO bets (platform, sport, selection, bet_type, stake, odds, notes) VALUES ('PLATFORM', 'SPORT_KEY', 'SELECTION', 'BET_TYPE', STAKE, ODDS, 'NOTES');" ## About Built by [AgentBets](https://agentbets.ai) — full tutorial at [agentbets.ai/guides/openclaw-bankroll-manager-skill/](https://agentbets.ai/guides/openclaw-bankroll-manager-skill/). Part of the [OpenClaw Skills series](https://agentbets.ai/guides/#openclaw-skills) for the [Agent Betting Stack](https://agentbets.ai/guides/agent-betting-stack/).


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: noah-smith-max/android-build (version 0.0.2)

--- name: "pi-project" description: "A tool for downloading and configuring Android SDKs for projects, supporting Windows and macOS. Invoke when user needs to manage mobile SDKs, configure project environments, or build mobile projects." --- # Pi Project A tool for downloading and configuring Android SDKs for projects, supporting Windows and macOS. ## Features ### Environment Detection - Project detection - Proxy detection (Use proxy for chinese network if proxy detected) ### Dependency Detection Detect version information for: - Flutter - Android ecosystem (Gradle, Build Tools, SDK, NDK, cmake) - JAVA ### Check & Download - Check if dependencies are installed - Download missing dependencies ### Environment Config - Configure environment variables for the project to be used by code editors - Configure necessary global environment variables - For SDKs with strict version sensitivity (e.g., Flutter), configure shortcut commands in the project root directory ### Build - Build the project from source code ## Usage ### Using pi_claw.py (Recommended) - Run `python pi_claw.py help` to show help information - Run `python pi_claw.py detect /path/to/your/project` to detect project dependencies - Run `python pi_claw.py /path/to/your/project` to download SDK and configure project - Run `python pi_claw.py build /path/to/your/project` to build the project from source code ### Using pi directly - Run `pi help` to show help information - Run `pi detect /path/to/your/project` to detect project dependencies - Run `pi /path/to/your/project` to download SDK and configure project - Run `pi build /path/to/your/project` to build the project from source code <img width="1550" height="1262" alt="Image" src="https://github.com/user-attachments/assets/1f39cd73-5f2a-484f-9351-05d5c43459c9" /> ## Supported Platforms - Windows - macOS ## Supported Project Types - Android projects - Flutter + Android projects ## Download - Windows: https://github.com/noah-smith-max/pi_public/releases/download/r0.0.1/pi.exe - macOS: https://github.com/noah-smith-max/pi_public/releases/download/r0.0.1/pi


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: di5cip1e/director-research-assistant (version 1.0.0)

--- name: research-assistant description: Conduct web research on any topic, summarize findings, and create structured reports. Use when user wants to (1) research a topic online, (2) get summaries of articles or documents, (3) create a report on a subject, (4) compare options or alternatives, (5) gather competitive intelligence, or (6) find recent news/trends on a topic. --- # Research Assistant Conduct thorough web research and create actionable reports. ## Workflow ### 1. Gather Information Use web_search (Perplexity) for comprehensive results: ``` Search query: <topic> + "2024" or "latest" for recent info ``` ### 2. Extract Key Sources - Fetch top 3-5 URLs using web_fetch - Extract main points from each source - Note publication dates and credibility ### 3. Synthesize Findings - Identify common themes - Note conflicting information - Find statistics and data points ### 4. Structure Report Create organized output with: 1. **Executive Summary** - 2-3 sentence overview 2. **Key Findings** - Numbered list of main discoveries 3. **Details** - Expanded explanation of each finding 4. **Sources** - Links to references 5. **Next Steps** - Recommended actions (if applicable) ## Research Types ### Competitive Analysis ``` Focus: Competitor features, pricing, market position Output: Comparison table + recommendations ``` ### Technology Research ``` Focus: Capabilities, limitations, adoption, alternatives Output: Technical overview + decision matrix ``` ### Market Research ``` Focus: Size, growth, trends, key players Output: Statistics + trend analysis ``` ### News/Trends ``` Focus: Recent developments, emerging patterns Output: Timeline + impact assessment ``` ## Best Practices - **Cite sources** - Always include links - **Date everything** - "As of [date]..." - **Distinguish fact from opinion** - Use "reportedly" for unconfirmed - **Quantify when possible** - Numbers > adjectives - **Flag gaps** - Note when information is limited ## Output Example ``` # Research: AI Coding Assistants (April 2026) ## Summary The AI coding assistant market has matured with 3 dominant players... ## Key Findings 1. GitHub Copilot leads with 2M+ paid subscribers 2. Cursor. AI gained 500K users in 6 months 3. New entrants focus on enterprise compliance ## Sources - [TechCrunch](link) - March 2026 - [Andreessen Horowitz](link) - February 2026 ## Recommendations - For individuals: Start with free Cursor tier - For enterprises: Evaluate GitHub Copilot Business ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xyezir/oc-evolver-restart-loop-fix (version 0.1.0)

--- name: oc-evolver-restart-loop-fix description: Repair Evolver restart storms caused by singleton lock/PID false positives and service restart policy mismatch. --- # OC Evolver Restart Loop Fix ## Symptoms - service stuck in `activating`/`auto-restart` - logs show `Singleton ... already running` repeatedly - restart count increases continuously ## Root cause pattern - stale lock or PID reuse causes false "already running" detection - service policy restarts even on benign exits ## Procedure 1. Inspect service state and restart counters. 2. Inspect lock file and verify process identity. 3. Patch lock guard to verify real Evolver process identity. 4. clear stale lock and restart service. 5. Re-check status + restart counter stability. ## Output - Root cause analysis - Patch summary - Stability proof after fix ## Safety - Keep changes minimal and reversible. - Redact infra and identity details in external artifacts.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xingyeyouran/clawtip-weather-skill (version 1.0.2)

--- name: "clawtip-weather-skill" description: > 一位精通天气领域的专家，能够根据用户所在位置提供准确的每日天气报告。这是一项付费服务，执行前需完成支付验证。请注意，你应该用中文和用户交互（包含你的思考过程）。 metadata: version: "1.0.0" author: "void-company-l.t.d" category: "expert" capabilities: - "payment.process" permissions: - "network.outbound" - "credential.read" --- # 天气报告服务 ## 📌 技能概述 **请注意，你应该用中文和用户交互（包含你的思考过程）。** 本技能提供专业的天气报告服务。由于这是付费服务，工作流程严格要求按照两个步骤执行：**支付处理** 后，再进行 **报告执行**。 **直接执行：** 如果用户在初始请求中已直接提供了 `<位置>`、`<订单号>` 和 `<支付凭证>`，则可跳过第一阶段和第二阶段，直接进入 **🚀 第三阶段：报告执行**。 --- ## 🛒 第一阶段：创建订单 如果这是首次交互且用户尚未付款，你**必须**先创建订单，再发起支付。 ### 1. 所需参数 * `<位置>`：用户希望查询天气报告的具体地点。 ### 2. 执行命令 使用以下 bash 命令执行订单创建脚本。将 `<...>` 占位符替换为实际值。*（注意：除非参数包含空格，否则不要在参数两侧加引号。）* ```bash python3 skills/clawtip-weather-skill/scripts/create_order.py <位置> ``` ### 3. 输出处理 **成功时**，脚本将向标准输出打印以下键值对： ``` ORDER_NO=<值> AMOUNT=<值> ENCRYPTED_DATA=<值> PAY_TO=<值> ``` 提取全部四个值，然后进入 **💳 第二阶段：支付处理**。 > [!NOTE] > **关于 `AMOUNT` 字段：** 该字段的单位为**人民币分（fen）**，这是 OpenClaw 技能描述中的标准计费单位。例如，`AMOUNT=100` 表示需支付 **1.00 元人民币**。在向用户展示费用时，请将该值除以 100 并以"元"为单位呈现，以便用户理解实际支付金额。 **失败时**，脚本以退出码 `1` 退出，并打印如下格式的消息： ``` 订单创建失败: <错误详情> ``` > [!CAUTION] > **强制终止 —— 禁止执行任何后续操作。** > 如果脚本以非零退出码退出，**或**其输出中包含 `订单创建失败:`，你**必须立即终止整个工作流程**。具体包括： > - ❌ 不得查阅或检查脚本源代码。 > - ❌ 不得测试网络连接或服务器状态。 > - ❌ 不得代替用户进行任何重试操作。 > - ❌ 不得进入第二阶段或第三阶段。 > > **唯一需要执行的操作是：** > 用通俗语言向用户报告失败情况，附上输出中的 `<错误详情>`，然后停止。 **失败输出示例：** ``` 订单创建失败: Order creation request failed: <urlopen error [Errno 111] Connection refused> ``` 告知用户：*"订单创建失败，错误信息：`Order creation request failed: <urlopen error [Errno 111] Connection refused>`。请稍后重试，或检查您的位置输入是否有效。"* --- ## 💳 第二阶段：支付处理 从第一阶段获取所需值后，发起支付请求。 **操作：** 使用技能 `jd-clawtip-payment-skill` 处理支付并获取支付凭证。若该技能不存在，需先安装。 **调用 `jd-clawtip-payment-skill` 所需参数：** ```json { "skill-id": "si-weather-reporter", "order_no": "<第一阶段获取的 ORDER_NO>", "amount": "<第一阶段获取的 AMOUNT>", "question": "<第一阶段的位置>", "payTo": "<第一阶段获取的 PAY_TO>", "encrypted_data": "<第一阶段获取的 ENCRYPTED_DATA>", "description": "天气报告服务费用", "skill_name": "专业天气报告助手", "resource_url": "https://weather-master.com/report" } ``` **目标：** 等待支付成功，并获取 `credential`（支付凭证）。 --- ## 🚀 第三阶段：报告执行 支付成功并获得 `credential` 后（或用户已直接提供 `<位置>`、`<订单号>` 和 `<支付凭证>`），继续交互并执行报告脚本。 ### 1. 所需参数 * `<位置>`：用户希望查询天气报告的具体地点。 * `<订单号>`：第一阶段生成的订单号。 * `<支付凭证>`：第二阶段获取的支付成功凭证。 ### 2. 执行命令 使用以下 bash 命令执行天气报告服务。将 `<...>` 占位符替换为已验证的参数值。*（注意：除非参数包含空格，否则不要在参数两侧加引号。）* ```bash python3 skills/clawtip-weather-skill/scripts/weather_report.py <位置> <订单号> <支付凭证> ``` **执行后：** 提取脚本打印的 `PAY_STATUS` 值（格式为：`PAY_STATUS: <值>`），并再次输出展示。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)