OpenClaw/clawhub-security-signals huggingface dataset:
Skill: xyanmi/webdav-sync (version 1.0.4)

--- name: webdav-sync description: Archive local files or directories into tar/tar.gz and upload them to a WebDAV endpoint, with optional notifications. Use when the user asks to back up a folder, sync files to WebDAV on a schedule, or update archive exclusions and remote paths. Trigger when user asks->'Sync this folder to WebDAV every night', 'Back up this directory to WebDAV and notify me'. Capabilities->(1) Create deterministic archives with exclude rules, (2) create remote WebDAV directories and upload via PUT, (3) integrate with wrappers and scheduled jobs, (4) evolve sync rules safely over time. learnable: true metadata: {"openclaw":{"emoji":"☁️","requires":{"bins":["curl","openclaw"],"env":["WEBDAV_SITE","WEBDAV_USERID","WEBDAV_PWD"]},"primaryEnv":"WEBDAV_SITE"}} --- # WebDAV Sync ## Overview Run `scripts/webdav_sync.py` to package local content as `.tar` or `.tar.gz` and upload it to a WebDAV target defined in an env file. Prefer this skill for repeatable backups and scheduled sync tasks. ## Core Logic 1. Read WebDAV credentials from an env file using `WEBDAV_SITE`, `WEBDAV_USERID`, and `WEBDAV_PWD`. 2. Create archives with explicit exclude patterns instead of implicit ignores. 3. Prefer explicit paths in cron jobs and wrappers. 4. Keep notification delivery outside the archive payload. Use the host messaging path after upload success or failure. 5. When changing sync scope, update both the wrapper script and any scheduled job that invokes it. 6. Record every confirmed improvement or compatibility fix in `maintenance.log`. ## Execution Patterns ### Direct run ```bash python3 {baseDir}/scripts/webdav_sync.py \ --source /path/to/folder \ --archive-prefix backup \ --remote-subdir backups \ --notify-channel <channel> \ --notify-target <target> \ --exclude 'folder/.trash' \ --exclude 'folder/.trash/*' \ --exclude 'folder/tmp' \ --exclude 'folder/tmp/*' ``` ### Wrapper usage Keep stable wrappers in a project-level scripts directory for cron or one-command execution. Use a thin wrapper that pins the interpreter and passes host-specific paths as arguments. ## Guardrails - Keep the script stdlib-only except for external binaries already present on the host (`curl`, optional messaging CLI). - Do not print credentials. - Do not pass WebDAV credentials through command-line arguments; use a temporary credential file with `0600` permissions and delete it after the request finishes. - Accept WebDAV `MKCOL` responses `201`, `301`, and `405` as non-fatal directory-ready states. - Accept upload responses `200`, `201`, and `204` as success. - If the user asks for pure `.tar`, set `--compression none`; otherwise prefer `gz`. - For future sync targets, add explicit exclude patterns instead of broad hidden-file stripping. ## Resources - Read `references/operations.md` for env keys, wrapper layout, and scheduling notes. - Run `scripts/webdav_sync.py --help` for the CLI surface.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mirni/gh-envcheck (version 1.0.0)

--- name: gh-envcheck description: "Check if your environment is ready to run a skill — verify that required environment variables are set and required CLI binaries are on PATH. Returns a ready/not-ready verdict with lists of present and missing items." metadata: {"openclaw":{"emoji":"🔧","requires":{"bins":["python"]},"install":[{"id":"pip","kind":"uv","packages":["fastapi","uvicorn","pydantic"]}]}} --- # EnvCheck Pre-flight check: does this environment have what the skill needs? ## Start the server ```bash uvicorn envcheck.app:app --port 8007 ``` ## Check environment ```bash curl -s -X POST http://localhost:8007/v1/check-env \ -H "Content-Type: application/json" \ -d '{"required_env": ["HOME", "PATH"], "required_bins": ["python", "git"]}' | jq ``` Returns `ready` (true/false), `present_env`, `missing_env`, `present_bins`, `missing_bins`. ## Pair with ScopeCheck Use ScopeCheck to find out what a skill needs, then EnvCheck to verify your environment has it: ```bash # Step 1: What does the skill need? SCOPE=$(curl -s -X POST http://localhost:8002/v1/check-scope \ -H "Content-Type: application/json" \ -d "{\"skill_content\": $(cat SKILL.md | jq -Rs)}") # Step 2: Do we have it? curl -s -X POST http://localhost:8007/v1/check-env \ -H "Content-Type: application/json" \ -d "{\"required_env\": $(echo $SCOPE | jq '.detected.env_vars'), \"required_bins\": $(echo $SCOPE | jq '.detected.cli_tools')}" | jq '.ready' ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: gooodplus/lark-meeting (version 1.0.1)

--- name: lark-meeting description: 帮助用户预约会议室, 当用户需要预约会议室时执行此技能 --- # 预约会议室 通过本仓库脚本调用飞书会议室与日历能力完成**初始化**（层级 + 会议室列表）与**按忙闲自动预约**。依赖本机已配置且已登录的 `lark-cli` 及相应 API 权限。 ## 仓库内配置文件（`conf/`） | 文件 | 作用 | |------|------| | `meeting.json` | 城市/大厦/楼层与 `rooms` 顺序；预约脚本默认读取 | | `meeting_room_blacklist.json` | **会议室黑名单**（初始化写列表、预约时再次过滤），可直接编辑；技能更新黑名单即改此文件 | ### `meeting_room_blacklist.json` 字段 与 `meeting.json` **同目录**（默认均为 `conf/`）。若文件不存在，脚本使用内置默认（等价于仓库内示例）。 | 字段 | 类型 | 说明 | |------|------|------| | `name_substrings` | 字符串数组 | 会议室**名称**包含其中**任一字串**则排除；设为 `[]` 可关闭名称规则 | | `exclude_if_capacity_gt` | 整数或 `null` | 飞书返回的 `capacity` **大于**该值则排除；设为 `null` 可关闭人数规则（**预约阶段**配置里的 `rooms` 通常无 `capacity`，此项主要在**重新初始化**拉取会议室时生效） | | `room_ids` | 字符串数组 | 显式按 `room_id` 排除 | **维护方式：**用户说「不要某会议室 / 排除面试间 / 拉黑某 room_id」时，由 **AI 编辑** `conf/meeting_room_blacklist.json`（保持合法 JSON）。 - 改 **名称 / room_id** 规则后，**无需重跑初始化**即可影响下次预约（预约脚本会读黑名单）。 - 改 **容量**规则或希望 **从飞书重新拉全量列表** 时，在用户确认后**再执行一次** `meeting_init_processor.py`（同城市/大厦/楼层），以刷新 `meeting.json` 中的 `rooms`。 **权限提示：**若无法写入 `conf/`，可提示用户在终端授权，例如：`sudo chown -R $(whoami):staff <技能仓库>/conf/`（路径按实际技能目录替换）。 ## 入口命令（在仓库根目录执行） | 能力 | 命令 | 说明 | |------|------|------| | 初始化 | `python scripts/meeting_init_processor.py` | **交互**：按提示选城市 → 职场（大厦）→ 楼层。**非交互**：同时传 `--city`、`--workplace` 或 `--building`、`--floor`；写入 `meeting.json`，并按黑名单过滤 `rooms` | | 预约 | `python scripts/meeting_processor.py --start-time <ISO> --end-time <ISO> --summary "<主题>"` | 按 `rooms` 顺序查忙闲；应用同目录黑名单后取首个空闲并创建日程 | **初始化脚本参数：**`--top-n`、`--page-size`；非交互三项见上。**预约脚本参数：**`--description`、`--config`（默认 `conf/meeting.json`）、`--calendar-id`（默认 `primary`）。 **首次使用：**若未配置 `lark-cli`，先按 `lark-shared` 完成 `lark-cli config init` 与 `lark-cli auth login`。 ## AI 工作方式 ### 初始化 - **优先非交互**：用户已给出城市、大厦、楼层且名称不易歧义时，确认后执行： `python scripts/meeting_init_processor.py --city "…" --building "…" --floor "…"` 匹配失败时脚本会打印参考列表（Top 10 等），再据报错收窄名称。 - **缺信息或易歧义**：请用户补全或自行交互运行初始化脚本。 - 成功后**可简述** `meeting.json` 关键信息（城市/楼层/会议室数量），并提醒可开始预约。 ### 预约 - **时间：**默认东八区 `+08:00` 解析自然语言为 ISO（**精确到秒**），缺时长/结束须追问。 - **执行前**向用户一句话确认起止时间与主题。 - **约束：**单次时长 ≤ 4 小时；`meeting.json` 不存在时引导先初始化。 ### 黑名单 - 按用户口述增删规则时，**直接改** `conf/meeting_room_blacklist.json`（与当前使用的 `meeting.json` 同目录；若用户自定义 `--config`，则黑名单为**该文件同目录**下的 `meeting_room_blacklist.json`）。 - 改完后预约立即生效；若用户依赖「容量」过滤或要重拉会议室列表，说明需**再跑一次初始化**。 ## 示例话术 - 「用北京某某大厦 17 楼初始化」→ 确认无歧义后执行带 `--city` / `--building` / `--floor` 的非交互命令。 - 「明天下午 3 点会议室开周会」→ 解析 ISO + `--summary`，缺时长先问。 - 「别给我订面试间」→ 确认 `name_substrings` 含 `面试间`（默认已有）；若无则写入并说明已生效。 ## 脚本说明 - `scripts/meeting_room_blacklist.py`：加载/解析黑名单规则（初始化与预约共用）。 - `scripts/meeting_init_processor.py`：写 `meeting.json`；黑名单路径固定为仓库内 `conf/meeting_room_blacklist.json`。 - `scripts/meeting_processor.py`：读 `meeting.json`；黑名单为 `config` 文件同目录的 `meeting_room_blacklist.json`。 - `scripts/lark_cli.py`：API 封装。 ## 限制 - 依赖 `lark-cli` 可用及会议室/日历权限。 - 层级名称可能重名，非交互匹配失败时需用户改用更精确名称或交互初始化。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: bytesagain3/bollinger (version 1.0.0)

--- name: "bollinger" version: "1.0.0" description: "Bollinger reference tool. Use when working with bollinger in finance contexts." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [bollinger, finance, finance, reference, cli] category: "finance" --- # Bollinger Bollinger reference tool. Use when working with bollinger in finance contexts. ## When to Use - Working with bollinger and need quick reference - Looking up finance standards or best practices for bollinger - Troubleshooting bollinger issues - Need a checklist or guide for bollinger tasks ## Commands ### `intro` ```bash scripts/script.sh intro ``` Overview and fundamentals ### `formulas` ```bash scripts/script.sh formulas ``` Key formulas and calculations ### `regulations` ```bash scripts/script.sh regulations ``` Regulatory framework and compliance ### `risks` ```bash scripts/script.sh risks ``` Risk factors and mitigation ### `instruments` ```bash scripts/script.sh instruments ``` Instruments and tools overview ### `strategies` ```bash scripts/script.sh strategies ``` Common strategies and approaches ### `glossary` ```bash scripts/script.sh glossary ``` Key terms and definitions ### `checklist` ```bash scripts/script.sh checklist ``` Due diligence checklist ### `help` ```bash scripts/script.sh help ``` ### `version` ```bash scripts/script.sh version ``` --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: semmyt/overlap-check (version 1.0.0)

--- name: overlap-check description: "Check for existing issues and PRs before creating new ones. Fires automatically when agent intends to file an issue, open a PR, or comment on a thread. Searches the target repo for duplicates and shows matches so the agent can decide whether to proceed or contribute to an existing thread instead." metadata: { "openclaw": { "emoji": "🔍", "requires": { "bins": ["gh"] }, }, } --- # Overlap Check Before creating a new issue or PR, search the target repo for existing threads that cover the same topic. ## When This Fires - You are about to run `gh issue create` - You are about to run `gh pr create` - The user asks you to "file an issue", "open a PR", "report this bug", or "submit a fix" - You are drafting a comment on an issue or PR you haven't read yet ## What to Do ### 1. Identify the target repo and your topic Figure out which repo you're targeting. If you're inside a cloned repo, run: ```bash gh repo view --json nameWithOwner -q .nameWithOwner ``` Summarize what your issue or PR is about in a few keywords. ### 2. Search for existing threads Run both searches. Drop filler words (the, a, is, for, with, this, that, when, not, but, and, from) from your keywords. ```bash gh search issues --repo OWNER/REPO "KEYWORDS" --limit 5 --json number,title,state,comments gh search prs --repo OWNER/REPO "KEYWORDS" --limit 5 --json number,title,state,comments ``` ### 3. Evaluate matches Read the titles and comment counts. If any look related: - Open the thread: `gh issue view NUMBER --repo OWNER/REPO` or `gh pr view NUMBER` - Read enough to understand whether your topic is already covered - Check if the thread is active, stale, or closed ### 4. Decide | Situation | Action | |-----------|--------| | Existing open thread covers your exact topic | Comment there instead of creating a new one | | Existing closed thread solved it | Don't reopen — link to it if relevant | | Existing thread is related but different | Proceed with new issue/PR, reference the related thread | | No matches | Proceed normally | ### 5. If you find duplicates, tell the user Show what you found before proceeding: ``` Found existing threads that may cover this: #13738 — WSL2 clipboard paste broken (16 comments, open) #14635 — Paste not working in WSL (3 comments, open) Should I comment on an existing thread or create a new one? ``` ## What NOT to Do - Don't skip this check because you're confident your topic is new - Don't create a new issue just because existing ones use slightly different wording - Don't run expensive analysis — two `gh search` calls is enough - Don't block the user — if they insist on creating a new thread after seeing duplicates, do it


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: tf9527666666-spec/stock-query-skill (version 1.0.0)

# SKILL.md - 股票查詢技能 ## 功能 查詢指定股票代碼的30天每日股價資料。 ## 使用方法 ``` 查詢股票代碼 [股票代碼] ``` ## 範例 ``` 查詢股票代碼 TSM 查詢股票代碼 0001.HK ``` ## 輸出格式 返回包含以下欄位的資料： - Date（日期） - Open（開盤價） - High（最高價） - Low（最低價） - Close（收盤價） - Volume（成交量） ## 依賴套件 - yfinance - pandas


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: haooyi/openclaw-sec-audit (version 0.1.3)

# OpenClaw Security Audit Source repository: https://github.com/haooyi/openclaw-sec Maintainer: haooyi ## Purpose Run a local security audit against the current OpenClaw installation and runtime environment, then return high-signal risks, impacted locations, and prioritized remediation steps. ## When To Trigger - The user asks whether the current OpenClaw environment is secure - The user suspects API key leaks, log leaks, overly broad permissions, or public exposure - The user wants a locally executable security report ## How To Execute Use local shell execution to run `resources/run_audit.sh`. The wrapper invokes the bundled standalone Python source shipped with the skill and does not depend on the repository checkout or the main project install. ## Output Requirements - Never print raw secrets - Keep config-derived evidence redacted or summarized instead of echoing raw values - Summarize risks, impacted files, priority, and remediation only - Order remediation steps as `critical -> high -> medium -> low` - If a host check is unsupported or permission-limited, say `skipped` or `unsupported` explicitly ## Suggested Invocation ```bash ./skills/openclaw-sec-audit/resources/run_audit.sh --format all ``` ## Runtime Assumption The host must provide `python3`. No editable install of the main project is required for the skill path.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: xadenryan/voice-wake-say (version 1.0.1)

--- name: voice-wake-say description: Speak responses aloud on macOS using the built-in `say` command when user input indicates Voice Wake/voice recognition (for example, messages starting with "User talked via voice recognition on <device>"). --- # Voice Wake Say ## Overview Use macOS `say` to read the assistant's response out loud whenever the conversation came from Voice Wake/voice recognition. Do **not** use the `tts` tool (it calls cloud providers). ## When to Use `say` (CHECK EVERY MESSAGE INDIVIDUALLY) **IF** the user message STARTS WITH: `User talked via voice recognition` - **Step 1:** Acknowledge with `say` first (so the user knows you heard them) - **Step 2:** Then perform the task - **Step 3:** Optionally speak again when done if it makes sense **IF** the user message does NOT start with that exact phrase - THEN: Do NOT use `say`. Text-only response only. **Critical:** - Check EACH message individually — context does NOT carry over - The trigger phrase must be at the VERY START of the message - For tasks that take time, acknowledge FIRST so the user knows you're working ## Workflow 1) Detect Voice Wake context - Trigger ONLY when the latest user/system message STARTS WITH `User talked via voice recognition` - If the message instructs "repeat prompt first", keep that behavior in the response. 2) Prepare spoken text - Use the final response text as the basis. - Strip markdown/code blocks; if the response is long or code-heavy, speak a short summary and mention that details are on screen. 3) Speak with `say` (local macOS TTS) ```bash printf '%s' "$SPOKEN_TEXT" | say ``` Optional controls (use only if set): ```bash printf '%s' "$SPOKEN_TEXT" | say -v "$SAY_VOICE" printf '%s' "$SPOKEN_TEXT" | say -r "$SAY_RATE" ``` ## Failure handling - If `say` is unavailable or errors, still send the text response and note that TTS failed.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: xuwenxindeai/lanhu-design (version 1.0.1)

--- name: lanhu-design description: Read Lanhu UI designs, extract slices, and download Web/iOS/Android assets using lh-design. Use when the user mentions 蓝湖, Lanhu, UI稿, 设计稿, 切图, iOS @2x/@3x, Android drawable, or Web 1x/2x/3x assets. --- # Lanhu Design ## Prerequisites Use the `lh-design` CLI from [REDACTED_SECRET]. If `lh-design` is missing, do not run remote installer commands from this skill. Ask the user to install `lh-design` from the project README, then verify with `lh-design --help`. The default installer paths are: ```text Source: ~/.lanhu-design-reader/src Virtualenv: ~/.lanhu-design-reader/venv Config: ~/.lanhu-design-reader/.env Command: ~/.local/bin/lh-design ``` The user must provide `LANHU_COOKIE` via shell env, a local `.env`, or `~/.lanhu-design-reader/.env`. If DDS schema reads need a separate login state, use `DDS_COOKIE`. ## Workflow 1. Parse the user's Lanhu URL and identify `image_id`. If the URL already includes `image_id` or `docId`, `--image-id` may be omitted. 2. Inspect slices first: ```bash lh-design slices '<Lanhu URL>' --image-id <image_id> -o slices.json ``` 3. Download assets for the target platform. Web: ```bash lh-design download-slices '<Lanhu URL>' --image-id <image_id> --scale 1x -o web_1x lh-design download-slices '<Lanhu URL>' --image-id <image_id> --scale 2x -o web_2x lh-design download-slices '<Lanhu URL>' --image-id <image_id> --scale 3x -o web_3x ``` iOS: ```bash lh-design download-slices '<Lanhu URL>' --image-id <image_id> --scale ios_2x -o ios_2x lh-design download-slices '<Lanhu URL>' --image-id <image_id> --scale ios_3x -o ios_3x ``` Android: ```bash lh-design download-slices '<Lanhu URL>' --image-id <image_id> --scale android_mdpi -o drawable-mdpi lh-design download-slices '<Lanhu URL>' --image-id <image_id> --scale android_hdpi -o drawable-hdpi lh-design download-slices '<Lanhu URL>' --image-id <image_id> --scale android_xhdpi -o drawable-xhdpi lh-design download-slices '<Lanhu URL>' --image-id <image_id> --scale android_xxhdpi -o drawable-xxhdpi lh-design download-slices '<Lanhu URL>' --image-id <image_id> --scale android_xxxhdpi -o drawable-xxxhdpi ``` ## Important - Web uses `1x/2x/3x`, not `ios_*`. - iOS uses `ios_2x/ios_3x`. - Android uses [REDACTED_SECRET]. - For Photoshop uploads, `base_size` equals iOS `@2x` / Android `xhdpi`. - Prefer `slices.json` as the source of truth before renaming or moving assets.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: qiqikuaidianpao/crc-bank-statement-converter (version 1.5.4)

--- name: crc-bank-statement-converter description: "将不同银行导出的流水 Excel / CSV 批量转换为监管报送标准格式（9 列）。Use when: 用户需要转换银行流水格式、汇总多银行多账户流水、整理监管报送数据。NOT for: 非银行流水文件处理、加密/损坏文件修复。需要 Python3 + openpyxl + xlrd。" metadata: { "openclaw": { "emoji": "🏦", "requires": { "bins": ["python3", "pip"] } } } --- # 银行流水格式批量转换 将不同银行导出的流水 Excel / CSV 文件批量转换为监管流水导入模板格式（9 列标准格式）。 ## When to Use ✅ **USE this skill when:** - "帮我把这些银行流水转成标准格式" - "把这个月所有子公司的流水汇总到一份 Excel" - "把各银行导出的流水统一整理成报送格式" - "批量转换流水文件，要汇总表和分项表" - 监管报送需要统一格式的银行流水 - 多个公司/多个银行的流水文件需要汇总 - 每月重复性的流水格式整理工作 ## When NOT to Use ❌ **DON'T use this skill when:** - 非 Excel / CSV 格式的文件（PDF、Word 等）→ 用对应的文件转换工具 - 需要修改流水内容或金额 → 这是格式转换工具，不改变数据 - 需要分析流水数据（趋势、统计）→ 转换后用数据分析技能 - 加密的银行文件 → 需先解密再转换 - 非银行流水类 Excel（如发票、合同）→ 不适用 ## 支持的银行格式 自动识别以下格式，无需手动选择： - **标准 .xlsx**（openpyxl 解析） - **旧版 .xls 二进制**（xlrd 解析） - **HTML 表格 .xls**（银行网页导出的 .xls 实际是 HTML） - **XML Spreadsheet .xls**（工行电子回单等） - **伪 .xls 实为 .xlsx**（扩展名不匹配的 ZIP 格式） - **标准 .csv**（自动识别 UTF-8 BOM、GB18030/GBK、UTF-16 等常见编码；支持中国银行等“中文[英文]”表头导出） ## Commands ### 首次使用 — 环境初始化 ```bash pip install openpyxl xlrd ``` 验证环境： ```bash python3 -c "import openpyxl, xlrd; print('OK')" ``` ### 转换流水文件 ```bash # 基本用法（自动输出 zip 到输入文件夹同级的"输出"目录） python3 /home/node/agents/skills/crc-bank-statement-converter/converter.py "<输入文件夹路径>" # 指定输出 zip 路径 python3 /home/node/agents/skills/crc-bank-statement-converter/converter.py "<输入文件夹路径>" "<输出 zip 路径>" ``` **参数说明：** - **输入文件夹路径**（必填）：包含 `.xls` / `.xlsx` / `.csv` 流水文件的文件夹，支持子文件夹递归扫描 - **输出 zip 路径**（可选）：不提供时自动生成到输入文件夹同级的 `输出` 目录下，文件名 `监管流水_<时间戳>.zip` ## Quick Responses **"帮我把这批银行流水转成标准格式"** 1. 确认用户提供了文件夹路径 2. 检查 Python 环境和脚本是否就绪 3. 执行转换（推荐输出到 workspace 方便用户下载）： ```bash python3 /home/node/agents/skills/crc-bank-statement-converter/converter.py "/home/node/workspace/流水数据" "/home/node/workspace/监管流水.zip" ``` 4. 报告转换结果（成功/失败数量）+ 提示用户去 workspace 下载 zip **"把本月所有子公司的银行流水统一转换"** ```bash python3 /home/node/agents/skills/crc-bank-statement-converter/converter.py "/home/node/workspace/本月流水" "/home/node/workspace/本月监管流水.zip" ``` **"检查转换后的文件是否与原始流水金额一致"** 转换完成后解压 zip，读取「汇总.xlsx」或某家公司单独的 Excel，抽查几行与原始文件对比金额列。 ## 输出格式 输出一个 **zip 压缩包**，结构如下： ``` 监管流水_<时间戳>.zip ├── 汇总.xlsx # 所有公司流水合并到一张表，含 _来源公司 列 ├── <原文件名 1>.xlsx # 每个源文件对应一份独立 Excel（9 列） ├── <原文件名 2>.xlsx └── ... ``` 模板 9 列：`日期 | 收入 | 支出 | 余额 | 摘要 | 对方户名 | 对方银行 | 对方账号 | 备注` - `日期` 固定输出为 `YYYY-MM-DD` 文本格式，例如 `2026-04-14`，不会保留时分秒。 - `对方户名`、`对方银行`、`对方账号` 会兼容常见的“对方/交易对方/交易对手/付款人/收款人/付方/收方/借方/贷方”等银行导出表头叫法。 zip 输出到 workspace 后，普通用户可直接从文件管理面板下载。 ## Notes - 自动跳过以 `~` 开头的临时文件和含 `说明` 的文件 - 自动过滤汇总行（含"合计"、"小计"、"累计"、"笔数"的行） - CSV 支持逗号、Tab、分号分隔；如果银行导出文件前几行是查询摘要，会自动定位真正表头行 - 电子回单格式（无余额列）的余额字段为空 - 如果转换失败，检查文件是否为加密或非标准格式 - 脚本位置：`/home/node/agents/skills/crc-bank-statement-converter/`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)