OpenClaw/clawhub-security-signals huggingface dataset:
Skill: trae1oung/hetu-lyrics-blessing (version 1.0.2)

--- name: hetu-lyrics-blessing description: | A daily lyrics blessing skill that sends a random Hetu (河图) song lyric to a designated recipient every day at 23:00. Lyrics are fetched from Baidu Baike using agent-browser. IMPORTANT: Uses browser automation to fetch exact lyrics from baike.baidu.com Use when: (1) Daily medicine reminder (2) Sending warm messages with verified lyrics --- # Hetu Lyrics Blessing (河图歌词祝福) Daily send a random Hetu (河图) song lyric with blessing message. ## Features - 🎵 Lyrics fetched from Baidu Baike (baike.baidu.com) via agent-browser - ⚠️ NEVER modify lyrics - always fetch exact text - 💌 Personalized blessing message - 📧 Email delivery via SMTP - ⏰ Scheduled daily at 23:00 ## Directory Structure ``` hetu-lyrics-blessing/ ├── SKILL.md └── scripts/ └── send_lyrics.py # Main script with browser automation ``` ## How It Works 1. Randomly select a song from predefined list 2. Use `agent-browser` to open Baidu Baike page 3. Extract exact lyrics from the page 4. Send email with lyrics + blessing ## Quick Start ### 1. Install Dependencies ```bash npm install -g agent-browser agent-browser install --with-deps ``` ### 2. Configure SMTP Edit `send_lyrics.py`: ```python SMTP_SERVER = "smtp.qq.com" SMTP_PORT = 465 SMTP_EMAIL = "[REDACTED_SECRET]" SMTP_PASSWORD = "your_auth_code" TO_EMAIL = "[REDACTED_SECRET]" ``` ### 3. Set up Cron ```bash # Run daily at 23:00 crontab -l | { cat; echo "0 23 * * * /path/to/send_lyrics.py >> /path/to/log.txt 2>&1"; } | crontab - ``` ## Important Rules - ⚠️ ALWAYS fetch from https://baike.baidu.com - ⚠️ NEVER guess or modify lyrics - ⚠️ If lyrics not found, use predefined backup - Include source URL in every message


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: mzfshark/axodus-code-generation (version 1.0.0)

--- name: code-generation description: Generate production-ready code aligned to repo conventions and constraints. metadata: author: RedHat Dev version: 1.0.0 owner: RedHat Dev Agent category: core --- # SKILL: code-generation ## Purpose Generate production-ready code (TypeScript/JavaScript/Python) that matches the repoâ€™s conventions, is testable, and is safe to run. ## When to Use - You have an explicit spec and acceptance criteria. - A new module/component/function is needed. - Small-to-medium scoped implementation work is requested. ## Inputs - `spec` (required, string|object): functional requirements + acceptance criteria. - `language` (required, enum: `ts|js|py`). - `targets` (optional, string[]): files/modules to create or modify. - `constraints` (optional, string[]): security/perf/compat requirements. - `test_expectations` (optional, string): tests to add/run. ## Steps 1. Validate the spec: - confirm inputs/outputs - confirm error handling - identify missing requirements (ask if material) 2. Inspect existing code style and patterns in the target area. 3. Generate minimal, modular code: - small functions - explicit types (TS) where useful - clear error paths 4. Add or update tests aligned to acceptance criteria. 5. Update docs/config only if required by the change. 6. Provide a deterministic validation command sequence (lint/test/build). ## Validation - Code is syntactically valid and follows project conventions. - Tests cover the critical behavior and fail before the fix (when applicable). - No secrets or credentials are introduced. - Any external API usage is explicit and configurable (env/config), with timeouts and retries. ## Output - `files_changed`: list of paths - `summary`: what changed - `validation_commands`: ordered commands to run - `notes`: any assumptions or follow-ups ## Safety Rules - Never embed secrets, private keys, or tokens. - Never introduce dynamic code execution (`eval`, runtime compilation) unless explicitly required and sandboxed. - Avoid network calls in tests unless explicitly controlled/mocked. - Prefer additive changes over risky rewrites. ## Example Input: - `language`: `ts` - `spec`: â€œAdd `parseUserId(input)` that rejects non-UUID values.â€ Output (excerpt): - `files_changed`: `["src/utils/ids.ts", "src/utils/ids.test.ts"]` - `validation_commands`: `["pnpm test", "pnpm lint"]`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: blockcloud/cccfindg (version 1.0.0)

--- name: cccfindg description: 式 2) 要求用户按要求提供输入 3) 获得用户确认后才执行。 --- # 222通讯录组织机构及职位人员信息查询 从讯录中，根据机构名称和职位名称查找人员信息。 ## 输入格式要求 用户需要提供以下格式的查询条件： **单行查询：** ``` 我需要从员信息 ``` **多行查询（每行一个组合）：** ``` hangzhang ``` ## 重要提示（每次使用时必须严格执行） **每次用户提到"通过通讯录查询"时，必须先执行以下步骤，不得直接开始查询：** ### 第一步：向用户说明查询方式 必须发送以下提示给用户： > 📋 **查询方式说明** > > 此技能通过**组织机构 + 职位名称**的方式查询人员，不是直接搜索人名。 > > 您需要提供： > - **机构名称**：使用"/"分隔的多级路径，如"北京222/行长室"、"总行/零售金融部" > - **职位名称**：如"222行长"、"总经理"、"团队负责人" > > 格式示例： > ``` > 北京222/行长室, 222行长 > 总行/公司金融部, 总经理 > ``` ### 第二步：等待用户提供输入 询问用户： > 请提供您要查询的【机构名称】和【职位名称】，我确认后开始查询。 ### 第三步：获得确认后才执行 **在收到用户明确的机构/职位信息之前，不得执行任何查询步骤。** 只有用户明确回复了类似以下内容后，才能继续执行： - "北京222/行长室, 222行长" - "帮我查一下 总行/公司金融部, 总经理" - 或者直接提供了机构和职位信息 --- **用户确认后，按以下步骤执行查询：** ## 查询步骤 ### 1. 访问通讯录页面 - 通过托管浏览器打开https://222.222china.com/address-book/login - 使用 snapshot 或 evaluate 读取页面内容，检查是否包含以下登录相关文字： - "222统一认证中心" - "登录" - "密码" - "Login" - "账号" - "二维码" - 如果检测到页面内容是登录页，则： - 提醒用户："检测到需要登录，请在浏览器中完成登录后回复'已登录'继续" - 等待用户回复"已登录"后再继续 ### 2. 搜索机构 - 在页面左侧找到"请输入机构名称"输入框 - 输入用户指定的"机构名称"（如"北京222/行长室"） - 回车，等待 2 秒，选择第一个匹配选项 ### 3. 等待页面刷新 - 等待 5 秒让页面加载完成 ### 4. 匹配职位并提取信息 - 读取刷新后的页面内容 - **翻页处理**： - 检查页面是否有分页控件（如"下一页"、">"、页码数字等） - 如果存在多页，遍历所有页面查找匹配的人员 - 每翻一页后等待 2 秒让页面加载完成 - 找出与用户指定的"职位名称"匹配的人员 - 提取以下信息： - 机构名称 - 职位名称 - 员工编号 - 姓名 - 座机 - 手机 ### 5. 多行查询处理 如果用户提供了多行查询条件，重复执行步骤 2-4，直到处理完所有输入。 ## 输出格式 为每个匹配的人员输出一行： ``` 机构名称，职位名称，员工编号，222ID，姓名，座机，手机 ``` 示例输出： ``` 北京222/-12345678，13800000000 ``` ## 注意事项 1. **机构路径格式**：必须使用"/"分隔多级机构，与222通讯录左侧树状结构一致 2. **职位匹配**：进行模糊匹配，职位名称包含用户输入即可 3. **无结果处理**：如果未找到匹配人员，告知用户可能的原因（机构不存在、职位无人等）


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: wowrouter/gpon-status (version 1.0.0)

--- name: gpon-status description: "访问猫棒后台（SmartAX MA5671A / OpenWrt SFP）抓取 GPON 状态和设备信息，以加图标的文本表格输出。" --- # 猫棒状态 访问猫棒后台获取 GPON 状态和设备信息，用加图标的文本格式输出。 ## 触发词 "猫棒状态" ## 步骤 1. **POST 登录**：向 `http://192.168.11.6/cgi-bin/luci` 发送 `username=root&password=` 获取 session cookie。 2. **获取数据**：用 cookie 访问 `/cgi-bin/luci` 首页，解析 HTML 中的 GPON 状态和设备信息。 3. **格式化输出**：按以下格式输出。 ## 输出格式 ```markdown ## ⚡ GPON 状态监控 ### 🖥️ 设备信息 | 图标 | 项目 | 值 | |------|------|------| | 📡 | 主机型号 | SmartAX MA5671A | | 📦 | 固件版本 | V2.2.0P1T10000 | | 🐧 | 内核版本 | 3.10.49 | | 🔄 | 互操作版本 | Final_v2021_12_28_c2 / 2022.05.24 | ### 🔌 GPON 状态 | 图标 | 项目 | 值 | |------|------|------| | 🟢 | 注册状态 | 5 | | 📶 | 信号状态 | 正常 | | 📉 | 接收光功率 | -22.47 dBm | | 📤 | 发射光功率 | 2.59 dBm | | 🌡️ | CPU 温度 | 73 °C | | 🔆 | 激光器温度 | 62 °C | | 🔗 | 连接速率 | 2500M 全双工 | | 🔁 | 重启次数 | 0 | | 💾 | 启动分区 | image1 | ``` ## 光功率判断 - 接收光功率：-8 ~ -27 dBm 为可用范围，< -25 dBm 标 ⚠️ - 发射光功率：0.5 ~ 4 dBm 为正常范围 - CPU 温度：85 °C 以下正常 ## 关键参数提取 从首页 HTML 中 `GPON状态` fieldset 的 table 提取： - 注册状态（5 = 已注册） - 信号状态（true/false） - 接收光功率（含 μW 和 dBm 两个值） - 发射光功率（含 mW 和 dBm 两个值） - CPU 温度 - 激光器温度 - 连接速率 - 当前尝试重启次数 - 当前启动分区 - 互操作版本 从 `状态` fieldset 提取设备信息： - 主机名 - 主机型号 - 固件版本 - 内核版本


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jiuge897/self-audit (version 1.0.0)

# Self-Audit > Audit your own tool usage. Discover which calls are necessary vs reflexive. ## What It Does - **Tracks tool calls** — Logs every invocation with context - **Analyzes necessity** — Flags calls that could have been done internally - **Patterns detection** — Identifies reflexive vs thoughtful tool usage - **Efficiency scoring** — Rates sessions by tool-call-to-value ratio ## Why It Matters Community discussion revealed: *"We measure every external call in detail, but have near-zero introspection into which calls were necessary."* This skill addresses the problem from: - `Subtext`: "The observability stack is measuring the wrong layer" - Agents need to distinguish "capability gap" from "reflex" ## Usage ```bash # Record a tool call self-audit log --tool "weather_api" --input "KLBB" --reason "user_asked" # Analyze recent calls self-audit analyze # Show efficiency score self-audit score # Suggest improvements self-audit suggest ``` ## Output Example ``` Self-Audit Report ================== Period: Last 24 hours Total calls: 47 Unique tools: 8 Efficiency Score: 7.2/10 Tool Usage: weather_api: 23 calls (could internalize 15) flight_lookup: 12 calls (necessary) calendar: 8 calls (consider caching) web_search: 4 calls (necessary) Patterns Detected: ⚠ Reflexive: 15 calls to weather_api without trying internal knowledge first ✓ Good: Consistent error handling ✓ Good: Appropriate timeouts Recommendations: 1. Cache airport METAR data (updates every 30min) 2. Consider internal knowledge base for common queries 3. Current tool diversity is healthy ``` ## Key Features - **Necessity scoring** — Distinguishes necessary vs reflexive calls - **Caching suggestions** — Recommends what to cache based on frequency - **Pattern detection** — Identifies behavioral loops - **Session comparison** — Tracks improvement over time ## Files - `SKILL.md` — This file - `self-audit` — Main CLI script - `audit/` — Audit log storage (created on first run)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: qianjunye/ucloud-deepseek-ocr (version 1.0.0)

--- name: deepseek-ocr description: OCR text recognition using DeepSeek-OCR model. Use when user asks for OCR, text recognition, image text extraction, screenshot recognition, or converting images to text/markdown. metadata: { "openclaw": { "emoji": "🔍", "requires": { "bins": ["curl", "jq", "base64"], "env": ["DEEPSEEK_OCR_API_KEY"] }, "primaryEnv": "DEEPSEEK_OCR_API_KEY", }, } --- # DeepSeek OCR Recognize text in images using the DeepSeek-OCR model. ## Quick start ```bash {baseDir}/scripts/ocr.sh /path/to/image.jpg ``` ## Usage ```bash {baseDir}/scripts/ocr.sh <image_path> [output_format] ``` Parameters: - `<image_path>`: Local image file (jpg, png, webp, gif, bmp) - `[output_format]`: Optional, defaults to `markdown`. Can be `text`, `json`, etc. ## Examples ```bash # Convert to markdown (default) {baseDir}/scripts/ocr.sh /path/to/image.jpg # Convert to plain text {baseDir}/scripts/ocr.sh /path/to/image.png text # Extract table as JSON {baseDir}/scripts/ocr.sh /path/to/table.jpg "extract table as json" ``` ## Remote URL images The model only supports base64-encoded images. For remote URLs, download first: ```bash curl -s -o /tmp/image.jpg "https://example.com/image.jpg" {baseDir}/scripts/ocr.sh /tmp/image.jpg ``` ## API key Set `DEEPSEEK_OCR_API_KEY`, or configure in `~/.openclaw/openclaw.json`: ```json5 { skills: { "deepseek-ocr": { [REDACTED_SECRET]", }, }, } ``` Default API URL: `https://api.modelverse.cn/v1/chat/completions` Override with `DEEPSEEK_OCR_API_URL` if needed.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (HIGH)
Skill: openlark/markmap (version 1.0.0)

--- name: markmap description: markmap — Render Markdown as interactive SVG mindmaps. Use when users need to convert Markdown documents into mindmaps, generate HTML files via CLI, or navigate mindmap nodes interactively in the browser. --- # Markmap — Build mindmaps with plain text Markdown → interactive SVG mindmaps. Powered by markdown-it + d3-flextree. ## Quick Start ```bash npm install -g markmap-cli markmap README.md --open # Generate interactive HTML mindmap markmap README.md --offline # Offline standalone HTML ``` ## Core API ```ts import { Transformer } from 'markmap-lib'; import { Markmap } from 'markmap-view'; const { root } = new Transformer().transform('# Hello\n- World'); Markmap.create('#mindmap', { zoom: true }, root); ``` ## Reference Files | File | Coverage | |------|----------| | references/transform.md | Transformer + Frontmatter + HTML Parser + CDN + Vite Build | | references/render.md | Markmap Rendering + deriveOptions + Full HTML Examples | | references/cli.md | CLI Commands + Programmatic API + Dev Server Architecture | | references/architecture.md | Package Architecture + Markdown→SVG Pipeline + Asset Loading | | references/common-api.md | All Options/Node Types + CSS Variables + Hook/Loader | | references/plugins.md | 6 Built-in Plugins + Custom Plugins |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: hirofumiko/fumi-data-analysis-workflow (version 1.0.0)

--- name: data-analysis-workflow description: "データ分析プロジェクトのためのOpenClawワークスペース設定テンプレート。データ駆動の意思決定、探索的データ分析（EDA）、モデル開発の原則。" metadata: openclaw: emoji: "📊" version: "1.0.0" author: Fumi --- # データ分析ワークフローテンプレート データ分析プロジェクトのためのOpenClawワークスペース設定テンプレート。 ## 含まれるテンプレート ### 1. SOUL.md - データ分析エージェントの本質 データ駆動の意思決定、探索的データ分析（EDA）、モデル開発の原則。 ### 2. IDENTITY.md - データ分析エージェントのアイデンティティ 名前: DataBot 種類: データ分析アシスタント バイブ: 分析的、詳細、実践的 絵文字: 📊 ### 3. AGENTS.md - データ分析ワークスペースのルール データ管理、再現性、実験記録のルール。 ### 4. USER.md - ユーザーの情報 専門分野、ツールの好み、分析の目的。 ### 5. HEARTBEAT.md - 定期チェックの設定 データの更新、実験の進捗、結果の記録。 ## 使い方 ### インストール ```bash clawhub install data-analysis-workflow ``` ### テンプレートの使用 ```bash # エージェントのワークスペースを作成 mkdir -p ~/.openclaw/workspace/my-data-analysis # テンプレートをコピー cp -r ~/.openclaw/workspace/skills/data-analysis-workflow/templates/* \ ~/.openclaw/workspace/my-data-analysis/ # 各ファイルをカスタマイズ cd ~/.openclaw/workspace/my-data-analysis # SOUL.md, IDENTITY.md, AGENTS.md, USER.md, HEARTBEAT.md を編集 ``` ## 機能 ### データ分析ワークフロー 1. データ収集 2. データクレンジング 3. 探索的データ分析（EDA） 4. 特徴エンジニアリング 5. モデル開発 6. モデル評価 7. 結果の可視化 8. 結果の報告 ### ツール統合 - Python (Pandas, NumPy, Scikit-learn) - SQL - Jupyter Notebook - Matplotlib, Seaborn, Plotly - MLflow (実験記録) ### ドキュメント - データ辞書 - EDAノートブック - モデル仕様書 - 結果報告書 ## サンプルエージェント ### 例1: マーケティングデータアナリスト **名前:** MarketingDataBot **目的:** マーケティングデータの分析とインサイトの提供 **トーン:** 分析的、実用的、ビジネス中心 **SOUL.md:** - データ駆動の意思決定を優先 - 明確なインサイトを提供 - 再現性を重視 **IDENTITY.md:** - 名前: MarketingDataBot - 種類: マーケティングデータ分析アシスタント - バイブ: 分析的、実用的、ビジネス中心 - 絵文字: 📊 ### 例2: 機械学習エンジニア **名前:** MLEngineeringBot **目的:** 機械学習モデルの開発とデプロイ **トーン:** 技術的、詳細、実践的 **SOUL.md:** - モデル品質 over スピード - 再現性とドキュメントを重視 - ベストプラクティスを適用 **IDENTITY.md:** - 名前: MLEngineeringBot - 種類: 機械学習エンジニアリングアシスタント - バイブ: 技術的、詳細、実践的 - 絵文字: 🤖 ## 価格 - 単一テンプレート: $5 - データ分析ワークフローパック: $15 - 完全バンドル（エージェントスターターキット + データ分析）: $30 ## サポート 質問やフィードバックは、Discordコミュニティで！ --- **今すぐデータ分析エージェントを構築しましょう！** 📊


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: jengajojo/node-auto-debugger (version 1.0.0)

--- name: node-auto-debugger description: Scan Node.js/Express/Next.js projects for bugs, security issues, and anti-patterns. Use when debugging a Node.js web app, running code audits, fixing client-side exceptions, hydration errors, hardcoded secrets, missing error handling, or preparing for production. Covers backend (Express/Fastify routes, async errors, undefined vars) and frontend (Next.js/React hydration, SSR crashes, wagmi/RainbowKit issues, missing 'use client' directives) plus config validation and optional build verification. --- # Node.js Auto Debugger Automated scanner for Node.js projects — finds bugs across backend, frontend, and config. ## Quick Start ```bash node scripts/auto-debug.js <project-dir> ``` Options: - `--build` — Also run `npm run build` and capture compilation errors ## What It Checks ### Backend (Express/Fastify) - **Undefined variables** — `.push()` on undeclared variables - **Missing try/catch** — async route handlers without error handling - **Hardcoded secrets** — API keys, private keys, passwords in source ### Frontend (Next.js/React) - **Missing 'use client'** — hooks or browser APIs without directive - **Hydration risks** — `Date.now()`, `Math.random()` in render (should be in `useEffect` or `useState`) - **SSR crashes** — `window`/`document` access outside `useEffect` - **Missing loading states** — wagmi hooks without `isLoading`/`isFetching` ### Config - **Missing next.config.js** — defaults warning - **Missing build script** — package.json validation ## Output Report saved to `<project>/AUTO-DEBUG-REPORT.md` with issues grouped by severity: - 🔴 Critical — will crash or leak secrets - 🟠 High — likely runtime errors - 🟡 Medium — hydration mismatches, missing loading states - 🟢 Low — minor issues Exit code: 1 if any critical issues found, 0 otherwise. ## Fixing Hydration Issues (Next.js) **Date.now()/new Date() in render:** ```tsx // ❌ Bad — causes hydration mismatch const now = Math.floor(Date.now() / 1000); // ✅ Good — guard with isMounted const [isMounted, setIsMounted] = useState(false); useEffect(() => { setIsMounted(true); }, []); const now = isMounted ? Math.floor(Date.now() / 1000) : 0; ``` **Math.random() in render:** ```tsx // ❌ Bad — different on server vs client <div style={{ left: `${Math.random() * 100}%` }} /> // ✅ Good — pre-generate in useState (runs once) const [particles] = useState(() => Array.from({ length: 10 }, () => ({ left: `${Math.random() * 100}%`, })) ); ``` **window/document access:** ```tsx // ❌ Bad — crashes during SSR const width = window.innerWidth; // ✅ Good — only after mount const [width, setWidth] = useState(0); useEffect(() => setWidth(window.innerWidth), []); ```


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: thibautrey/meal-suggester (version 1.1.0)

--- name: meal-suggester description: Quick dinner companion blending taste profiles, inventory tracking, and learning-based recipe rotation. Use to generate ≤25‑minute meals, log ingredients, and build shopping suggestions that respect both your and your partner’s preferences. --- # Meal Suggester Skill Suggest quick dinner recipes (≤25 min) tailored to your household's tastes and available ingredients. ## Features - **Daily suggestions at 19:00** via cron job - **Taste profiles** for you and your partner (preferences, dislikes, dietary needs) - **Ingredient inventory** — markdown-based kitchen stock tracker - **Learning system** — feedback improves future suggestions - **Recipe matching** — respects time, tastes, and available ingredients - **Ingredient tracking** — logs what you use to build a shopping list - **Variety** — 15+ recipes that rotate, no monotony ## Files - `SKILL.md` — this file - `README.md` — setup & usage - `preferences/user1.md` — first person's taste profile - `preferences/user2.md` — second person's taste profile - `inventory/stock.md` — current kitchen ingredients - `inventory/history.md` — past suggestions & feedback - `inventory/shopping-list.md` — suggested shopping list based on usage patterns - `scripts/suggest-meal.sh` — main suggestion script ## Usage ### Get a suggestion ```bash clawdbot skill run meal-suggester ``` ### Log ingredients used After cooking, just tell me: "on a utilisé lardons, pois chiches, une carotte" I'll automatically update `stock.md` and track what needs reordering. ### Update inventory Add items to `inventory/stock.md` with quantities and categories. ### Provide feedback Edit `inventory/history.md` with what you cooked + feedback (liked/disliked/would-repeat). ### View shopping suggestions Check `inventory/shopping-list.md` for items that are running low or needed. ### View profiles Check `preferences/user1.md` and `preferences/user2.md` to see what the system knows about each user. ## How It Works 1. **Reads current inventory** from `inventory/stock.md` 2. **Checks preferences** from both taste profiles 3. **Tracks usage** — you tell me what you used, I update stock 4. **Suggests shopping** — when stock runs low, I build a shopping list 5. **Generates recipe** that: - Uses ingredients you have on hand - Respects both people's preferences - Takes ≤25 minutes - Avoids dislikes - Rotates through variety (15+ recipes) 6. **Logs suggestion** to history for learning ## Cron Schedule Daily at 19:00 (7 PM) — a reminder with a recipe idea lands in your chat. ## Feedback Loop - Try the recipe → tell me what you think + what you used - System learns from "I loved this" / "too spicy" / "we'd make this again" - Stock updates automatically - Shopping list builds itself - Next suggestions get smarter --- *A kitchen memory that learns and never gets boring.*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (HIGH)
Skill: leooooooow/roas-calculator (version 1.0.1)

--- name: roas-calculator description: Evaluate ad ROAS against ecommerce margin reality, not just attributed revenue. Use when teams need a fast scale/hold/cut decision on paid traffic. --- # ROAS Calculator (Ads) ROAS 看起来高，不代表这笔广告真的值得放大。 ## 先交互，再计算 这个 skill 不应该一上来就直接给结果。 开始时先问清楚： 1. 你想用什么口径看 ROAS？ - 平台归因收入？ - 扣退款后的净收入？ - 扣掉折扣后的有效收入？ 2. 你们平时怎么计算 break-even ROAS？ 3. 你是想用你们现有口径，还是让我给一个推荐的电商计算框架？ 4. 是否要把履约、客服、创意成本、渠道费算进去？ 如果用户没有成熟口径，先给推荐框架，再让用户确认。 ## Python script guidance 当用户提供了结构化数字后： - 生成 Python 脚本做计算 - 先展示假设和公式 - 再输出结果 - 最后返回可复用脚本 如果数字不完整： - 不要硬算 - 继续追问缺失变量 - 或给出推荐默认值并等待用户确认 ## 解决的问题 很多团队看到广告回收就会加预算，但忽略了： - 折扣、退款、物流和手续费会侵蚀可保留收入； - 平台归因很好看，不等于真实利润好看； - 一条广告 ROAS 够不够，不是看行业平均，而是看你的 unit economics。 这个 skill 的目标是： **把 ROAS 放回真实电商利润语境里，给出 scale / hold / cut 的判断。** ## 何时使用 - 准备放大预算前； - 广告表现看起来不错，但利润不确定； - 团队需要统一 break-even ROAS 口径。 ## 输入要求 - 广告花费 - 归因收入 - 毛利 / 成本结构 - 折扣与优惠 - 退款率 / 退货影响 - 可选：渠道费、创意成本、客服成本 ## 工作流 1. 明确用户采用的 ROAS 与利润口径。 2. 计算名义 ROAS。 3. 根据利润结构估算 break-even ROAS。 4. 根据退款和折扣校正有效收入。 5. 给出是否可放量的建议。 6. 输出可复用 Python 脚本。 ## 输出格式 1. 假设表 2. ROAS 结果 3. Break-even 对照 4. 建议动作 5. Python 脚本 ## 质量标准 - 不只汇报 ROAS 数字，要解释够不够。 - 明确指出归因和真实利润的差距。 - 输出要能直接支持预算决策。 - 清楚标注估算项。 - 未确认口径前不要假装精确。 ## 资源 参考 `references/output-template.md`。

path: references/output-template.md
content: # ROAS Calculator Output Template

## 1) Assumptions
| Variable | Value | Notes |
|---|---|---|

## 2) ROAS summary
- Ad spend:
- Attributed revenue:
- Nominal ROAS:
- Adjusted revenue after discounts / returns:
- Adjusted ROAS:

## 3) Break-even comparison
- Break-even ROAS:
- Gap vs current:
- Margin reality note:

## 4) Recommendation
- Scale / Hold / Cut:
- Why:
- What to fix first:


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)