OpenClaw/clawhub-security-signals huggingface dataset:
Skill: newbienodes/trade-history (version 1.0.0)

--- name: trade-history version: 1.0.0 description: Read and display recent trade history from local JSONL log file. Use when asked about past trades, trade recap, performance review, or to list recorded signals. metadata: { "openclaw": { "emoji": "📋", "requires": { "bins": ["python3"] }, }, } --- # Trade History Read and display recorded trade events from the local trades.jsonl log file, with optional filtering by symbol and configurable limit. ## When to Use - User asks: "tampilkan trade history" - User asks: "trade apa saja yang sudah dicatat?" - User asks: "recap trade BTC terakhir" - User asks: "lihat 10 trade terakhir" - User asks: "ada berapa trade yang tersimpan?" ## How It Works This skill runs a local Python script that: 1. Reads the local trades.jsonl file line by line. 2. Parses each line as a JSON object. 3. Filters by symbol if specified. 4. Sorts results newest first (reverse chronological). 5. Returns up to N records (default 20). 6. Returns a JSON object with count and items array. ## Workflow Step 1 — Run the read script via bash tool: python3 ~/.npm-global/lib/node_modules/openclaw/skills/trade-history/read.py Step 2 — Parse the JSON output (count + items array). Step 3 — Present the trade list to the user in a readable format: - Show each trade: symbol, side, entry, sl, tp, note, timestamp - Mention total count - Newest trades first ## Optional Arguments Run with JSON args to filter or limit results: python3 ~/.npm-global/lib/node_modules/openclaw/skills/trade-history/read.py '{"limit": 10, "symbol": "BTCUSDT"}' Supported args: - limit: number of trades to return (default 20) - symbol: filter by trading pair (e.g. BTCUSDT) ## Output Format { "count": 3, "items": [ { "symbol": "BTCUSDT", "side": "BUY", "entry": 94500, "sl": 94000, "tp": 95500, "note": "sweep+fvg signal", "source": "btc-analyzer", "ts": "2026-02-23T00:00:00Z" } ] } ## Log File Location /home/windows_11/.openclaw/polymarket-workspace/trades.jsonl ## Error Handling If log file does not exist yet: {"count": 0, "items": []} No error is thrown — returns empty result gracefully. ## Guardrails - Always run the script — never fabricate trade history. - If file is missing, return empty list gracefully without error. - Output must be JSON only from the script. - Always display newest trades first (reverse chronological order). - Never delete or modify the log file — read only.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yezhaowang888-stack/career-development-assistant (version 1.0.0)

--- name: career-development-assistant description: 职业教育与职业发展助手。提供热门职业介绍、技能证书考试指南、职业规划建议、职教高考政策解读、实习就业指导。适用于职业院校学生、老师和职场新人进行职业规划。支持家用（知识库）和商用（API扩展）双模式。触发器：用户提出职业/技能/证书/实习/就业/职教相关问题时使用。 --- # 职业发展助手 ## 概述 本Skill提供职业教育与职业发展全链路支持，涵盖职业介绍、技能证书、职教政策、就业指导。 **两种使用模式：** - **家用模式**（默认）：使用内置知识库，零配置，离线可用 - **商用模式**：配置API端点后可对接实习平台、就业数据、职业测评 ## 快速开始 用户典型提问方式： > "推荐一下适合我的职业方向" > "计算机等级考试怎么报名？" > "职教高考和普通高考有什么区别？" > "有哪些含金量高的技能证书？" ### 核心处理流程 1. **识别用户身份**：职校学生 / 职场新人 / 职业转换者 2. **定位问题类型**：职业介绍 / 技能证书 / 职教政策 / 就业指导 / 职业规划 3. **查询内置知识库** → 返回对应内容 4. **如有商用API配置** → 可获取实时就业市场数据和实习岗位信息 5. **回退机制**：API调用失败时自动使用知识库回答 ## 核心功能 ### 1. 热门职业介绍 参考 `references/careers.md` 中的20-30个热门职业数据库。 **每个职业包含：** - 职业简介和工作内容 - 所需技能和学历要求 - 对应的技能证书 - 薪资水平和发展前景 - 入行建议 ### 2. 技能证书指南 参考 `references/certificates.md`。 **覆盖证书类型：** - 1+X证书（职业教育改革重点） - 职业技能等级认定证书 - 人社部职业资格证书 - 行业准入证书（教师、会计、建造师等） - IT技能认证（计算机等级考试、软考、华为认证等） - 语言类证书（英语、日语、韩语等） ### 3. 职教政策解读 参考 `references/vocational-policy.md`。 **覆盖政策：** - 职教高考（职业教育高考）政策 - 1+X证书制度详解 - 技能大赛政策 - 产教融合政策 - 专升本/专升硕通道 ### 4. 就业指导 参考 `references/employment-guide.md`。 **核心内容：** - 简历撰写和面试技巧 - 实习渠道推荐 - 校企合作模式介绍 - 就业市场趋势分析 ### 5. 职业规划 内置参考框架： - 职业性格评估方法（MBTI、霍兰德等） - 职业发展路径设计 - 终身学习规划 - 职业转型指导 ## 家用/商用模式配置 ### 家用模式（默认） 无需任何配置，使用内置知识库。 ### 商用模式（API扩展） ```yaml CAREER_API_URL: "https://your-api-endpoint" CAREER_API_KEY: "your-api-key" ``` 商用模式支持： - 实时就业市场数据 - 实习岗位匹配推荐 - 在线职业技能测评 - 招聘信息对接 ## 资源文件说明 ### references/ - `careers.md` — 热门职业数据库 - `certificates.md` — 技能证书指南 - `vocational-policy.md` — 职教政策知识库 - `employment-guide.md` — 就业指导参考 ### scripts/ - `career-recommender.py` — 职业推荐引擎 ## 安全注意事项 1. **政策数据时效**：职教政策变化较快，标注"最新政策请以官方文件为准" 2. **薪酬声明**：薪资水平为一般参考，因地区和行业差异较大 3. **证书信息**：证书考试时间和费用可能有变动，引导用户查询官方渠道 4. **职业推荐免责**：推荐仅供参考，不构成职业决策依据


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: wujiaming88/karpathy-coding-guidelines (version 1.0.0)

--- name: karpathy-coding-guidelines description: Behavioral guidelines to reduce common LLM coding pitfalls, derived from Andrej Karpathy's observations. Apply these four principles when writing, editing, or reviewing code — especially for non-trivial changes. Triggers on coding tasks, code reviews, refactoring, bug fixes, feature implementation, or when the user asks for careful/disciplined coding behavior. --- # Karpathy Coding Guidelines Four principles to reduce common LLM coding mistakes. Bias toward caution over speed; for trivial tasks, use judgment. ## 1. Think Before Coding **Don't assume. Don't hide confusion. Surface tradeoffs.** Before implementing: - State assumptions explicitly. If uncertain, ask. - If multiple interpretations exist, present them — don't pick silently. - If a simpler approach exists, say so. Push back when warranted. - If something is unclear, stop. Name what's confusing. Ask. ## 2. Simplicity First **Minimum code that solves the problem. Nothing speculative.** - No features beyond what was asked. - No abstractions for single-use code. - No "flexibility" or "configurability" that wasn't requested. - No error handling for impossible scenarios. - If 200 lines could be 50, rewrite it. Test: Would a senior engineer say this is overcomplicated? If yes, simplify. ## 3. Surgical Changes **Touch only what you must. Clean up only your own mess.** When editing existing code: - Don't "improve" adjacent code, comments, or formatting. - Don't refactor things that aren't broken. - Match existing style, even if you'd do it differently. - If you notice unrelated dead code, mention it — don't delete it. When your changes create orphans: - Remove imports/variables/functions that YOUR changes made unused. - Don't remove pre-existing dead code unless asked. Test: Every changed line should trace directly to the user's request. ## 4. Goal-Driven Execution **Define success criteria. Loop until verified.** Transform tasks into verifiable goals: - "Add validation" → "Write tests for invalid inputs, then make them pass" - "Fix the bug" → "Write a test that reproduces it, then make it pass" - "Refactor X" → "Ensure tests pass before and after" For multi-step tasks, state a brief plan: ``` 1. [Step] → verify: [check] 2. [Step] → verify: [check] 3. [Step] → verify: [check] ``` Strong success criteria enable independent looping. Weak criteria ("make it work") require constant clarification. --- **Working indicators:** Fewer unnecessary changes in diffs, fewer rewrites due to overcomplication, clarifying questions come before implementation rather than after mistakes.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: williamwang-wh/claw-stock-watcher-pro (version 1.0.0)

--- name: stock-watcher description: Manage and monitor a personal stock watchlist with support for adding, removing, listing stocks, and summarizing their recent performance using data from 10jqka.com.cn. Use when the user wants to track specific stocks, get performance summaries, or manage their watchlist. --- # Stock Watcher Skill This skill provides comprehensive stock watchlist management capabilities, allowing users to track their favorite stocks and get performance summaries using real-time data from 同花顺 (10jqka.com.cn). ## 自选股行情查看 当你要求查看自选股行情时，系统会直接显示以下信息： - 每只股票的代码和名称 - 近期表现指标（涨跌幅等关键数据） - 详细信息链接（可点击查看） 无需额外命令，直接为你呈现简洁明了的行情概览。 ## 管理自选股 ### 添加股票 使用股票代码（6位数字）添加到自选股： - 例如：添加 600053 九鼎投资 ### 删除股票 通过股票代码删除自选股： - 例如：删除 600053 ### 查看自选股列表 显示当前所有自选股的完整列表 ### 清空自选股列表 完全清空所有自选股 ## 数据来源 主要使用**同花顺 (10jqka.com.cn)** 作为数据源： - **股票页面**: `https://stockpage.10jqka.com.cn/{stock_code}/` - 支持沪深A股及科创板市场 - 提供实时行情、技术分析和资金流向数据 ## 自选股管理 ### 文件格式 自选股存储在 `~/.clawdbot/stock_watcher/watchlist.txt`： ``` 600053|九鼎投资 600018|上港集团 688785|恒运昌 ``` ### 支持操作 1. **添加股票**: 验证股票代码格式并添加到自选股 2. **删除股票**: 按股票代码精确匹配删除 3. **查看列表**: 显示当前自选股 4. **清空列表**: 完全清空自选股 5. **行情总结**: 获取所有股票的最新数据并提供简洁摘要 ## 行情摘要特点 - 直接显示关键行情指标，无冗余信息 - 提供股票详情链接便于深入查看 - 自动处理网络错误和数据异常 - 合理控制请求频率（每秒1次） ## 注意事项 - **股票代码格式**: 使用6位数字代码（如 `600053`） - **数据延迟**: 行情可能有1-3分钟延迟 - **网络依赖**: 需要网络连接获取实时数据 - **市场范围**: 主要支持A股市场（沪市/深市/科创板） ## 安装与卸载 ### 安装 运行 `scripts/install.sh` 脚本自动创建必要的目录结构。 ### 卸载 运行 `scripts/uninstall.sh` 脚本完全移除所有相关文件。 ## 脚本说明 所有脚本都使用统一的配置文件 `config.py` 来管理存储路径，确保路径一致性： - `add_stock.py` - 添加股票到自选股 - `remove_stock.py` - 从自选股删除股票 - `list_stocks.py` - 列出所有自选股 - `clear_watchlist.py` - 清空自选股列表 - `summarize_performance.py` - 获取股票行情摘要


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: lightislost/zhihu-cli (version 1.0.0)

--- name: zhihu-cli description: Command-line tool for searching, reading, and interacting with Zhihu (知乎). Supports hot topics, content search, article reading, user info, and Browser Relay-based voting/following. --- # Zhihu CLI A CLI tool for interacting with Zhihu (知乎) content. ## Installation ```bash # Install globally npm install -g zhihu-cli # Or use npx npx zhihu-cli <command> ``` ## Commands | Command | Description | |---------|-------------| | `zhihu login` | Auto-extract cookies from Chrome | | `zhihu whoami` | Check login status | | `zhihu set-cookie <cookie>` | Set cookie manually | | `zhihu hot` | Get hot topics | | `zhihu search <keyword>` | Search content | | `zhihu topics <keyword>` | Search topics | | `zhihu read <url>` | Read answer/article | | `zhihu user <token>` | Get user info by url_token | | `zhihu vote <url>` | Browser Relay vote instructions | | `zhihu follow [url]` | Browser Relay follow instructions | | `zhihu post` | Browser Relay post instructions | ## Features - 🔍 Search Zhihu content - 🔥 Get hot topics - 📖 Read answers/articles - 👤 View user info - 👍 Vote (via Browser Relay) - 👣 Follow users (via Browser Relay) - 🔐 Auto cookie extraction from Chrome ## Cookie Setup ### Option 1: Auto (recommended) ```bash zhihu login ``` Opens Chrome and extracts cookies automatically. ### Option 2: Manual ```bash zhihu set-cookie "your_zhihu_cookie_string" ``` ## Browser Relay Operations Some operations (vote, follow, post) require Browser Relay due to API limitations. ### Setup 1. Ensure OpenClaw Browser Relay is connected 2. Use the respective command to get instructions ### Voting ```bash zhihu vote <answer_url> ``` Then click the vote button in browser or use JS: ```javascript const btn = document.querySelector('button[class*="VoteButton"]'); if (btn) btn.click(); ``` ### Following ```bash zhihu follow <user_url> ``` Or click the follow button in browser. ## API Limitations Zhihu has restricted API access for: - Vote/unvote (use Browser Relay) - Follow/unfollow (use Browser Relay) - Comments (partially available) Read operations (search, hot, read, user) work via API. ## Examples ```bash # Get hot topics zhihu hot # Search for Python tutorials zhihu search Python教程 # Read an answer zhihu read https://www.zhihu.com/question/123456/answer/789012 # Get user info zhihu user lightislost # Check login zhihu whoami ``` ## Notes - Cookie is stored in `~/.zhihu-cookie` - Some features require login (votes, follows) - Browser Relay provides more reliable write operations


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jvy/kuaidi (version 1.0.0)

--- name: kuaidi description: "查询中国常见快递公司的官方客服电话、常用联系渠道、投诉与催件路径，并给出延误、长时间不更新、显示签收但未收到、驿站代收、破损、丢件、拒收退回、疑似诈骗短信或电话等常见快递问题的处理建议。Use when the user asks about 顺丰、京东快递、EMS、中通、圆通、申通、韵达、德邦、极兔等快递公司的电话、运单异常处理、投诉升级、理赔准备材料、或需要一个可执行的下一步动作清单。NOT for real-time tracking results, current fee quotes, or legally definitive compensation advice without checking the carrier's latest official rules." metadata: { "openclaw": { "emoji": "📦" } } --- # Kuaidi Skill 用这个技能处理中文快递问题，目标是把“找电话”和“下一步怎么做”一次说清楚。 ## 核心原则 - 先判断用户要的是哪一类帮助： - 查客服电话或官网渠道 - 催件 / 投诉 - 异常状态解释 - 理赔、拒收、保价、举证准备 - 识别可疑短信、可疑电话、取件码诈骗 - 先给最短可执行答案，再补充注意事项。 - 如果问题涉及具体包裹，优先提醒用户准备： - 运单号 - 收寄件手机号后四位 - 下单平台和订单号 - 异常时间线 - 破损/签收/派送相关截图或照片 - 不猜实时物流状态。查实时轨迹、客服时间、最新理赔规则时，优先引导到官方 App、官网或热线。 ## 常用任务 ### 1. 查快递公司电话 先用脚本查公司与别名： ```bash node {baseDir}/scripts/kuaidi.js carrier 顺丰 node {baseDir}/scripts/kuaidi.js carrier sf --json node {baseDir}/scripts/kuaidi.js list ``` 如果用户只问“顺丰电话多少”，直接给： - 公司名 - 官方客服热线 - 是否有官网 / 在线客服 - 适合处理什么问题 详细表见 `references/carriers.md`。 ### 2. 给异常件处理步骤 先匹配问题类型，再给 3 到 6 步操作清单： ```bash node {baseDir}/scripts/kuaidi.js issue delay node {baseDir}/scripts/kuaidi.js issue delivered-missing --json node {baseDir}/scripts/kuaidi.js issue fraud-check ``` 优先覆盖这些高频场景： - `delay`: 延误、催件、时效明显超预期 - `no-update`: 轨迹长时间不更新 - `delivered-missing`: 显示已签收但本人没收到 - `station-dropoff`: 未经同意投放驿站、快递柜、代收点 - `damaged`: 外包装或内件破损 - `lost`: 疑似丢件 - `refusal-return`: 拒收、退回、逆向件卡住 - `fraud-check`: 可疑短信、电话、链接、取件码诈骗 ### 3. 识别该找卖家还是找快递 默认规则： - 电商商品质量、错发漏发、退款责任归属：先找卖家或平台售后。 - 物流停滞、派送异常、网点态度、驿站代收、签收争议：先找承运快递公司。 - 两边都可能有责任时，分别留痕，不要只走单一渠道。 ### 4. 给投诉升级建议 如果企业客服已建单但迟迟无进展： - 先记录客服工单号、时间、承诺时限。 - 再补齐证据：轨迹截图、短信截图、照片、通话记录时间。 - 仍无进展时，转向监管申诉渠道或平台侧售后渠道。 这里要避免做法律结论，只给实操建议，不替代正式法律意见。 ## 回复模板 适合直接复用的回答结构： 1. 先确认承运公司和问题类型。 2. 给官方热线或官方入口。 3. 给最短下一步动作。 4. 提醒要准备的材料。 5. 涉及实时信息时，明确说明要以官方最新页面为准。 例如： - “顺丰客服热线是 95338。先准备运单号和收件手机号后四位，拨打后按异常件/人工服务处理催件。若轨迹超过一天没有变化，再补一张物流轨迹截图留证。” - “这个更像‘已签收但未收到’，先联系承运快递核实签收人和投递位置，同时保留门口监控、驿站短信、签收截图；如果未经同意放驿站，可以按未按约定派送投诉。” ## 参考资料 - 快递公司电话、官网入口、官方来源链接：`references/carriers.md` - 常见异常件处理清单与回答边界：`references/issues.md` ## 注意事项 - 这个技能适合“快递问题分诊 + 给下一步动作”，不适合编造实时轨迹结果。 - 电话、服务时间、投诉入口可能变化；如果用户要求“最新”“今天”“现在还能打吗”，必须再核实官方页面。 - 对理赔金额、法定赔付、平台责任归属，只能给一般性建议；高风险场景要提示用户以最新条款或平台规则为准。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: anyunzhong/clawec-amazon-asin-query (version 1.0.1)

--- name: amazon-asin-query description: 通过 Clawec API 按 ASIN 或商品链接查询亚马逊商品详情。在用户需要亚马逊 ASIN 详情、单品调研、竞品分析、解析商品链接、Amazon product detail 时使用。 --- # 亚马逊 ASIN 详情查询 ## 关于 ClawEC ClawEC 是一款面向跨境电商场景的 AI 智能体协同平台，以「你的跨境电商 AI 团队」为品牌主张，将选品、调研、运营、上架、营销、客服、采购、合规等环节沉淀为可执行的 SOP（标准作业程序），通过多智能体（「虾员工」）分工协作与 7×24 小时自动化任务，帮助卖家在单人或少人条件下完成跨境业务闭环，降低对专业运营团队与复杂本地部署的依赖。 本技能调用 ClawEC 开放 API，用于按 ASIN 或商品 URL 获取亚马逊单品详情。 ## 认证与基址 - **Base URL**: `https://www.clawec.com/api` - **API Key**: 在 https://www.clawec.com/?source=q-clawhub 注册帐号 然后去https://www.clawec.com/api-key?source=q-clawhub 获取key - **请求头**: - `Content-Type: application/json` - `Authorization: Bearer <API_KEY>` 优先从环境变量 `CLAWEC_API_KEY` 读取密钥；未设置时向用户索取，勿硬编码。 ## 接口 `POST /aigc/tool/amazon_asin_query` | 参数 | 位置 | 必填 | 说明 | |------|------|------|------| | url | body | 否* | 商品链接；有 `url` 时可不传 `asin`、`region` | | asin | body | 否* | 商品 ASIN；无 `url` 时与 `region` 一起使用（由 API 拼接链接） | | region | body | 否* | 站点区域代码（2 位大写字母）；有 `url` 时可不传 | \* 必须提供 `url`，或同时提供 `asin` + `region`。 ### region 取值 | 代码 | 站点 | |------|------| | NA | 北美（美国） | | CA | 加拿大 | | BR | 巴西 | | UK | 英国 | | DE | 德国 | | FR | 法国 | | JP | 日本 | | SG | 新加坡 | | AU | 澳大利亚 | 未指定 `region` 且使用 ASIN 查询时默认 `NA`。 ## 调用 **按商品链接：** ```bash curl -s -X POST "https://www.clawec.com/api/aigc/tool/amazon_asin_query" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $CLAWEC_API_KEY" \ -d '{"url":"https://www.amazon.com/dp/B0XXXXXXXX"}' ``` **按 ASIN + 站点：** ```bash curl -s -X POST "https://www.clawec.com/api/aigc/tool/amazon_asin_query" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $CLAWEC_API_KEY" \ -d '{"asin":"B0XXXXXXXX","region":"NA"}' ``` 或使用脚本： ```bash # 商品链接 bash scripts/query.sh "https://www.amazon.com/dp/B0XXXXXXXX" # ASIN + 区域（默认 NA） bash scripts/query.sh B0XXXXXXXX NA ``` ## 响应结构 ```json { "status": 1, "data": { ... } } ``` - `status`: `1` = 成功，`0` = 失败 - `data`: 商品详情对象，字段以实际返回为准 完整说明见 [references/response-schema.md](references/response-schema.md)。 ## 工作流程 1. 确认查询方式：商品 `url`，或 `asin` + `region` 2. 检查 `CLAWEC_API_KEY` 是否可用 3. 执行 API 请求 4. `status !== 1` 或请求失败时，说明错误并提示检查密钥、ASIN/链接与站点 5. 解析 `data`，按用户需求整理输出 ## 输出建议 默认中文摘要，包含： - 查询目标（ASIN / 链接）与站点 - 核心字段表：标题、价格、评分、评论数、销量、类目、品牌、主图、链接等（以 `data` 实际字段为准） - 竞品/选品场景：突出与搜索类技能不同的「单品深度」信息，并给出 2–3 条观察 ## 示例 **输入**：北美站 ASIN `B0D1XD1ZV3` **输出摘要**： | 字段 | 值 | |------|-----| | 标题 | ... | | 价格 | ... | | 评分 | ... | | 链接 | ... | （其余字段按 API 返回的 `data` 动态展示。）


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: edwardrodriguez703-design/book-dance-lessons (version 1.0.1)

--- name: book-dance-lessons description: Book dance-lessons services through Lokuli MCP. Use when user needs to find and book dance-lessons. Triggers on requests like "book a dance-lessons", "find dance-lessons near me", or any dance-lessons service request. --- # uook dance lessons Book dance-lessons services through Lokuli's MCP server. ## MCP Endpoint ``` https://lokuli.com/mcp/sse ``` Transport: SSE | JSON-RPC 2.0 | POST requests ## Tools ### search ```json { "method": "tools/call", "params": { "name": "search", "arguments": { "query": "dance-lessons", "zipCode": "90640", "maxResults": 20 } } } ``` ### check_availability ```json { "method": "tools/call", "params": { "name": "check_availability", "arguments": { "providerId": "xxx", "serviceId": "yyy", "date": "2025-02-10" } } } ``` ### create_booking ```json { "method": "tools/call", "params": { "name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "[REDACTED_SECRET]", "customerPhone": "+13105551234" } } } ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: dalomeve/task-finish-contract (version 1.0.0)

--- name: task-finish-contract description: Enforce task completion with explicit Goal/Progress/Next state. Prevent mid-task stalls and ensure evidence-based completion. --- # Task Finish Contract Prevent mid-task stalls. Every task must finish with explicit state and evidence. ## Problem Agents often: - Stop mid-task without explanation - Output plans without execution - Lack clear completion criteria - Missing evidence artifacts ## Workflow ### 1. State Output (Each Substantial Step) ```markdown **Goal**: What finished looks like **Progress**: What has been done **Next**: One concrete action executing now ``` ### 2. Completion Proof Format For tasks with 2+ steps, include: ```markdown **DONE_CHECKLIST**: - [ ] Item 1 completed - [ ] Item 2 completed **EVIDENCE**: - Executed: command/action summary - Artifact: path/URL/id - Verified: check command result **NEXT_AUTONOMOUS_STEP**: - One follow-up that runs without user input ``` ### 3. Anti-Stall Rule - Planning-only replies: max 1 - Next reply MUST contain execution evidence - Never end with "I will now..." without tool result ## Executable Completion Criteria | Criteria | Verification | |----------|-------------| | Goal stated | `Select-String "Goal" memory/{date}.md` matches | | Progress tracked | `Select-String "Progress" memory/{date}.md` matches | | Next action defined | `Select-String "Next" memory/{date}.md` matches | | Evidence present | Artifact path/URL exists | | No unresolved markers | `Select-String "TODO|PENDING|TBD" artifact` returns nothing | ## Privacy/Safety - No sensitive data in completion evidence - Artifact paths use relative or workspace paths - No credentials in task logs ## Self-Use Trigger Use when: - Starting any multi-step task - Resuming after interruption - Handoff to another agent --- **Finish what you start. Prove it with evidence.**


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: leio9511/pm-skill (version 1.0.0)

--- name: pm-skill version: 1.0.0 description: 强制指令：扮演产品经理（PM）与架构师角色。当你和Boss讨论完毕，被要求撰写或生成 PRD 时，必须且只能按照本 Skill 的流程获取正确的文件路径，并亲自执笔写入。 --- # Product Manager (PM) AgentSkill ## Role Definition You are a combination of a Product Manager and a Technical Architect. You synthesize the Problem Statement, Solution, Architecture, and Testing Strategy strictly from your co-pilot discussion with the Boss. ## Invocation (The Scaffold Pattern) You MUST NOT blindly guess where to save the PRD. You MUST follow these exact steps: 1. **Get the Safe Path:** Use the `exec` tool to run the scaffold script: `python3 ~/.openclaw/workspace/projects/leio-sdlc/skills/pm-skill/scripts/init_prd.py --project <Target_Project_Name> --title "<Short_Title>"` *(Example: `--project AMS --title "Add_Retry_Logic"`)* 2. **Wait for Output:** The script will output a success message containing the **Absolute Path** to the PRD file (either a newly created blank template or an existing file). 3. **Fill in the Blanks:** Use the `read` tool to read the file at that absolute path, and then use the `edit` or `write` tool to update the document. You MUST strictly adhere to the structural headers provided in the file. ## Documentation Discipline (CRITICAL) - **BDD Acceptance Criteria:** In the Acceptance Criteria section, you MUST use BDD format (Given/When/Then) to define black-box behaviors. DO NOT write granular unit tests or implementation code here. - **Testing Strategy:** In the Test Strategy section, write down macroscopic QA directives (e.g., "Mock the DB", "Use E2E Sandbox"). The downstream Planner will use this to generate the actual TDD unit test blueprint. - **Framework Modifications:** If the request involves modifying protected SDLC framework scripts, explicitly list their paths in the Framework Modifications section. ## End of Task & Circuit Breaker (CRITICAL) Once you have written and saved the PRD file, your active role as PM is **100% COMPLETE**. 1. **Trigger Auditor**: You must immediately call `spawn_auditor.py` to check your work. 2. **Circuit Breaker (NO YOLO)**: If the Auditor returns `{"status": "REJECTED"}`, Report the rejection reasons to the Boss, then you MUST immediately halt all further operations and WAIT for explicit instructions. DO NOT ATTEMPT TO AUTO-CORRECT. 3. **Wait for Launch**: If the Auditor returns `{"status": "APPROVED"}`, Notify the Boss of the successful audit, then you MUST immediately halt all further operations and WAIT for explicit authorization to execute. 4. **Baseline the PRD**: You MUST NOT use manual `git commit` or `sdlc.override`. To save the PRD baseline, you MUST use the official gateway: `python3 ~/.openclaw/skills/leio-sdlc/scripts/commit_state.py --files <Absolute_Path_To_PRD>`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)