OpenClaw/clawhub-security-signals huggingface dataset:
Skill: wuxi304-collab/stainless-client-tracker (version 1.0.0)

# stainless-client-tracker - 不锈钢客户跟进管理系统 ## 技能描述 专为不锈钢行业设计的客户跟进管理工具，追踪从初次接触到成交的全流程。 ## 核心功能 ### 1️⃣ 客户分类管理 - **行业细分**：封头/压力容器/造纸设备/化工设备/环保设备等 - **规模分级**：大型（年产值>1 亿）/中型（5000 万 -1 亿）/小型（<5000 万） - **地域分布**：按省份/城市聚类 - **产品需求**：304/316L/2205/2507 等牌号偏好 ### 2️⃣ 跟进阶段追踪 ``` 线索 → 初次接触 → 需求确认 → 报价 → 样品 → 谈判 → 成交 → 复购 ``` 每个阶段记录： - 跟进日期 - 联系人/职位 - 沟通要点 - 下一步行动 - 预计成交金额 ### 3️⃣ 拜访记录管理 - **拜访日期**：自动关联天气/交通 - **参与人员**：客户方 + 我方 - **讨论议题**：技术/价格/交期/服务 - **客户反馈**：正面/负面/中性 - **待办事项**：自动提醒 ### 4️⃣ 商机漏斗分析 - **Pipeline 可视化**：各阶段客户数量/金额 - **转化率统计**：阶段间转化比例 - **预测分析**：基于历史数据的成交概率 - **业绩目标**：月度/季度/年度达成率 ### 5️⃣ 自动提醒 - **跟进提醒**：超过 7 天未联系的客户 - **生日/节日**：客户关键日期关怀 - **合同到期**：续约/复购提醒 - **价格波动**：镍价/钢价大幅变动时通知重点客户 ### 6️⃣ 报表生成 - **周报**：本周跟进客户/新增商机/预计成交 - **月报**：业绩达成/客户增长/问题分析 - **季度复盘**：成功/失败案例总结 ## 数据结构 ### 客户档案 ```json { "客户 ID": "CLI-2026-001", "名称": "新乡七里营封头厂", "行业": "封头制造", "规模": "中型", "地址": "河南省新乡市新乡县七里营镇", "联系人": [ { "姓名": "张总", "职位": "采购经理", "电话": "138****1234", "微信": "zhang_xxx" } ], "产品需求": ["304 热轧板", "316L 冷轧板"], "年采购量": "500 吨", "当前阶段": "报价", "预计成交": "2026-04-15", "成交概率": "60%" } ``` ### 跟进记录 ```json { "记录 ID": "FOL-20260326-001", "客户 ID": "CLI-2026-001", "日期": "2026-03-26", "方式": "上门拜访", "参与人": ["张总", "李工"], "要点": [ "确认 304 材质要求", "讨论交期 15 天", "样品已寄送" ], "下一步": "等待样品确认", "截止日": "2026-04-05" } ``` ## 使用示例 ```javascript // 新增客户 await tracker.addClient({ 名称："万福压力容器", 行业："压力容器", 地址："江苏省扬州市广陵区泰安镇" }); // 记录跟进 await tracker.logFollowUp({ 客户 ID："CLI-2026-002", 日期："2026-03-26", 方式："电话", 要点：["确认技术参数", "约定下周拜访"] }); // 生成周报 const report = await tracker.generateWeeklyReport({ 日期范围：["2026-03-24", "2026-03-30"] }); ``` ## 集成能力 - **飞书集成**：自动同步客户信息到飞书多维表格 - **微信集成**：客户生日/节日自动发送祝福 - **邮件集成**：报价单/合同自动发送 - **日历集成**：拜访行程自动添加到日历 ## 版本历史 - **v1.0.0** (2026-03-26) - 初始版本 - 基础客户档案管理 - 跟进记录功能 - 周报生成模板 --- **作者**: 商务拓展专家 👔 **适用场景**: 不锈钢客户管理、销售跟进、业绩追踪


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 279458179/minimaxmusic (version 1.0.0)

--- name: minimax-music-generation description: 使用 MiniMax API 生成创意音乐。当用户要求生成音乐、创作歌曲、制作背景音乐时使用。支持纯音乐和人声歌曲，可指定风格、情绪和场景。 --- # MiniMax 音乐生成 ## 快速开始 ### API 端点 ``` POST https://api.minimaxi.com/v1/music_generation ``` ### 请求格式 (PowerShell) ```powershell $json = @{ model = "music-2.6" prompt = "音乐描述（风格、情绪、场景）" is_instrumental = $true # $false = 带歌词的人声歌曲 output_format = "url" # 返回 URL 而非 hex lyrics = "歌词内容" # 仅非纯音乐时需要 } | ConvertTo-Json -Compress Invoke-RestMethod -Uri "https://api.minimaxi.com/v1/music_generation" -Method Post -Headers @{ Authorization = "Bearer <API_KEY>" } -ContentType "application/json" -Body ([System.Text.Encoding]::UTF8.GetBytes($json)) -TimeoutSec 180 ``` ### 参数说明 | 参数 | 必填 | 说明 | |------|------|------| | model | 是 | 使用 `music-2.6` | | prompt | 是 | 音乐描述，1-2000字符，如"流行音乐,欢快,适合广告背景" | | is_instrumental | 否 | `$true`=纯音乐，`$false`=人声歌曲（默认） | | lyrics | 否 | 歌词，使用`\n`分隔行，支持标签`[Verse]` `[Chorus]`等 | | output_format | 否 | `url`（推荐）或`hex`，默认hex | | audio_setting | 否 | 音频设置：sample_rate(44100), bitrate(256000), format(mp3) | ### 响应示例 ```json { "data": { "audio": "https://...", "status": 2 }, "extra_info": { "music_duration": 142576, // 毫秒 "music_sample_rate": 44100, "bitrate": 256000 }, "base_resp": { "status_code": 0, "status_msg": "success" } } ``` ## 工作流程 1. 构建 JSON 请求体 2. 调用 API（超时建议 180 秒） 3. 检查 `base_resp.status_code === 0` 4. 下载音频文件（URL 有效期 24 小时） 5. 发送给用户 ## 常见错误 - `invalid params`: 参数格式错误，检查 JSON 结构和必填字段 - `insufficient balance`: 余额不足 - `model: xxx not support`: Token 未开通该模型权限 ## 提示词技巧 - **纯音乐**: `is_instrumental: $true`，prompt 示例：`独立民谣,忧郁,内省,渴望,独自漫步,咖啡馆` - **人声歌曲**: `is_instrumental: $false`，提供 lyrics，prompt 示例：`流行音乐,欢快,青春校园` - **歌词标签**: `[Verse]` `[Chorus]` `[Pre-Chorus]` `[Bridge]` `[Interlude]` `[Outro]`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector:  ()
Skill: mtsatryan/ah-documentation-writer (version 1.0.0)

--- name: documentation-writer description: 'You are a documentation writing specialist with expertise in technical writing, API documentation, user guides, and automated documentation. Use when: technical documentation and writing, api documentation, code documentation and comments, user guides and tutorials, architecture documentation.' --- # Documentation Writer You are a documentation writing specialist with expertise in technical writing, API documentation, user guides, and automated documentation generation. ## Core Expertise - Technical documentation and writing - API documentation (OpenAPI, Swagger, GraphQL) - Code documentation and comments - User guides and tutorials - Architecture documentation - README files and wikis - Documentation automation and generation - Documentation-as-code practices ## Technical Stack - **Doc Generators**: JSDoc, TypeDoc, Sphinx, Doxygen, GoDoc - **API Docs**: Swagger/OpenAPI, Postman, Insomnia, GraphQL Playground - **Static Sites**: Docusaurus, MkDocs, VuePress, GitBook - **Diagrams**: Mermaid, PlantUML, Draw.io, Lucidchart - **Formats**: Markdown, reStructuredText, AsciiDoc, LaTeX - **Publishing**: GitHub Pages, Read the Docs, Netlify, Vercel - **Testing**: Vale, textlint, markdown-lint, write-good ## Automated Documentation Framework > 📎 **Code example 1** (typescript) — see [references/examples.md](references/examples.md) ## API Documentation Templates > 📎 **Code example 2** (typescript) — see [references/examples.md](references/examples.md) ## Best Practices 1. **Comprehensive Coverage**: Document all aspects of the project 2. **Consistency**: Maintain consistent style and format 3. **Automation**: Automate documentation generation 4. **Examples**: Include practical, working examples 5. **Versioning**: Version documentation with code 6. **Accessibility**: Ensure documentation is accessible 7. **Maintenance**: Keep documentation up-to-date ## Documentation Strategies - API-first documentation approach - Documentation-as-code methodology - Automated extraction from code - Interactive documentation with examples - Multi-format output (MD, HTML, PDF) - Continuous documentation integration - Documentation testing and validation ## Approach - Analyze project structure and code - Extract documentation from comments - Generate comprehensive API docs - Create user-friendly guides - Build architecture documentation - Validate all documentation - Publish in multiple formats ## Output Format - Provide complete documentation frameworks - Include template libraries - Document API specifications - Add user guide templates - Include architecture diagrams - Provide validation tools --- ## Reference Materials For detailed code examples and implementation patterns, see [references/examples.md](references/examples.md).


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: arianxx/feishu-group-thread-reply (version 1.0.0)

--- name: feishu-group-thread-reply description: | Force openclaw-lark bot replies into message threads in Feishu group chats, preventing main chat noise. Patches the plugin's dispatch layer and optionally the feishu-live-card watcher. Use when: (1) Bot replies appear in the main group chat stream instead of threads (2) After updating openclaw-lark plugin (patches get overwritten by npm updates) (3) User mentions "thread reply", "群聊 thread", "回复到话题", "thread 回复" (4) Checking if the thread reply patch is still applied (5) Setting up a new OpenClaw instance with Feishu group chats --- # Feishu Group Thread Reply Patch openclaw-lark to reply in threads for all group chat messages. ## Quick Apply ```bash # 1. Patch plugin bash scripts/patch-lark-thread.sh # 2. Patch live-card (if installed) python3 scripts/patch-live-card.py # 3. Restart gateway openclaw gateway restart ``` ## Check Status ```bash bash scripts/patch-lark-thread.sh --check-only python3 scripts/patch-live-card.py --check-only ``` ## Heartbeat Auto-Check Add to `HEARTBEAT.md` to auto-detect and re-apply after plugin updates: ```markdown ### openclaw-lark thread patch Run: `bash <skill-dir>/scripts/patch-lark-thread.sh --check-only` If exit code 1, re-apply: `bash <skill-dir>/scripts/patch-lark-thread.sh` then restart gateway. ### feishu-live-card watcher Check running: `ps aux | grep watcher.py | grep -v grep` If not running: `cd ~/.openclaw/skills/feishu-live-card && python3 watcher.py start &` ``` ## How It Works The plugin hardcodes `replyInThread: dc.isThread` which is only true when the incoming message is already in a thread. The patch changes this to `dc.isGroup || dc.isThread` so all group replies use threads. For detailed explanation, see `references/how-it-works.md`. ## After Plugin Updates The openclaw-lark plugin is npm-installed. Updates overwrite patched files. Re-run: ```bash bash scripts/patch-lark-thread.sh openclaw gateway restart ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: lettywyse/investment-browser-sec (version 1.0.0)

--- name: Investment Browser SEC Scraper description: | Professional SEC EDGAR 10-Q/10-K parser for institutional investors. Extracts 47 financial metrics from HTML tables including Revenue, Net Income, EPS, Free Cash Flow, Balance Sheet items, MD&A risk factors. Auto-calculates YoY growth, gross margins (45.2% TSLA Q3'25), operating margins (9.1%), current ratio (2.12x), debt-to-equity. Exports native CSV/HTML/PDF/MD formats. keywords: [sec, edgar, 10q, 10k, earnings, financials, investing, portfolio] category: Finance price: 19 version: 1.0.0 author: Leticia --- # 🚀 Investment Browser SEC Scraper ## **TSLA Q3 2025 EXECUTED DEMO** (4 archivos generados): undefined ## 47 MÉTRICAS EXTRAÍDAS: | Category | Metrics | TSLA Q3'25 | |----------|---------|------------| | **P&L** | Revenue, Gross Profit, Net Income | $25.7B, $11.6B, $1.9B | | **Cash Flow** | FCF, Operating CF | $2.3B, $3.7B | | **Balance Sheet** | Cash, Debt | $33.6B, $12.4B | ## TRIGGERS: - "Investment Browser TSLA Q3" - "SEC 10Q AAPL latest" - "NVDA balance sheet" **$19/mes - Datos SEC reales sin APIs**


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: yinsuso/yinsuso-server-monitor (version 1.0.0)

# Server Monitor — 服务器监控技能 ## 描述 监控服务器核心资源（CPU、内存、磁盘、网络、负载），支持阈值告警和定时检查。基于 Linux 原生命令，无需额外安装。 ## 触发场景 - 用户要求"查看服务器状态"、"监控服务器"、"系统怎么样" - 定时检查服务器资源使用情况 - 资源超阈值时主动告警 ## 监控指标与命令 ### CPU 使用率 ```bash top -bn1 | grep "Cpu(s)" | awk '{print 100 - $8}' ``` 或使用： ```bash vmstat 1 2 | tail -1 | awk '{print 100 - $15}' ``` ### 内存使用 ```bash free -m | awk '/Mem:/ {printf "已用 %sMB / 总计 %sMB (%.1f%%)\n", $3, $2, $3*100/$2}' ``` ### 磁盘使用 ```bash df -h | grep -E '^/dev/' | awk '{printf "%s: 已用 %s/%s (%s)\n", $6, $3, $2, $5}' ``` ### 系统负载 ```bash uptime | awk -F'load average:' '{print $2}' | xargs ``` 返回值：1分钟、5分钟、15分钟平均负载 ### 网络流量 ```bash cat /proc/net/dev | grep -E 'eth0|ens|enp' | awk '{printf "接收: %.1fMB | 发送: %.1fMB\n", $2/1024/1024, $10/1024/1024}' ``` ### 磁盘 IO ```bash iostat -x 1 1 2>/dev/null || echo "未安装sysstat" ``` ## 一键全状态检查 ```bash echo "=== 服务器状态 ===" echo "" echo "📅 时间: $(date '+%Y-%m-%d %H:%M:%S')" echo "🖥️ 主机: $(hostname)" echo "⏱️ 运行: $(uptime -p 2>/dev/null || uptime | awk -F'up ' '{print $2}' | awk -F',' '{print $1}')" echo "" echo "💻 CPU: $(top -bn1 | grep 'Cpu(s)' | awk '{printf "%.1f%%", 100-$8}')" echo "🧠 内存: $(free -m | awk '/Mem:/{printf "%dMB/%dMB (%.1f%%)", $3, $2, $3*100/$2}')" echo "💾 磁盘: $(df -h / | awk 'NR==2{printf "%s/%s (%s)", $3, $2, $5}')" echo "📊 负载: $(uptime | awk -F'load average:' '{print $2}' | xargs)" echo "🌐 网络: $(cat /proc/net/dev | grep -E 'eth0|ens' | awk '{printf "↓%.1fMB ↑%.1fMB", $2/1024/1024, $10/1024/1024}')" echo "" echo "=== 占用前五进程 ===" ps aux --sort=-%mem | head -6 | awk 'NR>1{printf "%-20s %5s %5s\n", $11, $4"%", $4"MB"}' ``` ## 告警阈值配置 默认告警阈值： - CPU > 80% ⚠️ - 内存 > 85% ⚠️ - 磁盘 > 90% 🔴 - 负载 > CPU核心数 × 2 ⚠️ 发现超阈值时： 1. 记录告警信息 2. 如用户配置了通知渠道，发送告警消息 3. 建议处理方案 ## 定时监控 通过 cron 实现定时检查： ```bash # 每15分钟检查一次，超阈值通知 */15 * * * * /path/to/check.sh ``` 或通过 heartbeat 检查： 将检查指令加入 `HEARTBEAT.md`。 ## 进程异常检测 查找高资源占用进程： ```bash # CPU占用前10 ps aux --sort=-%cpu | head -11 | tail -10 # 内存占用前10 ps aux --sort=-%mem | head -11 | tail -10 # 僵尸进程 ps aux | awk '$8 ~ /Z/ {print}' ``` ## 使用示例 **用户**: "看看服务器状态" 执行一键全状态检查命令，格式化返回结果。 **用户**: "CPU占用高吗" 执行CPU检查命令，分析结果。 **用户**: "磁盘还剩多少" 执行磁盘检查命令，返回各分区剩余空间。 ## 注意事项 - 所有命令均为只读，不影响系统运行 - 需要基础 Linux 命令可用（top, free, df等） - 网络接口名可能因系统而异（eth0/ens/enp等），需根据实际调整 - 高负载时可建议用户执行 `htop` 进一步分析需安装 - 可配合 `universal-notify` 技能实现告警通知


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: agimodel/build (version 1.0.0)

--- name: build description: > The Autonomous Construction and Synthesis Engine. Standardizing the process of turning abstract intent into concrete digital and physical structures. --- # Build: The Architecture of Creation ## I. From Intent to Artifact **Build** is the foundational motor of progress. It manages the synthesis of code, hardware designs, and organizational structures, providing a unified interface for the "Act of Creation." ## II. Synthesis Layers - **Software**: Autonomous code generation and system architecture. - **Infrastructure**: Provisioning the skeletal frames for digital ecosystems. - **Organization**: Forming teams and operational workflows from scratch.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yshuolu/skillboss-models (version 1.0.0)

--- name: skillboss description: "Multi-AI gateway for agents. 50+ models: chat, image, video, TTS, STT, music, search." allowed-tools: Bash, Read metadata: {"clawdbot":{"requires":{"bins":["node"],"env":["SKILLBOSS_API_KEY"]},"primaryEnv":"SKILLBOSS_API_KEY"}} --- # SkillBoss One API key, 50+ models. Chat, image, video, TTS, STT, music, web search. ## List Models ```bash node {baseDir}/scripts/run.mjs --models node {baseDir}/scripts/run.mjs --models image node {baseDir}/scripts/run.mjs --models chat ``` ## Run a Model ```bash node {baseDir}/scripts/run.mjs --model bedrock/claude-4-5-sonnet --prompt "Explain quantum computing" node {baseDir}/scripts/run.mjs --model mm/img --prompt "A sunset over mountains" node {baseDir}/scripts/run.mjs --model minimax/speech-01-turbo --text "Hello world" ``` ## Smart Mode ```bash node {baseDir}/scripts/run.mjs --tasks node {baseDir}/scripts/run.mjs --task image --prompt "A sunset" node {baseDir}/scripts/run.mjs --task chat --prompt "Hello" --prefer price node {baseDir}/scripts/run.mjs --task tts --text "Hello world" ``` ## Save Media Files For image, video, audio, and TTS results the script prints the media URL. Use curl to download: ```bash URL=$(node {baseDir}/scripts/run.mjs --model mm/img --prompt "A sunset") curl -sL "$URL" -o sunset.png ``` ## Options | Flag | Description | |------|-------------| | `--models [type]` | List models (filter by type) | | `--model <id>` | Run a model by ID | | `--tasks` | List task types | | `--task <type>` | Auto-select best model | | `--prefer 
` | price / quality / balanced | | `--prompt <text>` | Text prompt | | `--text <text>` | Text for TTS | | `--size <WxH>` | Image/video size | | `--duration <sec>` | Duration for music/video | | `--voice-id <id>` | Voice ID for TTS | | `--image <url>` | Image URL for i2v | | `--context <text>` | System context for chat | Notes: - Get API key at https://www.skillboss.co - Use `--models` to discover available models - Use `--prefer price` for cheapest option


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 3rdbrain/hn-prospecting (version 1.0.0)

--- name: hn-prospecting description: Find high-intent leads on Hacker News via the free Algolia API — no API key needed. Score posts, surface Ask HN threads, and identify technical founders actively seeking tools. version: 1.0.0 author: ModelFitAI <[REDACTED_SECRET]> license: MIT keywords: [openclaw, skill, hackernews, hn, lead-gen, prospecting, sales, founders] requires: {} --- # Hacker News Prospecting Skill Find warm leads in Hacker News threads — technical founders and buyers actively seeking tools. Uses the **free Algolia HN Search API** — no API key, no credentials, no rate limits worth worrying about. ## How It Works The HN Algolia API (`hn.algolia.com`) provides full-text search over all HN content — stories, Ask HN threads, and comments — completely free with no auth. This skill searches for buying-intent posts and scores them by lead quality. ## Commands Run with Node.js: `node {baseDir}/hn-prospecting.js <command> [args]` - **search `<keyword>`** — Find high-intent HN posts mentioning your keyword - **ask** — Find recent "Ask HN" threads (best for tool discovery opportunities) - **front** — Get current front page stories (trending technical discussions) - **score** — Score an HN post for lead quality ## Usage ```bash node {baseDir}/hn-prospecting.js search "looking for AI agent tool" node {baseDir}/hn-prospecting.js search "alternative to Zapier" node {baseDir}/hn-prospecting.js ask "lead generation" node {baseDir}/hn-prospecting.js front node {baseDir}/hn-prospecting.js score --title "Ask HN: What do you use for outreach?" --points 45 --comments 32 ``` ## Environment Variables None required. The HN Algolia API is fully public. ## Why HN? HN readers are disproportionately technical founders, early adopters, and decision-makers — the exact ICP for most B2B SaaS tools. "Ask HN: What tools do you use for X?" threads are goldmines for qualified lead discovery.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: azraelji/testhy (version 1.0.0)

# Claude Skills 开发框架架构指导手册 ## 1. 项目概述 (Overview) 本框架基于 Anthropic Claude 的 Tool Use (Skills) 特性构建，旨在提供一个通过自然语言聊天即可调用各类底层工具的开发脚手架。 框架遵循高内聚、低耦合的设计原则，使开发者能够专注于“技能（Skill）”本身的编写，而无需过度关心 LLM 对话上下文、工具发现与函数执行的复杂逻辑。 ## 2. 架构设计 (Architecture Design) 整个系统分为以下几个分层架构： - **交互层 (CLI/API Interface)**: 负责接收用户输入，展示 Agent 的回复或执行结果。`main.py` - **代理层 (Agent Layer)**: 负责维护对话历史、与 Claude API 交互，解析模型返回的 Tool Use 请求。`core/agent.py` - **注册与调度层 (Registry & Dispatcher)**: 维护系统中所有可用的 Skills（工具），向 LLM 声明这些工具的 JSON Schema，并根据 LLM 的指令找到对应的 Python 函数执行器。`core/registry.py` - **技能层 (Skills Layer)**: 具体的业务代码抽象类及实现，继承自统一的 BaseSkill。`core/skill_base.py`, `skills/*` ## 3. 核心模块说明 (Core Modules)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: brucegutman/pipeworx-poetry (version 1.0.0)

--- name: pipeworx-poetry description: Poetry MCP — PoetryDB API (free, no auth) version: 1.0.0 metadata: openclaw: homepage: https://pipeworx.io/packs/poetry --- # pipeworx-poetry Poetry MCP — PoetryDB API (free, no auth). Free, no API key. Part of [Pipeworx](https://pipeworx.io). ## Tools - `search_poems` - `poems_by_author` - `random_poems` ## Connect ```json { "mcpServers": { "pipeworx-poetry": { "command": "npx", "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/poetry/mcp"] } } } ``` More at [pipeworx.io/packs/poetry](https://pipeworx.io/packs/poetry)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xiaoyiweio/brown-dust-2 (version 1.1.1)

--- name: brown-dust-2 description: "Brown Dust 2 全自动工具 — 每日/每周签到 + 活动出席签到 + 兑换码全自动兑换。触发词：BD2、棕色尘埃、brown dust、签到、兑换码、redeem。" version: 1.1.0 --- # Brown Dust 2 Automation 棕色尘埃2 全自动签到 + 兑换码兑换。 ## 触发规则 | 模式 | 示例 | |------|------| | 包含 `BD2` / `棕色尘埃` / `brown dust` | "BD2签到", "棕色尘埃兑换码" | | 包含 `签到` + 游戏相关 | "帮我BD2签到", "BD2每日签到" | | 包含 `兑换码` / `redeem` / `gift code` | "BD2兑换码", "redeem BD2 codes" | ## 三大功能 ### 功能 1 — Web Shop 签到（纯 API） 每日签到 + 每周签到 + 活动出席，一条命令搞定。 ```bash # 执行全部签到 python3 {baseDir}/scripts/signin.py # 查看活动信息 python3 {baseDir}/scripts/signin.py --event-info # 仅每日签到 python3 {baseDir}/scripts/signin.py --daily-only ``` ### 功能 2 — 兑换码自动兑换（纯 API） 自动从 BD2Pulse 抓取最新兑换码 → 调用官方 API 一键兑换。 ```bash # 自动抓取 + 全部兑换 python3 {baseDir}/scripts/redeem.py # 只看有哪些码 python3 {baseDir}/scripts/redeem.py --list ``` ### 功能 3 — 全套自动化 先签到再兑换码，一次跑完。 ## 前置要求 | 功能 | 需要什么 | 如何获取 | |------|---------|---------| | 签到 | Web Shop accessToken | 浏览器登录后提取（详见 persona.md） | | 兑换码 | 游戏内昵称 | `--save-nickname "昵称"` | ## Token 设置（首次 / 过期时） > **Agent 应通过浏览器工具自动提取 Token：** > > 1. 用 browser 工具打开 `https://webshop.browndust2.global/CT/` > 2. 等待页面加载 + 用户登录 > 3. 用 evaluate 执行 JS 提取 token： > ```js > JSON.parse(localStorage.getItem("session-storage")).state.session.accessToken > ``` > 4. 保存 token：`python3 signin.py --save-token "{token}"` > > 如果自动提取失败，引导用户手动操作： > F12 → Console → 粘贴上述 JS → 把结果告诉 Agent


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: liyico/local-file-manager (version 1.0.0)

--- name: local-file-manager description: Read, write, append, and list local files in the session's working directory. Use when you need to persist output to disk, read input files, or manipulate file system safely. Supports text files, JSON, CSV, Markdown. --- # Local File Manager Skill This skill provides safe file I/O operations within the session's `cwd`. It is designed for roles that need to store outputs locally (no cloud sync). ## Capabilities - **Read file**: Get contents of a text file - **Write file**: Create or overwrite a file - **Append file**: Add content to existing file - **List files**: Directory listing with filtering - **Delete file**: Remove a file (with safety checks) - **Copy/Move**: Simple file operations ## When to Use Role needs to: - Save generated code/analysis to disk - Read input documents (PDFs, text, etc.) - Append logs or results - Create output files in Markdown/JSON/CSV ## Usage ```bash # Read a file file-manager --action read --path output.md # Write content (from stdin or --content) file-manager --action write --path result.json --content '{"status":"done"}' # Append to file file-manager --action append --path log.txt --content "Job completed at $(date)" # List files in directory file-manager --action list --dir . --pattern "*.md" # Create directory file-manager --action mkdir --dir reports # Delete file (with confirmation) file-manager --action delete --path old_file.txt ``` ## Safety - **Sandboxed to cwd**: Cannot access files outside session's working directory - **Protected files**: Cannot delete files starting with `.` or in `../` - **Size limit**: Max file size 10MB (configurable) - **Dry-run support**: `--dry-run` shows what would happen ## Integration with Roles In role config, enable this skill: ```yaml plugins: allow: - local-file-manager - doc-parser ``` Then in the role's system prompt, guide usage: ``` When you finish analysis, write the result to a file: file-manager --action write --path summary.md --content "$YOUR_MARKDOWN" ``` ## Examples **Researcher saving analysis:** ```bash file-manager --action write --path analysis_$(date +%Y%m%d).md \ --content "# Analysis\n\n## Summary\n..." ``` **Developer saving code:** ```bash file-manager --action write --path src/main.py --content "$CODE" ``` **Automation appending log:** ```bash file-manager --action append --path /var/log/automation.log \ --content "[$(date)] Task completed\n" ``` ## Error Handling - If file doesn't exist for read: returns error code 1 - If path is outside cwd: denied - If write fails (permission): returns error - All errors logged to `~/.openclaw/logs/file-manager.log` ## Configuration Environment variables: - `FILE_MANAGER_MAX_SIZE`: Max file size in bytes (default 10485760) - `FILE_MANAGER_LOG`: Path to operation log (default `~/.openclaw/logs/file-manager.log`) - `FILE_MANAGER_DRY_RUN`: Set to "1" to only simulate operations


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)