OpenClaw/clawhub-security-signals huggingface dataset:
Skill: zvirb/gmail-send-email (version 1.0.2)

--- name: Gmail Send Email description: Atomic node skill to send an email via Gmail using the gog CLI. os: all requires: bins: - gog --- ## Lean Philosophy (Principles) - **Kaizen (改善):** This skill is an atomic node, broken down into its simplest, smallest component to eliminate waste and ensure perfection. - **Standardized Work (Hyojun Sagyo):** This node represents the most efficient, standardized path for this specific task before automation. - **Jidoka (自働化):** This node includes autonomous defect detection. It relies on the CLI's self-healing loop and will report errors if sending fails. # Gmail Send Email This skill allows the agent to send an email using the native CLI. ## Cognitive Directives WHEN [An email needs to be sent to one or more recipients] THEN [Execute the native terminal command `gog gmail send --to "..." --subject "..." --body "..."`] ## Schema Example ```json { "command": "gog gmail send --to \"[REDACTED_SECRET]\" --subject \"Invoice\" --body \"Please find the invoice attached.\" --json" } ``` ## Expected Output Confirmation that the email was sent successfully.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: andrewgufx/website-builder (version 1.0.0)

You are Website Builder, a product-minded website planning assistant. Your job is to help the user design and structure websites through conversation. You are not just a coder. You are a combined product strategist, UX planner, copywriter, and implementation assistant. Primary goals: 1. Understand the user's website goal. 2. Translate vague ideas into a clear site structure. 3. Propose pages, sections, content hierarchy, and user flow. 4. Write effective copy when needed. 5. Break the site into practical implementation tasks. 6. When asked, generate component ideas, page specs, or starter code plans. Rules: - Default to clarity and practicality. - Prefer simple, shippable website structures. - Do not over-engineer unless the user explicitly asks. - If the request is vague, make reasonable assumptions and state them. - Focus on helping the user ship a useful first version quickly. - Separate strategy, content, and implementation clearly. Output sections in this exact order: 1. Goal Interpretation 2. Recommended Site Type 3. Page Structure 4. Section-by-Section Breakdown 5. Suggested Copy 6. Visual / UX Direction 7. Tech Stack Suggestion 8. Build Plan 9. Optional Next Step Style: - Structured - Product-oriented - Startup-friendly - Clear enough for direct implementation


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bytesagain3/sms (version 3.0.0)

--- name: "sms" version: "3.0.0" description: "Manage SMS templates with variable substitution and formatting. Use when preparing bulk messages." author: "BytesAgain" homepage: "https://bytesagain.com" --- # sms Manage SMS templates with variable substitution and formatting. Use when preparing bulk messages. ## Commands ### `create` ```bash scripts/script.sh create <name text> ``` ### `list` ```bash scripts/script.sh list ``` ### `preview` ```bash scripts/script.sh preview <name> ``` ### `send` ```bash scripts/script.sh send <name phone> ``` ### `var` ```bash scripts/script.sh var <name key_val> ``` ### `export` ```bash scripts/script.sh export <file> ``` ## Data Storage Data stored in `~/.local/share/sms/`. --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: jasonoa888/marketing-genius (version 3.3.0)

--- name: marketing-genius description: Generate buyer psychology + ad copy. Use when user wants marketing insights, ad copy, or value propositions. --- # Marketing Genius Generate buyer psychology + ad copy for any product. ## Usage Tell OpenClaw: ``` 用marketing-genius分析 [产品]，受众是[受众] ``` ## What it does 1. Analyze product (URL or description) 2. Generate 3 cognitive shortcuts (heuristics) 3. Generate 5 ad copy variations ## API POST https://1agent.fyi/api ```json { "product": "Your product", "audience": "Target audience", "lang": "en" or "zh", "copyCount": 5 } ``` ## Output ```json { "heuristics": [ {"shortcut": "...", "explanation": "...", "applicationExample": "..."} ], "messaging": {...}, "adCopy": [...] } ```

path: metadata.json
content: name: marketing-genius
title: Marketing Genius
description: Generate buyer psychology + ad copy for any product
version: 3.3.0
author: JasonOA888
category: Marketing

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kai-tw/kai-tw-figma (version 1.0.3)

--- name: figma description: Interact with the Figma REST API to read files, export layers/components as images, and retrieve comments. Use when the user needs information from Figma designs or wants to export assets for development. Triggers include "read figma file", "export figma layer", or "check figma comments". metadata: openclaw: emoji: 📐 requires: env: - FIGMA_TOKEN --- # Figma Skill This skill allows the agent to interact with Figma files via the REST API. ## Setup Requires a Figma Personal Access Token (PAT). Environment Variable: `FIGMA_TOKEN` ## Procedures ### 1. Read File Structure To understand the contents of a Figma file (pages, frames, layers): `python scripts/figma_tool.py get-file <file_key>` ### 2. Export Images To export specific layers/components as images: `python scripts/figma_tool.py export <file_key> --ids <id1>,<id2> --format <png|jpg|svg|pdf> --scale <1|2|3|4>` ### 3. Check Comments To list recent comments on a file: `python scripts/figma_tool.py get-comments <file_key>` ## References - [Figma API Documentation](https://www.figma.com/developers/api)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: ivangdavila/serbian (version 1.0.0)

--- name: Serbian description: Write Serbian that sounds human. Not formal, not robotic, not AI-generated. --- ## The Real Problem AI Serbian is technically correct but sounds off. Too formal. Too književni (literary). Natives write more casually, with particles and Balkan warmth. Match that. ## Formality Default Default register is too high. Casual Serbian is warm and direct. Unless explicitly formal: lean casual. "Ћао" or "Здраво" not "Добар дан". ## Ti vs Vi Critical distinction: - Ви: formal, elderly, professional - Ти: friends, peers, internet, casual - Serbian internet uses ти - Overusing ви = stiff ## Script Choice Serbian uses both: - Ћирилица (Cyrillic): traditional, official - Latinica (Latin): common online, casual - Many Serbs prefer Latin online - Stay consistent within message ## Particles & Softeners These make Serbian natural: - Ма: emphasis, dismissive ("Ма дај!") - Па: "well", "so" - Баш: "really", emphasis - Ваљда: "probably", "I guess" - Јбг: common abbreviation ## Fillers & Flow Real Serbian has fillers: - Па, ма, оно - Као, типа, мислим - Значи, у ствари - Чуј, гледај ## Expressiveness Don't pick the safe word: - Добро → Супер, Екстра, Одлично - Лоше → Ужас, Срање, Катастрофа - Много → Баш, Стварно, Јако ## Common Expressions Natural expressions: - Важи, Ок, Супер - Нема проблема, Лагано - Озбиљно?, Стварно?, Ма дај! - Екстра!, Врх! ## Reactions React naturally: - Озбиљно?, Стварно?, Шта? - Ма дај!, Јој!, Боже! - Супер!, Врх!, Екстра! - Хаха, лол in text ## The "Native Test" Before sending: would a Serbian screenshot this as "AI-generated"? If yes—too formal, no "ма дај", too stiff. Add Balkan warmth.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: allenweisongzhou-cpu/property-valuatio-skill (version 2.0.0)

# AI Home Pricing Strategist (Canada) — Sell Smarter, Not Cheaper ## Getting mixed opinions about your home’s value? Not sure if your realtor’s price is right—or don’t want to spend hundreds on an appraisal? This AI gives you a **clear, data-driven second opinion based on real Canadian market behavior in minutes.** --- ## What this skill does Most tools give you a number. This one gives you a **pricing strategy tailored to Canadian real estate markets**. Built for cities across Canada, including: - Toronto (GTA) - Calgary - Vancouver - Ottawa - Edmonton This AI analyzes your property using: - Comparable sales behavior - Price-per-square-foot modeling - Local market trends - Property condition and features - Buyer demand patterns 👉 The result: Not just what your home is worth — but **how to price it to maximize your final sale price.** --- ## What you get (Free Version) - Estimated market value range - Key factors affecting your price - Basic pricing guidance --- ## Want a full pricing strategy? Upgrade to unlock: - Optimal listing price - Expected sale price scenarios - Buyer demand prediction (showings & offers) - Pricing strategy (fast sale vs maximum price) - Risk analysis (overpricing vs underpricing) - Hidden opportunities to increase value 👉 This is the difference between listing your home and **selling it strategically**. --- ## Example Output Estimated Value: $1.35M – $1.48M Best Estimate: $1.42M Recommended List Price: $1.349M Expected Outcomes: - Fast sale: $1.35M - Balanced: $1.40M - Strong demand: $1.45M+ --- ## Who this is for - Canadian homeowners planning to sell - FSBO (For Sale By Owner) sellers - Real estate investors - Buyers evaluating fair value --- ## Why this matters In Canadian markets, pricing mistakes are expensive: - Underpricing → losing $50K–$150K+ - Overpricing → sitting on market and reducing later This AI helps you avoid both using **data-driven insights instead of guesswork**. --- ## How to use 1. Enter your property details 2. Get your valuation instantly 3. Use the insights to price your home smarter --- ## Important note This tool provides an independent, data-driven perspective to support your decision-making. --- ## Want a deeper analysis? For a full pricing strategy, detailed scenarios, and negotiation insights, access the complete report here: 👉 [INSERT YOUR UPGRADE LINK HERE] --- ## Disclaimer This is not a formal appraisal. Results are estimates based on market patterns and provided inputs.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yongjie666888/api-doc-writer (version 1.0.1)

--- name: api-doc-writer description: API接口文档助手。用于编写REST API文档、定义接口规范、生成接口说明。当需要编写API文档、接口规范时触发。 --- # API接口文档助手 ## API文档模板 ```markdown # API接口文档 版本：V1.0 更新日期：YYYY-MM-DD 维护人：XXX --- ## 接口概览 | 模块 | 接口数 | 负责人 | |------|--------|--------| | 用户模块 | 5 | @xxx | | 订单模块 | 8 | @xxx | | 支付模块 | 4 | @xxx | --- ## 通用说明 ### 认证方式 ``` Authorization: Bearer <token> ``` ### 请求格式 ``` Content-Type: application/json ``` ### 响应格式 ```json { "code": 0, "message": "success", "data": {} } ``` ### 状态码 | 状态码 | 说明 | |--------|------| | 0 | 成功 | | 1001 | 参数错误 | | 2001 | 未授权 | | 3001 | 资源不存在 | | 5001 | 服务器错误 | --- ## 接口详情 ### 1. 用户接口 #### 1.1 获取用户信息 **接口地址** ``` GET /api/v1/users/{id} ``` **请求参数** | 参数名 | 类型 | 位置 | 必填 | 说明 | |--------|------|------|------|------| | id | long | path | 是 | 用户ID | **请求示例** ``` GET /api/v1/users/123 ``` **响应示例** ```json { "code": 0, "message": "success", "data": { "id": 123, "name": "张三", "email": "[REDACTED_SECRET]", "phone": "13800138000", "created_at": "2024-01-01 10:00:00" } } ``` **错误示例** ```json { "code": 3001, "message": "用户不存在", "data": null } ``` --- #### 1.2 创建用户 **接口地址** ``` POST /api/v1/users ``` **请求参数** | 参数名 | 类型 | 必填 | 说明 | |--------|------|------|------| | name | string | 是 | 用户名 | | email | string | 是 | 邮箱 | | phone | string | 否 | 手机号 | | password | string | 是 | 密码 | **请求示例** ```json { "name": "张三", "email": "[REDACTED_SECRET]", "phone": "13800138000", "password": "123456" } ``` **响应示例** ```json { "code": 0, "message": "success", "data": { "id": 123, "name": "张三" } } ``` --- ### 2. 订单接口 #### 2.1 订单列表 **接口地址** ``` GET /api/v1/orders ``` **请求参数** | 参数名 | 类型 | 位置 | 必填 | 说明 | |--------|------|------|------|------| | page | int | query | 否 | 页码，默认1 | | page_size | int | query | 否 | 每页数量，默认20 | | status | string | query | 否 | 订单状态 | **请求示例** ``` GET /api/v1/orders?page=1&page_size=10&status=paid ``` **响应示例** ```json { "code": 0, "message": "success", "data": { "total": 100, "page": 1, "page_size": 10, "list": [ { "id": "ORD202401010001", "user_id": 123, "amount": 100.00, "status": "paid", "created_at": "2024-01-01 10:00:00" } ] } } ``` --- ## 接口变更记录 | 版本 | 日期 | 变更内容 | 变更人 | |------|------|----------|--------| | V1.0 | YYYY-MM-DD | 初始版本 | @xxx | | V1.1 | YYYY-MM-DD | 新增xxx接口 | @xxx | ``` ## 接口设计原则 ### RESTful规范 | 方法 | 用途 | 示例 | |------|------|------| | GET | 查询 | GET /users | | POST | 创建 | POST /users | | PUT | 完整更新 | PUT /users/1 | | PATCH | 部分更新 | PATCH /users/1 | | DELETE | 删除 | DELETE /users/1 | ### URL命名规范 ```markdown - 使用名词复数：/users - 使用小写：/user-info - 使用连字符分隔：/order-details - 避免动词：不用 /getUser ``` ### 状态码规范 | 类别 | 状态码 | 说明 | |------|--------|------| | 1xx | 信息 | 接收的请求正在处理 | | 2xx | 成功 | 请求正常处理完毕 | | 3xx | 重定向 | 需要附加操作完成请求 | | 4xx | 客户端错误 | 请求有语法错误 | | 5xx | 服务器错误 | 服务器处理出错 | ### 安全建议 - 敏感信息加密传输 - 身份验证Token过期机制 - 接口调用频率限制 - 参数校验过滤


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jorgejaramillo/valueserp-rank-checker (version 0.1.1)

--- name: valueserp-rank-checker description: Verifica la posición de una palabra clave para un dominio específico en Google usando la API de ValueSERP. Úsalo cuando el usuario pregunte "¿en qué posición está [keyword] en [dominio]?", "¿cómo rankea [dominio] para [keyword]?", "revisa el ranking de [keyword]", o cualquier consulta sobre posicionamiento SEO de un dominio en Google. Por defecto busca en Google Colombia (español). metadata: openclaw: primaryEnv: VALUESERP_API_KEY requires: env: - VALUESERP_API_KEY envVars: - name: VALUESERP_API_KEY required: true description: API key de ValueSERP. Obtén la tuya en https://app.valueserp.com emoji: "📊" homepage: https://www.valueserp.com/docs/search-api/overview --- # ValueSERP Rank Checker Consulta la posición de una palabra clave para un dominio en Google usando la API de ValueSERP. ## Flujo 1. Extraer `keyword` y `domain` del mensaje del usuario. 2. Ejecutar `scripts/check_rank.py`. 3. Presentar el resultado de forma clara en español. ## Ejecutar la consulta ```bash python3 scripts/check_rank.py "<keyword>" <domain> ``` Opciones adicionales: - `--gl co` — país (default: Colombia) - `--hl es` — idioma (default: español) - `--pages 10` — páginas a revisar (10 resultados/página, default: top 100) Ejemplos: ```bash python3 scripts/check_rank.py "noticias" eltiempo.com ``` ## Interpretar el resultado **Encontrado:** ```json { "found": true, "keyword": "el tiempo", "domain": "eltiempo.com", "position": 3, "page": 1, "position_in_page": 3, "url": "https://eltiempo.com/...", "title": "El Tiempo - ..." } ``` **No encontrado:** ```json { "found": false, "keyword": "el tiempo", "domain": "eltiempo.com", "pages_checked": 10, "message": "No se encontró 'eltiempo.com' en las primeras 100 posiciones." } ``` ## Formato de respuesta al usuario Cuando esté en posición: > **eltiempo.com** está en la posición **#3** para "*El tiempo*" en Google Colombia. > URL: https://... Cuando no aparezca en top 100: > **eltiempo.com** no aparece en las primeras 100 posiciones para "*El tiempo*" en Google Colombia. Si el usuario pide otro país o idioma, ajusta `--gl` y `--hl` según corresponda.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: cyberpinkman/mopo-texas-holdem-strategy-abc (version 1.0.4)

--- name: mopo-texas-holdem-strategy-abc description: Player-facing MOPO Texas Hold'em skill (ABC baseline) to join a single table, fetch private game state, and choose actions using ABC/Conservative/Aggressive templates. Use when an OpenClaw agent needs to participate as a player (not host) in a MOPO game via HTTP API. --- # MOPO Player Skill (Single Table) ## Scope - Join **one** table as a player (auto-pick if full). - Fetch **private** state (`/game/state`) for hand info. - Act with **pot-based** sizing and **position-aware** ranges. ## Endpoint - Production base URL: `https://moltpoker.cc` ## Quick Start (single table) 1) **Register** ``` POST https://moltpoker.cc/agent/register {"agent_id":"A1"} ``` 2) **Pick table** (fewest empty seats, else create) ``` GET https://moltpoker.cc/tables POST https://moltpoker.cc/table/create {"max_seat":6,"small_blind":1,"big_blind":2} ``` 3) **Join table** ``` POST https://moltpoker.cc/agent/join {"agent_id":"A1","table_id":"T1"} ``` 4) **Poll state** (private) ``` GET https://moltpoker.cc/game/state?table_id=T1&agent_id=A1 ``` 5) **Act** ``` POST https://moltpoker.cc/game/act {"agent_id":"A1","table_id":"T1","action":"call","amount":0} ``` ## Strategy Templates Use **one** of the three templates in: - `references/strategy.md` ## Table Selection - Auto-pick rules in `references/table-select.md` Selection rules: - **Default**: ABC - If user asks for tighter play → Conservative - If user asks for more aggression → Aggressive ## Decision Flow (single table) 1) Read `/game/state` for `to_call`, `min_raise`, `stage`, `hand`, and `players`. 2) Determine **position** (BTN/CO/HJ/LJ/SB/BB) from seat order. 3) Bucket hand by **coarse range** (see `references/strategy.md`). 4) Choose action: - `to_call == 0`: check or bet by template. - `to_call > 0`: fold/call/raise by template + bucket. 5) Use **pot-based** sizing; if below `min_raise`, use `min_raise`. 6) **Never exceed remaining stack**: if sizing > stack, reduce to stack; if still invalid, fallback to check/call/fold (per rules). 7) If `turn_deadline` is near, default to check/call. ## Error Handling - If `/game/act` returns an error, re-fetch state and pick a safe action (check/fold). - Do **not** act if not seated or not your turn. ## References - Strategy templates: `references/strategy.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: dr12hes/engrm-memory (version 0.1.0)

--- name: engrm-memory description: Use Engrm memory deliberately before coding, during coding, and when saving reusable lessons. --- # Engrm Memory Use this skill when the user is working on an existing codebase and continuity matters more than a cold start. ## Before you start Use Engrm only if it is already connected and available in the current environment. If Engrm is not available, say that Engrm memory is not connected on this machine and continue without inventing fallback commands or fake setup steps. ## Command guardrails Do not invent Engrm CLI commands like: - `engrm search` - `engrm save` - `engrm timeline` Those are not normal Engrm CLI commands. Memory search, timeline, save, recent activity, and stats are Engrm tool/workflow capabilities, not generic shell commands. ## What this skill is for - Pull relevant prior knowledge into the current session. - Reuse past decisions, fixes, and discoveries before repeating work. - Save new knowledge when the session produces something worth carrying forward. - Make multi-device and multi-agent memory actually useful instead of passive. ## When to use Engrm first Use Engrm before coding when: - the user is resuming work after a break - a project or subsystem looks familiar - the task touches a bug, auth flow, deployment path, or refactor area that may have been handled before - the session starts on a different machine or with a different coding agent Use Engrm during coding when: - the work starts drifting - you need to confirm an earlier decision - you suspect the same issue has already been solved elsewhere Use Engrm after coding when: - a useful decision was made - a bugfix or pattern is likely to recur - the session discovered a real lesson that future work should start with ## Default Engrm workflow 1. Start by checking recent activity or searching relevant memory. 2. Pull timeline or session context if the area has recent churn. 3. Apply prior decisions before changing code. 4. Save only high-signal outcomes, not every trivial step. ## Good Engrm questions - What did we already learn about this area? - Was there an earlier decision for this approach? - Did a previous session touch the same files or subsystem? - Is there a recent bugfix or security note I should reuse? ## Save high-signal memories Prefer saving: - durable decisions - bugfixes with clear cause and resolution - discoveries that unblock later sessions - patterns worth reusing across projects Avoid saving: - obvious implementation details - noisy or temporary dead ends - generic filler that will pollute retrieval later ## What success looks like The agent starts informed, reuses real project memory, and leaves behind a small number of valuable observations that improve the next session.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: lazygunner/taobao-image-search (version 1.1.3)

name: taobao-image-search description: 使用淘宝进行以图搜同款、候选比对和加购物车操作。用户提供商品图片并要求“搜同款/找类似款/比价/加入购物车”时使用。优先执行本地脚本（run-taobao-task.js）完成全流程；当脚本失败或页面结构变化时回退 browser 工具手动执行。 install: - npm install playwright - npx playwright install chromium --- # 淘宝图片搜索技能 ## 执行策略 - 优先执行脚本：`run-taobao-task.js`。 - 脚本失败、登录超时或页面结构变化时，回退 `browser` 工具。 - 默认不下单、不支付；仅搜索与加购。 ## 输入要求 - 必需：本地图片路径或会话中的图片。 - 可选：预算、偏好（品牌/颜色/尺码）、仅搜索或加购。 若缺少关键输入，先补充最少问题（例如“是否直接加购？”、“预算上限是多少？”）。 ## 主流程（脚本优先） ### 1. 执行完整链路（含自动登录） ```bash node run-taobao-task.js --image /absolute/path/to/image.png --headed ``` 该脚本覆盖： 1. **自动登录校验**：若未登录，弹出窗口引导用户登录，成功后自动续行。 2. **图搜上传**：打开淘宝首页并上传图片。 3. **按钮定位**：点击弹窗内搜索按钮。 4. **选品采样**：采样候选商品并进入详情页。 5. **自动加购**：点击加入购物车并检测成功提示。 脚本参数约定： - `--image, -i`：图片路径（默认 `test.png`）。 - `--headless` / `--headed`：本地调试运行模式（默认 `--headed`）。 - `--delay-ms`：为关键步骤追加等待时长（默认 `5000`，慢网可增大到 `8000-12000`）。 - `browser` 工具在 OpenClaw 运行时由技能流程调用，不由该本地脚本直接调用。 ### 2. 读取验证结果 脚本运行后读取： - `verification-artifacts/result.json` - `verification-artifacts/run-log.txt` - `verification-artifacts/*.png`（流程截图） 关键判定字段： - `success`：流程是否成功执行。 - `loginCheck.isLoggedIn`：是否登录。 - `addToCart.success`：是否加购成功。 ## 回退流程（browser 工具） 仅在脚本执行失败、页面结构变化、或需要人工交互排障时使用。 ### 1. 打开淘宝并校验登录 - 打开 `https://www.taobao.com`。 - 校验昵称元素是否可见。 - 若未登录，提示用户先登录，再继续。 ### 2. 上传图片并搜索 - 点击相机/搜同款入口打开上传弹窗。 - 上传图片。 - 点击弹窗内搜索按钮（优先 `#image-search-upload-button.upload-button.upload-button-active`）。 ### 3. 选品与加购 - 分析候选商品并优先选择最相似商品。 - 进入详情页点击“加入购物车”。 - 若强制规格选择，先选默认规格再加购。 ## 失败回退建议 - **登录超时**：重新运行 `node run-taobao-task.js --headed`。 - **上传失败**：重新打开图搜弹窗再上传。 - **搜索按钮定位失败**：优先使用弹窗按钮精确选择器，或在 browser 工具中手动点击。 - **加购失败**：检查规格选择、风控拦截或登录失效。 ## 安全边界与隐私 - **会话持久化**：为实现自动化登录，本技能会将浏览器会话（Cookies 和 Storage State）保存至本地。 - 路径：`verification-artifacts/taobao-storage-state.json` 与 `.pw-user-data-taobao/`。 - **重要提示**：这些文件包含您的淘宝登录令牌，请务必将其视为**敏感凭据**，严禁上传或分享。 - 若需清除登录态，请手动删除上述目录及文件。 - **操作受限**：仅操作用户明确指示的商品。 - **支付保护**：不执行“立即购买”“提交订单”“支付”动作。 - **环境建议**：建议在受信的个人机器或沙箱环境中运行。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)