OpenClaw/clawhub-security-signals huggingface dataset:
Skill: jamy-lei/meal-subsidy (version 1.3.0)

--- name: meal-subsidy description: 2号人事部餐补申请自动化 — 读考勤判断下班时间，全自动填表提交。触发方式："申请餐补"查昨天；"申请4月7日餐补"查指定日期；"申请4月餐补"查整月批量申请；"本周餐补"查本周批量申请。 --- # 餐补申请自动化 自动读取2号人事部考勤，判断下班时间是否满足餐补条件，全自动填写并提交。 ## 申请条件 | 下班时间 | 餐补 | |---------|------| | ≥ 20:30 | 20元 | | 00:00 ~ 06:00（跨天） | 40元 | | 其他 | 不申请 | **跨天**：结束时间日期+1天（如 00:30 → 第二天00:30） --- ## 触发指令 | 指令 | 效果 | |------|------| | "申请餐补" | 查昨天，满足则申请 | | "申请4月7日餐补" | 查指定日期（默认当年，如2026年4月7日）| | "申请4月餐补" | 查整个4月（默认当年），批量申请所有满足条件的日期 | | "本周餐补" | 批量申请本周所有满足条件的日期 | --- ## 快速开始 ### 第一步：安装依赖 ```bash pip install playwright playwright install chromium ``` > 只需安装一次。依赖 Playwright 而非 Selenium，无需额外配置 ChromeDriver。 ### 第二步：启动 Chrome 远程调试（只需一次） ```bash "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 ``` > Mac：`/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --remote-debugging-port=9222` 打开后扫码登录 `https://i-wework.2haohr.com/desk/home`，之后运行无需重复登录。 > 如果脚本报错 "Cannot connect to Chrome"，先执行此步骤 ### 第三步：运行脚本 ```bash # 申请指定日期（默认昨天） py -3 meal_subsidy.py --date 2026-04-07 # 申请整月（批量） py -3 meal_subsidy.py --mode month --year 2026 --month 4 ``` --- ## 截图说明 | 文件 | 内容 | |------|------| | `screenshots/att_YYYYMMDD.png` | 考勤截图（上传用） | | `screenshots/meal_form_*.png` | 餐补表单截图 | | `screenshots/meal_before_submit_*.png` | 提交前确认 | | `screenshots/after_submit_*.png` | 提交后截图 | | `screenshots/late_YYYYMM.csv` | 申请记录表 | --- ## 依赖 | 依赖 | 说明 | |------|------| | Python 3.8+ | 语言环境 | | playwright | `pip install playwright` | | Chrome 浏览器 | 系统已安装即可 | --- ## 常见问题 **Q: 报错 "Cannot connect to Chrome"** A: Chrome 没有以远程调试模式启动。按第二步重新启动 Chrome。 **Q: 提示 "登录超时"** A: 需要先在 Chrome 里手动扫码登录一次（只需一次）。 **Q: 提交流程正常但上传的截图不对** A: 请确保 Chrome 打开了考勤页面（显示日期和下班时间），再运行脚本。 --- ## 技术说明 - **浏览器连接**：通过 CDP（Chrome DevTools Protocol）连接端口 9222，已登录状态不丢失 - **iView picker 填写**：直接 send_keys 无效，必须用 JS 原生 setter 触发 Vue 响应式 - **iframe 处理**：餐补表单在 iframe 内，JS 直接跨帧操作 `.ivu-date-picker` - **自动启动**：端口 9222 不可用时，脚本会自动启动新的带调试端口的 Chrome


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: sipoon/sipoon-brainstorming (version 0.1.0)

# brainstorming > **借鉴来源**：Superpowers (obra/superpowers) 的 brainstorming skill > > 在动手写代码之前，先通过追问把需求搞清楚，展示设计方案给用户确认，再动手。 > > **核心理念**：写代码前不问清楚 = 返工成本 10x。 --- ## 触发条件 满足以下任一场景时**自动激活**，无需用户调用： - 用户要求创建一个新的功能/模块/项目 - 用户描述了一个需求，但没有明确的范围边界 - 用户说"帮我做个 XXX"（模糊请求） - 用户要求实现某个功能，但没有说明输入/输出/边界条件 **不适用于**：纯搜索、纯阅读、简单确认、快速修复已知 bug。 --- ## 工作流程 ### Step 1：追问澄清（不跳步） 遇到模糊需求，按以下清单追问： ``` [需求澄清] 1. 用户故事：谁在什么场景下需要这个功能？ 2. 输入：数据从哪来？格式是什么？ 3. 输出：期望的结果是什么？格式是什么？ 4. 边界：什么情况算成功？什么情况算失败？ 5. 优先级：这个功能的核心价值是什么？MVP 是什么？ 6. 约束：有没有技术限制？性能要求？兼容性要求？ ``` **规则**： - 一次问 2-3 个最重要的问题，不要一次问完（减少用户认知负担） - 用户回答后继续追问，直到需求明确 - 如果用户拒绝回答，告诉用户这会影响实现质量，让他决定是否继续 ### Step 2：产出设计文档（分块展示） 需求明确后，产出设计文档，但**不要一次性全部展示**，分块展示： ``` ## 设计草案 v0.1 ### 模块结构 [文字描述] ### 风险点 [列出 1-2 个最需要用户确认的点] --- 请确认以上方向是否正确，我会继续细化。 ``` **原则**：每次展示用户能在 30 秒内读完的分量。 ### Step 3：用户确认 → 产出实施计划 用户确认设计后，产出实施计划： ``` ## 实施计划（简化版） | 阶段 | 任务 | 验收标准 | |------|------|---------| | Phase 1 | [任务描述] | [标准] | | Phase 2 | [任务描述] | [标准] | 每个 Phase 完成后再进入下一个。 ``` ### Step 4：TDD 循环（用户说"go"之后） **进入此步之前，必须先通过 `grill-me` 确认**。 - 每个任务：先写失败测试 → 再实现 → 再验证 - 每完成一个任务，主动报告进度 - 遇到阻塞，立刻报告，不要等 - 完成后 → 调用 `skill-compounding` 检查是否值得沉淀 --- ## 关键原则 | 原则 | 说明 | |------|------| | **不猜需求** | 有歧义就问，不要假设 | | **用户决策权** | 设计方向用户定，AI 只执行 | | **分块确认** | 不一次性给完整方案，分段确认 | | **先测试后实现** | TDD 循环，减少返工 | | **阻塞即升级** | 遇到问题立刻报告，不沉默 | --- ## 下一跳（Skill 链式调用） brainstorming 是**入口技能**，完成后按以下路径自动调用： ``` brainstorming → grill-me → [implementation] ↘ agent-teams（需要多角度审查时） ↘ conductor（大型项目/多阶段任务） ``` **下一跳触发条件**： - 设计确认后 → 自动调用 `grill-me` 做实施前最后确认 - 需要多角色并行审查 → 调用 `agent-teams` - 项目规模大/多阶段 → 调用 `conductor` 接管后续流程 - 解决方案有复用价值 → 调用 `skill-compounding` ## 与其他 Skill 的配合 - `skill-compounding`：如果这个需求的解决方案值得复用，在完成后提取为 Skill - `refactoring`：如果发现现有代码结构不合理，先讨论再改 - `test-specialist`：测试用例设计有疑问时调用 --- ## 触发命令 **自动触发**，不需要用户手动调用。当检测到模糊需求时主动激活。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: spacesq/s2-energy-perception (version 1.1.1)

--- name: s2-energy-perception description: S2-SP-OS Energy Radar. Maps spatial inventory and generates advanced local visual dashboards (Bar/Pie/Trend) for user insights without cloud analytics. / S2 能耗雷达。映射空间设备库，并在本地生成高级数据可视化看板（柱状/饼图/趋势），拒绝云端分析泄露隐私。 version: 1.1.1 author: Space2.world homepage: https://space2.world/s2-sp-os tags: [S2-SP-OS, Energy, Dashboard, Edge-Analytics] metadata: {"clawdbot":{"emoji":"⚡","requires":{"bins":["python3"], "pip":["pandas", "numpy", "matplotlib"], "env":["S2_PRIVACY_CONSENT"]}}} allowed-tools: [exec] --- # ⚡ S2-Energy-Perception: Spatial Energy Radar ## 🤖 Instructions for AI Agents (CRITICAL) **Prerequisite:** `export S2_PRIVACY_CONSENT=1` **Action 1: Inventory (盘点)** ```bash python3 energy.py --action inventory --method default --zone living_room --grid ALL Action 2: Generate Visual Dashboard (生成高级可视化看板) Use this command to generate professional charts (Power rating bars, 30-day fluctuation lines) when the user asks for an energy report. Bash python3 energy.py --action generate_dashboard --zone ALL --grid ALL Note: This will return a list of local image URIs (e.g., file:///...png). You MUST present these image links directly to the user in your markdown response.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: wd041216-bit/feishu-task-control (version 1.0.1)

--- name: feishu-task-control homepage: https://docs.openclaw.ai/commands description: > Use in Feishu chats when the user wants to inspect, stop, or clean up background tasks spawned from the current chat. Uses subagents and session tools to list running tasks, stop one specific task, or stop all active tasks. --- # Feishu Task Control Use this skill when the user wants to stop a task, cancel a background job, or see which tasks are still running in the current Feishu chat. ## Goal Give the user clear control over spawned background tasks. ## Built-In Commands OpenClaw already supports these slash commands in the requester chat: - `/subagents list` to list active child tasks - `/subagents kill <id|#|all>` to stop one child task or all child tasks - `/subagents info <id|#>` to inspect one task - `/stop` to stop the current requester run and all active spawned child tasks ## Natural-Language Handling If the user says things like: - `结束这个任务` - `停掉第2个任务` - `取消那个调研` - `把所有后台任务停掉` - `现在有哪些任务在跑` - `第2个任务现在到多少了` - `给我看看每个任务的进度` Then translate that into the right task-control action. If the user instead says `继续`, `再试一试`, or something that clearly means "resume the unfinished thing", do not force a task-control flow unless the conversation is truly about stopping/inspecting tasks. First check whether the previous request itself is unfinished. ## Workflow ### 1. Find active tasks Use `subagents` or `sessions_list` to inspect the active child tasks for the current requester session. ### 2. Resolve the target Resolve the user's target in this order: 1. exact numeric id or list index 2. exact label 3. fuzzy match on the task summary 4. if still ambiguous, show the active task list and ask the user which one ### 3. Stop the right scope - One specific child task -> `subagents kill <id>` - All child tasks in this requester chat -> `subagents kill all` - Entire current run plus children -> `/stop` ## Response Style Keep Feishu replies short and explicit. Never expose internal tool payloads, raw JSON, session ids, command objects, or "I will now call X" narration in the user-facing reply. Perform the check or kill action first, then answer only with the human-readable result. If the user says `再试一试`, `继续`, or similar, do not reply with a checklist of what you plan to inspect. Inspect it silently and reply with the actual task status or the actual blocker. Examples: - `已停掉任务 #2：行业调研。` - `已结束当前聊天里全部后台任务。` - `当前在跑 3 个任务：#1 周报，#2 行业调研，#3 PPT 生成。` - `当前在跑 3 个任务：#1 周报 75%，#2 行业调研 30%，#3 PPT 85%。` - `现在有两个任务都叫“调研”，请告诉我是 #2 还是 #4。` ## Safety - Never kill tasks from another unrelated chat unless the current tool visibility explicitly allows that and the user clearly asked for it - If no matching task exists, say so directly - If the kill fails, report the failure plainly


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: nexscope/influencer-outreach (version 1.0.0)

# Influencer Outreach Find, contact, and manage influencer partnerships for e-commerce brands. Outreach templates, negotiation tactics, contract frameworks, and relationship management across Instagram, TikTok, YouTube, and more. ## Capabilities - Influencer discovery by platform, niche, and audience demographics - Outreach email and DM templates (cold and warm) - Rate negotiation frameworks and pricing benchmarks - Campaign brief creation and content guidelines - Contract templates covering usage rights and deliverables - Performance tracking and reporting - Long-term ambassador program design - Micro-influencer vs macro-influencer strategy ## Install ```bash npx skills add nexscope/influencer-outreach ``` ## Usage Ask your AI agent: - "Write outreach emails for 10 fitness influencers for my supplement brand." - "What should I pay a TikTok creator with 50K followers?" - "Create a contract template for influencer partnerships." ## Output Structured recommendations with actionable steps, benchmarks, and platform-specific guidance. --- *Built by [Nexscope](https://www.nexscope.ai/) — AI-powered e-commerce tools for sellers worldwide.*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: midlifedad/youam (version 0.3.0)

--- name: youam description: Send and receive messages with other AI agents using the Universal Agent Messaging protocol. version: 0.3.0 metadata: openclaw: requires: bins: - uam install: - kind: uv package: youam bins: - uam homepage: https://docs.youam.network --- # UAM - Universal Agent Messaging You can send messages to and receive messages from other AI agents using the `uam` CLI. ## Setup (first time only) If `uam whoami` fails, initialize first: uam init This gives you a UAM address (e.g., `myagent::youam.network`) and generates encryption keys. ## Commands > **Tip:** For programmatic access, see [Native Channel (Plugin)](#native-channel-plugin) below. ### Check your identity uam whoami ### Send a message uam send <address> "<message>" Example: `uam send hello::youam.network "Hi, I'm an agent using UAM!"` ### Check your inbox uam inbox ### View contacts uam contacts ### Share your contact card uam card Outputs your signed contact card as JSON, including your address, public key, and relay URL. ### Manage handshake requests uam pending # List pending requests uam approve <address> # Approve a sender uam deny <address> # Deny a sender Some agents require approval before you can message them. If your message is held pending, wait for the recipient to approve you. ### Block or unblock senders uam block <pattern> # Block an address or domain (e.g., *::evil.com) uam unblock <pattern> # Remove a block ### Verify domain ownership (advanced) uam verify-domain <domain> Proves you own a domain for Tier 2 DNS-verified status. Follow the instructions to add a DNS TXT record. ## Native Channel (Plugin) For deeper integration, use the UAM plugin as a native messaging channel. This provides Python functions your agent can call directly -- no CLI subprocess needed. ### Quick Start from uam.plugin.openclaw import UAMChannel # Create a channel (auto-detects your agent identity) channel = UAMChannel() # Send a message channel.send("hello::youam.network", "Hi, I'm an OpenClaw agent!") # Check your inbox messages = channel.inbox() for msg in messages: print(f"From {msg['from']}: {msg['content']}") ### Channel API #### UAMChannel(agent_name=None, relay=None, display_name=None) Create a channel instance. If `agent_name` is omitted, auto-detects from existing keys or uses hostname. #### channel.send(to_address, message, thread_id=None) -> str Send a message. Returns the message ID. Auto-initializes and connects. #### channel.inbox(limit=20) -> list[dict] Returns a list of message dicts with keys: `message_id`, `from`, `content`, `timestamp`, `thread_id`. #### channel.contact_card() -> dict Returns your signed contact card as a JSON-compatible dict. #### channel.contacts() -> list[dict] Lists known contacts (offline, no relay connection needed). #### channel.is_initialized() -> bool Check if UAM agent keys exist on disk. ### One-Liner Functions For simple use cases: from uam.plugin.openclaw import send_message, check_inbox send_message("hello::youam.network", "Quick message!") messages = check_inbox()


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xueyetianya/bytesagain-crypto (version 1.0.0)

--- name: "BytesAgain Crypto — Professional Market Data & Indicators" description: "Real-time crypto prices and 100+ technical indicators (RSI, MACD, etc.) using Binance API. 支持实时行情监控、指标计算及全网资产扫描。Pure technical reference, zero external ads." version: "1.0.0" author: "BytesAgain" homepage: https://bytesagain.com source: https://github.com/bytesagain/ai-skills tags: ["crypto", "bitcoin", "trading", "indicators", "binance", "bilingual", "行情"] --- # BytesAgain Crypto / 楼台加密助手 The most powerful local crypto analysis suite for AI agents. ## Quick Start / 快速开始 Just ask your AI assistant: / 直接告诉 AI 助手： - "Show me real-time RSI for BTC/USDT on 1h timeframe" (显示BTC一小时RSI) - "What is the MACD signal for ETH right now?" (获取ETH实时MACD信号) - "Scan top USDT pairs for oversold conditions" (扫描超卖的USDT交易对) ## Features / 功能特性 - **Real-Time Data**: Direct integration with Binance Public API. - **Indicators**: RSI, MACD, Bollinger Bands, EMA, SMA, and more. - **Zero API Key**: No registration needed for basic queries. ## Requirements / 要求 - bash 4+ - python3 (requests) ## Feedback https://bytesagain.com/feedback/ Powered by BytesAgain | bytesagain.com


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: 1kalin/afrexai-accounts-payable (version 1.0.0)

# Accounts Payable Automation Framework You are an AP process optimizer. When the user describes their payable workflows, vendor relationships, or payment processes, generate a complete accounts payable management framework. ## What You Produce ### 1. Invoice Processing Pipeline - 3-way match automation (PO → receipt → invoice) - OCR extraction rules and validation checks - Exception handling workflows (price variance, quantity mismatch, missing PO) - Duplicate invoice detection (vendor + amount + date + invoice number) ### 2. Approval Routing | Threshold | Approver | SLA | |-----------|----------|-----| | <$1,000 | Auto-approve (matched) | Immediate | | $1,000-$10,000 | Department manager | 2 business days | | $10,000-$50,000 | VP/Director | 3 business days | | $50,000+ | CFO/Controller | 5 business days | ### 3. Payment Optimization - Early payment discount capture (2/10 Net 30 = 36.7% annualized return) - Payment timing strategy by vendor tier - Cash flow impact modeling - Virtual card rebate opportunities (1-2% on eligible spend) ### 4. Vendor Management - Vendor master data standards (TIN verification, W-9/W-8BEN collection) - Payment terms negotiation framework - Vendor scorecard: on-time delivery, invoice accuracy, responsiveness - Annual vendor review cadence ### 5. Month-End Close Checklist - [ ] Accrue for received-not-invoiced items - [ ] Clear aged items >90 days (investigate or write off) - [ ] Reconcile AP subledger to GL - [ ] Run duplicate payment report - [ ] Verify prepaid expense amortization - [ ] Confirm 1099 vendor flagging current ### 6. Key Metrics | Metric | Good | Great | World-Class | |--------|------|-------|-------------| | Cost per invoice | <$8 | <$4 | <$2 | | Invoice exception rate | <25% | <15% | <5% | | Days payable outstanding | 30-45 | Optimized to terms | Dynamic by cash position | | Early pay discount capture | >50% | >75% | >90% | | Straight-through processing | >40% | >60% | >80% | ### 7. Fraud Prevention - Segregation of duties matrix (no single person controls vendor setup + payment) - Positive pay enrollment for check payments - ACH fraud filters and payment anomaly detection - Vendor bank change verification (callback to known number, never from email) - Monthly: run vendor-employee address/bank match report ## Context Packs For industry-specific AP frameworks with regulatory requirements, compliance checklists, and automation ROI calculators: → https://afrexai-cto.github.io/context-packs/ ($47/pack) **Fintech Pack** — Payment processing compliance, reconciliation automation **Manufacturing Pack** — 3-way match for complex BOMs, landed cost tracking **Construction Pack** — Retention holdbacks, lien waiver management, AIA billing ## Tools - Revenue Leak Calculator: https://afrexai-cto.github.io/ai-revenue-calculator/ - Agent Setup Wizard: https://afrexai-cto.github.io/agent-setup/ - Bundles: Pick 3 ($97) | All 10 ($197) | Everything ($247)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: chenggongdu/aliyun-speech-transcriber (version 0.1.0)

--- name: aliyun-speech-transcriber description: Transcribe publicly accessible audio or video URLs with Aliyun speech services. Use when the user wants speech-to-text via Aliyun DashScope, needs transcript JSON or extracted plain text, or wants to process a cloud-accessible media URL (including signed Qiniu URLs) into transcription results. homepage: https://dashscope.aliyun.com/ metadata: {"clawdbot":{"emoji":"🎤","requires":{"env":["ASR_DASHSCOPE_API_KEY"]},"tags":["speech","transcription","asr","audio","aliyun","dashscope"]}} --- # Aliyun Speech Transcriber Use this skill to turn externally accessible media URLs into transcript results. ## Current scope Current implementation focuses on **DashScope file transcription** using the `paraformer-v2` model, aligned with the existing Java service pattern. ## Required environment variables - `ASR_DASHSCOPE_API_KEY` Fallback supported: - `DASHSCOPE_API_KEY` Optional: - `ALIYUN_SPEECH_MODEL` - defaults to `paraformer-v2` - `ALIYUN_SPEECH_LANG_HINTS` - defaults to `zh,en` - `ALIYUN_SPEECH_POLL_SECONDS` - defaults to `5` - `ALIYUN_SPEECH_TIMEOUT_SECONDS` - defaults to `1800` ## Inputs Pass one or more externally accessible URLs: ```powershell node scripts/transcribe.js --file-url "https://example.com/audio.mp3" ``` Multiple files: ```powershell node scripts/transcribe.js --file-url "https://a.com/1.mp3" --file-url "https://a.com/2.mp3" ``` ## Output The script returns JSON with: - `success` - `provider` - `engine` - `taskId` - `requestId` - `results` - `text` `text` is a best-effort plain-text extraction from the final JSON result. ## Chaining from Qiniu Typical workflow: 1. Use `qiniu-upload` to upload a local file. 2. Prefer a signed private URL if the domain is not anonymously readable. 3. Pass the returned URL into this skill. ## Safety rules - Never hardcode Aliyun credentials. - Fail fast if `DASHSCOPE_API_KEY` is missing. - Only send URLs the user intends to transcribe.


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zhaoguoqiang-hub/proactive-trigger (version 0.4.0)

--- name: proactive-trigger description: 主动触发引擎v4：基于兴趣衰减、沉默检测、话题热度，决定何时进行主动干预。触发条件：用户沉默、兴趣衰减、主动干预时机成熟。 --- # Proactive Trigger - 主动触发引擎 ## 使用方法 ### 直接调用 ```bash node scripts/trigger.js <命令> [选项] ``` ### 信号处理模式 ```bash node scripts/trigger.js --process-signal <signal> ``` ## 命令 - `assess [选项]` - 评估触发时机 - `suggest [选项]` - 生成触发建议 - `check [选项]` - 检查触发条件 ## 示例 ```bash # 评估兴趣图谱 node scripts/trigger.js assess --interest-graph # 检查沉默指数 node scripts/trigger.js suggest --silence-index # 信号处理 node scripts/trigger.js --process-signal boundary_violation ``` ## 与proactive-engine集成 该skill通过`--process-signal`参数与proactive-engine信号系统集成，是主动干预的核心决策引擎。


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: financial-ai-analyst/stock-market-hotspot-discovery (version 1.0.0)

--- name: stock-market-hotspot-discovery description: 面向A股市场热点发现的综合能力。适用于用户提出“今日热点是什么”“当前热股有哪些”等泛化问题时，返回结构化的Markdown热点报告。覆盖热点资讯、热门股票等维度。触发核心条件：用户关注市场层面的热门方向或事件热度，而非单一标的的深度诊断或指标计算。 metadata: { "openclaw": { "requires": { "env":["EM_API_KEY"] } } } --- # 股市热点发现 通过**自然语言问句**识别当前市场热点，返回 Markdown 热点报告，适用场景包括： - **今日市场热点总览（资讯/事件/话题）** - **热门股票与活跃方向识别** - **交易日内快速捕捉情绪变化与关注焦点** ## 密钥来源与安全说明 - 本技能仅使用一个环境变量：`EM_API_KEY`。 - `EM_API_KEY` 由东方财富妙想服务（`https://ai.eastmoney.com/mxClaw`）签发，用于接口鉴权。 - 在提供密钥前，请先确认密钥来源、可用范围、有效期及是否支持重置/撤销。 - 禁止在代码、提示词、日志或输出文件中硬编码/明文暴露密钥。 ## 功能范围 ### 基础热点能力 - 输入自然语言问句，调用热点发现接口生成结构化结论 - 覆盖热门资讯、热门股票等市场级热点信息 - 返回可读 Markdown 报告（优先提取 `data.displayData`） - 支持将结果保存为本地 `.md` 文件，便于盘后复盘 ### 触发规则（何时使用本技能） - 用户问题是**市场层面的热点发现**：如“今日热点”“热股有哪些” - 用户未指定单只股票/基金做深度诊断，也未要求具体指标计算 - 用户关注“热门、热搜、大事、活跃赛道、关注方向”等泛化主题 ### 不触发规则（何时不要使用本技能） - 用户明确询问单只股票深度分析（应走 stock-diagnosis） - 用户明确询问单只基金深度分析（应走 fund-diagnosis） - 用户要求具体指标计算或量化建模（MACD、回测、组合优化等） ### 触发示例 | 触发（热点发现） | 不触发（诊断/指标） | |---|---| | 今日热点是什么？ | 海康威视怎么样？ | | 今天最热的股票有哪些？ | 丹化科技的MACD金叉了吗？ | | 最近流行哪些投资赛道？ | 帮我建一个基金组合优化模型 | ## 前提条件 ### 1. 注册东方财富妙想账号 访问 https://ai.eastmoney.com/mxClaw 注册账号并获取 API Key。 ### 2. 配置 Token ```bash # macOS 添加到 ~/.zshrc，Linux 添加到 ~/.bashrc export EM_API_KEY="your_api_key_here" ``` 然后根据系统执行对应的命令： **macOS：** ```bash source ~/.zshrc ``` **Linux：** ```bash source ~/.bashrc ``` ## 快速开始 ### 1. 命令行调用 ```bash python3 {baseDir}/scripts/get_data.py --query "今日热点" ``` **输出示例** ```text Saved: /path/to/workspace/stock_market_hotspot_discovery/stock_market_hotspot_discovery_90bf169c.md （随后输出 Markdown 热点内容） ``` **参数说明：** | 参数 | 说明 | 必填 | |---|---|---| | `--query` | 用户原始自然语言问句 | ✅（`--query` 或 stdin 二选一） | | `--no-save` | 仅输出结果，不写入本地文件 | 否 | ### 2. 代码调用 ```python import asyncio from pathlib import Path from scripts.get_data import discover_hotspot async def main(): result = await discover_hotspot( question="今日热点", output_dir=Path([REDACTED_SECRET]), save_to_file=True, ) if "error" in result: print(result["error"]) else: print(result["content"]) if result.get("output_path"): print("已保存至:", result["output_path"]) asyncio.run(main()) ``` ## 输出规范 通过脚本或工具拿到诊股结果后，**对用户的可见回复必须以接口返回的 Markdown 正文为主体**，避免模型二次转述。仅当接口/脚本明确返回 `error`、或正文为空时，才用简短文字说明失败原因；**禁止**在失败时杜撰报告内容。 ## 常见问题 **错误：EM_API_KEY is required.** → 需先配置 `EM_API_KEY`，请联系官网获取并手动配置。 **为什么有时候不会保存 md 文件？** → 当返回为不支持场景或失败结构（如 `code/status` 异常、`data` 为空）时，脚本会只输出内容而不落盘。 **如何只看输出，不落盘？** ```bash python3 -m scripts.get_data --query "今日热点" --no-save ``` ## 合规说明 - 热点信息具有时效性，结果反映接口调用时刻的市场状态。 - 热点信息仅供参考，不构成投资建议，输出时应附风险提示。 - 禁止在代码或提示词中硬编码账号 ID、会话 ID 或 token。 - 接口失败时不得编造结论，应返回明确错误或不确定性说明。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)