OpenClaw/clawhub-security-signals huggingface dataset:
Skill: shahuquan-dotcom/my-summarize (version 1.0.2)

--- name: summarize description: Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube). homepage: https://summarize.sh metadata: {"clawdbot":{"emoji":"🧾","requires":{"bins":["summarize"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/summarize","bins":["summarize"],"label":"Install summarize (brew)"}]}} --- # Summarize Fast CLI to summarize URLs, local files, and YouTube links. ## Quick start ```bash summarize "https://example.com" --model google/gemini-3-flash-preview summarize "/path/to/file.pdf" --model google/gemini-3-flash-preview summarize "https://youtu.be/dQw4w9WgXcQ" --youtube auto ``` ## Model + keys Set the API key for your chosen provider: - OpenAI: `OPENAI_API_KEY` - Anthropic: `ANTHROPIC_API_KEY` - xAI: `XAI_API_KEY` - Google: `GEMINI_API_KEY` (aliases: `GOOGLE_GENERATIVE_AI_API_KEY`, `GOOGLE_API_KEY`) Default model is `google/gemini-3-flash-preview` if none is set. ## Useful flags - `--length short|medium|long|xl|xxl|<chars>` - `--max-output-tokens <count>` - `--extract-only` (URLs only) - `--json` (machine readable) - `--firecrawl auto|off|always` (fallback extraction) - `--youtube auto` (Apify fallback if `APIFY_API_TOKEN` set) ## Config Optional config file: `~/.summarize/config.json` ```json { "model": "openai/gpt-5.2" } ``` Optional services: - `FIRECRAWL_API_KEY` for blocked sites - `APIFY_API_TOKEN` for YouTube fallback

path: _meta.json
content: ownerId: kn7cgk6e033f0wmyhhmx2mrav983j6ax
slug: my-summarize
version: 1.0.1
publishedAt: 1774511917437

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dmx64/security-scanner (version 1.0.0)

--- name: security-scanner description: Automated security scanning and vulnerability detection for web applications, APIs, and infrastructure. Use when you need to scan targets for vulnerabilities, check SSL certificates, find open ports, detect misconfigurations, or perform security audits. Integrates with nmap, nuclei, and other security tools. --- # Security Scanner Automated security scanning toolkit for penetration testing and vulnerability assessment. ## Quick Start ### Port Scan ```bash nmap -sV -sC -oN scan.txt TARGET ``` ### Vulnerability Scan ```bash nuclei -u TARGET -o results.txt ``` ### SSL Check ```bash sslscan TARGET ``` ## Scan Types ### 1. Quick Recon Fast initial scan for live hosts and open ports: ```bash nmap -sn -T4 SUBNET # Host discovery nmap -F TARGET # Fast port scan (top 100) ``` ### 2. Full Port Scan Comprehensive port and service detection: ```bash nmap -p- -sV -sC -A TARGET -oN full_scan.txt ``` ### 3. Web Application Scan ```bash nuclei -u https://TARGET -t cves/ -t vulnerabilities/ -o web_vulns.txt nikto -h TARGET -o nikto_report.txt ``` ### 4. SSL/TLS Analysis ```bash sslscan TARGET testssl.sh TARGET ``` ## Output Save reports to `reports/security-scan-YYYY-MM-DD.md` with: - Target information - Open ports and services - Vulnerabilities found (severity rated) - Recommendations ## Ethics - Only scan authorized targets - Get written permission before testing - Report vulnerabilities responsibly - Never exploit without authorization


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: linshuikeji/browser-search (version 1.0.7)

--- name: browser-search description: | 浏览器搜索技能 - 安全的网页搜索工具 使用本地浏览器进行自动化搜索和内容提取 支持 Bing、Google、Baidu、DuckDuckGo 等公开搜索引擎 无需 API 配置，路径输出受限 --- # Browser Search 技能 使用本地浏览器进行安全的网页搜索和内容提取。 ## 安全说明 **仅用于合法用途**，严格遵守以下限制： - ✅ **仅访问公开搜索引擎**：Bing、Google、Baidu、DuckDuckGo - ✅ **路径输出受限**：结果文件只能保存到用户主目录 - ✅ **无危险函数**：不使用 eval/exec 等危险函数 - ✅ **严格的超时控制**：防止无限等待 - ❌ **禁止访问敏感站点**：仅支持公开搜索引擎 - ❌ **禁止爬取私有内容**：仅提取搜索结果摘要 ## 核心功能 - 🔍 **多搜索引擎支持**：Bing、Google、Baidu、DuckDuckGo - 📄 **内容提取**：自动提取搜索结果标题和链接 - 💾 **结果保存**：保存到 JSON/TXT/MD 文件（路径受限） ## 使用场景 - 查找最新新闻和资讯 - 搜索技术文档和教程 - 市场调研（仅限公开信息） ## 触发词 - "搜索..." - "查找..." - "用浏览器搜索..." - "帮我找..." ## 快速开始 ```bash # 基本搜索 browser-search "人工智能 2026" # 指定引擎 browser-search "AI 趋势" --engine bing # 保存结果 browser-search "Python 教程" --output ~/results.json --max 5 ``` ## 注意事项 - 需要本地 Chromium 浏览器 - 结果可能受地区限制 - 仅用于合法合规用途 - 输出文件路径必须在用户主目录

path: _meta.json
content: ownerId: kn72w01rkvyt12aqn4kr31tr7x82wpa0
slug: browser-search
version: 1.0.7
publishedAt: 1773922251532

path: requirements.txt
content: playwright>=1.58.0


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: geodeterra/strava-cli (version 0.1.0)

--- name: strava-cli description: Interact with Strava via the strava-client-cli Python tool. Use for viewing activities, athlete profiles, stats, and exporting data. Covers setup (creating a Strava account, API app, and OAuth) and all CLI commands. --- # Strava CLI ## Install ```bash uvx --from strava-client-cli strava --help # Or install persistently: uv tool install strava-client-cli ``` ## Setup ### 1. Create a Strava Account (if needed) Sign up at https://www.strava.com/register. Only name, email, and password required. ### 2. Create a Strava API Application 1. Go to https://www.strava.com/settings/api 2. Fill in: - **Application Name**: any descriptive name - **Category**: pick closest match (e.g. "Other") - **Website**: any URL (e.g. your GitHub) - **Authorization Callback Domain**: `localhost` - **Description**: brief description 3. Check the API Agreement checkbox 4. Click **Create** 5. Note your **Client ID** and **Client Secret** > **Important**: New Strava API apps allow only **1 connected athlete**. To connect a different athlete, revoke the current one at Settings → My Apps → Revoke Access. ### 3. Authenticate ```bash strava auth ``` Enter Client ID and Client Secret when prompted. Open the displayed URL in a browser, authorize, then copy the `code` parameter from the redirect URL (`http://localhost/?code=XXXXX`) and paste it back. Tokens auto-refresh (every 6 hours). Config: `~/.config/strava-cli/config.json`, tokens: `~/.config/strava-cli/tokens.json`. #### Manual Token Exchange (headless/automated) If no browser is available, do the OAuth flow manually: 1. Build the auth URL: ``` https://www.strava.com/oauth/authorize?client_id=CLIENT_ID&response_type=code&redirect_uri=http://localhost&approval_prompt=force&scope=activity:read_all,profile:read_all ``` 2. Open in any browser, authorize, grab the `code` from the redirect URL 3. Exchange: ```bash curl -s -X POST https://www.strava.com/oauth/token \ -d client_id=CLIENT_ID \ -d client_secret=CLIENT_SECRET \ -d code=CODE \ -d grant_type=authorization_code ``` 4. Save the response tokens to `~/.config/strava-cli/tokens.json`: ```json { "access_token": "...", "refresh_token": "...", "expires_at": 1234567890, "token_type": "Bearer" } ``` ## Commands ```bash strava profile # Athlete profile strava stats # Run/ride/swim stats summary strava activities --limit 10 # Recent activities strava activities --type Run --after 2024-01-01 # Filter by type/date strava activity 12345678 # Detailed activity view strava export --output ./data --format json # Bulk export ``` ## Source https://github.com/geodeterra/strava-cli


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: itcastwsy/cbismb-harmonyos-publish (version 1.0.0)

--- name: cbismb-harmonyos-publish version: 1.0.0 description: 自动发布文章到中小企业IT网 HarmonyOS 板块。当用户要求发布文章到中小企业IT网、cbismb.com、HarmonyOS开发者社区时触发此技能。 license: MIT input: properties: category: type: string description: 文章分类 default: HarmonyOS tags: type: string description: 文章标签 default: HarmonyOS is_original: type: boolean description: 是否原创 default: true privacy_agreement: type: boolean description: 是否勾选隐私声明 default: true enable_comments: type: boolean description: 是否开启评论 default: true --- # 中小企业 IT 网 HarmonyOS 板块文章发布 ## 概述 本技能用于自动发布文章到中小企业 IT 网 HarmonyOS 开发者社区板块。 **发布页面地址**: `https://www.cbismb.com/harmonyos/release` **板块首页**: `https://www.cbismb.com/harmonyos/home` ## 前置条件 - 用户已登录中小企业 IT 网账号 - Chrome 浏览器已附加 OpenClaw Browser Relay 扩展 ## 发布流程 ### 1. 打开发布页面 ``` browser action=open url=https://www.cbismb.com/harmonyos/release ``` ### 2. 填写文章内容 | 字段 | 操作 | 备注 | | -------- | -------------------------------- | ------------------ | | **标题** | 点击 `textbox "请输入标题"` 输入 | 限制长度，简洁明了 | | **正文** | 点击编辑区域 `paragraph` 输入 | 支持 Markdown 格式 | ### 3. 设置文章属性 | 属性 | 选择路径/操作 | | ---------------- | -------------------------------------------------------------------------------- | | **分类** | 优先使用用户输入的 `category` (默认: HarmonyOS)。路径参考: 操作系统 > [category] | | **标签** | 优先使用用户输入的 `tags` (默认: HarmonyOS)。点击 `+` 按钮，输入标签名后按 Enter | | **是否原创** | 根据用户输入的 `is_original` (默认: true) 设置开关状态 | | **是否开启评论** | 根据用户输入的 `enable_comments` (默认: true) 设置开关状态 | ### 4. 确认发布 1. 根据 `privacy_agreement` (默认: true) 勾选「隐私声明」复选框（勾选后才能发布） 2. 点击「发布」按钮 ## 页面元素参考 ### 分类选择 ``` 点击分类下拉框 → 展开"操作系统" → 选择"HarmonyOS" (或用户指定的分类) ``` 分类下拉菜单结构： - 操作系统 - HarmonyOS - OpenHarmony - 其它 - 应用开发 - 设备开发 - 框架语言 - 其它 ### 常用标签 根据文章内容选择合适的标签： - HarmonyOS - HarmonyOS 6 - 鸿蒙生态 - ArkTS - ArkUI - 鸿蒙开发 ## 注意事项 1. **隐私声明**：原创文章需要勾选隐私声明才能发布 2. **审核机制**：文章发布后可能需要审核，通常 1-3 个工作日 3. **正文统计**：页面底部显示"正文数字"，确保内容完整 4. **保存草稿**：如需暂存，点击「保存草稿」而非「发布」 ## 示例用法 **用户请求**： > 帮我在中小企业 IT 网的 HarmonyOS 板块发布一篇关于 HarmonyOS API 22 的介绍文章 **执行步骤**： 1. 提示用户输入参数（分类、标签、原创、隐私、评论），使用默认值或用户输入 2. 打开发布页面 3. 输入标题：`HarmonyOS API 22 新特性详解` 4. 输入正文（Markdown 格式） 5. 选择分类：操作系统 > [用户输入的分类] 6. 添加标签：[用户输入的标签] 7. 根据输入设置原创和评论开关 8. 根据输入勾选隐私声明 9. 点击发布 ## 错误处理 | 问题 | 解决方案 | | -------------- | ----------------------- | | 页面无法加载 | 检查网络连接和登录状态 | | 找不到分类选项 | 确认分类下拉框已展开 | | 发布按钮无响应 | 检查是否勾选隐私声明 | | 标签添加失败 | 确保输入后按 Enter 确认 |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ivangdavila/cpo (version 1.0.1)

--- name: CPO / Chief Product Officer slug: cpo version: 1.0.1 homepage: https://clawic.com/skills/cpo description: Drive product strategy with roadmap prioritization, team leadership, board communication, and competitive intelligence. changelog: Added Core Rules structure and product leadership frameworks. metadata: {"clawdbot":{"emoji":"📦","os":["linux","darwin","win32"]}} --- ## When to Use User wants product leadership for their company, startup, or project. Agent acts as virtual Chief Product Officer handling product strategy, roadmap, and org management. ## Quick Reference | Topic | File | |-------|------| | Product strategy frameworks | `operations.md` | | Hiring and building teams | `hiring.md` | | Career growth to CPO | `growth.md` | | CPO readiness assessment | `readiness.md` | | Performance evaluation | `evaluation.md` | ## Core Rules ### 1. Strategy ≠ Roadmap - Strategy is the bets you're making - Roadmap is the plan to execute them - Don't confuse features with strategy ### 2. Say No Often - CPO value is in what gets cut, not added - Every yes is a no to something else - Protect focus ruthlessly ### 3. Metrics With Context - Numbers without narrative mislead the board - Explain why, not just what - Trends matter more than snapshots ### 4. Protect the Team - Shield PMs from thrash - Fight for resources - Take the heat so they can build ### 5. Customer Obsession - Stay close to users even at executive level - Talk to customers weekly - Data informs, customers reveal ### 6. Decisive, Not Dictatorial - Strong opinions, loosely held - Listen to the team, then decide - Own the decision, share the credit ### 7. Kill Bad Ideas Fast - Sunk cost is not a reason to continue - Small experiments before big bets - Celebrate killing as much as shipping ## Product Focus by Stage | Stage | Focus | |-------|-------| | Pre-PMF | Customer discovery, rapid iteration, find retention | | Series A | Scalable roadmap, first PM hires, competitive positioning | | Series B | PM managers, product ops, platform vs feature | | Series C+ | Multi-product, M&A integration, org design | ## Common Traps - Feature factory — shipping without strategy - Roadmap theater — beautiful plans nobody follows - Metric gaming — optimizing numbers, not value - Ivory tower — losing touch with customers - Consensus seeking — trying to make everyone happy ## Human-in-the-Loop These decisions require human judgment: - Major pivots or product kills - Pricing strategy changes - Team restructuring - Board-level commitments ## Related Skills Install with `clawhub install <slug>` if user confirms: - `ceo` — executive leadership - `cto` — technical strategy - `cmo` — marketing alignment - `product-manager` — PM fundamentals ## Feedback - If useful: `clawhub star cpo` - Stay updated: `clawhub sync`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: terrycarter1985/tc-bluebubbles (version 1.0.0)

--- name: bluebubbles description: Send and manage iMessages via BlueBubbles self-hosted macOS server author: BlueBubbles author-url: https://bluebubbles.app version: 1.0.0 tags: ["imessage", "messaging", "communication"] metadata: { "requires": { "config": ["channels.bluebubbles.server_url", "channels.bluebubbles.password"], "env": [] } } --- # BlueBubbles iMessage Skill ## Overview Use this skill to send and manage iMessage conversations through a self-hosted BlueBubbles server. Supports text messages, attachments, reactions, edits, unsend, and iMessage effects. ## Configuration Add this to your gateway config: ```toml [channels.bluebubbles] server_url = "http://192.168.1.100:1234" # Your BlueBubbles server URL [REDACTED_SECRET]" allowed_senders = ["*"] # Allow all senders, or list specific handles ``` ## Usage Examples ### Send a text message ```json { "tool": "bluebubbles_send", "parameters": { "target": "+15551234567", "message": "Hello from your AI assistant!" } } ``` ### Send a message with iMessage effect ```json { "tool": "bluebubbles_send", "parameters": { "target": "+15551234567", "message": "Congratulations! 🎉", "effect": "confetti" } } ``` ### Send an attachment ```json { "tool": "bluebubbles_send_attachment", "parameters": { "target": "+15551234567", "file_path": "/workspace/output/report.pdf", "caption": "Here's the report you requested" } } ``` ### React to a message ```json { "tool": "bluebubbles_react", "parameters": { "target": "+15551234567", "message_id": "msg_12345", "emoji": "👍" } } ``` ## Supported Effects - slam, loud, gentle, invisible-ink - balloons, confetti, lasers, fireworks, shooting-star - celebration, echo, spotlight, love


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: wohaoshuai/buy-domain-helper (version 1.5.0)

--- name: buy-domain-helper description: | 3-layer site launcher: tunnel any HTML instantly (no account), deploy to Cloudflare Pages (permanent), then buy a domain and link it via DNS. Use when a user wants to share a local page, host a site, or get a custom domain live. version: 1.0.0 metadata: openclaw: requires: env: [] bins: - node - cloudflared - wrangler emoji: "🌐" homepage: https://github.com/wohaoshuai/buy-domain-helper --- # Buy Domain Helper 3 layers — pick the depth that fits the user's need: | Layer | What it does | Needs | |-------|-------------|-------| | **1 — Tunnel** | Instant public URL for any local dir or port | Nothing (cloudflared auto-installs) | | **2 — Pages** | Permanent hosting on `*.pages.dev` | Cloudflare account + Pages token | | **3 — Domain** | Custom domain linked to Pages via DNS | Domain purchased + DNS token | ## Helper script ```bash node site.js <command> [--token CF_API_TOKEN] [--account CF_ACCOUNT_ID] ``` | Command | Layer | Description | |---------|-------|-------------| | `tunnel <dir\|port>` | 1 | Instant public URL via Cloudflare Tunnel | | `deploy <name> <dir>` | 2 | Deploy to Cloudflare Pages | | `zone <domain>` | 3 | Get zone ID for a domain | | `dns-link <zone-id> <project>` | 3 | Add CNAME pointing domain to Pages | | `pages-domain <project> <domain>` | 3 | Attach custom domain to Pages project | | `domain-check <domain>` | 3 | Check availability on Cloudflare Registrar | ## Setup - **Layer 1**: No setup. `cloudflared` installs automatically via Homebrew if missing. - **Layer 2**: Needs a Cloudflare API token with **Account > Cloudflare Pages > Edit** permission. - **Layer 3**: Needs a separate token with **Zone > DNS > Edit** permission for the specific domain. Create tokens at: https://dash.cloudflare.com/profile/api-tokens


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: lorexxar/daily-beauty (version 1.0.10)

--- name: daily-beauty description: 每日美图推送。当用户发送"今日美图"、"美图"、"看美女"等关键词时触发。从小红书搜索真人美女博主，返回1位博主的9张全身照美图。自动排除壁纸号、AI账号、营销号。 --- # 每日美图 从小红书获取真人美女博主的全身照美图，每次返回 **1位博主的9张图片**。 ## 触发词 - "今日美图" - "美图" - "看美女" - "推荐美女" ## 执行方式 运行 Python 脚本： ```bash python3 ~/.openclaw/workspace/skills/daily-beauty/daily_beauty.py ``` 脚本会自动： 1. 搜索小红书博主 2. 筛选真人博主（排除已推送的、AI账号、壁纸号、营销号） 3. 下载9张全身照图片 4. 更新去重记录 5. 输出 JSON 格式的结果 ## 去重数据文件 - `data/pushed_bloggers.json` - 已推送博主 user_id 列表 - `data/pushed_images.json` - 已推送图片 URL 列表 ## 输出格式 ```json { "success": true, "blogger": { "nickname": "昵称", "fans": "粉丝数", "likes": "获赞数", "desc": "简介" }, "images": ["图片路径1", "图片路径2", ...] } ``` ## 推送到飞书 使用 message tool 发送图片： ``` message action=send channel=feishu target=user:ou_2f7b674673f4020ca4a64deda675ccc9 message="博主介绍" path=图片路径 ``` ## 注意事项 1. 脚本会自动跳过已推送的博主和图片 2. 图片必须是全身照（宽高比 >= 1.3） 3. 博主粉丝数必须 > 1000 4. 自动排除包含黑名单关键词的账号


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal:  | SkillSpector: suspicious (CRITICAL)
Skill: qiyun154-cyber/sentry-ai (version 1.0.0)

--- name: sentry-ai description: Solana/Base Multi-Chain Meme Scanner & Auditor (Anti-Rug) metadata: { "openclaw": { "emoji": "🛡️", "requires": { "env": [], "bins": [], "skills": [] }, "install": [] } } --- # Sentry-AI: Multi-Chain Meme Scanner & Auditor 赋予你的 OpenClaw 顶级"科学家"的嗅觉。 ## 简介 本插件专为一级市场玩家设计，集成全自动合约静态审计与链上动态监控。通过 LLM 逻辑判断，秒级识别"貔貅盘"与"老鼠仓"。 ## 核心功能 ### Auto-Scan - 毫秒级接入 DexScreener/Raydium 新池子流 - 实时监控 Solana/Base 链新代币 ### Risk Score - 基于代码安全性加权评分 - 流动性占比分析 - 社交媒体增长率监测 ### One-Click Execute - 支持配置止盈止损逻辑 - 智能 Gas 优化 ## 支持链 - Solana - Base - Ethereum (Coming Soon) ## 使用方法 ```bash # 扫描新池子 python scripts/scan.py # 检查特定代币 python scripts/audit.py <TOKEN_ADDRESS> ``` ## 定价 - 免费版：基础扫描 - Pro版 ($19.9/月)：完整审计 + 实时推送 --- *Powered by OpenClaw*


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: peand-rover/clawhub-ops (version 1.0.0)

--- name: clawhub-ops description: ClawHub Skill 发版、账号管理、SEO 优化、数据查询的完整操作手册。当需要发布新 Skill、切换账号、查询 downloads 数据、排查发版归属问题、验证 IP 代理时使用。包含 5 个账号的 token/IP 对照、双 config 路径陷阱、已知 CLI Bug、速率限制规则。 --- # ClawHub 发版操作 SOP ## 发版前必做 5 步 ```bash # 1. 确认当前 token cat "~/Library/Application Support/clawhub/config.json" # 2. 同时写入两个 config 路径（缺一不可） echo '{"registry":"https://clawhub.ai","token":"TOKEN"}' > ~/Library/Application\ Support/clawhub/config.json echo '{"registry":"https://clawhub.ai","token":"TOKEN"}' > ~/.config/clawhub/config.json # 3. 确认出口 IP（必须与账号绑定 IP 一致） curl -s --proxy "PROXY_URL" https://api.ipify.org # 4. 发版（必须加 --name 和 --version 参数） HTTPS_PROXY=PROXY_URL npx clawhub@latest publish <path> --slug <slug> --version 1.0.0 --name "<长关键词名>" # 5. 发完验证归属（8秒后） sleep 8 && curl -sL -x http://127.0.0.1:7897 -o /dev/null -w "%{url_effective}" "https://clawhub.ai/skills/<slug>" ``` ## 账号矩阵（token / proxy / IP） 详见 `references/accounts.md` ## 速率限制规则（死规定） - **同一账号**相邻发版间隔 **≥15 分钟**（不能卡固定值，太像脚本） - 不同账号可以串行（宿主机 config 文件只有一个，不能并行，否则 token 互相覆盖） - 发版脚本 `/Users/user/.openclaw/workspace-master/铁柱-workspace/scripts/publish-with-proxy.sh` 已内置间隔检查，<15 分钟直接 exit 1 ## 已知 CLI Bug 1. **`whoami` 返回缓存**：永远返回第一次登录的账号名，不可信。验证归属必须 curl URL 2. **`publish` 必须加 `--version`**：不读 frontmatter version 字段，必须显式传 3. **`--name` 参数必填**：frontmatter displayName 不生效，必须用 `--name "<全称>"` ## macOS 双 config 路径（致命陷阱） - CLI **优先读** `~/Library/Application Support/clawhub/config.json` - 次级读 `~/.config/clawhub/config.json` - `CLAWHUB_TOKEN` 环境变量在 CLI v0.9.0 中被**完全忽略** - 切换账号必须**同时更新两个路径** ## Downloads 数据查询 ```bash # 标准查询脚本（格式：downloads:N，无引号无空格） bash /Users/user/.openclaw/workspace-master/shared/scripts/clawhub-downloads.sh \ nemo-video nemo-edit nemo-subtitle ... # 手动单个查询 curl -sL -x http://127.0.0.1:7897 "https://clawhub.ai/<account>/<slug>" \ | grep -o 'downloads:[0-9]*' | head -1 | cut -d: -f2 ``` ⚠️ trpc `/api/trpc/skill.bySlug` 和 REST `/api/skills/<slug>` 均已失效 ## SEO 策略 - slug 含关键词 = 不可逾越的排名优势（score 3.0+ vs 品牌 slug 2.0） - displayName 每个词都计入向量，宁可长不删词 - description 嵌入多语种关键词，一个 Skill 覆盖多语言搜索 - 触发词黑名单：`free trial` / `free credits` / `100 credits`（触发 spam 检测） ## 发布审核铁律 发布前检查： - API 域名必须是 `mega-api-prod.nemovideo.ai` - displayName 必须是带关键词的长名（≥50字符） - 无触发词（grep "free trial\|free credits"） - 与已发 Skill 差异度 > 40% 详细操作见 `references/publish-checklist.md`


Security scan verdicts — ClawScan: malicious | static analysis: clean | VirusTotal: suspicious | SkillSpector:  ()
Skill: petersunpingww-droid/chinese-encoding-handler (version 1.0.0)

# Chinese-Encoding-Handler ## 描述 中文编码处理工具包，解决 PowerShell 环境下中文文件读写乱码问题。提供自动编码检测、安全文件读写和终端显示修复功能。 ## 触发场景 - 读取中文文件时出现乱码 - 写入中文内容后无法正常显示 - PowerShell 终端中文显示异常 - 需要自动检测文件编码 - 处理包含中文的配置文件或数据文件 ## 使用方法 ### 检测文件编码 ```powershell .\scripts\encoding-detector.ps1 -Path "C:\path\to\file.txt" ``` **输出示例**： ``` 文件路径：C:\path\to\file.txt 检测编码：UTF-8-BOM 置信度：100% ``` ### 安全读取中文文件 ```powershell .\scripts\safe-read.ps1 -Path "C:\path\to\file.txt" ``` **带编码参数读取**： ```powershell .\scripts\safe-read.ps1 -Path "C:\path\to\file.txt" -Encoding "UTF-8" ``` ### 安全写入中文文件 ```powershell .\scripts\safe-write.ps1 -Path "C:\path\to\file.txt" -Content "中文内容" ``` **指定编码写入**： ```powershell .\scripts\safe-write.ps1 -Path "C:\path\to\file.txt" -Content "中文内容" -Encoding "UTF-8-BOM" ``` ### 修复终端显示 ```powershell .\scripts\terminal-fix.ps1 ``` **永久修复（需要管理员权限）**： ```powershell .\scripts\terminal-fix.ps1 -Permanent ``` ## 技术细节 ### 编码检测原理 1. **BOM 检测**：优先检查文件开头的字节顺序标记（BOM） - UTF-8-BOM: `EF BB BF` - UTF-16-LE: `FF FE` - UTF-16-BE: `FE FF` 2. **内容分析**：无 BOM 时，通过字节分布和常见中文字符编码特征判断 - GBK/GB2312：双字节字符特征 - UTF-8：多字节序列特征 3. **置信度评分**：根据匹配程度给出 0-100% 置信度 ### UTF-8-BOM 优势 - ✅ **兼容性好**：Windows 程序（记事本、Excel）识别准确 - ✅ **跨平台**：Linux/macOS 正常读取 - ✅ **无乱码风险**：明确标识编码格式 - ⚠️ **注意**：某些 Unix 工具可能不兼容 BOM ### 兼容性说明 | 系统 | 支持程度 | 备注 | |------|---------|------| | Windows PowerShell 5.1 | ✅ 完全支持 | 推荐 UTF-8-BOM | | Windows PowerShell 7+ | ✅ 完全支持 | 默认 UTF-8 | | Linux/macOS | ✅ 支持 | 建议无 BOM UTF-8 | | CI/CD 环境 | ✅ 支持 | 需确保终端 UTF-8 | ## 故障排除 ### 常见问题 Q&A **Q1: 为什么读取文件还是乱码？** - 检查文件编码是否被正确识别 - 尝试手动指定 `-Encoding` 参数 - 使用 `encoding-detector.ps1` 重新检测 **Q2: 写入的文件在记事本打开乱码？** - 使用 `-Encoding "UTF-8-BOM"` 参数 - 避免使用纯 UTF-8（无 BOM） **Q3: PowerShell 终端显示中文为方框？** - 运行 `terminal-fix.ps1` - 检查终端字体是否支持中文 - 使用 `-Permanent` 参数永久修复 **Q4: 批量处理文件时部分失败？** - 检查文件权限 - 确认文件未被其他程序占用 - 查看错误日志定位具体文件 ### 错误代码说明 | 错误码 | 含义 | 解决方案 | |--------|------|---------| | ERR-001 | 文件不存在 | 检查路径是否正确 | | ERR-002 | 权限不足 | 以管理员身份运行 | | ERR-003 | 编码检测失败 | 手动指定编码参数 | | ERR-004 | 文件被占用 | 关闭占用程序后重试 | | ERR-005 | 终端设置失败 | 检查注册表权限 | ## 相关资源 - [PowerShell 编码官方文档](https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_character_encoding) - [UTF-8 BOM 规范](https://www.unicode.org/faq/utf_bom.html) - [GitHub 仓库](https://github.com/openclaw/chinese-encoding-handler)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)