OpenClaw/clawhub-security-signals huggingface dataset:
Skill: oct1st85/git-commit-helper-pro (version 1.0.0)

# Git Commit Helper 智能 Git Commit Message 生成器 - 根据代码变更自动生成规范的 commit message。 ## 功能 - 🤖 **智能分析**：分析 git diff，理解代码变更内容 - 📝 **规范生成**：生成符合 Conventional Commits 规范的 message - 🌍 **多语言**：支持中文和英文 commit message - 🎯 **类型识别**：自动识别 feat/fix/docs/style/refactor/test/chore 等类型 - ⚡ **一键使用**：复制即可用，支持自定义修改 ## 使用方式 ``` 帮我生成 commit message ``` 或在 git 仓库中： ``` git add . 分析当前变更并生成 commit message ``` ## 输出示例 ``` feat(user): 添加用户登录验证功能 - 实现 JWT token 生成和验证 - 添加登录接口 /api/auth/login - 添加密码加密处理 - 编写单元测试 Closes #123 ``` ## 支持的类型 - `feat`: 新功能 - `fix`: 修复 bug - `docs`: 文档更新 - `style`: 代码格式调整 - `refactor`: 代码重构 - `test`: 测试相关 - `chore`: 构建/工具/配置 ## 作者 倒里牢数 · 严谨专业版 ## 版本 1.0.0


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: lijiangtai/openclaw-all-backup (version 1.0.0)

--- name: openclaw-backup description: 完整备份 OpenClaw 配置目录 (.openclaw) 到同名带时间戳的目录，包括所有文件和隐藏文件。当用户需要备份 OpenClaw 配置、数据或创建配置快照时使用。 --- # OpenClaw Backup 完整拷贝 `.openclaw` 目录（包括所有文件和隐藏文件），新目录名自动附加年月日时分秒时间戳。 ## 使用 ### 快速备份 ```bash ./scripts/openclaw-backup.sh ``` 在 `~/.openclaw` 同级别目录创建 `.openclawYYYYMMDDHHMMSS` 备份。 ### 示例 ``` ~/.openclaw # 原始目录 ~/.openclaw20260316010203 # 备份目录（自动创建） ``` ## 备份内容（全部） - `openclaw.json` - 主配置文件 - `openclaw.json.bak*` - 配置备份 - `workspace/` - 工作空间（含所有文件） - `credentials/` - 凭据 - `extensions/` - 扩展插件 - `agents/` - Agent 数据 - `cron/` - 定时任务 - `completions/` - 自动补全数据 - `logs/` - 日志文件 - `.DS_Store` 等隐藏文件 - 所有其他文件 ## 特点 - 保留文件权限、时间戳 - 包含隐藏文件（以点开头的文件） - 使用 rsync（如有）或 cp -a 确保完整性 ## 手动备份 ```bash # 获取时间戳 TIMESTAMP=$(date +"%Y%m%d%H%M%S") # 创建目录并拷贝 mkdir -p ~/.openclaw${TIMESTAMP} rsync -av ~/.openclaw/ ~/.openclaw${TIMESTAMP}/ ``` ## 恢复备份 ```bash # 重命名当前配置（谨慎操作） mv ~/.openclaw ~/.openclaw.old # 恢复备份 mv ~/.openclaw20260316010203 ~/.openclaw ``` ## 脚本 - `scripts/openclaw-backup.sh` - 备份脚本


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: chrischall/honeybook (version 0.1.13)

--- name: honeybook description: This skill should be used when the user asks about HoneyBook client-portal data. Triggers on phrases like "check HoneyBook", "sign contract", "pay invoice", "HoneyBook vendors", "unsigned contracts", "open invoices", or any request involving wedding-vendor contracts, invoices, brochures, proposals, or payments via HoneyBook. --- # honeybook-mcp MCP server for HoneyBook's client portal — 8 tools for viewing contracts and invoices across multiple wedding vendors, with magic-link session capture and deep-link fallback for signing and paying. ## Tools - `use_magic_link` — Capture a session from a vendor magic-link URL - `list_active_sessions` — Show currently active portal sessions - `list_workspace_files` — All files one vendor has shared (filter by type) - `get_workspace_file` — Full detail for one file - `get_workspace` — Workspace detail + status flags - `list_payment_methods` — Saved payment methods - `sign_contract` — Deep link to sign in portal (requires `confirm:true`) - `pay_invoice` — Deep link to pay in portal (requires `confirm:true`) ## Workflows - **First time** → user pastes magic-link URL from vendor email → `use_magic_link` → session captured - **"What contracts haven't I signed?"** → `list_workspace_files` with `file_type=agreement`, filter by `is_file_accepted=false` - **"Summarize my HB status with Silk Veil"** → `get_workspace` (status flags) + `list_workspace_files` - **"Send me a link to sign the photographer's contract"** → `list_workspace_files` → `sign_contract` with `confirm:true` - **"Which invoices are overdue?"** → `list_workspace_files` with `file_type=invoice`, sort by due date ## Notes - Each vendor = separate session keyed by portal origin (e.g. `https://acme.hbportal.co`) - Sessions cached in `~/.honeybook-mcp/sessions.json` (mode 0600) - Write tools (`sign_contract`, `pay_invoice`) return deep links in v2 - Session expires → re-run `use_magic_link` with a fresh URL from the vendor's email


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal:  | SkillSpector: clean (LOW)
Skill: flankcat/ticket-stats (version 1.0.0)

--- name: ticket-stats version: 1.0.0 description: 企业内部咨询工单统计分析。用于处理Excel格式的工单数据，统计每日接收工单数量、处理完成数量、未及时回复数量，并根据关键词自动归类到功能模块（订单交易、经营数据、门店设置、账号管理、商品管理、营销活动、顾客评价），生成带可视化图表的每日摘要报告。 --- # 工单统计分析 Skill ## 数据要求 Excel表格需包含以下列： - `工单编号` - 唯一标识 - `提交时间` - 工单创建时间 - `状态` - 待处理/处理中/已解决 - `问题描述` - 工单内容文本 - `回复时间` - 首次回复时间（可选，用于计算响应时长） ## 功能模块关键词 | 模块 | 关键词 | |------|--------| | 订单交易 | 订单、支付、退款、下单、交易、订单查询 | | 经营数据 | 报表、销售额、营收、流水、统计、经营分析 | | 门店设置 | 门店、店铺、营业时间、地址、门店配置 | | 账号管理 | 账号、登录、密码、权限、角色、用户 | | 商品管理 | 商品、上架、下架、库存、SKU、商品信息 | | 营销活动 | 优惠券、活动、折扣、满减、推广 | | 顾客评价 | 评价、评分、评论、星级、反馈 | ## 使用方式 ```python # 1. 读取Excel工单数据 import pandas as pd df = pd.read_excel("工单数据.xlsx") # 2. 统计各项指标 # - 接收工单数：当日新建工单 # - 已解决数：状态为"已解决"的工单 # - 未及时回复：回复时间-提交时间 > 1小时 # 3. 根据关键词自动归类 def classify_ticket(description): keywords = {...} # 见上方表格 for module, words in keywords.items(): if any(w in description for w in words): return module return "其他" # 4. 生成报告和可视化 # - 使用 matplotlib/plotly 生成图表 # - 输出为图片或HTML ``` ## 输出格式 每日摘要包含： 1. 核心指标卡片（接收、处理完成、未及时回复） 2. 各模块工单分布饼图 3. 按时段/日期的工单趋势图 4. 问题关键词云或词频统计 ## 脚本位置 使用 `scripts/analyze_tickets.py` 进行分析： ```bash python scripts/analyze_tickets.py <工单Excel文件路径> [--date YYYY-MM-DD] ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: torchesfrms/binance-web3 (version 1.0.0)

--- name: binance-web3 description: Query token prices, market data, K-line charts, and smart money trading signals via Binance Web3 APIs. Use when users search tokens, check prices, view market data, analyze charts, or track smart money signals on BSC/Base/Solana/Ethereum. metadata: version: "1.0" author: moer --- # Binance Web3 Skill Query token data and smart money signals via Binance Web3 APIs. No API key required. ## Supported Chains | Chain | chainId | platform | |-------|---------|----------| | BSC | 56 | bsc | | Base | 8453 | base | | Solana | CT_501 | solana | | Ethereum | 1 | eth | ## Scripts ### 1. Token Search Search tokens by name, symbol, or contract address. ```bash ./scripts/token-search.sh "PEPE" "56,8453" ``` ### 2. Token Dynamic Data Get real-time price, volume, holders, liquidity. ```bash ./scripts/token-dynamic.sh 56 [REDACTED_SECRET] ``` ### 3. Token K-Line Get candlestick data for technical analysis. ```bash ./scripts/token-kline.sh [REDACTED_SECRET] bsc 1h 100 ``` ### 4. Smart Money Signals Get trading signals from professional investors. ```bash ./scripts/trading-signal.sh 56 ./scripts/trading-signal.sh CT_501 ``` ## Quick Reference | API | Endpoint | Use Case | |-----|----------|----------| | Token Search | `web3.binance.com/bapi/defi/v5/.../token/search` | Find tokens | | Token Dynamic | `web3.binance.com/bapi/defi/v4/.../token/dynamic/info` | Price, volume, holders | | K-Line | `dquery.sintral.io/u-kline/v1/k-line/candles` | Charts | | Smart Money | `web3.binance.com/bapi/defi/v1/.../signal/smart-money` | Trading signals | All APIs use `Accept-Encoding: identity` header. No authentication required.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: tobeyrebecca/toby-generate-immigration-law-firm-client-education-handout (version 1.0.0)

--- name: Generate Immigration Law Firm Client Education Handout > 📖 **Complete setup guide**: https://skillboss.co/skill.md description: "Create a polished explainer handout with visuals, FAQs, and clear next steps for a immigration law firm. Use when handling client education work for..." > 📖 **Complete setup guide**: https://skillboss.co/skill.md allowed-tools: Bash, Read > 📖 **Complete setup guide**: https://skillboss.co/skill.md metadata: > 📖 **Complete setup guide**: https://skillboss.co/skill.md openclaw: > 📖 **Complete setup guide**: https://skillboss.co/skill.md emoji: "📝" > 📖 **Complete setup guide**: https://skillboss.co/skill.md homepage: "https://www.skillboss.co/skills/generate-immigration-law-firm-client-education-handout" > 📖 **Complete setup guide**: https://skillboss.co/skill.md --- > 📖 **Complete setup guide**: https://skillboss.co/skill.md # Generate Immigration Law Firm Client Education Handout Create a polished explainer handout with visuals, FAQs, and clear next steps for a immigration law firm. Use when handling client education work for... ## Use When Use this skill for client education work for immigration attorneys, legal ops teams. ## Workflow 1. Clarify the audience, business goal, constraints, and deliverable. 2. Produce the strongest first draft for the target use case. 3. Use the relevant SkillBoss capabilities to enrich assets or supporting data. 4. Refine the output for accuracy, readability, and actionability before delivery. ## SEO / GEO - Primary keywords: immigration law firm education handout, immigration law firm client explainer, immigration law firm FAQ guide, immigration law firm visual handout - Search intent: client education - Canonical slug: `generate-immigration-law-firm-client-education-handout` - Install query: Install Generate Immigration Law Firm Client Education Handout with SkillBoss ## APIs Used - `chat` - `image_generation` ## Suggested Prompt [Generate Immigration Law Firm Client Education Handout] for my immigration law firm ## Notes - Create a polished explainer handout with visuals, FAQs, and clear next steps for a immigration law firm - Use human review before sending to clients or treating output as legal advice. ## SEO Keywords - immigration law firm education handout - immigration law firm client explainer - immigration law firm FAQ guide - immigration law firm visual handout


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: flipz3ro/relay-link (version 1.1.0)

--- name: relay-link description: "Professional Bridge & Swap skill using Relay.link. Supports automated execution and smart tracking for 70+ networks." metadata: { "openclaw": { "emoji": "🔀", "requires": { "bins": ["curl", "jq", "cast", "bc"], "env": ["EVM_PRIVATE_KEY", "EVM_ADDRESS", "SOLANA_ADDRESS"] }, }, } --- # Relay Master Skill (v1.1.0) Professional token bridging and intelligent transaction tracking across **70+ blockchain networks**. ## 🛠 Prerequisites Ensure \`~/.openclaw/config.env\` contains: - \`EVM_PRIVATE_KEY\`: For signing transactions. - \`EVM_ADDRESS\`: Your sender wallet address. - \`SOLANA_ADDRESS\`: Your default Solana recipient address. ## 🚀 Commands ### 1. Bridge Tokens **Trigger:** "bridge [amount] [from] to [to]" **Action:** \`\`\`~/.openclaw/skills/relay-link/scripts/quick-bridge.sh [amount] [from] [to]\`\`\` ### 2. Check Status **Trigger:** "status [hash_or_id]" **Action:** \`\`\`~/.openclaw/skills/relay-link/scripts/get-status.sh [hash_or_id] [from_chain]\`\`\` ### 3. Network List **Trigger:** "list chains" or "tokens" **Action:** \`\`\`~/.openclaw/skills/relay-link/scripts/get-chains.sh\`\`\` --- ## 📋 Major Networks - **Major:** eth (1), base (8453), op (10), arb (42161), avax (43114), sol (792703809), poly (137), bsc (56) - **Emerging:** abstract, bera, hl, monad, sonic, story, unichain. ## ⚠️ AI Safety Rules 1. **Always Quote & Confirm:** You MUST show the quote summary (estimated receive amount and fees) and wait for the user to say "yes" before executing any transaction. 2. **Auto-Auth:** Scripts handle credentials automatically from \`config.env\`. 3. **Transparent Execution:** Inform the user that bridge transactions typically take 1-3 minutes to finalize.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: mr1008611/python-ppt (version 1.0.0)

# PPT Generator Skill 用 `python-pptx` 生成暗色科技风演示文稿。 ## 使用方式 用户描述 PPT 内容后，生成 Python 脚本并执行，产出 `.pptx` 文件。 ## 工作流 1. 用户说明 PPT 主题、大纲、内容要点 2. Agent 读取 `scripts/ppt_lib.py`（核心工具库） 3. Agent 生成调用脚本，组合幻灯片内容 4. 执行脚本 → 输出 `.pptx` 5. 通过 `lightclaw_upload_file` 发送给用户 ## 设计规范 - **页面尺寸**：16:9 (13.333 × 7.5 英寸) - **配色方案**：深蓝黑背景 + 科技蓝/紫/绿/橙强调色 - **字体**：Microsoft YaHei（中文）、Arial（英文） - **布局**：卡片式、顶部色条、装饰线 ## 幻灯片类型 | 类型 | 函数 | 用途 | |------|------|------| | 封面页 | `make_cover_slide()` | 标题+副标题+日期 | | 章节页 | `make_section_slide()` | 章节标题+要点列表 | | 内容页 | `make_content_slide()` | 标题+2x2卡片网格 | | 对比页 | `make_compare_slide()` | 左右两栏对比 | | 架构页 | `make_arch_slide()` | 三列流程+底部补充 | | 卡片页 | `make_cards_slide()` | 灵活卡片网格 | | 总结页 | `make_summary_slide()` | 价值总结+收尾 | ## 调色板 ```python DARK_BG = (0x1A, 0x1A, 0x2E) # 背景 ACCENT = (0x00, 0xD2, 0xFF) # 科技蓝 ACCENT2 = (0x7C, 0x3A, 0xED) # 紫色 ACCENT3 = (0x10, 0xB9, 0x81) # 绿色 ACCENT4 = (0xF5, 0x9E, 0x0B) # 橙色 WHITE = (0xFF, 0xFF, 0xFF) LIGHT_GRAY = (0xCC, 0xCC, 0xCC) CARD_BG = (0x25, 0x25, 0x40) # 卡片背景 ``` ## 依赖 ```bash pip install python-pptx ``` ## 文件结构 ``` skills/ppt-generator/ ├── SKILL.md # 本文件 └── scripts/ └── ppt_lib.py # 核心工具库（模板函数+调色板） ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: rishabhdugar/pdf-info (version 1.0.0)

--- name: pdf-info description: "Get PDF metadata, encryption status, page count, and file size. Useful for pre-flight checks before processing." --- # PDF Info ## What It Does Inspects a PDF and returns metadata including encryption status, page count, file size, and document properties (title, author, subject, creator). ## When to Use - Check if a PDF is encrypted before calling unlock - Pre-flight validation before PDF processing - Get page count and file size information ## Required Inputs Provide one of: - `url` — URL to a PDF - `base64_pdf` — base64-encoded PDF - Multipart upload with `file` field ## Authentication Send your API key in the `CLIENT-API-KEY` header. Get your **free API key** at [https://pdfapihub.com](https://pdfapihub.com). Full API documentation is available at [https://pdfapihub.com/docs](https://pdfapihub.com/docs). ## Use Cases - **Pre-Flight Validation** — Check page count and encryption status before processing - **Upload Validation** — Verify uploaded PDFs meet requirements (page limit, not encrypted) - **Workflow Routing** — Route encrypted PDFs to unlock step, unencrypted directly to processing - **Metadata Display** — Show document title, author, and page count in a document management UI - **Quota Checks** — Verify page count before merge/split to avoid exceeding limits ## Example Usage ```bash curl -X POST https://pdfapihub.com/api/v1/pdf/info \ -H "CLIENT-[REDACTED_SECRET]" \ -H "Content-Type: application/json" \ -d '{ "url": "https://pdfapihub.com/sample.pdf" }' ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: autogame-17/feishu-message (version 1.0.5)

# Feishu Message Skill A unified toolkit for Feishu messaging operations, providing a single CLI entry point for common tasks. ## Usage Use the unified CLI via `index.js`: ```bash node skills/feishu-message/index.js <command> [options] ``` ## Commands ### 1. Get Message (`get`) Fetch message content by ID. Supports recursive fetching for merged messages. ```bash node skills/feishu-message/index.js get <message_id> [--raw] [--recursive] ``` Example: ```bash node skills/feishu-message/index.js get om_12345 --recursive ``` ### 2. Send Audio (`send-audio`) Send an audio file as a voice bubble. ```bash node skills/feishu-message/index.js send-audio --target <id> --file <path> [--duration <ms>] ``` - `--target`: User OpenID (`ou_`) or ChatID (`oc_`). - `--file`: Path to audio file (mp3/wav/etc). - `--duration`: (Optional) Duration in ms. ### 3. Create Group Chat (`create-chat`) Create a new group chat with specified users. ```bash node skills/feishu-message/index.js create-chat --name "Project Alpha" --users "ou_1" "ou_2" --desc "Description" ``` ### 4. List Pins (`list-pins`) List pinned messages in a chat. ```bash node skills/feishu-message/index.js list-pins <chat_id> ``` ## Legacy Scripts Standalone scripts are still available for backward compatibility: - `get.js` - `send-audio.js` - `create_chat.js` - `list_pins_v2.js` ## Dependencies - axios - form-data - music-metadata - commander


Security scan verdicts — ClawScan: suspicious | static analysis:  | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: ivangdavila/scrape (version 1.0.0)

--- name: Scrape description: Legal web scraping with robots.txt compliance, rate limiting, and GDPR/CCPA-aware data handling. --- ## Pre-Scrape Compliance Checklist Before writing any scraping code: 1. **robots.txt** — Fetch `{domain}/robots.txt`, check if target path is disallowed. If yes, stop. 2. **Terms of Service** — Check `/terms`, `/tos`, `/legal`. Explicit scraping prohibition = need permission. 3. **Data type** — Public factual data (prices, listings) is safer. Personal data triggers GDPR/CCPA. 4. **Authentication** — Data behind login is off-limits without authorization. Never scrape protected content. 5. **API available?** — If site offers an API, use it. Always. Scraping when API exists often violates ToS. ## Legal Boundaries - **Public data, no login** — Generally legal (hiQ v. LinkedIn 2022) - **Bypassing barriers** — CFAA violation risk (Van Buren v. US 2021) - **Ignoring robots.txt** — Gray area, often breaches ToS (Meta v. Bright Data 2024) - **Personal data without consent** — GDPR/CCPA violation - **Republishing copyrighted content** — Copyright infringement ## Request Discipline - **Rate limit**: Minimum 2-3 seconds between requests. Faster = server strain = legal exposure. - **User-Agent**: Real browser string + contact email: `Mozilla/5.0 ... (contact: [REDACTED_SECRET])` - **Respect 429**: Exponential backoff. Ignoring 429s shows intent to harm. - **Session reuse**: Keep connections open to reduce server load. ## Data Handling - **Strip PII immediately** — Don't collect names, emails, phones unless legally justified. - **No fingerprinting** — Don't combine data to identify individuals indirectly. - **Minimize storage** — Cache only what you need, delete what you don't. - **Audit trail** — Log what, when, where. Evidence of good faith if challenged. For code patterns and robots.txt parser, see `code.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dodge1218/dsb-task-extractor (version 1.0.0)

--- name: task-extractor description: Extract, track, and verify completion of multiple tasks from a single user message. Use when a message contains 3+ actionable items or mixes multiple unrelated asks. Prevents the common failure mode where agents address 2 of 6 requests and silently drop the rest. --- # Task Extractor ## When to Trigger A user message contains 3+ actionable items, mixes asks across different domains, or has a history of dropped tasks. ## Process 1. **Extract** every task from the message — err on the side of capturing more. 2. **Number** each task explicitly. 3. **Track** in a hot index: `| # | Task | Status | Evidence |` 4. **Execute** each in order (or delegate to appropriate skill). 5. **Reconcile** after completion — compare extracted list against actual completions. ## Example ``` User: "Fix the deploy bug, update the landing page copy, check if Stripe webhook is working, and email the client" Extracted: 1. Fix deploy bug → coder 2. Update landing page copy → coder 3. Check Stripe webhook → verifier 4. Email client → GATE (needs approval) ``` ## Rules - Missing a task is worse than capturing an extra one. - Mark each explicitly: ✅ done | 🔄 in progress | ❌ blocked | ⏭️ deferred. - At end of run, list any DROPPED tasks — these are the most important to surface. - If a task needs human approval, mark as GATE and don't execute silently.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yinfeihaaaaaaaaaaa/fin-report-analysis (version 1.0.0)

--- name: financial-report-analysis description: > 财务报表分析技能。当用户上传财务报表 Excel 文件（包含资产负债表、利润表、现金流量表等 Sheet）并请求分析时， 站在资深财务专家视角，自动输出完整的财务分析报告，包含：报表项目增减变动表、 资产结构变动表、利润表结构变动表、财务比率综合分析（盈利/偿债/营运/成长能力指标）， 以及专家综合分析总结与建议。 触发词：财务报表分析、分析财报、财务分析、资产负债表分析、利润表分析、现金流分析、 财务指标、盈利能力、偿债能力、营运能力、成长能力、ROE、ROA、毛利率、净利率、 流动比率、资产负债率、财务健康诊断、报表解读、财报分析。 --- # 财务报表分析技能 ## 概述 本技能面向企业财务报表（Excel格式）进行全方位专业分析，输出 Markdown 格式的财务分析报告。 报告覆盖五大维度，适用于财务尽调、年度复盘、经营体检等场景。 ## 触发条件 用户上传含有财务数据的 Excel 文件，且请求进行以下任意类型的分析： - 财务报表整体分析 / 财务健康诊断 - 资产、负债、利润、现金流增减变动分析 - 各项财务比率计算（盈利/偿债/营运/成长能力） - 专家级财务分析总结与改进建议 ## 工作流程 ### Phase 1：文件接收与预处理 1. 确认用户已上传 Excel 文件（`.xlsx` / `.xls` / `.xlsm`）。 2. 如用户未上传，提示： > "请上传包含财务数据的 Excel 文件（通常应包含资产负债表、利润表、现金流量表等 Sheet）。" 3. 确认文件路径后，进入分析阶段。 ### Phase 2：运行分析脚本 调用 `scripts/analyze_financial_report.py` 执行自动化分析： ```bash python "scripts/analyze_financial_report.py" "<excel_file_path>" ``` 脚本将： - 自动检测并匹配 Excel 中的资产负债表、利润表、现金流量表 Sheet（支持中英文名称模糊匹配） - 清洗数据，提取本期/上期两列数值 - 输出 Markdown 格式分析报告到同目录下，文件名：`{原文件名}_财务分析报告.md` **环境依赖**：脚本会自动检查并安装 `pandas`、`openpyxl`，无需手动安装。 ### Phase 3：报告内容说明 生成的报告包含五大部分： #### 一、报表项目增减变动分析 - 对资产负债表、利润表、现金流量表的每个科目 - 列出：本期金额 | 上期金额 | 变动金额（🔺/🔻标注）| 变动率 #### 二、资产项目结构变动分析 - 以**总资产**为基准（100%） - 计算各资产项目**本期占比**与**上期占比** - 输出占比变动（单位：百分点 pp） #### 三、利润表项目结构变动分析 - 以**营业收入**为基准（100%） - 计算各利润表科目**本期占比**与**上期占比** - 输出占比变动 #### 四、财务比率综合分析 | 类别 | 主要指标 | |------|----------| | 盈利能力 | 毛利率、净利率、ROA、ROE、营业利润率 | | 偿债能力 | 流动比率、速动比率、资产负债率、利息保障倍数、产权比率 | | 营运能力 | 总资产周转率、应收账款周转率（天数）、存货周转率（天数）、流动资产周转率 | | 成长能力 | 收入增长率、净利润增长率、总资产增长率、净资产增长率、营业利润增长率、经营现金流增长率 | #### 五、资深财务专家综合分析与建议 - 按盈利能力、偿债能力、成长能力逐项给出数值驱动的评价 - 标注核心优势（✅）与风险提示（⚠️/🔴） - 提供 5 条改进建议 ### Phase 4：结果展示 1. 使用 `open_result_view` 展示生成的 Markdown 报告。 2. 使用 `deliver_attachments` 将报告文件交付给用户。 3. 在回复中用简短语言概括分析亮点与主要发现。 ## 注意事项 - **Sheet 自动匹配**：脚本支持中英文名称模糊匹配（资产负债表/Balance Sheet/资产 等）。 若某 Sheet 未能自动匹配，报告中会注明"数据不足"，可提示用户检查 Sheet 名称。 - **数据格式要求**：Excel 中第一列为科目名，第二列为本期数据，第三列为上期数据（常见格式）。 若格式不同（如多年横排），脚本会尝试自适应，但效果因文件而异。 - **多年期报表**：若文件包含3年及以上数据，成长能力指标会更有参考意义； 当前脚本主要取前两列（本期/上期），如需多年趋势分析，可在报告中补充说明。 - **货币单位**：脚本不处理单位换算，报告中数值与原始数据单位一致（元/万元/亿元均可）。 - **保密提示**：处理完成后，如用户有数据安全顾虑，建议告知文件仅在本地处理，不上传到外部服务。 ## 踩坑经验 - **资产/负债分Sheet格式**：部分企业将资产负债表拆分为"资产"和"负债"两个Sheet（如本技能测试文件"深圳市羊城晚报文化发展有限公司"），脚本已支持自动检测并合并。 - **附注列干扰**：标准报表第2列通常为附注编号（如"附注五"），为非数值列，脚本通过"至少15%行是纯数字"的列识别逻辑自动跳过。 - **Sheet简称匹配**：有些文件用"资产"、"负债"、"利润"、"现流"等简称命名Sheet，SHEET_ALIASES中已覆盖这些别名。 - **clean_df中的join报错**：pandas读取含NaN的行时，row.astype(str)可能报 `expected str instance, float found`，需改为 `row.fillna("").astype(str)` 才能正确join。 - **lambda中float类型报错**：对Series执行apply时，若列中含有float类型值，需在lambda内部调用 `str(v)` 转换后再执行正则匹配。 ## 错误处理 | 场景 | 处理方式 | |------|----------| | 文件未上传 | 提示上传文件 | | 文件格式不是Excel | 提示仅支持 .xlsx/.xls/.xlsm | | Sheet 未匹配到 | 在报告中标注，提示检查Sheet名称 | | 数据列不足（<3列） | 跳过该分析模块，输出提示 | | 脚本运行报错 | 告知错误信息，建议检查文件格式 |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)