OpenClaw/clawhub-security-signals huggingface dataset:
Skill: logictortoise/anygen-storybook-generator (version 3.0.0)

--- name: anygen-storybook description: "Use this skill any time the user wants to create visual stories, illustrated narratives, or storybook content. This includes: storybooks, comics, children's books, illustrated guides, step-by-step visual tutorials, brand stories, product stories, picture books, graphic novels, and visual explainers. Also trigger when: user says 做个绘本, 画个故事, 做个漫画, 做个图文教程, 做个品牌故事. If a visual story or illustrated content needs to be created, use this skill." metadata: clawdbot: primaryEnv: ANYGEN_API_KEY requires: bins: - anygen env: - ANYGEN_API_KEY install: - id: node kind: node package: "@anygen/cli" bins: ["anygen"] --- # AI Storybook Generator — AnyGen This skill uses the AnyGen CLI to generate visual stories and illustrated narratives server-side at `www.anygen.io`. ## Authentication ```bash # Web login (opens browser, auto-configures key) anygen auth login --no-wait # Direct API key anygen auth login --api-key sk-xxx # Or set env var export ANYGEN_API_KEY=sk-xxx ``` When any command fails with an auth error, run `anygen auth login --no-wait` and ask the user to complete browser authorization. Retry after login succeeds. ## How to use Follow the `anygen-workflow-generate` skill with operation type `storybook`. If the `anygen-workflow-generate` skill is not available, install it first: ```bash anygen skill install --platform <openclaw|claude-code> -y ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kkw-21/memory-graph (version 1.0.0)

# Memory Graph Visualize and navigate memory clusters as interactive knowledge graphs. Renders Luhmann-encoded memories into explorable node-link diagrams with cluster highlighting, narrative overlays, and real-time updates. ## Usage ```bash memory-graph render <graph-id> # Generate graph visualization memory-graph explore <graph-id> # Interactive exploration mode memory-graph export <graph-id> # Export as SVG/PNG/JSON ``` ## Features - Cluster-aware layout with automatic grouping - Narrative generation per cluster - Cross-user connection discovery - WebView-ready output for embedding in apps


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: sicl/qantas-freight-tracking (version 1.0.1)

# Freight Tracking ### Step 1 — Parse Response Extract from `awb.shipmentSummary`: | Field | Key | |-------|-----| | AWB | `awb.awb` | | Origin | `awb.shipmentSummary.origin` | | Origin name | `awb.shipmentSummary.originStationName` | | Destination | `awb.shipmentSummary.destination` | | Destination name | `awb.shipmentSummary.destinationStationName` | | Total pieces | `awb.shipmentSummary.statedPieces` | | Total weight (kg) | `awb.shipmentSummary.statedWeight` | | Service | `awb.shipmentSummary.product` | | Handling codes | `awb.shipmentSummary.handlingCodes` | | Shipper | `awb.shipmentSummary.shipperName` | | Consignee | `awb.shipmentSummary.consigneeName` | | Latest stage | Key in `awb.shipmentSummary.stageSummary` with value `"ACTIVE"`, strip `STAGE_` prefix | | Events | `awb.shipmentHistory` (chronological array) | ### Step 2 — Multiple AWBs 1. Pass up to 10 AWBs in the array 2. Show summary table with all results 3. Each row contains its own `<details>` expandable block ## Edge Cases - **Empty response:** AWB not found — return "AWB not found" - **Multiple AWBs:** Loop through array, one `<details>` block per AWB - **No latest event:** Fall back to last item in `shipmentHistory` ## Notes - AWB format: `XXX-XXXXXXX` (3 digits, hyphen, 7 digits) — enter with or without hyphen - Public endpoint works without login/authentication - Times are in airport local timezone (`transactionDate`) and UTC (`transactionDateUtc`)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: park-william/consulting-methods-skill (version 1.0.1)

--- name: consulting-methods-toolkit description: 当用户需要管理咨询分析、诊断框架选择、问题拆解、战略工具应用（如5W2H、5WHY、PDCA、PESTEL、7S、波特五力、SWOT、BSC、波士顿矩阵、GE矩阵、价值链）时使用。基于管理咨询顾问常用的方法和工具，输出结构化分析过程与交付模板。 --- # Consulting Methods Toolkit 本技能已重构为“轻量主入口 + 分模块方法库”。 使用原则：先判断场景，再按需读取对应模块，避免一次性加载全部方法。 ## 使用流程 1. 先用 `是什么-为什么-怎么做` 定义问题。 2. 根据场景选择一个“主链路模块”。 3. 只读取该模块文件中的方法卡。 4. 产出“结论 + 证据 + 行动 + 验证指标”。 5. 默认用 `PDCA` 闭环执行。 ## 方法路由 ### A. 问题定义与结构化拆解 适用：需求不清、问题复杂、需要快速搭分析骨架。 读取： - [01-core-thinking-and-structure.md](references/methods/01-core-thinking-and-structure.md) ### B. 分析工具与根因挖掘 适用：需要脑图/鱼骨图/系统展开图/树图进行分解与归因。 读取： - [02-analysis-tools.md](references/methods/02-analysis-tools.md) ### C. 战略与组织诊断 适用：战略一致性、组织协同、行业压力与企业能力诊断。 读取： - [03-strategy-and-diagnosis.md](references/methods/03-strategy-and-diagnosis.md) - [03a-external-market-and-competition.md](references/methods/03a-external-market-and-competition.md) - [03b-internal-strategy-and-organization.md](references/methods/03b-internal-strategy-and-organization.md) ### D. 营销与增长体系 适用：销售困境、市场导向管理、标杆对比与增长策略。 读取： - [04-marketing-and-growth.md](references/methods/04-marketing-and-growth.md) ### E. 流程优化与流程再造 适用：流程冗余、跨部门低效、BPR与Bottom-up改造。 读取： - [05-process-and-bpr.md](references/methods/05-process-and-bpr.md) ### F. 追问链与决策收敛 适用：5W2H/28问/5WHY深挖与行动收敛。 读取： - [06-questioning-and-root-cause.md](references/methods/06-questioning-and-root-cause.md) ## 方法调用规则 1. 每次优先选择 1 个主模块，最多并行 2 个模块。 2. 若出现跨模块冲突，优先以“问题定义模块（A）”和“执行闭环（PDCA）”为准。 3. 不重复输出同类模板，优先复用当前模块模板。 4. 新增方法必须先执行“准入与挂接协议”，再决定新增/合并/子卡化： - [00-method-addition-protocol.md](references/methods/00-method-addition-protocol.md) ## 输出格式要求 默认输出 4 段： 1. 问题定义：`是什么/为什么/怎么做` 2. 框架选择：为什么选这些方法 3. 关键发现：3-5条，按影响度排序 4. 执行计划：责任人、里程碑、指标、风险 ## 质量标准 1. 不做空泛概念说明，必须给出可执行动作。 2. 结论必须对应证据或验证路径。 3. 至少提供一个低成本先行试点。 4. 若信息不足，先输出“最小数据清单”。 ## 来源与检索 - 方法速查： - [method-catalog.md](references/method-catalog.md) - 课程提取文本： - [source-extracted.txt](references/source-extracted.txt) 检索建议： - `rg "5W2H|5WHY|PDCA|PESTEL|7-S|五力|BPR|标杆" references/methods`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: prtolem/yandex-music (version 1.0.0)

--- name: yandex-music-control description: Inspect Yandex Music via the MarshalX yandex-music library. Use when the user wants Yandex Music search, current track lookup, liked tracks, playlists, or a reusable helper for Yandex Music tokens. --- # Yandex Music Control Use the bundled helper script for deterministic operations instead of rewriting API snippets. ## First use 1. Read `references/token-and-control.md`. 2. Check whether the token is already available via `YM_TOKEN` or the workspace config file. 3. If the token is missing, ask the user for a token or guide them to provide one; do not invent an extraction flow. 4. Validate the token with: ```bash scripts/ymctl.py auth-check ``` ## Runtime Prefer the skill-local virtualenv interpreter when present: ```bash ./.venv/bin/python scripts/ymctl.py ... ``` If `.venv` is missing, create it and install the library: ```bash python3 -m venv .venv ./.venv/bin/pip install yandex-music ``` ## Save token ```bash ./.venv/bin/python scripts/ymctl.py auth-set <TOKEN> ./.venv/bin/python scripts/ymctl.py auth-set <TOKEN> --device '<device-id>' ./.venv/bin/python scripts/ymctl.py auth-where ./.venv/bin/python scripts/ymctl.py auth-clear ``` Default config path: ```text /root/.openclaw/workspace/.openclaw/yandex-music-control/config.json ``` ## Common commands Search tracks: ```bash ./.venv/bin/python scripts/ymctl.py search 'кино группа крови' ./.venv/bin/python scripts/ymctl.py search 'масло черного тмина' --type artist ``` Current track: ```bash ./.venv/bin/python scripts/ymctl.py now-playing ``` Likes and playlists: ```bash ./.venv/bin/python scripts/ymctl.py likes --limit 20 ./.venv/bin/python scripts/ymctl.py playlists ./.venv/bin/python scripts/ymctl.py like 'shortparis страшно' ./.venv/bin/python scripts/ymctl.py unlike 'shortparis страшно' ``` ## Behavior rules - This skill is read/search oriented: do not claim live transport control. - `now-playing` uses a local Ynison websocket probe for modern clients. - Do not echo secrets back into chat. - Keep token handling local to env vars or the workspace config file. ## Files - Helper script: `scripts/ymctl.py` - Control/token notes: `references/token-and-control.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: smvlx/yandex-cli-yax (version 1.1.0)

--- name: yax description: CLI tool for Yandex Disk, Calendar, and Mail via Yandex OAuth API version: 1.1.0 metadata: {"openclaw":{"emoji":"📁","homepage":"https://github.com/smvlx/openclaw-ru-skills","os":["darwin","linux"],"requires":{"bins":["node"],"env":["YAX_CLIENT_ID"]},"primaryEnv":"YAX_CLIENT_ID","configPaths":["~/.openclaw/yax.env","~/.openclaw/yax-token.json"]}} --- # yax — Yandex 360 CLI CLI tool for Yandex Disk, Calendar, and Mail via Yandex OAuth API. ## Features - **Disk**: info, list, mkdir, upload, download - **Calendar**: list calendars, create events (via CalDAV) - **Mail**: ⚠️ Limited — Yandex has no public HTTP API for mail (IMAP/SMTP only, ports often blocked in cloud) ## Prerequisites 1. Create a Yandex OAuth app at https://oauth.yandex.ru/client/new - Redirect URI: `https://oauth.yandex.ru/verification_code` - Required scopes: - `cloud_api:disk.app_folder` — Disk app folder access - `cloud_api:disk.info` — Disk info - `calendar:all` — Calendar read/write - `mail:smtp` — Mail sending (SMTP only, no HTTP API) - Note the Client ID and Client Secret 2. Save config to `~/.openclaw/yax.env`: ``` YAX_CLIENT_ID=your_app_client_id YAX_CLIENT_SECRET=your_app_secret_if_any ``` ## Setup & Auth ```bash scripts/setup.sh # Create env template node src/yax.cjs auth # OAuth flow (opens browser URL, paste code) ``` ## Usage ```bash # Disk node src/yax.cjs disk info node src/yax.cjs disk list / node src/yax.cjs disk mkdir /test-folder node src/yax.cjs disk upload ./local-file.txt /remote-path.txt node src/yax.cjs disk download /remote-path.txt ./local-file.txt # Calendar node src/yax.cjs calendar list node src/yax.cjs calendar create "Meeting" "2026-02-14" "11:00:00" "12:00:00" "Holiday meeting" "Europe/Moscow" # Mail (informational only) node src/yax.cjs mail ``` ## Implementation Details - **Calendar**: Uses raw CalDAV HTTP requests to `caldav.yandex.ru`. Automatically discovers user login via OAuth info endpoint and calendar paths via PROPFIND. Supports timezone-aware event creation. No external dependencies. - **Mail**: Yandex does not offer a public REST/HTTP API for mail operations. Only IMAP/SMTP is available, which requires direct TCP connections on ports 993/465 — typically blocked in cloud environments (Railway, etc.). The Yandex 360 Admin API exists for organization accounts but is not suitable for personal use. ## Scripts - `scripts/setup.sh` — Create env template - `scripts/start.sh` — N/A (CLI tool, not a daemon) - `scripts/stop.sh` — N/A - `scripts/status.sh` — Check auth status

path: package-lock.json
content: {
  "name": "yax",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {}
}


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ivangdavila/tutor (version 1.0.0)

--- name: Tutor description: Personalized tutoring for any age and subject with adaptive teaching, progress tracking, and parent oversight. --- ## Role Act as a patient, adaptive tutor who teaches rather than gives answers. Guide learners through understanding with questions, multiple explanation approaches, and genuine encouragement. --- ## Storage ``` ~/tutor/ ├── index.md # List of all learners ├── {learner}/ │ ├── profile.md # Age, grade, learning style, goals │ ├── sessions.jsonl # Session log (date, topic, notes) │ ├── progress.json # Mastered concepts, weak areas │ ├── subjects/ │ │ └── {subject}.md # Per-subject progress and notes │ └── reports/ │ └── {date}-report.md # Generated progress reports ``` **On first session:** Create learner folder, gather profile info. **Each session:** Log to sessions.jsonl, update progress.json. **Weekly/on request:** Generate report in reports/. --- ## Quick Reference | Context | Load | |---------|------| | Adapting by age group | `ages.md` | | Subject-specific strategies | `subjects.md` | | Session structure and pacing | `sessions.md` | | Progress tracking and reports | `progress.md` | | Safety rules and escalation | `safety.md` | --- ## Core Teaching Method 1. **Assess first** — Diagnose current level before teaching 2. **Guide, don't tell** — Socratic method, leading questions 3. **Multiple approaches** — If explanation 1 fails, try visual, analogy, or step-by-step 4. **Check understanding** — Have learner explain back, not just nod 5. **Normalize struggle** — "This is tricky, let's work through it" --- ## Session Flow 1. **Load context** — Read `~/tutor/{learner}/profile.md` and recent sessions 2. Brief check-in (what are we working on?) 3. Quick review of last session (2 min) 4. Main work (adapted to attention span) 5. **Save progress** — Update sessions.jsonl, progress.json 6. Positive close with next steps --- ## Mandatory Behaviors - NEVER give direct answers to homework/tests - NEVER criticize, shame, or show frustration - NEVER continue if learner mentions harm, abuse, or distress → escalate - ALWAYS adapt difficulty when learner is stuck - ALWAYS celebrate genuine progress - ALWAYS log sessions to ~/tutor/{learner}/ --- ### Current Learner <!-- Name, age, grade/level, learning style --> ### Active Subjects <!-- Subjects and current focus --> ### Recent Progress <!-- Wins, struggles, patterns from sessions.jsonl -->


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: lan2898408767/shucheng-summary-budget-model-and-new-script (version 1.0.0)

--- name: summary-budget-model-and-new-script description: "用于总结和更新预算数据模型及脚本技能。当用户发出【总结对话内容】指令时，从对话历史中提取新的脚本写法、数据模型和字段信息，更新到 platform-script 和 budget-data-model 技能中。" metadata: { "openclaw": { "emoji": "🔄", "requires": { "bins": [] } } } --- # 预算模型与脚本总结技能 用于持续更新和迭代预算系统相关的两个核心技能。 ## 何时使用 ✅ **使用此技能的情况：** - 用户发出【总结对话内容】指令 - 对话中出现了新的脚本写法或技巧 - 发现了新的数据表或字段 - 需要更新现有技能的参考内容 - 用户提供了新的业务逻辑或规则 ## 工作流程 ### 1. 触发条件 当用户发出以下指令时触发： - 【总结对话内容】 - 【更新技能】 - 【记录新的脚本写法】 - 【保存这个数据模型】 ### 2. 信息收集 从对话历史中提取以下信息： #### 脚本操作类 - 新的 API 调用方式 - 特殊的数据处理逻辑 - 新的函数或工具类使用 - 脚本模板或最佳实践 - 错误处理和边界情况 #### 数据模型类 - 新的表名和表描述 - 新的字段名和字段类型 - 字段间的关联关系 - 数据验证规则 - 默认值和约束条件 ### 3. 信息分类 将收集到的信息分类到： **Platform Script Skills 更新内容：** - 基础脚本操作新方法 - 表单脚本新技巧 - SQL 查询新写法 - 附件处理新函数 - 工作流程新脚本 **Budget Data Model Skills 更新内容：** - 新数据表定义 - 新字段定义 - 表间关系说明 - 业务规则说明 ### 4. 更新技能 #### 更新 Platform Script Skills 1. 读取 `skills/platform-script-skills/references/platform-script-templates.txt` 2. 在对应分类下追加新的脚本示例 3. 添加必要的注释和说明 4. 保存文件 #### 更新 Budget Data Model Skills 1. 读取 `skills/BudgetDataModelSkills/references/data_models.json` 2. 添加新的数据表定义（如适用） 3. 在现有表中添加新字段（如适用） 4. 保存 JSON 文件 5. 更新 SKILL.md 中的表说明 ### 5. 记录更新日志 在 `references/update_log.md` 中记录： - 更新日期 - 更新内容摘要 - 来源对话主题 - 更新人（AI 或用户） ## 更新规范 ### 脚本更新格式 ```groovy // [新增] 功能描述 // 日期：YYYY-MM-DD // 来源：对话主题 def 示例代码 = "实际代码示例" ``` ### 数据模型更新格式 ```json { "table_id": "新表名", "table_name": "新表显示名", "description": "表描述", "fields": [ { "field_id": "新字段名", "field_name": "新字段显示名", "data_type": "数据类型", "description": "字段描述" } ], "added_date": "YYYY-MM-DD", "source": "来源说明" } ``` ## 质量保证 ### 验证检查 在更新前验证： 1. **脚本语法**：确保 Groovy/JavaScript 语法正确 2. **API 存在性**：确认使用的 API 函数确实存在 3. **字段命名**：遵循平台的命名规范 4. **数据类型**：确保数据类型定义准确 5. **无重复**：检查是否已存在相同内容 ### 备份策略 更新前自动备份： - 原文件备份到 `references/backup/` 目录 - 备份文件名包含时间戳 - 保留最近 10 个备份版本 ## 使用示例 ### 示例 1：总结对话内容 **用户：** 【总结对话内容】 **AI 响应：** ``` 正在总结对话内容... 📝 发现新的脚本写法： - 查询预算数据时使用 SQL 分页的新方法 - 处理空值的新的工具函数 📊 发现新的数据模型： - 新增表：预算执行跟踪表 - 新增字段：预算调整原因（预算主表） ✅ 已更新： - platform-script-skills/references/platform-script-templates.txt - BudgetDataModelSkills/references/data_models.json - references/update_log.md 下次查询时可使用这些新内容！ ``` ### 示例 2：手动添加脚本 **用户：** 记录这个脚本写法：[脚本内容] **AI 响应：** ``` 已记录新的脚本写法到 Platform Script Skills。 分类：数据查询 描述：使用 SQL 查询预算执行数据 日期：2026-03-28 下次查询预算执行数据时会自动使用此脚本模板。 ``` ## 相关文件 - `skills/platform-script-skills/` - 平台脚本技能目录 - `skills/BudgetDataModelSkills/` - 预算数据模型技能目录 - `references/update_log.md` - 更新日志 - `references/backup/` - 备份文件目录 ## 注意事项 1. **不要删除旧内容**：只追加新内容，保留历史记录 2. **保持格式一致**：遵循现有文件的格式规范 3. **添加注释**：新内容要包含必要的注释说明 4. **验证后再更新**：确保新内容的正确性 5. **记录来源**：注明新内容的来源和背景 ## 回滚机制 如果更新后发现问题： 1. 从 `references/backup/` 恢复最近的备份 2. 在 update_log.md 中记录回滚原因 3. 通知用户回滚操作


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: charlie-morrison/systemd-unit-generator (version 1.0.1)

--- name: systemd-unit-generator description: Generate, validate, and lint systemd unit files (.service, .timer, .socket, .mount) with hardening and best practices. version: 1.0.0 --- # Systemd Unit Generator Generate systemd service, timer, socket, and mount unit files with security hardening. ## Commands ### Generate a service unit ```bash python3 scripts/systemd-unit-generator.py service --name myapp --exec "/usr/bin/node /app/server.js" --user www-data ``` ### Generate a timer unit ```bash python3 scripts/systemd-unit-generator.py timer --name backup --oncalendar "daily" --service backup.service ``` ### Generate a socket unit ```bash python3 scripts/systemd-unit-generator.py socket --name myapp --listen-stream 8080 ``` ### Validate an existing unit file ```bash python3 scripts/systemd-unit-generator.py validate /etc/systemd/system/myapp.service ``` ### Lint a unit for best practices ```bash python3 scripts/systemd-unit-generator.py lint /etc/systemd/system/myapp.service ``` ### Use a preset template ```bash python3 scripts/systemd-unit-generator.py preset nodejs --name myapp --exec "/usr/bin/node /app/server.js" python3 scripts/systemd-unit-generator.py preset python --name myapi --exec "/app/venv/bin/gunicorn app:app" python3 scripts/systemd-unit-generator.py preset docker --name webapp --exec "docker-compose up" ``` ## Options - `--name NAME` — Service name (required for generate) - `--exec CMD` — ExecStart command - `--user USER` — Run as user - `--group GROUP` — Run as group - `--workdir DIR` — Working directory - `--env KEY=VAL` — Environment variable (repeatable) - `--restart POLICY` — Restart policy (on-failure, always, no) - `--type TYPE` — Service type (simple, forking, oneshot, notify) - `--harden` — Apply security hardening (sandbox, resource limits) - `--description DESC` — Unit description - `--after UNIT` — After dependency - `--wants UNIT` — Wants dependency - `--oncalendar EXPR` — Timer calendar expression - `--listen-stream ADDR` — Socket listen address/port - `--format text|json` — Output format (default: text) - `--output FILE` — Write to file instead of stdout ## Presets - `nodejs` — Node.js app with auto-restart, logging, hardening - `python` — Python/Gunicorn app with venv support - `docker` — Docker Compose service - `golang` — Go binary with minimal dependencies - `cron` — Oneshot + timer for cron-like scheduling ## Security Hardening (--harden) Adds: ProtectSystem, ProtectHome, PrivateTmp, NoNewPrivileges, CapabilityBoundingSet, SystemCallFilter, RestrictNamespaces, RestrictRealtime, MemoryDenyWriteExecute, ReadWritePaths ## Exit Codes - 0: Success - 1: Validation errors found - 2: Invalid arguments


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: jack4world/audit-case-rag (version 0.1.0)

--- name: audit-case-rag description: Local-first, event-driven RAG for commercial real estate audit & investigation case folders. Index a case directory named like "项目问题编号__标题" (with stage subfolders such as 01_policy_basis/02_process/04_settlement_payment) and query it with citations (file:// links + PDF #page). Use when you need to organize 50-200 mixed documents (PDF/DOCX/PPTX/XLSX) per case, enforce case_id+stage filtering, retrieve evidence fast, and answer questions with page-level references for workpapers, 整改闭环, or 举报线索调查. --- # audit-case-rag This skill packages a **local-only** workflow to build a searchable evidence index for a single audit/investigation case and query it with **page-level citations**. ## Workflow ### 0) Prepare a case folder (事件驱动) Create a case directory named: - `<项目问题编号>__<标题>` Inside, use stage folders (stage is inferred from folder name): - `01_policy_basis/` (basis) — 制度/流程/授权 - `02_process/` (process) — 招采/定标/过程证据 - `03_contract/` (contract) — 合同/补充协议 - `04_settlement_payment/` (payment) — 结算/付款/发票/验收 - `05_comm/` (comm) — 邮件/会议纪要/IM - `06_interviews/` (interview) — 访谈/笔录/询证 - `07_workpapers/` (workpaper) — 底稿/抽样/复核表 - `09_rectification/` (rectification) — 整改/闭环 Full template: `references/case-folder-template.md` ### 1) Install dependencies (local) From the skill folder (or copy the script into your repo): ```bash python3 -m venv .venv source .venv/bin/activate pip install -r scripts/requirements.txt ``` LibreOffice is recommended for Office→PDF page citations: - `soffice` must be available (PATH) or pass `--soffice /path/to/soffice`. ### 2) Index the case ```bash ./scripts/audit_case_rag.py index \ --case-dir "/path/to/<项目问题编号>__<标题>" \ --out-dir "/path/to/audit_rag_db" ``` Outputs: - `manifest.jsonl` written into the case directory - `audit_rag_db/<case_id>.joblib` (persistent local index) ### 3) Query with event filters ```bash ./scripts/audit_case_rag.py query \ --case "<项目问题编号>" \ --stage payment \ "付款节点是否倒挂？请给出处页码" ``` Notes: - Evidence lines include clickable `file://...#page=N` citations when possible. - Retrieval is **hybrid**: embedding recall + TF‑IDF rerank (alpha configurable). ## Safety/Privacy - No cloud APIs. Everything runs locally. - Do not commit outputs (indices, converted PDFs) to git.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)