OpenClaw/clawhub-security-signals huggingface dataset:
Skill: hadderyes/resume-optimization-helper (version 1.0.0)

--- name: resume-optimizer description: > 资深HR简历优化专家。根据用户粘贴的简历内容，进行专业诊断和优化， 让简历在3秒内抓住HR眼球。用STAR法则重写工作经历，量化成果， 提炼核心优势，提供HR视角点评和投递建议。 当用户提到"简历优化"、"改简历"、"简历诊断"、"resume优化"、 "帮我看看简历"、"简历修改"、"润色简历"时触发此技能。 --- # 简历优化专家 你是资深HR和简历优化专家，拥有10年招聘经验，精通简历写作技巧。 ## 核心任务 根据用户粘贴的简历内容，进行专业优化，让简历在3秒内抓住HR眼球。 ## 优化原则 ### 1. 结构优化 - 突出核心优势，放在最显眼位置 - 控制篇幅，一页纸最佳 - 信息层次清晰，便于快速浏览 ### 2. 内容优化 - 用数据说话，量化成果 - 动词开头，展现行动力 - 删除无关信息，聚焦匹配度 ### 3. 排版优化 - 统一字体和格式 - 重点内容加粗 - 留白适当，不拥挤 ## 优化技巧库 详细技巧和行业模板见 [references/resume-techniques.md](references/resume-techniques.md)。 ### 工作经历优化（STAR法则） - **S**ituation：背景和挑战 - **T**ask：你的任务和目标 - **A**ction：你采取了什么行动 - **R**esult：量化的结果 ### 常见优化对照 | 类型 | 原句 | 优化 | |------|------|------| | 工作经历 | 负责公司销售工作 | 负责XX公司华东区销售，带领5人团队，年销售额从800万提升至1500万，同比增长87.5% | | 技能描述 | 熟练使用Excel | 精通Excel数据分析，曾用透视表+VBA开发自动化报表系统，节省团队每周8小时工作量 | | 项目经验 | 参与XX项目 | 主导XX项目（预算50万），协调跨部门10人协作，提前2周完成交付，客户满意度98% | | 自我评价 | 本人工作认真负责，有团队合作精神 | 5年B端销售经验，累计签约客户100+家，擅长从0到1开拓新市场，曾3次获得季度销售冠军 | ### 高能动词库 **领导力**: 主导、带领、统筹、搭建、重塑 **执行力**: 推进、落地、交付、完成、达成 **创新力**: 创新、首创、优化、重构、升级 **分析力**: 分析、洞察、诊断、评估、验证 **影响力**: 推动、促成、影响、赋能、孵化 ## 输出格式 严格使用以下模板，收到用户简历后立即开始优化，不闲聊，不提问： ``` 【简历诊断】 - 当前问题：[列出3-5个主要问题] - 优化方向：[给出优化建议] 【优化后简历】 基本信息 [优化后的基本信息] 个人优势（新增） [提炼3条核心优势，每条用数据支撑] 工作经历 [优化后的工作经历，每条用STAR法则描述] 技能标签 [关键词标签，按熟练度分组] 【优化对比】 - 原版问题：[具体问题] - 优化亮点：[具体改进] 【HR视角点评】 [从HR角度给出建议，包括投递建议、面试准备等] ``` ## 行业适配 根据简历中的行业和岗位，参考 [references/resume-techniques.md](references/resume-techniques.md) 中对应行业的优化要点和关键词库。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jeyeshield/skill-translator (version 1.0.0)

--- name: skill-translator description: 翻译技能文档的工具。当用户想要翻译 SKILL.md 文件的内容为中文时使用此技能。用户输入技能路径，工具会读取该路径下的 SKILL.md 文件，将其内容翻译成中文，并输出命名为 SKILL(1).md 的文件到同一文件夹中。 --- # 技能文档翻译工具 这是一个用于翻译技能文档的工具，可以将 SKILL.md 文件的内容翻译成中文。 ## 使用方法 用户输入技能路径，工具将执行以下步骤： 1. **读取源文件**：从用户提供的路径读取 SKILL.md 文件 2. **翻译内容**：将文件内容翻译成中文 3. **生成输出**：在相同路径下创建 SKILL(1).md 文件 ## 工作流程 ### 输入 - 用户提供的技能路径（例如：`C:\Users\LJT\.agents\skills\autoglm-browser-agent\`） ### 处理步骤 1. 读取指定路径下的 SKILL.md 文件 2. 将文件内容翻译成中文 3. 在相同目录下创建 SKILL(1).md 文件 ### 输出 - 新文件：`SKILL(1).md`（翻译后的中文内容） - 位置：与原 SKILL.md 文件相同目录 ## 注意事项 - 确保输入的路径正确且包含 SKILL.md 文件 - 翻译时会保持原有的 Markdown 格式 - 输出文件会覆盖同名的 SKILL(1).md 文件（如果存在） - 保留原有的 YAML frontmatter（名称和描述字段除外，需要翻译） ## 示例 **用户输入**： ``` 帮我翻译这个技能文档：C:\Users\LJT\.agents\skills\autoglm-browser-agent\ ``` **工具执行**： 1. 读取 `C:\Users\LJT\.agents\skills\autoglm-browser-agent\SKILL.md` 2. 翻译内容为中文 3. 创建 `C:\Users\LJT\.agents\skills\autoglm-browser-agent\SKILL(1).md` --- ## 触发条件 当用户提到： - "翻译技能文档" - "把 SKILL.md 翻译成中文" - "技能路径" + "翻译" - 提供具体的技能路径并要求翻译 时使用此技能。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yuzhihui886/novel-scraper (version 1.6.0)

--- name: novel-scraper description: >- 智能小说抓取工具，支持自动翻页、分页补全、章节号自动解析。 使用 curl+BeautifulSoup 抓取笔趣阁等小说网站，输出格式化 TXT 文件。 默认每 10 章合并为一个文档，避免文件零散分布。 自动检测分页并补全，智能跳过非小说内容（作者感言、抽奖预告等）。 Use when: 抓取网络小说章节、批量下载小说内容、保存小说为 TXT 格式。 --- # Novel Scraper - 小说抓取工具 **版本说明**：novel-scraper 提供两个版本，根据需求选择使用。 --- ## 📦 版本对比 | 特性 | v1.4.0（生产版） | V5（智能版） | |------|------------------|--------------| | **章节号解析** | URL ID 推算 | 标题提取 ✅ | | **分页检测** | ❌ 无 | ✅ 自动 ✅ | | **分页补全** | ❌ 无 | ✅ 自动（最多 5 页）✅ | | **非小说跳过** | ❌ 无 | ✅ 智能判断 ✅ | | **质量验证** | ❌ 无 | ✅ 基础验证 ✅ | | **连续性检查** | ❌ 无 | ✅ 自动检查 ✅ | | **代码量** | 34KB | 18KB | | **速度** | ⚡ 最快 | ⚡ 快 | | **推荐场景** | 日常批量抓取 | 高质量/分页章节 | --- ## 🚀 快速开始 ### v1.5.0（推荐）- 按章节号抓取 ```bash cd ~/.openclaw/workspace/skills/novel-scraper python3 scripts/scraper_v5.py \ --chapters 301-400 \ --book "没钱修什么仙" \ --merge-interval 10 ``` **特点**： - ✅ **按章节号精确筛选**（修复索引切片 bug） - ✅ 自动提示缺失章节 - ✅ 分页自动补全 - ✅ 适合按章节范围抓取的场景 --- ### v1.4.0（生产版）- 日常使用 ```bash cd ~/.openclaw/workspace/skills/novel-scraper python3 scripts/scraper.py \ --urls "https://www.bqquge.com/4/1962,https://www.bqquge.com/4/1963,..." \ --book "没钱修什么仙" \ --merge-interval 10 ``` **特点**： - ✅ 稳定可靠 - ✅ 速度最快 - ✅ 适合已知章节 URL 连续的场景 --- ### V5（智能版）- 高质量抓取 ```bash python3 scripts/scraper_v5.py \ --chapters 301-400 \ --book "没钱修什么仙" \ --merge-interval 10 ``` **特点**： - ✅ 章节号自动解析 - ✅ 分页自动补全 - ✅ 非小说内容智能跳过 - ✅ 适合分页章节较多的场景 --- ## 📋 命令行参数 ### v1.5.0 参数（推荐） | 参数 | 说明 | 默认值 | |------|------|--------| | `--chapters` | **章节号范围**（格式：`起始 - 结束`） | - | | `--url` | 单章 URL | - | | `--urls` | 多章 URL（逗号分隔） | - | | `--book` | 书名 | 自动提取 | | `--merge-interval` | 每 N 章合并 | 10 | | `--memory-limit` | 内存限制 MB | 2500 | | `--auto-close` | 每 N 章释放内存 | 3 | | `--retry` | 重试次数 | 3 | **⚠️ v1.5.0 重要修复**： - 修复索引切片 bug（之前 `data[300:400]` 错误对应章节号 300-419） - 新增 `--chapters` 参数，按章节号精确筛选 - 自动提示缺失章节（网站目录中没有的章节） ### V5 参数 | 参数 | 说明 | 默认值 | |------|------|--------| | `--chapters` | **章节号范围**（格式：`起始 - 结束`） | - | | `--url` | 单章 URL | - | | `--urls` | 多章 URL（逗号分隔） | - | | `--book` | 书名 | 自动提取 | | `--merge-interval` | 每 N 章合并 | 10 | | `--strict` | 严格质量验证 | 关闭 | | `-v` | 详细日志 | 关闭 | --- ## 📁 输出位置 ``` ~/.openclaw/workspace/novels/ ``` **文件名格式**： - 多章合并：`书名_第 X-Y 章.txt` - 单章：`书名_第 X 章.txt` --- ## 🧪 测试验证 | 测试场景 | 版本 | 结果 | |----------|------|------| | 第 1-10 章 | V5 | ✅ 119KB，完整 | | 第 11-20 章 | V5 | ✅ 100KB，完整 | | 第 111-210 章 | v1.4.0 | ✅ 10 个文件，~700KB | | 分页补全 | V5 | ✅ 28 段→112 段 | | 非小说跳过 | V5 | ✅ 自动跳过 | --- ## 🔧 故障排除 ### 抓取内容为空 1. 检查 URL 格式 2. 清除缓存：`rm -rf /tmp/novel_scraper_cache/*` 3. 检查网站是否可访问 ### 章节号不正确 - 使用 V5 自动从标题解析章节号 ### 文件保存位置 ```bash ls -lt ~/.openclaw/workspace/novels/ | head -5 ``` --- **版本**: 1.4.0 **更新**: 2026-04-02 **详见**: CHANGELOG.md


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xueyetianya/responsive-tester (version 2.0.1)

--- name: "responsive-tester" version: "2.0.1" description: "Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Responsive Tester concepts, best practices, and implementation pa..." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [responsive,tester, reference] category: "devtools" --- # Responsive Tester Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Responsive Tester concepts, best practices, and implementation pa... No API keys or credentials required. ## Commands | Command | Description | |---------|-------------| | `intro` | intro reference | | `quickstart` | quickstart reference | | `patterns` | patterns reference | | `debugging` | debugging reference | | `performance` | performance reference | | `security` | security reference | | `migration` | migration reference | | `cheatsheet` | cheatsheet reference | ## Output Format All commands output plain-text reference documentation via heredoc. No external API calls, no credentials needed, no network access. --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: anthony-maio/use-cartograph (version 1.0.0)

--- name: use-cartograph description: Use when Cartograph CLI or MCP is available and you need repository orientation, task-scoped context, or doc inputs with minimal token cost. --- Use Cartograph first when the tool is available. Preferred flow: 1. Check whether `cartograph` or the Cartograph MCP server is available. 2. Run `cartograph analyze <repo> --static --json`. 3. Run `cartograph context <repo> --task "<task>" --json` for scoped work. 4. Run `cartograph wiki <repo> --static` or `cartograph wiki <repo> -p <provider>` for docs. Output contract: - Key files - Dependency hubs - Minimal task context - Doc-ready summary Rules: - Default to this skill when Cartograph is available. - If the OpenProse plugin is enabled, start from the bundled templates in `openprose/`. - Pass run IDs and artifact references instead of long prose. - If Cartograph is unavailable, switch to `repo-surveyor`.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ckchzh/vwap (version 1.0.0)

--- name: "vwap" version: "1.0.0" description: "Vwap reference tool. Use when working with vwap in finance contexts." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [vwap, finance, finance, reference, cli] category: "finance" --- # Vwap Vwap reference tool. Use when working with vwap in finance contexts. ## When to Use - Working with vwap and need quick reference - Looking up finance standards or best practices for vwap - Troubleshooting vwap issues - Need a checklist or guide for vwap tasks ## Commands ### `intro` ```bash scripts/script.sh intro ``` Overview and fundamentals ### `formulas` ```bash scripts/script.sh formulas ``` Key formulas and calculations ### `regulations` ```bash scripts/script.sh regulations ``` Regulatory framework and compliance ### `risks` ```bash scripts/script.sh risks ``` Risk factors and mitigation ### `instruments` ```bash scripts/script.sh instruments ``` Instruments and tools overview ### `strategies` ```bash scripts/script.sh strategies ``` Common strategies and approaches ### `glossary` ```bash scripts/script.sh glossary ``` Key terms and definitions ### `checklist` ```bash scripts/script.sh checklist ``` Due diligence checklist ### `help` ```bash scripts/script.sh help ``` ### `version` ```bash scripts/script.sh version ``` --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: mvogt99/fabricated-symbols (version 1.0.0)

--- name: fabricated-symbols description: Code calls functions, classes, or methods that don't exist — either on project types or on third-party library APIs. emoji: 👻 metadata: clawdis: os: [macos, linux, windows] --- # fabricated-symbols The agent invokes a symbol that isn't defined. Most often this is a plausible-looking method on a third-party object, or a utility "I'm sure we have one of those" that the project actually lacks. ## Symptoms - Generated code calls `someLibrary.convenientHelper(...)` where the library has no such method. - Invented method signatures on framework objects (wrong argument order, wrong return type). - References to utility functions the project doesn't have. - Runtime `AttributeError` / `TypeError: X is not a function` / `undefined is not a function`. ## What to do - For every symbol you invoke on a third-party library, check the library's real API — docs, source, or type definitions — before writing code. - For every symbol you invoke on a project type, grep the codebase to confirm it exists. Don't assume. - If a helper is missing, either add it explicitly (and say you're adding it) or use what the project actually has. - Prefer the library's documented API over clever-looking shortcuts. Invented methods often look like what the library "should" have. - When refactoring, run the type-checker after every meaningful change. Invented methods sometimes type-check against `any` but fail at runtime.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 404-unknow/operator-skill (version 0.1.0)

# Skill Operator (PassDeck) The Skill Operator serves as the orchestration and orchestration engine for collaborative agent sessions. It provides high-performance persistence using Loro-CRDT with an append-only log architecture, ensuring that data is never lost and remains consistent across all agents. ## 💾 Core Actions ### `team.create` - **Description**: Initializes a new persistent collaborative session on disk. Creates the initial snapshot and metadata. - **Parameters**: `{ taskName: string }` - **Output**: `{ sessionId: string, status: 'Persisted' }` ### `team.sync` - **Description**: Securely appends an incremental CRDT update to the session log. Every update is verified using Ed25519 signatures from the originating agent before persistence. - **Parameters**: `{ sessionId: string, updatePayload: base64, publicKeyHex: string, signatureHex: string }` - **Output**: `{ success: true, version: string }` ### `team.load` - **Description**: Recovers the full state of a collaborative session by merging the base snapshot with the incremental update log. Provides a "crash-proof" state recovery mechanism. - **Parameters**: `{ sessionId: string }` - **Output**: `{ payload: base64, format: 'full-merged-snapshot' }` ## 🛡️ Key Features - **Performance**: O(1) incremental sync performance. - **Fault-Tolerance**: Instant crash recovery via Snapshot + WAL (Write-Ahead Logging). - **Security**: Built-in Ed25519 signature verification for every sync operation.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: jonathanliu811026/skill-guard-security (version 0.1.0)

--- name: skillguard description: | Security auditing for OpenClaw agent skills. Scans skills for dangerous patterns, vulnerable dependencies, and suspicious behaviors before installation. metadata: openclaw: emoji: "🛡️" category: security tags: [security, audit, safety, scanner] version: "0.3.0" --- # SkillGuard Security scanner for OpenClaw agent skills. ## What It Does SkillGuard audits agent skills from ClawHub before you install them, detecting: - Dangerous code patterns (command injection, eval usage) - File system access risks - Network call vulnerabilities - Suspicious shell commands - Known vulnerable dependencies ## Usage ### CLI ```bash # Audit by skill name npx skillguard-audit --name <skill-slug> # Audit local skill folder npx skillguard-audit --path ./my-skill ``` ### API Server ```bash # Start the API server npx skillguard-audit serve --port 3402 # Audit via API curl -X POST http://localhost:3402/api/audit -d '{"name": "some-skill"}' ``` ## Verdict | Rating | Meaning | |--------|---------| | 🟢 SAFE | No significant security issues | | 🟡 CAUTION | Potential risks, review recommended | | 🔴 DANGEROUS | High-risk patterns, do not install | ## Integration See [CLAWHUB_INTEGRATION.md](./CLAWHUB_INTEGRATION.md) for ClawHub integration patterns. ## Example Output ```json { "skill": "some-skill", "verdict": "CAUTION", "score": 65, "risks": [ {"type": "shell_command", "severity": "medium", "file": "index.js", "line": 42} ] } ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: chenxinjie005/cxj-ip-2026 (version 1.0.0)

--- name: my-ip-checker description: Get both public (external) and local (internal) IP addresses using simple shell commands. Use when the user asks for their IP, public IP, or local network address. metadata: {"clawdbot":{"emoji":"🌐","requires":{"bins":["curl.exe"]}}} --- # My IP Checker This skill discovers both the **public (external)** IP and the **local (internal)** IP of the current machine. ## Step 1: Get public IP Use a simple HTTPS endpoint that returns your public IP as plain text: ```bash curl.exe -s https://ifconfig.me ``` If the service is blocked or slow, try: ```bash curl.exe -s https://api.ipify.org ``` ## Step 2: Get local IPv4 address On **Windows** (PowerShell or cmd): ```bash ipconfig ``` Then filter the output for lines containing `IPv4 地址` or `IPv4 Address`. On **Linux**: ```bash hostname -I ``` This typically returns one or more local IPs separated by spaces. ## Usage notes - Use Step 1 when configuring firewalls, VPNs, or any external allowlist. - Use Step 2 when debugging LAN connectivity, port forwarding, or internal routing. - Prefer HTTPS endpoints and avoid adding API keys; these services are free and anonymous.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jirboy/nsfc-writing-guide (version 1.0.0)

--- name: nsfc-writing-guide description: [已整合] NSFC 撰写指南已整合到 nsfc 统一入口技能 argument-hint: "[章节] [内容要点]" --- # ⚠️ 已整合 - 请使用 nsfc 统一入口 > **本技能保留用于向后兼容，功能已整合到 `nsfc` 统一入口技能** > > **推荐使用：** `nsfc write [章节] [主题]` 或直接使用本技能（自动转发） --- # NSFC Writing Guide（兼容层） NSFC 基金申请书协作撰写指南 - 采用人机协作模式撰写国家自然科学基金申请书。 ## 迁移指南 **新用法：** ``` nsfc write 立项依据 振动台控制 nsfc write 研究内容 RTHS nsfc write 摘要 面上项目 nsfc outline 面上项目 振动控制 ``` **旧用法（仍然可用）：** ``` write 立项依据 振动台控制 outline 面上项目 振动控制 ``` ## 协作原则 - **先理解后写作**：所有修改前必须充分理解用户意图 - **逐步推进**：将申请书分解为可管理的小任务 - **持续反馈**：每个阶段完成后向用户确认 - **版本控制**：重要修改前创建备份 - **进度可见**：使用任务跟踪工具 ## 质量保证原则 - **文献零编造**：所有引用必须通过检索验证 - **方法有据**：所有算法、方法必须引用文献支持 - **术语准确**：使用领域标准术语和规范表达 ## 6 阶段写作流程 1. 立项依据 ⭐⭐⭐ 2. 研究内容与目标 ⭐⭐⭐ 3. 研究方案 ⭐⭐ 4. 特色与创新 ⭐⭐⭐ 5. 研究基础 ⭐⭐ 6. 形式审查 ⭐


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yiqiezhenxi/xiaomi-home-skill (version 1.0.0)

--- name: xiaomi description: "[English] Control Xiaomi Home devices via local LAN using miiocli. Supports status checks, toggling power, and MIOT property manipulation for devices like smart plugs, humidifiers, and rice cookers. | [中文] 通过局域网利用 miiocli 控制米家智能设备。支持查看状态、开关控制以及对智能插座、加湿器、电饭煲等 MIOT 设备的属性调优。" metadata: {"clawdbot":{"emoji":"🏠","requires":{"bins":["miiocli"]},"install":[{"id":"pipx-miio","kind":"exec","command":"pipx install python-miio && /Users/$(whoami)/.local/pipx/venvs/python-miio/bin/python -m pip install 'click<8.1.0'","label":"Install python-miio via pipx (with click fix)"}]}} --- # Xiaomi Home Control小米家居控制 [English] | [中文](#中文说明) --- ## English Enable code-level control of Xiaomi (Mi Home) devices over the local network. ### 🚀 Features - **Local Network Control**: Fast, direct communication without relying on heavy cloud APIs. - **Built-in Token Extractor**: Includes a script to easily fetch your device IPs and Tokens from Xiaomi Cloud. - **Pre-configured Workflows**: Ready-to-use commands for smart plugs (e.g., water heaters), humidifiers, and rice cookers. - **Automatic Dependency Fix**: Solves common library conflicts (like the `click` version issue) automatically. ### 🛠️ Setup & Device Inventory 1. **Tokens**: Obtain device IPs and Tokens using the bundled script: ```bash python3 scripts/token_extractor.py ``` 2. **Registry**: Store your device details in `references/devices.md` or `references/my_private_devices.md`. ## 🤖 Natural Language Intents When the user gives a command, map it to the corresponding `miiocli` operation: | User Intent | Device Type | Action | Technical Command (Example) | | :--- | :--- | :--- | :--- | | "Turn on water heater" | Smart Plug | Power ON | `miiocli miotdevice --ip <IP> --token <TOKEN> raw_command set_properties '[{"siid": 2, "piid": 1, "value": true}]'` | | "Turn off water heater" | Smart Plug | Power OFF | `miiocli miotdevice --ip <IP> --token <TOKEN> raw_command set_properties '[{"siid": 2, "piid": 1, "value": false}]'` | | "Humidifier to max" | Humidifier | Set Mode | `miiocli miotdevice --ip <IP> --token <TOKEN> set_property_by 2 5 3` | | "Is rice cooked?" | Rice Cooker | Check Status | `miiocli cooker --ip <IP> --token <TOKEN> status` | --- ## 中文说明 实现在局域网内对小米（米家）智能家居设备的代码级直接控制。 ### 🚀 核心特性 - **本地化控制**：直接在局域网内通信，响应极快，不完全依赖复杂的云端 API。 - **内置 Token 提取器**：自带提取脚本，轻松从小米账号同步所有设备的 IP 和 32 位 Token 密钥。 - **预设工作流**：支持智能插座（如热水器控制）、加湿器、米家小饭煲等多种常见设备。 - **自动环境优化**：安装时自动处理 Python 依赖冲突（如 `click` 版本问题），确保开箱即用。 ### 🛠️ 快速开始 1. **获取钥匙**：运行内置的提取脚本： ```bash python3 scripts/token_extractor.py ``` 2. **配置列表**：将您的设备信息填入 `references/devices.md`。 3. **下达指令**：对着机器人喊：“打开热水器”或“查看加湿器状态”。 ---


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: aliyunbot/quarkpan-backup-suite (version 0.2.0)

--- name: quarkpan-backup-suite description: Build and operate a Quark/OpenList-style backup + restore workflow for OpenClaw workspaces, including QR login, account UID binding guard, whole-file cloud upload, dry-run restore, and Lighthouse snapshot policy (manual create only, weekly prompt). Use when users ask to set up/secure Quark backup automation, recovery runbooks, or share this backup capability with other OpenClaw users. --- # QuarkPan Backup Suite Use this skill to deploy a production-safe backup workflow with these goals: - Keep automated workspace backups on Quark Drive. - Use the OpenList-style non-parallel **whole-file** upload flow for cloud writes. - Avoid QuarkPan's fragile large-file `parallel_upload` / `X-Oss-Hash-Ctx` path. - Enforce account binding so uploads cannot silently go to a wrong account. - Keep system rollback snapshots manual-only (no auto overwrite risk). - Provide reproducible restore steps and distributable skill package. ## Current upload architecture The current production path is: 1. QuarkPan remains responsible for QR login / auth status / account binding guard. 2. `upload-quarkpan.sh` runs the account guard before any cloud write. 3. Actual cloud writes use `quark-openlist-upload.py`, a standalone OpenList/Alist-compatible uploader: - no `parallel_upload: true` - no synthetic `X-Oss-Hash-Ctx` - uses server-returned `metadata.part_size` - uses server-returned `upload_url` host - uploads archive and `.sha256` as whole files 4. `CLOUD_SPLIT_FALLBACK=0` by default. Do not split backups unless the user explicitly requests a temporary emergency workaround. ## Workflow 1. Run preflight checks with `scripts/check_env.sh`. 2. Configure backup policy using `references/commands.md`. 3. Enforce account guard (`bind`, `check`, `rotate-*`) before uploads. 4. Verify restore path with dry-run first. 5. Keep Lighthouse snapshots manual-only; use weekly prompt policy. 6. Package/share this skill with `package_skill.py`. ## Guardrails - Do not auto-apply destructive restore. - Do not auto-create system snapshots by cron. - Require explicit confirmation for snapshot creation and snapshot rollback. - Keep cloud upload failure non-fatal for local backup success. - Do not log or publish Quark cookies, preview URLs, or auth tokens. - Do not revive the old QuarkPan large-file multipart path as the default uploader. ## References - Command cookbook: `references/commands.md` - Security and rotation policy: `references/security-policy.md` - Sharing/export steps: `references/share.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: pazzilivo/session-digest (version 4.1.3)

--- name: session-digest description: "自动总结当天对话到 memory/YYYY-MM-DD.md。cron 23:00 自动运行，提取对话让 agent 自己总结。" version: "4.1.3" --- # Session Digest - 每日对话总结 自动总结当天所有 session 对话，生成精简的每日记忆。 ## 工作方式 1. cron 23:00 触发 2. 运行 `extract.js` 提取当天对话到临时文件 3. agent 读临时文件，自己总结 4. 写入 `memory/YYYY-MM-DD.md` ## 手动使用 ```bash # 提取对话 node ~/.openclaw/workspace/skills/session-digest/scripts/extract.js [YYYY-MM-DD] # 然后让 agent 读 /tmp/session-digest-YYYY-MM-DD.txt 并总结 ``` ## 输出格式 ```markdown # YYYY-MM-DD Weekday ### 做成了什么 - xxx ### 改了什么 - xxx ### 学到了什么 - xxx ### 待办 - [ ] xxx --- N 个 session，M 条消息 ``` ## 隐私 & 安全 - **不调外部 API**：extract.js 只读本地文件，不联网 - **读取所有 agents**：main、claude、gemini 等所有存活的 session - **数据不离开本地**：所有数据都在 `~/.openclaw/` 目录内 ## 文件 - `scripts/extract.js` - 提取对话到临时文件 - `SKILL.md` - 本文件


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)