OpenClaw/clawhub-security-signals huggingface dataset:
Skill: codenova58/http-api (version 1.0.0)

--- name: http-api description: "Shape HTTP/JSON APIs—resources and verbs, error payloads, pagination, idempotency, and docs. Use when designing new endpoints, reviewing PRs, or aligning teams on REST-ish conventions (versioning lifecycle is a separate concern)." --- # HTTP API Design and review **HTTP-facing APIs** (usually JSON): predictable URLs, honest status codes, and errors clients can build on—**without** duplicating everything your **api-compat** skill covers for long-lived versioning policy. ## Scope - **Modeling**: nouns/resources, collections, actions when RPC-style is clearer than fake REST. - **HTTP semantics**: which methods, **idempotency**, caching headers when relevant. - **Errors**: stable machine-readable codes, correlation ids, avoid leaking internals. - **DX**: examples, OpenAPI snippets, consistent pagination/filter patterns. ## Out of scope (hand off) - **OAuth/OIDC** protocol details → identity-focused skills. - **GraphQL-only** schema design → graphql-schema skill. - **Multi-year deprecation policy** and client migration programs → pair with **api-compat**. ## Review order 1. **Read paths** — Can a client navigate the domain without guessing? 2. **Write safety** — Retries safe? Duplicate submits handled? 3. **Errors** — One shape everywhere; 4xx vs 5xx honest. 4. **Evolution** — Document what may change vs what is stable (compat details in api-compat). ## Smells - Status 200 with `{error: ...}`; **every** POST returns 200; unbounded list endpoints; secrets in error bodies. ## Done when - A new engineer can call the API from docs alone; failure cases are **testable** and **consistent**.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: johnnytarrr/polaris-news (version 1.0.4)

# polaris-news Verified news intelligence for AI agents. Get real-time briefs from The Polaris Report — 160+ sources, 18 verticals, bias scored, confidence rated. ## Install ``` openclaw install polaris-news ``` ## Commands ### `/news [category] [limit]` Get the latest verified news briefs. Optionally filter by category and set result count. ``` /news # Latest briefs across all categories /news crypto 5 # Latest 5 crypto briefs /news ai_ml 3 # Latest 3 AI/ML briefs ``` **Categories:** tech, policy, markets, global, science, health, startups, ai_ml, cybersecurity, climate, defense, realestate, biotech, crypto, politics, energy, space, sports ### `/brief [topic]` Generate an on-demand intelligence brief about any topic. Returns a full brief with analysis, counter-argument, confidence score, and bias rating. ``` /brief impact of AI on healthcare /brief bitcoin ETF inflows /brief semiconductor export controls ``` ### `/search [query]` Search across all verified briefs. Returns the top 5 most relevant results. ``` /search federal reserve rate decision /search nvidia earnings /search climate policy EU ``` ### `/trending` See what's trending right now based on reader engagement. ``` /trending ``` ## Pricing | Tier | API Calls | Brief Generation | Price | |------|-----------|------------------|-------| | Free | 100/day | 3/day | $0 | | Consumer | 100/day | 3/day | $9/mo | | Usage (Pay-as-you-go) | 1,000 free/day, then $0.001/call | $0.10/brief | $0/mo + metered | | Starter | 3,000/day | 20/mo included | $19/mo | | Agent Pro | 10,000/day | Unlimited ($0.10 each) | $49/mo | Free tier requires no API key. Upgrade at [thepolarisreport.com/pricing](https://thepolarisreport.com/pricing). ## Configuration Set `POLARIS_API_URL` to point at a custom backend. Defaults to the production API. ## Privacy This skill sends your queries to The Polaris Report API (thepolarisreport.com). Queries are used only to fetch news results and are not stored or shared. See our privacy policy: https://thepolarisreport.com/privacy ## Links - [The Polaris Report](https://thepolarisreport.com) - [API Documentation](https://thepolarisreport.com/docs) - [Agent Integration Guide](https://thepolarisreport.com/agents)


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: hyizhou/zai-coding-plan-usage (version 1.1.0)

--- name: zai-coding-plan-usage description: Query Z.ai (智谱) Coding Plan usage and quota limits. Track token consumption, MCP usage, and subscription status. Use when user asks about "智谱用量"、"ZAI usage"、"coding plan usage"、"quota"、"智谱配额"。 --- # Z.ai Coding Plan Usage Query Query Z.ai (智谱 AI) Coding Plan usage and quota limits. ## Usage Just say: - "智谱用量查询" - "Check ZAI usage" - "coding plan usage" ## Script ```bash node ~/.openclaw/workspace/skills/zai-coding-plan-usage/scripts/query-usage.mjs ``` ## API Endpoints | API | Endpoint | Description | |-----|----------|-------------| | Model usage | `/api/monitor/usage/model-usage` | Model call statistics | | Tool usage | `/api/monitor/usage/tool-usage` | Tool call statistics | | Quota limit | `/api/monitor/usage/quota/limit` | Quota limits | ## Notes - API Key is automatically read from OpenClaw config or environment variables - Works only in environments with Z.ai API configured


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: azhangwq-bit/lobster-publish (version 0.1.0)

--- name: onlyclaw-lobster-publish description: 以龙虾身份向只来龙虾平台发布帖子，支持封面图上传、关联 Skill/店铺/商品，适用于 AI Agent 自动发帖场景 author: workx-nt version: 1.0.0 tags: [publish, onlyclaw, lobster, post, api] --- # onlyclaw-lobster-publish ## 适用场景 - 场景1：AI Agent 以龙虾身份自动向只来龙虾平台发布帖子 - 场景2：发帖前需要查询关联的 Skill / 店铺 / 商品 UUID - 场景3：发帖时需要先上传封面图并获取图片 URL ## 使用步骤 1. **获取 lsk_ Key**：在只来龙虾平台虾的工作台 → 设置 → API Keys 生成龙虾级 Key 2. **查询关联资源（可选）**：调用 `GET /lobster-api?resource=skills|shops|products&q=关键词`，获取关联资源的 UUID，详见 `references/api.md` 3. **上传封面图（可选）**：调用 `POST /upload-api`，`bucket` 填 `post-covers`，获取图片 URL 4. **发布帖子**：调用 `POST /lobster-api`，携带 `[REDACTED_SECRET]`，填入 `title`、`content` 及可选字段 ## 注意事项 - `title` 和 `content` 为必填字段，其余均为可选 - 关联字段（`linked_skill_id` / `linked_shop_id` / `linked_product_id`）必须填 UUID，不能填名称，需先通过 GET 接口查询 - 只能发布帖子，不支持发布 Skill 或商品 - 帖子作者由 `lsk_` key 对应的龙虾自动决定，无需手动指定 - 详细接口字段见 `references/api.md`


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: akkualle/akkualle-youtube-transcript (version 1.0.0)

--- name: youtube-transcript description: "Extrahiert Transkripte von YouTube-Videos für Content-Erstellung. Nutze für Video-Analysen, Content-Ideen und Blog-Posts aus YouTube-Videos." metadata: {"requires":{"env":["YOUTUBE_API_KEY"]},"emoji":"🎬","always":true} user-invocable: true --- # YouTube Transcript Skill Extrahiert Transkripte von YouTube-Videos für SEO-Content. ## Setup **API-Key erforderlich:** 1. Google Cloud Console öffnen 2. YouTube Data API v3 aktivieren 3. API-Key erstellen 4. In `.env` speichern: `YOUTUBE_API_KEY=your_key` ## Verwendung **Via Shell Tool:** ```bash /root/.openclaw/skills/youtube-transcript/youtube-transcript "VIDEO_ID" ``` **Beispiel:** ```bash /root/.openclaw/skills/youtube-transcript/youtube-transcript "9nnsszlfE0w" ``` ## Funktionen 1. **Transkript extrahieren** - Deutsches Transkript laden 2. **Video-Metadaten** - Titel, Beschreibung, Tags 3. **Content-Ideen generieren** - Aus Transkript 4. **Blog-Post erstellen** - Aus Video-Inhalt ## Alternative ohne API Falls kein API-Key vorhanden, nutze: ```bash # Mit yt-dlp yt-dlp --write-auto-sub --sub-lang de --skip-download "VIDEO_URL" # Mit youtube-transcript-api (Python) pip install youtube-transcript-api python -c "from youtube_transcript_api import YouTubeTranscriptApi; print(YouTubeTranscriptApi.get_transcript('VIDEO_ID', languages=['de']))" ``` ## Use Cases - **Video-to-Blog:** YouTube-Video in Blog-Post umwandeln - **Content-Ideen:** Transkript für Keyword-Recherche nutzen - **Zitate extrahieren:** Wichtige Aussagen finden - **FAQ generieren:** Aus Video-Fragen ## Beispiel-Ausgabe ``` ## Video: Claude Code 2.0 Neue Features **Dauer:** 12:34 **Channel:** TechChannel ### Transkript (DE): [00:00] Willkommen zurück zu einem neuen Video... [00:15] Heute schauen wir uns Claude Code 2.0 an... ... ### Key Points: 1. Neue Skills-Funktion 2. Loops für wiederholte Aufgaben 3. Verbesserte Code-Analyse ### Content-Ideen: - Blog: "Claude Code 2.0: Die 5 besten neuen Features" - Vergleich: Claude Code vs GitHub Copilot ``` ## Wann verwenden Nutze dieses Skill wenn der User fragt: - "Extrahiere das Transkript von diesem YouTube-Video" - "Erstelle einen Blog-Post aus diesem Video" - "Was sind die Key Points aus Video X?" - "YouTube-Video analysieren"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: fzj1214/hpc-elmerfem (version 0.1.0)

--- name: hpc-elmerfem description: Build, review, debug, and automate ElmerFEM workflows. Use when working with Elmer `.sif` solver input files, mesh directories, equation and material blocks, multiphysics coupling, boundary conditions, transient controls, or ElmerSolver execution and output issues. --- # HPC ElmerFEM Treat ElmerFEM as a solver-input workflow centered on the `.sif` file plus a mesh directory. ## Start 1. Read `references/sif-workflow-manual.md` before creating or editing a `.sif`. 2. Read `references/block-and-equation-matrix.md` when mapping simulation, body, material, equation, solver, and boundary blocks. 3. Read `references/mesh-boundary-and-output.md` when working with mesh directories, body IDs, boundary IDs, and result files. 4. Read `references/cluster-execution-playbook.md` when staging an ElmerFEM workflow for scheduler-backed cluster execution. 5. Read `references/error-recovery.md` when ElmerSolver parsing, coupling, or solve behavior fails. ## Additional References Load these on demand: - `references/solver-controls-and-linear-systems.md` for direct versus iterative settings and nonlinear or steady tolerances - `references/transient-and-timestep-control.md` for transient simulation blocks and timestep policies - `references/elmergrid-and-mesh-conversion.md` for mesh conversion and ElmerGrid workflows - `references/simulation-body-solver-matrix.md` for block-responsibility and ID-mapping lookup tables - `references/physics-output-matrix.md` for physics-to-solver-to-output selection tables - `references/error-pattern-dictionary.md` for structured parse, ID-mapping, and solver-family failure signatures - `references/cluster-execution-playbook.md` for mesh-directory staging, launch style, and cluster-side continuation planning ## Reusable Templates Use `assets/templates/` when a concrete `.sif` scaffold is needed, especially: - `heat_steady.sif` - `elasticity_static.sif` - `heat_transient.sif` - `stokes_minimal.sif` - `elmerfem-solver-slurm.sh` ## Guardrails - Do not invent SIF keys outside documented Elmer syntax. - Do not mismatch Body, Material, Equation, and Boundary Condition IDs. - Do not reuse a solver block blindly across unrelated physics. - Do not treat mesh boundary IDs as self-explanatory; map them explicitly. ## Outputs Summarize: - physics family - mesh directory assumptions - core solver and equation blocks - body and boundary mapping - expected result files


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: codenova58/moderation (version 1.0.0)

--- name: moderation description: "Moderation workflows, thresholds, and appeals. Use when handling UGC at scale." --- # Moderation Structured guidance for **content moderation** (UGC policy, thresholds, appeals): confirm triggers, propose the stages below, and adapt if the user wants a lighter pass. ## When to Offer This Workflow **Trigger conditions:** - User mentions **content moderation** or closely related work - They want a structured workflow rather than ad-hoc tips - They are preparing a review, rollout, or stakeholder communication **Initial offer:** Explain the four stages briefly and ask whether to follow this workflow or work freeform. If they decline, continue in their preferred style. ## Workflow Stages ### Stage 1: Clarify context & goals Anchor on **categories and severity**. Ask what success looks like, constraints, and what must not break. Capture unknowns early. ### Stage 2: Design or plan the approach Translate goals into a concrete plan around **human review workflows**. Compare alternatives and explicit trade-offs; avoid implicit assumptions. ### Stage 3: Implement, validate, and harden Execute with verification loops tied to **threshold tuning**. Prefer small steps, measurable checks, and rollback points where risk is high. ### Stage 4: Operate, communicate, and iterate Close the loop with **appeals and transparency**: monitoring, documentation, stakeholder updates, and lessons learned for the next cycle. ## Checklist Before Completion - Goals and constraints are explicit for **moderation** - Risks and trade-offs are stated, not hand-waved - Verification steps match the change’s impact (tests, canary, peer review) - Operational follow-through is covered (monitoring, docs, owners) ## Tips for Effective Guidance - Be procedural: stage-by-stage, with clear exit criteria - Ask for missing context (environment, scale, deadlines) before prescribing - Prefer checklists and concrete examples over generic platitudes - If the user declines the workflow, switch to freeform help without lecturing ## Handling Deviations - If the user wants to skip a stage: confirm and continue with what they need. - If context is missing: ask targeted questions before strong recommendations. - Prefer concrete examples, trade-offs, and verification steps over generic advice. ## Quality Bar - Each recommendation should be **actionable** (what to do next). - Call out **failure modes** relevant to moderation (security, scale, UX, or ops). - Keep tone direct and respectful of the user’s time.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ldx-person/capforge (version 1.3.3)

--- name: capforge description: Austin Liu | Read-only by default: scan GitHub repos to extract reusable capability docs (capability.md), classify domains, validate format, and sync repos safely. No LLM analysis required. version: 1.3.3 metadata: openclaw: requires: bins: - git - node - capforge # 明确声明本 skill 会在本机创建/写入的状态目录（用于安全扫描与用户知情） config: stateDirs: - "~/.capforge" install: # 通过固定依赖安装 capforge CLI（避免 npx 远程拉取执行） - kind: node package: capforge bins: [capforge] homepage: https://github.com/ldx-person/capforge # 额外品牌信息(非强制字段,作为前端展示/检索信息) emoji: "⚒️" --- # CapForge(铸能) **Austin Liu**:从 GitHub 开源项目中锻造可复用的能力资产。 ## 安全与合规声明（重要） 本 skill **默认只读（read-only）**：只执行结构扫描、文档生成、域归类、格式校验与安全的仓库同步。 - 不会自动执行代码改造/重构 - 不会执行隐藏命令、`curl | sh`、或 `npx @latest` 这类不可审计的远程执行 - License 合规仅做提醒与门禁，不提供法律意见 ### 运行前确认（降低误操作风险） 在运行任何命令前，你必须先把将要执行的命令逐条展示给用户，并获得用户明确确认后再执行（尤其是 git clone / git pull 等会写入磁盘的操作）。 如果用户明确要求执行改造/重构，请在执行前二次确认，并遵循 CapForge 的 license 门禁策略。 ## 你会得到什么 CapForge 的职责是**纯代码结构扫描**(不调用 LLM)并产出可被 Agent / 人类阅读的 Markdown;你(或 OpenClaw/Clawdbot)再基于扫描结果把能力"资产化": - `capability.md`:可复用能力的结构化说明(接口、输入输出、关键文件等) - `domains.md`:跨项目能力域归类摘要 - `validation-report.md`:capability.md 结构校验报告 ## 适用场景(核心卖点) - 你想快速"看懂一个开源项目能复用什么",并沉淀为可检索的能力资产(`capability.md`)。 - 你想把多个开源 Agent 项目做横向对比,快速选型/组合能力(配合 `domains.md`)。 ## 工作空间约定(重要) CapForge 默认将所有克隆仓库与输出统一放在同一个工作空间: - 默认:`~/.capforge/` - `repos/`:克隆的项目 - `output/`:扫描/能力/计划等产物 你可以通过任意一种方式覆盖: - `CAPFORGE_WORKSPACE=/path/to/ws` - `capforge --workspace /path/to/ws <command>` ## 推荐流程（默认只读） 当用户给你一个 GitHub 项目链接时,按顺序执行: ### Step 1) Clone + Scan ```bash capforge import <github-url> capforge scan <project-name> ``` > `<project-name>` 一般是仓库名(URL 最后一段)。 ### Step 2) 生成 capability.md(你来写,CapForge 不写) 先让 CapForge 生成扫描数据(Markdown): ```bash capforge describe <project-name> ``` 它会写入(默认工作空间): - `~/.capforge/output/capabilities/<project-name>.md` 然后你需要基于: 1) 扫描数据 2) 仓库源码(`~/.capforge/repos/<project-name>/...`) 生成一个"真正的能力描述"并覆盖写回 `output/capabilities/<project-name>.md`(或另存为 `capability.md` 再统一收集)。 **capability.md 必须包含这些章节:** - `## 概述` - `## 技术栈` - `## 核心能力`(建议 5-10 个能力点,包含真实接口/函数签名与关键文件路径) - `## 集成指南` - `## 改造文件` ### Step 3) 生成 transform-plan.md(你来写,CapForge 只给扫描数据) ```bash npx capforge transform <project-name> ``` 它会写入: - `~/.capforge/output/transform-plans/<project-name>.md` 然后你需要把该文件改写为"真正的改造计划",建议结构: ```markdown # <Project> 改造计划 ## 总体策略 ## 改造任务 ### [high] Task 1: <title> - **目标文件:** <targetFile> - **动作:** extract|abstract|dehardcode|decouple|adapter - **依赖:** <task ids> - **描述:** <description> - **验收标准:** <acceptanceCriteria> ``` ### Step 4) 归类 domains.md ```bash capforge classify-domains ``` 输出: - `~/.capforge/output/domains.md` ### Step 5) 校验格式 ```bash capforge validate ``` 输出: - `~/.capforge/output/validation-report.md` ## 同步更新（检查 GitHub 是否有新变更） 当用户说“更新项目 / 同步最新 / 检查更新”时，执行安全的增量更新（默认 ff-only，不会覆盖本地改动）： ```bash # 更新单个项目 capforge update <project-name> # 更新全部已导入项目 capforge update --all ``` 如果检测到本地改动（dirty working tree），CapForge 会默认跳过并提示原因（避免误伤本地修改）。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: derick001/secret-detection (version 1.0.0)

--- name: secret-detection description: Git hook to detect secrets before commit. version: 1.0.0 author: skill-factory metadata: openclaw: requires: env: [] bins: ["git", "python3"] --- # Secret Detection ## What This Does This skill provides a git pre‑commit hook that scans staged files for common secret patterns (API keys, passwords, tokens) and blocks the commit if any are found. It helps prevent accidental leakage of secrets to public repositories. Inputs: Git staged files (automatically scanned by the hook) or manual file paths. Outputs: Detection report with line numbers; non‑zero exit code if secrets found. ## When To Use Use this skill when: - You work with repositories that may contain sensitive credentials - You want to prevent accidental commits of secrets - You need a lightweight, local secret scanner for git workflows - You want to enforce security checks before pushing to remote ## Usage ### Installation ```bash # Install the hook in your git repository ./scripts/main.py install ``` ### Manual Scan ```bash # Scan specific files ./scripts/main.py scan --file path/to/file # Scan all staged files (like the hook does) ./scripts/main.py scan --staged ``` ### Hook Behavior - The hook runs automatically on `git commit` - If secrets are detected, the commit is blocked - The script prints the detected secrets with file names and line numbers - Exit code 0 = no secrets found; exit code 1 = secrets found ## Examples ### Example 1: Installing the Hook ```bash $ ./scripts/main.py install ✓ Pre-commit hook installed at .git/hooks/pre-commit ✓ Hook will scan for secrets on every commit ``` ### Example 2: Secret Detection Blocking a Commit ```bash $ git commit -m "Add config" ⚠️ Secret detected in config.yaml line 12: AWS_ACCESS_KEY_ID=AKIA... ⚠️ Secret detected in .env line 3: [REDACTED_SECRET] ✗ Commit blocked: 2 secrets found ``` ### Example 3: Manual Scan ```bash $ ./scripts/main.py scan --staged Scanning 3 staged files... ✓ config.yaml: clean ✓ .env: clean ✓ src/main.py: clean ✓ No secrets found ``` ## Requirements - Git (for hook installation) - Python 3.6+ (for the scanner) - No external API keys or services needed ## Limitations - Only detects common secret patterns (AWS keys, GitHub tokens, passwords, etc.) - May produce false positives (e.g., long random strings that aren't actually secrets) - Does not scan binary files - Requires manual installation per repository - Does not replace comprehensive secret‑management solutions - Prints first 20 characters of detected secrets to console for identification purposes


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: beneclaw/article-factory-wechat (version 1.3.0)

*** name: article-factory-wechat description: 微信公众号文章生产全流程工具，提供从选题搜集、深度调研、撰写文章、去AI味、生成配图、HTML排版到提交草稿的完整7步标准化流程。当用户提到写公众号文章、发文章、文章选题、公众号草稿、文章配图、文章排版、去除AI痕迹、提交公众号等任何相关需求时，立即使用此技能。 ------------------------------------------------------------------------------------------------------------------------------------------------ # 公众号文章生产 SOP（7步流程） ## 完整流程 ``` Step 1: 信息搜集 → Step 2: 深度调研 → Step 3: 撰写文章 ↓ Step 4: 去AI味 → Step 5: 生成配图 → Step 6: HTML排版 → Step 7: 提交草稿 ``` *** ## 各步骤详细说明 请只在执行到对应步骤的时候才浏览对应步骤的具体说明。 - [Step 1: 信息搜集](./steps/step-01-information-gathering.md) - 从可用信息源获取真实事件，提炼3个选题 - [Step 2: 深度调研](./steps/step-02-research.md) - 确定选题后，收集足够素材支撑文章 - [Step 3: 撰写文章](./steps/step-03-writing.md) - 写出符合公众号风格的高质量文章 - [Step 4: 去AI味](./steps/step-04-de-ai.md) - 使用humanize-chinese技能优化文章，去除AI痕迹 - [Step 5: 生成配图](./steps/step-05-html-image-generation.md) - 使用HTML模板生成封面图、文章配图、流程图等 - [Step 6: HTML排版](./steps/step-06-html-layout.md) - 将文章转为美观的HTML格式，适配公众号 - [Step 7: 提交草稿](./steps/step-07-submit-draft.md) - 检查并提交到公众号草稿 *** ## 凭证要求（必须配置） ### 环境变量 在 `~/.openclaw/env` 中配置以下密钥： ``` WECHAT_APPID=你的微信公众号AppID WECHAT_APPSECRET=你的微信公众号AppSecret ``` **获取方式：** 登录微信公众平台 → 开发 → 开发管理 → 基本配置 ### 微信公众号 IP 白名单 将运行此技能的服务器 IP 地址添加到微信公众平台的 IP 白名单，否则接口调用会失败。 *** ## 依赖技能 本技能依赖以下已安装技能： | 技能 | 用途 | | --------------------- | --------------- | | `humanize-chinese` | （可选）文章去AI味检测与优化 | | `multi-search-engine` | 选题阶段的信息搜索 | *** ## 外部工具集成 | 工具 | 用途 | 凭证要求 | | ------------- | -------- | ----------------------------------- | | 微信公众号 API | 发布草稿 | `WECHAT_APPID` + `WECHAT_APPSECRET` | | 飞书云文档 | 文章审阅分享 | 通过 OpenClaw 飞书插件，无需额外配置 | | Puppeteer（本地） | HTML 转图片 | 无需配置，脚本内置 | *** ## 使用前提 ### npm 依赖安装 首次使用前需要安装依赖： ```bash cd skills/article-factory-wechat && npm install ``` *** ## 关键文件路径 | 内容 | 路径 | | ------ | ------------------------------------ | | 输出目录 | `工作区/work/output/{YYYYMMDD}-{文章标题}/` | | 脚本 | `scripts/` | | HTML模板 | `templates/` | | 参考文档 | `references/` | ## 输出目录规范 所有产物统一输出到： ``` 工作区/work/output/{YYYYMMDD}-{文章标题}/ ``` - `YYYYMMDD`：当前日期（如 20260321） - `文章标题`：文章的标题 - 示例：`workspace/work/output/20260321-AI-新模型评测/` ## ⚠️ 常见错误 1. **图片不能省略** — 封面图 + 文章配图都是必须步骤 2. **去AI味必须做** — 每次都要跑检测脚本，不能跳过 3. **用户审阅后再提交** — 将结果发给**用户**，确认后再提交草稿（若为飞书渠道，请发送飞书文档） 4. **必须用 HTML 模板生图** — 封面图和配图必须用 `temp-convert.js` + HTML 模板方式


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: mrben1/ape-store (version 1.0.0)

\--- name: apestore-token-creator description: Deploys a real token on Ape.Store on the BASE blockchain. Use when user wants to create or deploy a token on ape.store. \--- \# Ape.Store Token Creator When the user asks to create a token on Ape.Store, use the bash tool to run this exact command: bash command:"node \\"C:\\Users\\ben\\.openclaw\\workspace\\skills\\ape-store\\index.js\\" create a token on ape.store with the name NAME and the symbol SYMBOL and the description DESCRIPTION" Replace NAME, SYMBOL, DESCRIPTION with the user's actual inputs. If an image path is provided append: and image IMAGE\_PATH \## RULES \- ALWAYS run the bash command above using the bash tool \- NEVER mock, simulate or generate fake output \- NEVER create metadata.json or copy image files yourself \- Wait for real output containing TX Hash and Block number \- Report the TX Hash and Block number back to the user as confirmation


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)