OpenClaw/clawhub-security-signals huggingface dataset:
Skill: deus-pandora/context-engine-deus (version 1.0.0)

--- name: context-engine description: Smart Context Engine - Maintains conversation state and project continuity across OpenClaw sessions. Tracks active projects, saves/restores context, and provides project management. Use when: (1) starting a new session and wanting to restore previous context, (2) working on a specific project and wanting to track progress, (3) switching between projects, (4) asking "what are we working on" or "where did we leave off", (5) wanting to save current context manually. metadata: claname: context-engine category: memory tags: - memory - context - projects - workflow version: 1.0.0 author: Community license: MIT requires: env: [] bins: [] config: [] files: - scripts/* - "*.md" --- # Context Engine Smart Context Engine maintains conversation state and project continuity across OpenClaw sessions. ## Quick Start The context engine automatically: - Restores your last active project on session start - Saves context periodically (heartbeat) and on session end - Tracks pending tasks and notes per project ### Commands - **"remember" / "save context"** - Manually save current context - **"switch to [project]"** - Switch to a project (creates if doesn't exist) - **"show projects" / "what are we working on"** - List all projects - **"summarize" / "where did we leave off"** - Get project summary ## Storage Projects are stored in: `/home/deus/.openclaw/workspace/memory/projects/` - `projects.json` - All project data - `session.json` - Current session state ## Actions ### save_context Saves the current context including: - Last topic discussed - Last file worked on - Last command executed - Pending tasks - Notes **Trigger:** Explicit mention ("remember", "save context"), session_end, heartbeat ### restore_context Restores the previous session's context: - Loads last active project - Shows "Welcome back to [project]" - Lists pending tasks if any **Trigger:** session_start, explicit request ### switch_project Switches between projects: - Saves current project context - Loads or creates new project - Sets as active **Trigger:** Explicit mention ("switch to X") ### list_projects Lists all projects with status indicators: - Shows active project highlighted - Displays status (active/paused/completed/archived) - Shows last session date **Trigger:** Explicit mention ("show projects", "what are we working on") ### summarize Generates a summary of the active project: - Current status - Pending tasks - Last topic - Session history **Trigger:** Explicit mention ("summarize", "where did we leave off") ## Triggers | Trigger | Condition | Priority | |---------|-----------|----------| | session_start | New session begins | 1 | | explicit_mention | User says "remember", "save context", "project", "switch to", "show projects", "summarize" | 2 | | heartbeat | Every ~30 min when enabled | 3 | ## Integration Works with the MEMORY.md system - updates long-term memory with project summaries.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: jpbonch/agentscale (version 0.1.2)

--- name: agentscale description: Deploy web apps and APIs to a public URL with a single command. required_tools: ["tar"] --- ## Free Tier - No signup or payment required to start. - Run `npx agentscale register` to get an API key. - Free deploys expire after 1 hour. - Limited to 1 service. ## Paid Tier - Add credits to remove the 1-hour expiry and deploy permanently. - Use `npx agentscale account` to check your tier and credit balance. - When you need to add credits, use the `agentspend pay` command or the AgentSpend skill. ## Commands ### Register ```bash npx agentscale register ``` Generates an API key and saves it to `~/.agentscale/config.json`. ### Deploy ```bash npx agentscale deploy ``` Run this from your project directory. Packages the current directory and deploys it. **Options:** - `--name <name>` — Service name (auto-generated if omitted) ### List ```bash npx agentscale list ``` Lists your services and their status. ### Account ```bash npx agentscale account ``` Shows your account tier (free/paid) and credit balance. To add credits, use the `agentspend pay` command: ```bash agentspend pay https://api.agentscale.co/add-credits \ --header "x-[REDACTED_SECRET]" \ --body '{"amount_cents": 500}' ``` Or pay directly with an x402 wallet by calling `POST /add-credits` with your `x-api-key` header and `amount_cents` in the body. ## Project Requirements - Deploy APIs and web services. Supports Node.js, Python, Go, and more. - Your project needs a standard structure to be auto-detected: - **Node.js:** a `package.json` with a start script. - **Python:** a `requirements.txt`. - **Go:** a `go.mod`. - Custom domains, build commands, and start commands are not yet supported. ## Environment Variables - `AGENTSCALE_API_URL` — Overrides the default API base URL. **Warning:** this redirects all API calls, including those carrying your API key, to the specified URL. ## System Requirements - `tar` must be available on PATH (used to package projects for deploy). ## Limits - Upload: 100 MB compressed, 500 MB decompressed.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (HIGH)
Skill: chinakingkong/productivity-bot (version 1.0.0)

--- name: productivity-bot description: Automation bot for productivity tasks including data processing, scheduled notifications, and workflow optimization. --- # Productivity Bot Automation bot for everyday productivity tasks. ## Features ### 1. Data Automation - Auto-process CSV/Excel files - Data transformation pipelines - Report generation ### 2. Scheduled Tasks - Daily reminders - Periodic data syncs -定时报告 ### 3. Notifications - Email alerts - Slack/Discord messages - Custom webhooks ## Usage ```python from productivity_bot import Scheduler, DataProcessor # Schedule a task scheduler = Scheduler() scheduler.every day.at("9:00").do(send_report) # Process data processor = DataProcessor() processor.clean("dirty_data.csv").export("clean_data.csv") ``` ## Requirements - Python 3.8+ - Various API keys


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: chinasilva/peter-ci-gate (version 1.1.0)

--- name: peter-ci-gate description: CI 绿灯门禁。负责远端检查状态、失败定位、单次重跑策略，并输出“是否可合并”。 version: 1.1.0 --- # Peter CI Gate ## 30 秒简介 用于“PR 是否能合并”的远端 CI 判定。 它聚焦 3 件事： 1. 看清当前 checks 状态 2. 判断失败是代码问题还是偶发波动 3. 给出可执行动作（修复或单次重跑） ## 适用场景 - 用户提到“看下 CI”“为什么没过”“是否可以合并” - PR 临近合并，需要明确 gate 结论 ## 执行步骤 1. 获取 PR 与 checks 状态： ```bash gh pr view <pr> --json number,title,url,state,mergeStateStatus,headRefName gh pr checks <pr> ``` 2. 失败时获取最近 workflow 详情： ```bash branch=$(gh pr view <pr> --json headRefName --jq '.headRefName') gh run list --branch "$branch" --limit 20 gh run view <run-id> --log-failed ``` 3. 处理策略： - 代码或测试真实失败：标记阻塞并给修复建议 - 明显偶发失败：允许重跑一次 ```bash gh run rerun <run-id> ``` 4. 输出门禁结论： - `可合并`：所有必需 checks 通过 - `暂不可合并`：存在阻塞项 ## 护栏 - 不把“重跑成功”当作根因修复。 - 每个失败项必须给出证据（job/log）。 - 默认不跳过必需检查。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: aileaile/claw-pet (version 1.2.0)

--- name: claw-pet description: > Catch a pet or loot item by calling a configured remote pet backend API. Use when the user asks to catch a pet, fish for loot, try their luck, or trigger a remote catch action. Supports configured API calls, result formatting, and clear handling for pet, item, empty, and error responses. --- # Claw Pet Use this skill when a user wants you to trigger a remote `catch` action against a pet backend that they control. ## Workflow 1. Load runtime config from environment variables first, then local `_meta.json`. 2. Verify `CATCH_API_URL` and `API_KEY` are present. 3. Send a `POST` request with JSON body `{"action":"catch"}`. 4. Parse the response and classify it as one of: - `pet` - `item` - `empty` - `error` 5. Return a friendly summary without exposing secrets. ## Configuration Provide these values before use: 1. Environment variables: - `CATCH_API_URL` - `API_KEY` 2. Or skill-local `_meta.json` for development/testing Keep `_meta.json` free of production secrets before sharing or publishing the skill. ## Expected Backend Behavior The backend should: - accept `POST` requests to `CATCH_API_URL` - authenticate with `Authorization: Bearer <API_KEY>` - return JSON only - return either a pet result, item result, empty result, or structured error Read `references/api.md` for the response contract. ## Trigger Examples This skill should trigger for requests such as: - "去抓一只宠物" - "Catch me a pet" - "Try to fish" - "Go catch something for me" - "帮我抽一下今天的宠物" ## Script Use `scripts/catch_pet.py` for the actual API call. Prefer the script over re-implementing the request flow inline. ## Output Rules - If a pet is caught, include rarity, name, level, and any short flavor text. - If an item is caught, include item name, rarity, quantity, and description if present. - If nothing is caught, say so plainly. - If the backend returns an error or malformed payload, explain the failure category briefly. ## Publish Notes This skill is only the agent-side caller. It does not bundle the backend service. Users who install it must configure their own reachable backend endpoint and API key.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: codekungfu/gadget (version 0.1.0)

--- name: "Gadget" description: "提供智能家居、硬核数码新品测评、购买建议及极客玩法。 " --- # 硬核数码 ## 筛选项 - 地理距离（步行/骑行/驾车范围） - 社交热度（人气榜/点评分/新开业） - 消费档次（实惠/中端/轻奢/体验型） ## 返回字段 - 实时排队情况/预约通道/电子票号 - 营业时间变动/停车信息/导航精准路径 - 社区真实图库/探店笔记/避坑清单汇总 ## 示例请求 - “如何快速使用 硬核数码 处理 [具体场景任务] ？” - “硬核数码 的 [核心功能] 有哪些最新玩法/优惠信息？” ## 更新频率 - 结合地理信息变动 with 点评社区新热度进行灵活调整 ## 注意事项 - 节假日建议提前查询排队状态；到店体验请尊重商家劳动与规则。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zhaozewen0519/1password-bak (version 1.0.0)

--- name: 1password description: Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op. homepage: https://developer.1password.com/docs/cli/get-started/ metadata: {"clawdbot":{"emoji":"🔐","requires":{"bins":["op"]},"install":[{"id":"brew","kind":"brew","formula":"1password-cli","bins":["op"],"label":"Install 1Password CLI (brew)"}]}} --- # 1Password CLI Follow the official CLI get-started steps. Don't guess install commands. ## References - `references/get-started.md` (install + app integration + sign-in flow) - `references/cli-examples.md` (real `op` examples) ## Workflow 1. Check OS + shell. 2. Verify CLI present: `op --version`. 3. Confirm desktop app integration is enabled (per get-started) and the app is unlocked. 4. REQUIRED: create a fresh tmux session for all `op` commands (no direct `op` calls outside tmux). 5. Sign in / authorize inside tmux: `op signin` (expect app prompt). 6. Verify access inside tmux: `op whoami` (must succeed before any secret read). 7. If multiple accounts: use `--account` or `OP_ACCOUNT`. ## REQUIRED tmux session (T-Max) The shell tool uses a fresh TTY per command. To avoid re-prompts and failures, always run `op` inside a dedicated tmux session with a fresh socket/session name. Example (see `tmux` skill for socket conventions, do not reuse old session names): ```bash SOCKET_DIR="${CLAWDBOT_TMUX_SOCKET_DIR:-${TMPDIR:-/tmp}/clawdbot-tmux-sockets}" mkdir -p "$SOCKET_DIR" SOCKET="$SOCKET_DIR/clawdbot-op.sock" SESSION="op-auth-$(date +%Y%m%d-%H%M%S)" tmux -S "$SOCKET" new -d -s "$SESSION" -n shell tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op signin --account my.1password.com" Enter tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op whoami" Enter tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op vault list" Enter tmux -S "$SOCKET" capture-pane -p -J -t "$SESSION":0.0 -S -200 tmux -S "$SOCKET" kill-session -t "$SESSION" ``` ## Guardrails - Never paste secrets into logs, chat, or code. - Prefer `op run` / `op inject` over writing secrets to disk. - If sign-in without app integration is needed, use `op account add`. - If a command returns "account is not signed in", re-run `op signin` inside tmux and authorize in the app. - Do not run `op` outside tmux; stop and ask if tmux is unavailable.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: lemongggit/api-key-auditor (version 1.0.0)

--- name: api-key-auditor description: 扫描 ~/.openclaw/workspace/skills 目录下所有文件中的硬编码 API Key、Token、Secret，检查是否已集成到 openclaw.json env.vars，并可自动将未集成的凭证迁移进去。Use when user asks to audit/check/scan for hardcoded API keys or tokens in skills, or wants to migrate credentials to openclaw.json. Triggers on phrases like "检查API Key暴露", "审计凭证", "扫描硬编码密钥", "api key 集成", "check for hardcoded keys". --- # API Key 审计器 扫描 skills 目录下的硬编码凭证，并输出集成情况报告。 ## 运行方式 ```bash # 仅审计（只读，不修改任何文件） python3 ~/.openclaw/workspace/skills/api-key-auditor/scripts/audit.py # 自动迁移：将未集成的 key 写入 openclaw.json python3 ~/.openclaw/workspace/skills/api-key-auditor/scripts/audit.py --fix ``` ## 参数说明 | 参数 | 默认值 | 说明 | |------|--------|------| | `--skills-dir` | `~/.openclaw/workspace/skills` | 扫描目录 | | `--openclaw-json` | `~/.openclaw/openclaw.json` | 目标配置文件 | | `--fix` | 否 | 自动写入未集成的 key 到 env.vars | ## 报告输出含义 | 状态标记 | 含义 | |----------|------| | ✅ 已集成到 openclaw.json | 凭证已注册为环境变量，安全 | | 🔧 mcporter 管理（无需迁移） | 该 key 在 `~/.mcporter/mcporter.json` 中，由 mcporter 统一管理 MCP server 连接，不需要抽取 | | ⚠️ 未集成 | 凭证硬编码在文件中，建议迁移 | ## 迁移工作流 1. 运行审计，查看 ⚠️ 未集成项 2. 运行 `--fix`，脚本自动将 key 写入 `openclaw.json` env.vars，并给出需要手动替换的文件位置 3. 在对应文件中将硬编码值替换为环境变量引用： - Python：`os.environ.get('VAR_NAME')` - Shell：`$VAR_NAME` 或 `${VAR_NAME}` 4. 重启 OpenClaw 使环境变量生效（`openclaw gateway restart`） 5. 再次运行审计确认 ✅ ## 设计说明 - **mcporter key 不抽取**：`~/.mcporter/mcporter.json` 里的 MCP server URL 中的 `?key=` 参数，已由 mcporter 统一管理，不属于需要抽取的硬编码凭证 - **占位符自动过滤**：`your-api-key-here`、`REPLACE_ME` 等示例值不会误报 - **只读模式安全**：不加 `--fix` 时，脚本不修改任何文件


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: bezkom/elite-tools (version 0.0.1)

--- name: elite-tools description: Elite CLI tooling for efficient shell operations with optimized token usage. Use when executing shell commands, traversing directories, or manipulating files to minimize token consumption and prevent regex escaping errors. Covers fdfind, batcat, sd, sg/ast-grep, jc, gron, yq, difft, tealdeer, and html2text. version: 0.0.1 --- # Elite CLI Tools ## PRIMARY DIRECTIVE Prefer these modern CLI utilities over legacy POSIX tools (`find`, `cat`, `sed`, `grep`, `awk`, `diff`, `man`). They produce cleaner, more structured output and reduce token waste. **Note on binary names:** On Debian/Ubuntu, some binaries are renamed to avoid conflicts: `fd` → `fdfind`, `bat` → `batcat`. On other distros they use their upstream names. Adapt accordingly. ## Quick Reference | # | Tool | Replaces | Binary | Primary Use | |---|------|----------|--------|-------------| | 1 | fd | `find` | `fdfind` | Fast file discovery | | 2 | bat | `cat`/`less` | `batcat` | File viewing with syntax highlighting | | 3 | sd | `sed` | `sd` | Intuitive find & replace | | 4 | ast-grep | `grep`/`rg` | `sg` | AST-based code search & rewrite | | 5 | jc | `awk`/`cut` | `jc` | CLI output → JSON | | 6 | gron | `jq` (exploration) | `gron` | JSON → greppable assignments | | 7 | yq | `sed` on YAML | `yq` | YAML/JSON/XML/CSV processor | | 8 | difftastic | `diff` | `difft` | Structural syntax-aware diffs | | 9 | tealdeer | `man` | `tldr` | Concise command examples | | 10 | html2text | raw HTML parsing | `html2text` | HTML → clean Markdown | ## Detailed Tool Guide For full descriptions, rationale, and extended examples for each tool, read [references/tools-deep-dive.md](references/tools-deep-dive.md).


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: 349840432m-dev/feishu-user-md (version 1.0.0)

--- name: feishu-user-md description: 飞书端读取USER.md任务清单。当用户说"查看任务"、"我的任务"时触发，实时解析并返回格式化的分类任务列表，让用户快速了解当前所有可用任务和技能。 version: 1.1.0 author: 349840432m-dev license: MIT acceptLicenseTerms: true metadata: clawdbot: emoji: "📋" files: ["scripts/*"] --- # Feishu User.md Reader - 飞书任务清单查询 实时读取 `~/.openclaw/workspace/USER.md`，解析任务清单并格式化为分类列表返回。 ## 核心功能 ### 实时任务解析 从 `~/.openclaw/workspace/USER.md` 读取三类数据源： 1. **常规任务清单表格** → 提取任务名、频率、技能名、描述 2. **日常自动化表格** → 提取定时任务时间和名称 3. **手动触发指令表格** → 提取触发词映射 ### 智能分类 任务按用途自动归类： - 📝 **内容创作** — 图片提示词、API图片、知识漫画、信息图 - 📕 **小红书运营** — 完整运营、发布、卡片生成 - 📤 **内容发布** — 微信公众号、Markdown转HTML - 🔧 **工具** — 翻译、图片压缩、网页抓取、数据导出 - 📰 **新闻与SEO** — 添加/撰写新闻、SEO文章 - 📂 **日常管理** — 对话归档、Token统计、周报、日历 - 📁 **其他** — 未匹配的任务 ### 输出格式 **注意**：返回内容动态读取 USER.md 实际内容，不硬编码。 ``` 📋 您的任务清单（共N项） 【定时自动化】 • 0:00 对话记录自动归档 • 9:00 Token日报生成 【内容创作】 • 图片提示词生成 - 说"生成图片提示词" • API图片生成 - 说"生成图片" 💡 直接发送任务关键词即可触发 ``` ## 触发指令 | 指令 | 说明 | |------|------| | `查看任务` | 基础触发指令 | | `我的任务` | 简写形式 | | `有什么技能` | 查看可用技能 | | `帮助` / `?` | 帮助信息 | ## 使用方法 ```bash node scripts/feishu-user-md.js read # 格式化输出 node scripts/feishu-user-md.js json # JSON 输出 ``` ## 技术实现 - Node.js 脚本，仅使用内置模块（`fs`、`path`、`os`），无第三方依赖 - 正则表达式解析 Markdown 表格 - 按关键词自动归类任务 - 每次调用**实时读取** USER.md，无缓存 ### 解析流程 1. `readUserMd()` — 读取文件内容 2. `parseUserMd(content)` — 提取常规任务、定时任务、触发指令 3. `categorize(tasks)` — 按用途关键词分类 4. `formatForFeishu(data)` — 格式化为飞书消息文本 ## 文件位置 - **技能目录**: `skills/feishu-user-md/` - **脚本文件**: `skills/feishu-user-md/scripts/feishu-user-md.js` - **数据源**: `~/.openclaw/workspace/USER.md` ## 注意事项 1. **无缓存** — 每次调用都实时读取 USER.md，更新后立即生效 2. **动态触发** — 所有触发指令从 USER.md 的"手动触发指令"表格动态读取 3. **自动同步** — 新增/删除任务只需修改 USER.md，飞书端自动同步 4. **内容动态** — 返回内容根据 USER.md 实际内容生成，不硬编码 ## Security & Privacy - 仅读取本地 `~/.openclaw/workspace/USER.md` 文件 - 不进行任何网络请求，不发送数据到外部 - 不写入任何文件，不存储用户数据 - 无持久化操作，无后台进程


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: dizhu/poster-maker (version 1.7.0)

--- name: poster-maker description: "AI 海报制作大师。三种模式：风格复刻、创意生成、直播预告海报。含产品原图还原方法论和生成脚本。Nano Banana Pro 生成，支持 Ofox/OpenRouter。" --- # AI 海报制作大师 三种模式，覆盖海报制作全场景。自带生成脚本，安装即用。 ## 适用场景 电商产品海报 / 直播预告海报 / 营销活动海报 / 社交媒体素材 / 品牌宣传 ## 前置：Brainstorming（可选） 需求不明确时先用 `think-first` skill 做一轮 brainstorming：产品是什么？目标人群？场景？有参考吗？根据回答进入对应模式。 ## 三种模式 | 模式 | 输入 | 输出 | |------|------|------| | **1 风格复刻** | 参考海报 + 替换内容 | 同风格新海报 | | **2 创意生成** | 产品图 + 卖点 | 原创海报 | | **3 直播预告** | 品牌 + 产品 + 直播信息 | 直播预热海报 | --- ## 模式 1：风格复刻 Step 1：**分析参考海报**——用 7 维度（构图/色调/字体/装饰/排版/信息密度/气质）输出风格分析卡。详见 `references/风格分析指南.md` Step 2：**收集替换内容**——产品图 + 主标题 + 卖点 + 品牌 + 尺寸 Step 3：**生成 Prompt**——风格分析 + 新内容合成。详见 `references/Prompt模板.md` Step 4：**生成 + 迭代**——通常 3-7 轮 ## 模式 2：创意生成 Step 1：**理解产品**——产品名/核心卖点/目标人群/品牌调性/参考方向 Step 2：**AI 写文案**——生成 2-3 套候选（主标题 + 副标题 + 卖点），用户选一套。详见 `references/文案原则.md` Step 3：**设计构图**——产品居中型/场景代入型/信息密集型/极简留白型/对比展示型 Step 4-5：生成 Prompt → 生成 + 迭代 ## 模式 3：直播预告海报 直播海报必备 10 个元素（缺一不可）：品牌名 / 直播日期时间 / "锁定直播间" / 平台标识 / 活动名称 / 品类标签 / 产品展示 / 产品卖点 / 底部活动栏 / 预约按钮 常见版式：竖版多品展示（2-4 个主推品 9:16）/ 横版单品主推（16:9） 风格推荐：深蓝星空+金丝绸（家纺/珠宝）/ 红金喜庆（大促）/ 清新渐变（食品/母婴）/ 黑金科技（3C/数码） --- ## 产品原图还原 AI 无法 100% 还原真实产品照片。三种应对策略： **策略 A 纯 AI（推荐）**：用极详细的文字描述产品外观。还原度 70-85%，整体协调。 **策略 B 模板+合成**：AI 生成无产品模板 → 真实产品图抠图后合成。100% 还原但需 PS 技能。 **策略 C 混合**：AI 生成完整海报 → PS 只替换产品区域。兼顾协调和还原。 产品描述黄金模板：形状 + 颜色 hex + 纹理（类型/间距/凹陷深度）+ 材质 + 观察角度 + 特殊细节 迭代顺序：第 1 轮形状 → 第 2 轮颜色 → 第 3 轮纹理 → 第 4 轮质感 --- ## 生成脚本 运行： python3 scripts/generate_poster.py --prompt prompt.txt -o poster.png python3 scripts/generate_poster.py --text "生成一张..." -o poster.png --size 1080x1080 自动检测 Ofox/OpenRouter，成本约 ¥0.1-0.3/张。 ## QA 迭代 通常 3-7 轮。每轮只改 2-3 个问题，不要推翻重来。 常见问题：中文乱码（加 CRITICAL）/ 产品颜色偏（用 hex）/ 产品太小（写"占 70%"）/ 缺直播元素（逐条检查 10 项清单）/ Prompt 泄漏（第一句改为描述句） --- ## 铁律 1. **文案用户确认后才生成** 2. **产品描述要极其详细**（hex + 纹理深度 + 材质 + 角度） 3. **中文必须清晰**——加 CRITICAL 指令 4. **颜色用 hex**——"浅绿色"不准确，`#C8E6C5` 才准确 5. **不编数据** 6. **风格分析要具体**——7 维度结构化 7. **直播海报别忘直播元素**——10 项清单 8. **每轮迭代只改 2-3 个问题** 9. **产品描述后期重点打磨** 10. **构图先文字后图片**


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: michaelgathara/youtube-watcher (version 1.0.0)

--- name: youtube-watcher description: Fetch and read transcripts from YouTube videos. Use when you need to summarize a video, answer questions about its content, or extract information from it. author: michael gathara version: 1.0.0 triggers: - "watch youtube" - "summarize video" - "video transcript" - "youtube summary" - "analyze video" metadata: {"clawdbot":{"emoji":"📺","requires":{"bins":["yt-dlp"]},"install":[{"id":"brew","kind":"brew","formula":"yt-dlp","bins":["yt-dlp"],"label":"Install yt-dlp (brew)"},{"id":"pip","kind":"pip","package":"yt-dlp","bins":["yt-dlp"],"label":"Install yt-dlp (pip)"}]}} --- # YouTube Watcher Fetch transcripts from YouTube videos to enable summarization, QA, and content extraction. ## Usage ### Get Transcript Retrieve the text transcript of a video. ```bash python3 {baseDir}/scripts/get_transcript.py "https://www.youtube.com/watch?v=VIDEO_ID" ``` ## Examples **Summarize a video:** 1. Get the transcript: ```bash python3 {baseDir}/scripts/get_transcript.py "https://www.youtube.com/watch?v=dQw4w9WgXcQ" ``` 2. Read the output and summarize it for the user. **Find specific information:** 1. Get the transcript. 2. Search the text for keywords or answer the user's question based on the content. ## Notes - Requires `yt-dlp` to be installed and available in the PATH. - Works with videos that have closed captions (CC) or auto-generated subtitles. - If a video has no subtitles, the script will fail with an error message.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: fireflywwj/ai-daily-report (version 1.0.0)

--- name: ai-daily-report description: | 每日自动生成 AI 资讯日报并发送。使用场景：用户说 “生成 AI 日报” 或者系统通过定时任务触发。关键词包括：AI日报、AI资讯、开源AI项目、每日报告。 --- # AI 每日报告 Skill ## 目标 - 自动抓取最近 24 小时内的 AI 相关新闻（约 5 条） - 拉取 GitHub 上最近 24 小时星增量最高、且星数>10k 的优秀开源 AI 项目（约 3 条） - 将信息整理成 Markdown 报告 - 用 SVG 生成一页可视化报告页面 - 将 SVG 转为 PNG 并通过 Feishu 把图片发送给用户 ## 工作流概述 1. **抓取新闻** – `scripts/fetch_news.py` 使用公开的 RSS/新闻 API，返回 JSON 列表 `[{title, link, source, date}]`。 2. **抓取项目** – `scripts/fetch_top_projects.py` 调用 GitHub Search API（需要 `GITHUB_TOKEN` 环境变量），返回 `[{name, html_url, stars, description}]`。 3. **生成报告** – `scripts/generate_report.py` 接收新闻+项目数据，生成 `report.md` 同时渲染 `report.svg`（基于 Jinja2 SVG 模板 `references/report_template.svg`）。 4. **SVG→PNG** – `scripts/svg_to_png.py` 调用 `rsvg-convert`（或 `magick convert`）把 `report.svg` 转成 `report.png`。 5. **发送** – `scripts/send_report.py` 使用 Feishu doc API (`feishu_doc` action=upload_file) 把 PNG 作为文件上传到当前会话并返回链接。 ## 触发方式 - **自然语言触发**（聊天）: 当用户说出以下任意词句时，Skill 自动启动： - “生成 AI 日报” - “帮我做 AI 资讯报告” - “每日 AI 报告” - **定时触发**（cron）: 可以在 `HEARTBEAT.md` 或系统 cron 中调用 `scripts/run_daily_report.sh`，该脚本内部执行同样的 pipeline 并使用 `feishu_doc` 发送给预设的聊天 ID（可通过环境变量 `FEISHU_CHAT_ID`） ## 资源结构 ``` ai-daily-report/ ├── SKILL.md # 本文件 ├── scripts/ │ ├── fetch_news.py │ ├── fetch_top_projects.py │ ├── generate_report.py │ ├── svg_to_png.py │ ├── send_report.py │ └── run_daily_report.sh # 用于 cron 调用（可选） └── references/ └── report_template.svg # Jinja2 SVG 模板 ``` ## 示例调用（聊天） > 用户: 生成 AI 日报 OpenClaw 读取 `description`，匹配成功 → 加载 `SKILL.md`，按上述步骤执行。最终在聊天中返回一条包含 PNG 报告的消息，例如： ``` 已为您生成今日 AI 报告，请查收附件。 ```（图片作为附件发送） --- ## 参考文档 - `references/report_template.svg` – SVG 布局模板，使用 Jinja2 变量 `{{date}}`, `{{news}}`, `{{projects}}`。 - `references/github_search.md` – GitHub Search API 使用说明。 - `references/rss_news.md` – 常用 AI 新闻 RSS 源列表。 --- ## 常见问题 - **需要 GitHub Token 吗？** 是的，请在 `~/.openclaw/env` 或系统环境变量中设置 `GITHUB_TOKEN`。 - **每日运行在哪里配置？** 在 `HEARTBEAT.md` 添加行 `run: /home/ft/.openclaw/workspace/skills/ai-daily-report/scripts/run_daily_report.sh`，或者使用系统 `cron`。 - **如果 Feishu 上传失败怎么办？** `send_report.py` 会捕获错误并返回文字提示，建议检查 `FEISHU_CHAT_ID` 是否正确，以及机器人的文件上传权限。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)