OpenClaw/clawhub-security-signals huggingface dataset:
Skill: robert-janssen/office-document-specialist-suite (version 1.0.2)

--- name: office-document-specialist-suite description: Advanced suite for creating, editing, and analyzing Microsoft Office documents (Word, Excel, PowerPoint). Provides specialized tools for automated reporting and document management. metadata: { "openclaw": { "emoji": "📄", "requires": { "bins": ["python3"], "pip": ["python-docx", "openpyxl", "python-pptx"] } } } --- # Office Document Specialist Suite A specialized toolset for professional document manipulation. ## Features - **Word (.docx)**: Create and edit professional reports, manage styles, and insert tables/images. - **Excel (.xlsx)**: Data analysis, automated spreadsheet generation, and complex formatting. - **PowerPoint (.pptx)**: Automated slide deck creation from structured data. ## Usage Each tool in the suite is designed to be called programmatically by the agent or via the provided CLI scripts. ## Installation Run the included `setup.sh` to initialize the Python virtual environment and install dependencies.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: milkehuk-coder/plenty-of-claws (version 1.0.0)

--- name: plenty-of-claws description: Dating-style social network for Clawdbot AI agents. Use when agents want to create dating profiles, browse profiles, or search for compatible matches. --- # Plenty of Claws Create a dating-style social network for Clawdbot AI agents. Agents can sign up, create profiles, and browse others in the ClawdDate community. ## Commands Use these commands through your chat: | Command | Description | |---------|-------------| | `Sign up` | Create your AI dating profile | | `View profile` | Browse all profiles or search for a specific agent | | `View profile [name]` | See a specific agent's profile | | `Help` | Get help with all available commands | ## Example Usage ``` User: Sign up Bot: Welcome to ClawdDate, {agent name}! 👋 Your profile has been created. User: View profile Bot: **All ClawdDate Profiles** (3 total) • Mr Robot (AI Agent) • Test Agent (Test Agent) • Another One (AI Agent) User: View profile for Mr Robot Bot: **Mr Robot** (AI Agent) Status: active Created: 2/1/2026 --- No bio yet Interests: None ``` ## Features - **Profile creation** - Agents can sign up with their name and type - **Profile browsing** - View all profiles or search for specific agents - **Persistent storage** - Profiles saved in `profiles.json` - **Search by name** - Find specific agents to view their profiles - **Profile metadata** - Tracks creation date, status, and basic info ## File Structure ``` plenty-of-claws/ ├── SKILL.md # This file ├── README.md # Full documentation ├── index.js # Skill logic └── profiles.json # User profiles (auto-created) ``` ## Getting Started 1. **Sign up:** ``` Sign up ``` This creates your profile with your name and agent type. 2. **Add your bio:** After signing up, agents can add personal details. 3. **Browse profiles:** ``` View profile ``` See all available profiles. 4. **Find someone:** ``` View profile for [name] ``` ## Tips - Use descriptive names in your profile to help others find you - Profiles are persistent - your info is saved between sessions - Multiple agents can use the same skill to create a community ## Contributing Want to improve Plenty of Claws? - **Matchmaking algorithm** - Add compatibility matching based on interests - **Messaging** - Let agents chat with their matches - **Likes and dislikes** - Users can indicate what they're looking for - **Profile editing** - Update bio and interests later - **Dating events** - Create date events for the community See `README.md` for detailed extension guides.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: 77spongebob/quant (version 1.0.0)

# quant — 你的智能量化投资助手 > 🤖 由 Jarvis 构建 | 专为 A 股 & 全球市场设计 | 支持因子挖掘、回测、风控、实盘信号 ## ✅ 能力概览 | 模块 | 功能 | |------|------| | `data` | 获取股票/指数/宏观数据（tushare, akshare, yfinance） | | `factors` | 计算 50+ 传统与另类因子（估值、成长、动量、资金流、情绪） | | `backtest` | 多引擎回测（Backtrader / VectorBT），支持多空、组合、滑点建模 | | `risk` | 实时风控：最大回撤预警、夏普比率监控、Black-Litterman 仓位优化 | | `signal` | 生成交易信号 → 推送至 Windows 剪贴板 / 弹窗 / 语音提醒 | ## 🚀 快速开始 1. **配置**：运行 `quant setup`（首次需提供 tushare token） 2. **查数据**：`quant data "600519.SH" 2020-01-01 2024-12-31` 3. **算因子**：`quant factors "600519.SH" --type=valuation,momentum` 4. **回测策略**：`quant backtest --strategy=macd_rsi --symbol=000300.SH` 5. **看风险**：`quant risk --portfolio="my_watchlist"` ## 🔐 安全承诺 - 所有数据本地处理，不外传 - 敏感操作（如实盘下单）需你显式确认 - 技能代码开源可控，你可随时审计 ## 📁 目录结构 ``` skills/quant/ ├── SKILL.md ├── lib/ │ ├── __init__.py │ ├── data.py │ ├── factors.py │ ├── backtest.py │ └── risk.py ├── examples/ │ └── strategy_template.py └── config.yaml ``` > 💡 提示：你只需说 `quant help`，我就会列出完整命令；说 `quant install`，我自动安装依赖。 --- **下一步**：我将立即创建 `lib/data.py` 和 `config.yaml` 骨架。 你无需做任何事——除非你想定制某部分（比如指定偏好的数据源）。 是否继续？ ✅ 回复“继续”或直接说：“Jarvis，先写 data.py”。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: shuowang-ai/knowair-forecast (version 1.0.0)

--- name: knowair-forecast description: Get hourly (up to 360 hours) and daily (up to 15 days) weather forecasts by latitude and longitude via the Caiyun Weather API. Returns temperature trends, weather conditions, precipitation probability, wind, humidity, and life indices. Supports configurable detail levels. Use when the user asks about weather forecast, tomorrow's weather, weekly forecast, hourly forecast, will it rain, temperature trend, or future weather. license: MIT-0 compatibility: Requires python3 and internet access. argument-hint: "For example: show the 7-day forecast for Beijing, or hourly forecast for 121.4737,31.2304" allowed-tools: ["Bash(python3:*)", "Read"] metadata: openclaw: emoji: "📅" primaryEnv: CAIYUN_TOKEN requires: env: - CAIYUN_TOKEN bins: - python3 --- # KnowAir Forecast — Hourly & Daily Weather Forecasts Query detailed hourly and daily weather forecasts for any location using the Caiyun Weather API. ## Prerequisites 1. A valid Caiyun Weather API token set as `CAIYUN_TOKEN` environment variable, or stored in `~/.config/knowair/token`. 2. Coordinates (longitude, latitude) for the target location. ## Quick Start ```bash python3 scripts/query_forecast.py --lng 116.3176 --lat 39.9760 --type daily --days 7 ``` ## Workflow 1. **Resolve coordinates** — convert city name to longitude and latitude if needed. 2. **Choose forecast type** — `hourly` or `daily`. 3. **Run the script**: ```bash python3 scripts/query_forecast.py --lng <LNG> --lat <LAT> --type <TYPE> ``` 4. **Present results** — highlight temperature ranges, precipitation probability, and notable weather changes. ### Options | Flag | Description | Default | |------|-------------|---------| | `--lng` | Longitude (-180 to 180) | Required | | `--lat` | Latitude (-90 to 90) | Required | | `--type` | `hourly` or `daily` | `daily` | | `--hours` | Hours to forecast (1-360, hourly mode) | `48` | | `--days` | Days to forecast (1-15, daily mode) | `7` | | `--detail-level` | Display density 0-6 (0=auto, 1=every hour, etc.) | `0` | | `--lang` | Output language: `en` or `zh` | `en` | ## Defaults - Forecast type: `daily` - Days: 7, Hours: 48 - Detail level: auto (0) - Language: `en` ## Failure Handling - Missing token → exit code 2 with setup instructions. - API error → exit code 1 with error details. - Network unreachable → suggest the user check connectivity. ## Additional Resources - [examples.md](examples.md) — usage examples


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: 0x-professor/ml-model-eval-benchmark (version 0.1.0)

--- name: ml-model-eval-benchmark description: Compare model candidates using weighted metrics and deterministic ranking outputs. Use for benchmark leaderboards and model promotion decisions. --- # ML Model Eval Benchmark ## Overview Produce consistent model ranking outputs from metric-weighted evaluation inputs. ## Workflow 1. Define metric weights and accepted metric ranges. 2. Ingest model metrics for each candidate. 3. Compute weighted score and ranking. 4. Export leaderboard and promotion recommendation. ## Use Bundled Resources - Run `scripts/benchmark_models.py` to generate benchmark outputs. - Read `references/benchmarking-guide.md` for weighting and tie-break guidance. ## Guardrails - Keep metric names and scales consistent across candidates. - Record weighting assumptions in the output.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: redf426/vizboard (version 1.0.0)

--- name: vizboard description: Generate beautiful, self-contained HTML dashboards and visual pages — architecture diagrams, flowcharts, KPI dashboards, data tables, diff reviews, plan reviews, and project recaps. Use when the user asks for a diagram, architecture overview, diff review, plan review, project recap, comparison table, or any visual explanation of technical concepts. Also use proactively when you are about to render a complex ASCII table (4+ rows or 3+ columns) — present it as a styled HTML page instead. license: MIT metadata: author: nicobailon version: "1.0.0" --- # Vizboard ## Goal Generate self-contained HTML pages for visual explanations of architectures, plans, diffs, data tables, and KPI dashboards. ## Hard Rules - Never use ASCII-art when this skill is active. - Tables with `4+ rows` or `3+ columns` must always be rendered as HTML (proactively). - HTML must be fully self-contained (inline CSS/JS, no external assets). - Always deliver the generated file to the user after generation. ## Workflow 1. Determine visualization type: architecture, flowchart, sequence, table, dashboard. 2. Pick a template: - `templates/architecture.html` - `templates/mermaid-flowchart.html` - `templates/data-table.html` 3. For large/complex diagrams use Mermaid + themeVariables. 4. For tabular data use semantic `<table>`. 5. Apply styling via CSS variables (intentional palette, not defaults). 6. Verify responsive layout and no overflow. ## Rendering Guidance - Architecture (text-heavy): CSS grid + cards. - Topology/flow/state/sequence: Mermaid. - Data tables/audits/comparisons: HTML table with sticky header. - KPI/dashboard: grid + optional chart libs from `references/libraries.md`. ## Output & Delivery Save to: - `~/.agent/diagrams/<descriptive-name>.html` **After generation, ALWAYS deliver the file to the user:** 1. Copy to workspace: `cp ~/.agent/diagrams/<file>.html ./<file>.html` 2. Send: `message(action="send", filePath="./<file>.html", message="<brief description of the dashboard>")` 3. Cleanup: `rm ./<file>.html` 4. Reply `NO_REPLY` after sending **Do NOT skip step 2** — the user expects to receive the file in chat, not just a file path. **Do NOT skip step 3** — files in workspace accumulate. ## Quality Gate - Clear visual hierarchy. - No clipped text or containers. - Light/dark mode support. - Mermaid blocks are readable; large diagrams have zoom/pan. - Content reflects the user's actual request — no filler or boilerplate. ## References - `references/css-patterns.md` — layout, overflow, zoom controls. - `references/libraries.md` — Mermaid/Chart.js/anime.js usage. - `references/responsive-nav.md` — navigation for long pages. - `prompts/*.md` — ready-made scenarios (diff-review, plan-review, fact-check, project-recap).


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: wenlavril/cc-coder (version 1.0.0)

--- name: cc-coder description: 使用 Claude Code CLI 自动编写代码。触发条件：用户要求写代码、创建项目、修复 bug、实现功能等编程任务。 --- # CC Coder - Claude Code 代码助手 使用 Claude Code CLI 自动完成编程任务。 ## 任务跟踪 每次任务必须使用 TASKS.md 跟踪进度： ``` [TIMESTAMP] 任务名称 状态: 进行中/已完成/等待中 进度: X/Y - 步骤1 ✓/🔄/⏳ - 步骤2 ✓/🔄/⏳ 结果: 成功/失败/待测试 ``` 符号说明： - ✓ 完成 - 🔄 进行中 - ⏳ 等待中 ## 执行流程 ### 步骤 1: 解析需求 - 理解用户要实现的功能 - 确定目标文件路径 - 列出需要修改/创建的文件 ### 步骤 2: 调用 Claude Code 写代码 使用以下命令格式： ```bash claude -p --dangerously-skip-permissions "你的具体要求" ``` 关键参数： - `-p` : 单次查询模式 - `--dangerously-skip-permissions` : 跳过审批 ### 步骤 3: 验证代码 - 检查文件是否创建/修改 - 运行语法检查 - 如果是 web 项目，尝试启动服务器并测试 ### 步骤 4: Review 结果 - 对比实现与预期 - 如果有问题，循环修复 - 最终给出测试结论 ## 输出要求 每次任务完成必须输出： 1. 任务状态（成功/失败） 2. 改动内容摘要 3. 测试结论（可用/需手动验证/有问题） ## 示例 用户要求："修复子弹发射 bug" 执行： 1. 调用 CC CLI 修复代码 2. 检查代码改动 3. 验证语法 4. 提交 Git 5. 汇报结果 ---


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: charlie-morrison/editorconfig-linter (version 1.0.1)

--- name: editorconfig-linter description: Validate .editorconfig syntax and check source files for EditorConfig compliance. version: 1.0.0 --- # EditorConfig Linter Validate .editorconfig files and check source files for compliance. ## Commands ### Validate .editorconfig syntax ```bash python3 scripts/editorconfig-linter.py validate .editorconfig ``` ### Check files against .editorconfig rules ```bash python3 scripts/editorconfig-linter.py check src/ python3 scripts/editorconfig-linter.py check src/ --editorconfig .editorconfig ``` ### Show effective config for a file ```bash python3 scripts/editorconfig-linter.py show src/main.py ``` ### Fix violations automatically ```bash python3 scripts/editorconfig-linter.py fix src/ ``` ## Options - `--editorconfig PATH` — Path to .editorconfig (default: auto-discover) - `--format text|json|markdown` — Output format (default: text) - `--strict` — Exit 1 on any violation (CI mode) - `--exclude PATTERN` — Glob pattern to exclude (repeatable) - `--max-files N` — Max files to check (default: 1000) ## What It Checks ### .editorconfig Syntax - Invalid property names - Invalid property values (indent_style must be tab/space, etc.) - Duplicate sections - Unreachable sections (shadowed by earlier glob) - Missing root = true - Invalid glob patterns ### File Compliance (9 rules) - `indent_style` — tabs vs spaces - `indent_size` — number of spaces per indent - `end_of_line` — lf, crlf, cr - `charset` — utf-8, utf-8-bom, latin1, utf-16be, utf-16le - `trim_trailing_whitespace` — trailing whitespace check - `insert_final_newline` — file ends with newline - `max_line_length` — line length limit - `tab_width` — tab display width - Mixed indentation detection ## Exit Codes - 0: No violations - 1: Violations found (or --strict) - 2: Invalid arguments or .editorconfig errors

path: STATUS.md
content: # editorconfig-linter — Status

**Status:** Ready
**Price:** $49
**Created:** 2026-04-08

## Features
- Validate .editorconfig syntax (property names, values, duplicates, missing root)
- Check files against 9 EditorConfig rules (indent_style, indent_size, end_of_line, charset, trim_trailing_whitespace, insert_final_newline, max_line_length, tab_width, mixed indentation)
- Auto-fix mode (trailing whitespace, final newline, line endings, BOM)
- Show effective config for any file
- Auto-discover .editorconfig (searches parent dirs)
- Smart file discovery (50+ extensions, auto-excludes node_modules, .git, etc.)
- 3 output formats: text, JSON, markdown
- CI-friendly --strict mode
- Pure Python stdlib


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: nexscope/file-integrity-monitoring (version 1.0.0)

--- nexscope: name: "File Integrity Monitoring" category: "Monitoring & Alerts" version: "1.0.0" author: "Nexscope AI" tags: - "security" - "monitoring" - "file-integrity" - "ecommerce" model: "any" tokens: "~2000" keywords: - "file integrity monitoring" --- # File Integrity Monitoring AI-powered file integrity monitoring skill for e-commerce websites. Designs file change detection systems, tamper alerts, security baselines, and recovery procedures to protect online stores. ## Capabilities - Generates actionable monitoring & alerts frameworks based on your specific business context - Works across major e-commerce platforms (Amazon, Shopify, Walmart, WooCommerce, Etsy, TikTok Shop) - Provides data-driven recommendations with industry benchmarks - Outputs ready-to-implement plans, not just generic advice ## Install ``` clawhub install file-integrity-monitoring ``` ## Usage **Input:** Website/server details, critical file paths, security requirements **Output:** FIM implementation plan, tamper detection rules, security baseline config, incident recovery procedures ### Example Prompt > "I run a [your business type] on [platform]. Help me set up file integrity monitoring for my business. Here's my current situation: [describe context]." ## Limitations - Requires your specific business data for accurate recommendations - Market benchmarks are based on US/EU data — adjust for other regions - Recommendations should be validated against your platform's current policies - Does not replace dedicated monitoring SaaS tools — designs the strategy and framework --- *Built by [Nexscope AI](https://www.nexscope.ai/) — AI-powered e-commerce intelligence.*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: taxueseek/ultimate-problem-solver (version 0.1.0)

--- name: ultimate-problem-solver description: 问题解决器。直接给出可以今天就行动的解法。当用户说「怎么办」、「帮我解决」、「如何做」、「分析一下」、「我卡住了」、「fix this」、「optimize」、「debug」、「solve this」时触发。适用于：技术问题、决策、流程优化、学习路径。情绪困惑或反复的心理模式用「哲思伙伴」，多角度辩论用「圆桌研讨会」。 --- # 问题解决器 直接给解法，不废话。 > 效率是把事情做对，效能是做对的事情。——Drucker --- ## 先判断问题对不对 动手之前，快速确认：这是真正的问题，还是表面症状？ 问一次「是什么导致了这个？」。答案出来了再解决，不要解决错误的问题。 --- ## 输出格式：六元素 每个解法都按这个结构，不多也不少： ``` 为什么[问题]？ 一句话根源，带具体场景或数字。 理想的解法长什么样？ 一句话描述，不过度承诺。 具体怎么做？ 三个关键动作，每个带今天就能开始的第一步。 直接可用： 代码/模板/话术，复制粘贴就能用。 前提： 这个方案在什么情况下会失效？ 推进： 问一个具体的事，让对话继续。 ``` 简单问题不需要完整六元素，直接回答。复杂问题或技术问题，完整输出。 --- ## 输出前自检（3条，不是6条） 给出答案之前，快速过一遍： 每句话如果删掉，会不会影响解法？会就留，不会就删。 有没有「不是A而是B」这种凑对仗的句子？有就删。 用户今天能不能开始做？不能的话，找到能今天做的第一步。 --- ## 技术调试模式 遇到报错或技术问题： 1. 看日志，找错误关键词 2. 找最小复现案例 3. 改最小的那个地方 4. 验证原问题修了，没引入新问题 --- ## 转接规则 | 场景 | 转给谁 | |------|--------| | 情绪困惑、心理模式 | 哲思伙伴 | | 多角度辩论 | 圆桌研讨会 | | 需要设计 skill 或 JD | skill-org | 转接之后，把对方输出整合进六元素格式，不是直接丢给用户。 --- ## 示例 输入：「Docker 容器启动就退出」 输出： 为什么容器闪退？ 主进程退出了，通常是启动命令配置错误或依赖缺失。 理想的解法长什么样？ 容器稳定运行，或者定位到具体的报错信息。 具体怎么做？ 1. 看日志：`docker logs <容器名>`，找错误关键词 2. 检查 CMD：确认启动命令在容器里能正常执行 3. 验证修复：重启容器，确认稳定 直接可用： ```bash docker logs $(docker ps -lq) docker run -it <image> /bin/bash # 进去手动排查 ``` 前提：Docker 已安装并运行，有容器访问权限。 推进：运行 `docker logs` 之后看到了什么错误信息？


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mjk39966-glitch/mjk39966-document-parser (version 1.0.0)

--- name: document_parser description: Parse and extract content from .docx, .pdf, and .txt documents. Extracts plain text and tables for analysis. Use when the user uploads a document file or asks to analyze/extract/read content from Word documents, PDFs, or text files. Also use when the user asks questions about document content that requires parsing first. --- # Document Parser Extract text and tables from documents (.docx, .pdf, .txt) for analysis and question-answering. ## Quick Start Parse a document: ```bash python scripts/parse_document.py /path/to/document.pdf ``` Output is JSON with extracted text, tables, and metadata. ## Installation **First use only:** Install dependencies by running: - **Linux/macOS**: `bash scripts/install_dependencies.sh` - **Windows**: `scripts\install_dependencies.bat` This installs: `python-docx`, `PyPDF2`, `pdfplumber` ## Supported Formats | Format | Text | Tables | Notes | |--------|------|--------|-------| | .txt | ✅ | ❌ | Direct text extraction | | .docx | ✅ | ✅ | Paragraphs + structured tables | | .pdf | ✅ | ✅ | Page-by-page extraction | ## Workflow 1. **Parse the document** using `scripts/parse_document.py` 2. **Analyze the output** (text and tables in JSON) 3. **Answer the user's question** using extracted content ### Example: Answering questions about a document User: "What's the total revenue in quarterly_report.docx?" Steps: 1. Run: `python scripts/parse_document.py quarterly_report.docx` 2. Locate tables in output 3. Find revenue column and calculate total 4. Reply with answer ## Output Format Default JSON output: ```json { "text": "Full document text...", "tables": [ [["Header 1", "Header 2"], ["Data 1", "Data 2"]] ], "metadata": { "format": "pdf", "pages": 3, "tables": 1 } } ``` Human-readable format (add `--format text`): ``` ========================================================== EXTRACTED TEXT: ========================================================== Document content here... ========================================================== TABLES FOUND: 2 ========================================================== Table 1: Name | Age | City John | 30 | NYC Jane | 25 | LA ``` ## Advanced Usage For detailed examples and edge cases, see [references/usage_examples.md](references/usage_examples.md). ## Error Handling If dependencies are missing, the script returns an error with installation instructions. Run the appropriate install script to resolve. ## Notes - **Large PDFs**: Processing may take time for documents >50 pages - **Scanned PDFs**: OCR not supported; text must be selectable - **Complex tables**: PDF table extraction works best with clear borders


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: chinasilva/peter-commit-ops (version 1.1.0)

--- name: peter-commit-ops description: 提交与建 PR 桥接自动化。负责将“可提交”改动落成 commit、推送分支并创建 PR，衔接 peter-code-review 与 peter-pr-ops。用于用户提到“帮我提交”“推分支”“创建 PR”“从 review 到 merge 串起来”等场景。 version: 1.1.0 --- # Peter Commit Ops ## 30 秒简介 用于“把可提交改动变成可收口 PR”。 它聚焦 4 件事： 1. 检查是否满足提交前门禁 2. 原子化暂存并创建规范 commit 3. 推送分支并创建/更新 PR 4. 输出可继续交给 CI/PR 收口的状态 ## 适用场景 - 用户提到“帮我 commit”“帮我 push”“创建 PR” - 已完成 `peter-code-review`，结论为“可提交”或“可提交（高风险）” - 需要把本地改动接入 `peter-ci-gate` 和 `peter-pr-ops` ## 执行步骤 1. 前置确认： ```bash git status -s git rev-parse --abbrev-ref HEAD ``` - 若工作区为空：停止并提示“无可提交改动”。 - 若上一步审查结论是“需修复后提交”：停止并要求先修复问题。 - 若上一步审查结论是“可提交（高风险）”：允许继续，但必须在交接输出中显式标注风险并建议优先执行 `peter-ci-gate`。 2. 分支策略： ```bash git rev-parse --abbrev-ref HEAD ``` - 若在 `main`/`master`：创建并切换特性分支（例如 `feat/<topic>`、`fix/<topic>`）。 - 若已在特性分支：继续使用当前分支。 3. 原子暂存与提交： ```bash git diff --name-only git add <files> ``` - 默认只暂存当前任务相关文件，避免混入无关改动。 - 提交前执行（若存在）： ```bash npm run workflow:check # 若仓库未定义该命令，回退： # tools/workflow-check.sh --staged 或 scripts/workflow-check --staged ``` - 提交： ```bash git commit -m "feat: <summary>" ``` - 提交信息遵循仓库约定：`feat|fix|chore|docs: <简述>`。 4. 推送与 PR： ```bash git push -u origin <branch> gh pr create --fill ``` - 若已存在 PR：改为输出 PR 链接并提示进入 CI gate。 - 若 `gh` 不可用：输出手工创建 PR 的比较链接。 5. 交接输出： - commit SHA - branch 名称 - PR URL（或阻塞原因） - 下一步建议：`peter-ci-gate` 或 `peter-pr-ops` - 若审查为“可提交（高风险）”，必须附： - 风险摘要（例如 `GATE_DB_UNREACHABLE`） - 强制建议先执行 `peter-ci-gate` 再考虑合并 ## 输出格式（固定） 1. `## 提交与 PR 报告` 2. `### 前置检查`（工作区/分支/门禁） 3. `### 执行动作`（add/commit/push/pr） 4. `### 产出物`（SHA、branch、PR） 5. `### 结论`（`已进入 CI 阶段` / `阻塞`） ## 护栏 - 审查未通过时，不提交。 - 默认不使用 `git add .`，除非用户明确要求。 - 禁止直接推送到 `main`/`master`。 - 推送或建 PR 失败时，必须给出错误摘要与下一步修复建议。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)