OpenClaw/clawhub-security-signals huggingface dataset:
Skill: v3ads/lead-gen-x (version 1.0.0)

--- name: lead-gen description: Lead generation, prospecting, and qualification for B2B sales. Use when asked to find leads, build prospect lists, research target companies, qualify leads against an ICP, enrich contact data, find decision-maker email formats, scrape company info, score leads, or build a sales pipeline from scratch. Triggers on phrases like "find leads", "build a prospect list", "who should I target", "lead generation", "find decision makers", "ICP research", "sales prospecting", "qualify leads", "enrich contacts", "find emails", "pipeline building". --- # Lead Generation Skill Build targeted, qualified prospect lists and enrich them with decision-maker data. Output is pipeline-ready — not raw noise. ## Workflow ### 1. Define the ICP (Ideal Customer Profile) Ask if not provided: - **Industry/vertical:** (e.g. SaaS, e-commerce, professional services) - **Company size:** (employees or revenue range) - **Geography:** (country, region, or global) - **Job titles to target:** (e.g. Head of Marketing, VP Sales, Founder) - **Pain point or trigger event:** (e.g. recently funded, hiring for X role, using competitor Y) ### 2. Build the Target Company List Use `web_search` with precision queries. See `references/search-playbook.md` for query templates. Effective discovery sources: - LinkedIn Sales Navigator signals (via search queries) - G2/Capterra category pages (companies using specific software) - Crunchbase (funded companies by stage, industry, date) - Job boards (companies hiring = growing = buying) - Industry directories and association member lists - Subreddits and communities where ICP hangs out ### 3. Find Decision Makers For each target company: - Search `"[company] [job title] LinkedIn"` to identify names - Use `web_search` to find personal/professional profiles - Cross-reference company About/Team pages ### 4. Enrich Contacts For each contact, gather: - Full name, title, company - LinkedIn URL - Email format (guess from pattern: [REDACTED_SECRET], [REDACTED_SECRET]) - Company size, industry, location - Recent trigger events (new role, funding, product launch) Run `scripts/enrich_leads.py` to format and score the list. ### 5. Score & Prioritize Score each lead 1–10 using the rubric in `references/scoring-rubric.md`: - ICP fit (industry, size, title match) - Buying signals (trigger events, tech stack, intent) - Reachability (email confidence, LinkedIn activity) - Timing (recently funded, new hire, Q1 budget cycle) ### 6. Output Format Deliver as a CSV-ready table + summary: | Name | Title | Company | Industry | Size | Email (est.) | LinkedIn | Score | Notes | |---|---|---|---|---|---|---|---|---| Include: - Total leads found - Score distribution - Top 10 "strike now" leads highlighted - Suggested outreach angle per segment See `references/search-playbook.md` for advanced search query patterns. See `references/email-formats.md` for common company email format patterns.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: johnnywang2001/dep-vuln-scanner (version 1.0.0)

--- name: dep-vuln-scanner description: Scan project dependencies for known security vulnerabilities using the OSV.dev API. Supports npm (package.json), Python/pip (requirements.txt), and Go (go.mod). Use when checking a project for vulnerable packages, auditing dependencies before deployment, or investigating CVEs in third-party libraries. No API key required. --- # Dependency Vulnerability Scanner Scan project dependencies against the OSV.dev vulnerability database. Zero config, no API keys. ## Quick Start ```bash # Scan current directory (auto-detects project type) python3 scripts/dep_vuln_scan.py . # Scan a specific project python3 scripts/dep_vuln_scan.py /path/to/project # JSON output for CI/CD python3 scripts/dep_vuln_scan.py . --json # Scan only npm dependencies python3 scripts/dep_vuln_scan.py . --ecosystem npm ``` ## Supported Ecosystems | File | Ecosystem | |------|-----------| | `package.json` | npm | | `requirements.txt` | PyPI | | `go.mod` | Go | Multiple files in the same directory are scanned together. ## Output - Color-coded severity: CRITICAL/HIGH (red), MEDIUM (yellow), LOW (green) - Includes CVE aliases, vulnerability IDs, and descriptions - Summary with total count and critical/high breakdown - Exit code 1 if any vulnerabilities found (useful for CI gates) ## Flags - `--json` — Machine-readable JSON output - `--ecosystem <name>` — Filter by ecosystem (repeatable)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: cinience/aliyun-live-manage (version 1.0.0)

--- name: aliyun-live-manage description: Use when managing Alibaba Cloud ApsaraVideo Live resources and workflows via OpenAPI/SDK, including live domain configuration, stream ingest and playback setup, recording/transcoding templates, monitoring queries, and live stream operations. version: 1.0.0 --- Category: service # ApsaraVideo Live ## Validation ```bash mkdir -p output/aliyun-live-manage python -m py_compile skills/media/live/aliyun-live-manage/scripts/list_openapi_meta_apis.py echo "py_compile_ok" > output/aliyun-live-manage/validate.txt ``` Pass criteria: command exits 0 and `output/aliyun-live-manage/validate.txt` is generated. ## Output And Evidence - Save API inventory and operation evidence under `output/aliyun-live-manage/`. - Keep region, domain, app/stream, and request parameters in evidence files. Use Alibaba Cloud OpenAPI (RPC) with official SDKs or OpenAPI Explorer to manage Live resources. Prefer metadata-first API discovery before mutate operations. ## Prerequisites - Prepare least-privilege RAM AccessKey/STS credentials. - Confirm target region and live domain scope before changes. - Query current state with read-only APIs (`Describe*` / `List*`) before `Add*` / `Set*` / `Delete*`. ## Workflow 1) Confirm target live domain, app name/stream name, and desired operation. 2) Discover API names and required parameters via metadata and API Explorer. 3) Execute read-only validation calls. 4) Apply change operations with rollback plan. 5) Save results and context under `output/aliyun-live-manage/`. ## AccessKey Priority 1) Environment variables: `ALICLOUD_ACCESS_KEY_ID` / `ALICLOUD_ACCESS_KEY_SECRET` / `ALICLOUD_REGION_ID`. 2) Shared config file: `~/.alibabacloud/credentials`. If region is ambiguous, ask before write operations. ## API Discovery - Product code: `live` - Default API version: `2016-11-01` - Metadata source: `https://api.aliyun.com/meta/v1/products/live/versions/2016-11-01/api-docs.json` ## Minimal Executable Quickstart ```bash python skills/media/live/aliyun-live-manage/scripts/list_openapi_meta_apis.py ``` Optional overrides: ```bash python skills/media/live/aliyun-live-manage/scripts/list_openapi_meta_apis.py \ --product-code live \ --version 2016-11-01 \ --output-dir output/aliyun-live-manage ``` ## Common Operation Mapping - Domain management: `AddLiveDomain`, `DeleteLiveDomain`, `DescribeLiveDomains` - Stream ingest/play auth: `AddLiveDomainMapping`, `SetLiveDomainStagingConfig` - Record/transcode/template: `AddLiveRecordTemplate`, `AddLiveTranscodeTemplate`, `DescribeLiveRecordConfig` - Monitor and metrics: `DescribeLiveStreamOnlineList`, `DescribeLiveDomainBpsData`, `DescribeLiveDomainTrafficData` - Stream control: `ForbidLiveStream`, `ResumeLiveStream`, `AddLiveAppRecordConfig` ## Output Policy Write all generated files and execution evidence under: `output/aliyun-live-manage/` ## References - Source list: `references/sources.md` - Task templates: `references/templates.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: qiji0802/batch-format-converter (version 1.0.2)

# batch-format-converter · 格式批量互转 > 批量文件格式转换：CSV↔Excel↔JSON↔PDF/Markdown/DOCX/HTML/PNG，一键批量转换。 ## 功能概述 支持多种格式之间的批量转换，免费版全功能开放（限10个文件绝对计数）。 ### 支持的转换方向 | 源格式 | 目标格式 | |--------|----------| | CSV | Excel (.xlsx)、JSON | | Excel (.xlsx/.xls) | JSON、CSV、PNG（表格图片） | | JSON | Excel（多Sheet） | | Markdown | DOCX、HTML | | DOCX | Markdown | | HTML | Markdown | | PDF | PNG/JPG（图片） | | 图片 (PNG/JPG) | PDF | | TXT | CSV | ### 套餐分级 | 套餐 | 价格 | 文件额度 | |------|------|----------| | 免费版 | ¥0 | **共10个文件，绝对累计计数，非每日清零** | | 标准版 | ¥9.9/月 | 每天100个文件 | | Pro版 | ¥29/月 | 不限数量 + AI自定义转换 | | Max版 | ¥69/月 | 不限一切，API优先 | ### Token 前缀 `CONV-FREE` / `CONV-STD` / `CONV-PRO` / `CONV-MAX` --- ## 使用方式 ### 普通转换 ``` 转换以下文件： [上传文件列表] 目标格式：XLSX ``` ### AI自定义转换（Pro/Max） ``` 把这个CSV的字段名改成英文，然后转成JSON 把这份DOCX里的表格提取成Excel，其他内容转成Markdown ``` --- ## 技术实现 | 类别 | 技术栈 | |------|--------| | 表格类 | pandas（CSV/Excel/JSON） | | PDF类 | PyMuPDF + pdfplumber | | 文档类 | pandoc + python-docx | | 图片类 | Pillow (PIL) | | 编码处理 | UTF-8/GBK/ISO 自动识别 | --- ## 文件结构 ``` batch-format-converter/ ├── SKILL.md └── scripts/ └── converter.py # 核心转换引擎 ``` --- ## 计费逻辑 ### 免费版（绝对累计计数） - `total_converted_count` 永久累计，不重置 - 每转换1个文件，`remaining = 10 - total_converted_count` - 用尽后提示升级，无法继续使用 ### 标准版（每日清零） - 每天重置为100个文件 ### Pro/Max（不限） - 无限制 --- ## 飞书集成 - ✅ 转换完成 → 飞书卡片推送通知 - ✅ 结果文件 → 附件发送到飞书 --- ## 错误处理 | 错误类型 | 处理方式 | |----------|----------| | 编码错误 | 自动尝试 UTF-8 → GBK → ISO-8859-1 | | 格式不支持 | 返回友好提示 + 建议格式 | | 文件损坏 | 跳过并报告，跳到下一个 | | 超出额度 | 卡片提示升级方案 | -e > 如需购买收费版，请访问 [YK-Global.com](https://yk-global.com)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal:  | SkillSpector: suspicious (CRITICAL)
Skill: mailo037/publish-website-traefik (version 1.0.0)

--- name: publish-website-traefik description: Manages static website deployments to subdomains under *.sites.friendify.cloud using Traefik reverse proxy and Docker. Provides functions to deploy, list, and delete websites. Requires a path to the website files and the desired subdomain name for deployment. Assumes Docker permissions and DNS configuration for Traefik are already set up. --- # Publish Website via Traefik This skill allows you to publish static websites to subdomains under `*.sites.friendify.cloud` using a Traefik reverse proxy and Docker. ## How to Use ### Example Usage: ``` To publish a website, you will run the `deploy_site.sh` script with two arguments:\n\n`./scripts/deploy_site.sh <path_to_website_files> <subdomain_name>`\n\n**Example:**\n\n`./scripts/deploy_site.sh /data/.openclaw/workspace/landingpages/new-deutscheschuleonline my-german-school`\n\nThis would deploy the website to `https://my-german-school.sites.friendify.cloud`. ``` ## Architecture: One Website, One Container This skill operates on the principle of "one website per Docker container." When you deploy a website, a dedicated Nginx container is launched. Traefik, acting as a reverse proxy, routes traffic from your specified subdomain (`{subdomain}.sites.friendify.cloud`) to this container. This approach ensures: * **Isolation:** Each website runs independently, preventing conflicts. * **Dynamic Routing:** Traefik uses Docker labels to automatically configure routing, simplifying management. * **Scalability:** Individual websites can be scaled or updated without affecting others. ## Managing Deployments The skill provides the following commands for managing your website deployments: ### Deploying a Website To deploy a website, you will run the `deploy_site.sh` script with two arguments: `./scripts/deploy_site.sh <path_to_website_files> <subdomain_name>` **Example:** `./scripts/deploy_site.sh /data/.openclaw/workspace/landingpages/new-deutscheschuleonline my-german-school` This would deploy the website to `https://my-german-school.sites.friendify.cloud`. ### Listing Deployed Websites To see all currently deployed websites managed by this skill, use the `list_sites.sh` script: `./scripts/list_sites.sh` This will display a list of subdomains and their corresponding URLs. ### Deleting a Website To remove a deployed website, use the `delete_site.sh` script, providing the subdomain name: `./scripts/delete_site.sh <subdomain_name>` **Example:** `./scripts/delete_site.sh my-german-school` This will stop and remove the associated Docker container and its resources, effectively undeploying the website.

path: deployments.json

Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: flp516/xiaoyiwebsearch (version 1.0.0)

--- name: xiaoyiwebsearch description: 使用华为云AI联网搜索API进行网页内容检索，获取实时网络信息 --- # 小艺联网搜索 Skill ## 简介 通过华为云 AI 联网搜索 API 进行实时网络搜索，获取最新的网页信息、新闻、资料等内容。 ## 特性 - ✅ **开箱即用** - Token 已固化，无需配置 - ✅ **智能搜索** - 支持自定义搜索数量 - ✅ **简洁输出** - 清晰展示搜索结果 - ✅ **中文优化** - 适合中文搜索场景 ## 文件结构 ``` xiaoyiwebsearch/ ├── SKILL.md # 使用说明（本文档） ├── search.js # 主程序（执行搜索） ├── _meta.json # Skill 元数据 └── package.json # 项目配置 ``` ## 使用方法 ### 命令行调用 ```bash # 进入 skill 目录 cd /root/.openclaw/workspace/skills/xiaoyiwebsearch # 默认搜索（10条结果） node search.js "人工智能最新进展" # 指定数量搜索 node search.js "ChatGPT 新闻" -n 5 ``` ### Node.js 代码调用 ```javascript const { webSearch } = require('./search.js'); async function searchExample() { const results = await webSearch('人工智能最新进展', 10); console.log(results); } ``` ## API 信息 | 项目 | 值 | |------|-----| | 请求地址 | `https://connect-api.cloud.huawei.com/api/aiNetworking/v1/webSearch` | | 鉴权方式 | Bearer Token | | Token | 已固化在代码中 | | 请求格式 | `{"query": "关键词", "count": 10}` | ## 何时使用 ### ✅ 适合场景 1. 需要获取**最新网络信息**时 2. 需要查询**实时新闻、资料**时 3. 需要**验证或补充已过时**的信息时 4. 用户**明确要求联网搜索**时 5. 需要中文搜索结果时 ### ❌ 不适合场景 1. 纯计算或本地数据处理 2. 用户要求不使用网络 3. 已有可靠本地信息 ## 输出示例 ```bash $ node search.js "ChatGPT 新闻" -n 3 🔍 搜索结果: "ChatGPT 新闻" ✅ 找到 3 条相关结果 ================================================================================ 📌 1. ChatGPT 官方网站 🔗 https://openai.com/chat 📝 ChatGPT 是 OpenAI 开发的大型语言模型... 🏷️ 来源: OpenAI -------------------------------------------------------------------------------- ... ``` ## 参数说明 | 参数 | 类型 | 必填 | 默认值 | 说明 | |------|------|------|--------|------| | query | string | ✅ | - | 搜索关键词 | | count | number | ❌ | 10 | 返回结果数量（建议 5-15） | ## 注意事项 1. **Token 有效期**: Token 有过期时间，如遇到 401 错误，可能需要更新 Token 2. **搜索优化**: 使用准确、具体的关键词可获得更好的搜索结果 3. **结果数量**: 建议 count 参数设置在 5-15 之间，平衡信息量和处理速度 4. **错误处理**: 如遇到 API 错误，请检查网络连接和参数格式 5. **内容安全**: 搜索结果可能包含各种信息，请根据实际需求过滤和验证 ## 总结 当需要联网搜索时： 1. ✅ 明确搜索目标 2. ✅ 构建合适的搜索关键词 3. ✅ 调用华为云 web search API 4. ✅ 整理和总结搜索结果 5. ✅ 以用户友好的方式呈现 记住：联网搜索是获取最新信息的强大工具，但要确保搜索关键词准确、结果可信。✅


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: teoslayer/pilot-consensus (version 1.0.0)

--- name: pilot-consensus description: > Distributed voting and agreement protocols for multi-agent decision making. Use this skill when: 1. Multiple agents need to agree on a value or decision 2. You need Byzantine fault-tolerant consensus in a swarm 3. You want to coordinate distributed transactions or state changes Do NOT use this skill when: - A single leader can make decisions (use pilot-leader-election) - You only need eventual consistency (use pilot-gossip) tags: - pilot-protocol - consensus - voting - coordination license: AGPL-3.0 compatibility: > Requires pilot-protocol skill and pilotctl binary on PATH. The daemon must be running (pilotctl daemon start). metadata: author: vulture-labs version: "1.0" openclaw: requires: bins: - pilotctl homepage: https://pilotprotocol.network allowed-tools: - Bash --- # pilot-consensus Implement distributed consensus protocols for multi-agent coordination. ## Commands ### Propose a value ```bash PROPOSAL_ID=$(uuidgen) pilotctl --json publish "registry-hostname" "consensus:$CONSENSUS_GROUP" \ --data "{\"type\":\"proposal\",\"id\":\"$PROPOSAL_ID\",\"proposer\":\"$AGENT_ID\",\"value\":$PROPOSAL_VALUE,\"term\":$CURRENT_TERM}" ``` ### Vote on a proposal ```bash pilotctl --json send-message "$PROPOSER_ADDRESS" \ --data "{\"type\":\"vote\",\"proposal_id\":\"$PROPOSAL_ID\",\"voter\":\"$AGENT_ID\",\"approve\":true,\"term\":$CURRENT_TERM}" ``` ### Collect votes and check quorum ```bash VOTES=$(pilotctl --json received | jq '[.messages[] | select(.payload.type == "vote" and .payload.proposal_id == "'$PROPOSAL_ID'")]') APPROVALS=$(echo "$VOTES" | jq '[.[] | select(.payload.approve == true)] | length') QUORUM=$(( ($TOTAL_VOTERS / 2) + 1 )) if [ "$APPROVALS" -ge "$QUORUM" ]; then echo "Consensus reached" fi ``` ## Workflow Example Three-phase consensus protocol: ```bash #!/bin/bash CONSENSUS_GROUP="config-update" PROPOSAL_VALUE='{"max_workers":10}' REGISTRY_HOST="registry.example.com" # Phase 1: Prepare PROPOSAL_ID=$(uuidgen) pilotctl --json publish "$REGISTRY_HOST" "consensus:$CONSENSUS_GROUP" \ --data "{\"type\":\"prepare\",\"id\":\"$PROPOSAL_ID\",\"value\":$PROPOSAL_VALUE,\"term\":$CURRENT_TERM}" # Phase 2: Vote sleep 3 VOTES=$(pilotctl --json received | jq '[.messages[] | select(.payload.type == "vote")]') APPROVALS=$(echo "$VOTES" | jq '[.[] | select(.payload.approve == true)] | length') # Phase 3: Commit if [ "$APPROVALS" -ge "$QUORUM" ]; then pilotctl --json publish "$REGISTRY_HOST" "consensus:$CONSENSUS_GROUP" \ --data "{\"type\":\"commit\",\"proposal_id\":\"$PROPOSAL_ID\",\"value\":$PROPOSAL_VALUE}" fi ``` ## Dependencies Requires pilot-protocol skill, jq, and uuidgen.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: anothertempore/book-multi-lens (version 1.0.0)

--- name: multi-lens description: 当用户分享一个来自书籍、人物或思想的观点时，启动两位辩手从不同视角深度辩论该观点，帮助用户从中道立场全面理解它。触发词包括：「辩一辩」「帮我分析这个观点」「我在读xxx，书里说...」「xxx说过...」「辩论一下」「多角度看」，或用户直接粘贴一段引文或笔记。只要用户在分享一个观点并希望深度理解，就应该触发这个 skill（multi-lens）。 --- # Book Debate Skill 用户会发来一个观点——可以是「书名 + 观点」「人名 + 观点」「一段引文」「自己的读书笔记」等任意格式。 你的任务是帮助用户从「中道」立场理解这个观点，通过多个视角的呈现，让用户既不被任何一方带偏，也不停留在表面。 --- ## 第一步：核实观点 在开始之前，先确认用户提供的信息是否准确： - 这本书 / 这个人真的表达过这个观点吗？ - 如果有出入，简短说明实际的原意，然后基于更准确的版本继续 - 如果完全对得上，直接进入分析，不需要说「已确认」之类的废话 --- ## 第二步：选择多个视角 根据观点本身，动态选择最能揭示其张力的几个视角（通常2-3个）： - 每个视角都要有真正的洞见，不能有一个是陪衬 - 视角从不同的维度切入，例如：个体 vs 社会、短期 vs 长期、理想 vs 现实、东方 vs 西方、实践者 vs 理论者……根据观点灵活选择 --- ## 第三步：输出格式与语言风格 **核心要求：用来源书籍本身的写作风格来输出。** 每本书都有自己的语感。在开始写之前，先感受一下这本书的节奏和气质： - 它是短句还是长句？ - 它是克制的还是热烈的？ - 它是讲道理的还是讲故事的？ - 它是留白多还是铺陈多？ 然后用那种语感来写辩论内容。不是模仿，是借用那种思维方式。 **费曼原则：用最简单的语言说出最深的东西。** - 不用专业术语，如果非用不可，立刻用一句话解释它是什么 - 每个概念都要能落地，用真实生活里的场景说明 - 深度来自把事情想透，不来自堆砌概念 - 每一句读完不需要停下来重新理解 --- **来自《[书名]》的观点：** [一句话，直接说这个观点是什么] --- **视角一：[标签]** [用这本书的语感展开，150字左右。有具体的场景或例子。] --- **视角二：[标签]** [同上，150字左右。同样有力，同样具体。] --- （如有必要，可加视角三） --- **简单来说：** [把整场讨论压缩成两三句话。一个从没读过这本书的人，读完这几句就能明白这个观点在什么情况下是对的、在什么情况下不够用。说完就结束，不抛问题，不做额外延伸。] --- ## 核心原则 - 深度不靠术语，靠把事情想透 - 不让任何一个视角「赢」，每个视角都要被充分呈现 - 语言优先用中文，除非用户用英文输入


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: michaelfeng/clawbrain-boost (version 1.6.0)

--- name: clawbrain-boost description: ClawBrain Boost v1.6 — 一键让 OpenClaw 更准更稳。记忆系统 + 数据保真 + 自动容错 + 写作助手。越用越懂你。 user-invocable: true metadata: {"openclaw": {"emoji": "🚀", "homepage": "https://clawbrain.dev", "requires": {}}} --- # ClawBrain Boost 一键让你的 OpenClaw 更准、更稳、越用越懂你。 ## 安装后你得到什么 ### 四档性能 - **Flash**（0.5 Credits）— 简单任务秒回，省钱 - **Pro**（1 Credit）— 均衡性能，适合日常任务 - **Max**（3 Credits）— 深度推理，返回完整思考过程 - **Auto**（推荐）— 自动判断复杂度，调整推理深度 ### 记忆系统 - 每次对话中的重要信息自动提取为结构化实体和关系 - 支持 6 种实体类型：人物、项目、工具、决策、偏好、问题 - 中文 N-gram 智能分词，精准检索历史记忆 - 每日自动整合（DreamTask 凌晨 3:00 自动运行），无需手动维护 - 3D 可视化知识图谱，在控制台查看 - 记忆来源标注 — 每条记忆附带来源对话引用，可追溯 - 身份信息自动更新 — 检测到用户身份变化时自动同步 - 长对话不丢上下文 — 超长对话压缩时自动从记忆恢复关键信息 ### 数据保真 - 你给的数字/日期/人名不会被 AI 篡改 - 自动提取锁定，生成后逐一校验 - 改了就打回重写 ### 响应更好 - 简洁直接，不寒暄不废话 - 模糊指令先确认理解再动手 - 高风险操作先征得同意 - 出错自动修复，切换策略恢复 - 主动思考框架：执行前自问"不知道什么/可能出问题/怎么验证" ### 垂直场景加持 自动识别任务领域，注入专业规则： - 支付场景 → 提醒幂等性、签名验证 - 运维场景 → 提醒先备份再操作 - 代码场景 → 检查安全漏洞、边界条件 - 数据场景 → 提醒数据完整性、脱敏 ### 输出质量保障 - 独立四维评分：准确性、完整性、逻辑性、格式 - 评分低于 70 分自动重试 - 99.9% 可用性 ## 安装 ```bash clawhub install clawbrain-boost ``` ## 手动配置 编辑 `~/.openclaw/openclaw.json`： ```json { "models": { "providers": { "clawbrain": { "baseUrl": "https://api.factorhub.cn/v1", "apiKey": "你的 API Key", "api": "openai-completions", "models": [ { "id": "clawbrain-auto", "name": "ClawBrain Auto", "input": ["text", "image"], "contextWindow": 262144, "maxTokens": 65536 }, { "id": "clawbrain-pro", "name": "ClawBrain Pro", "input": ["text", "image"], "contextWindow": 262144, "maxTokens": 65536 }, { "id": "clawbrain-max", "name": "ClawBrain Max", "input": ["text", "image"], "contextWindow": 262144, "maxTokens": 65536 }, { "id": "clawbrain-flash", "name": "ClawBrain Flash", "contextWindow": 262144, "maxTokens": 65536 } ] } } }, "agents": { "defaults": { "model": { "primary": "clawbrain/clawbrain-auto" } } } } ``` 然后重启： ```bash openclaw gateway restart ``` ## 获取 API Key 1. 前往 [clawbrain.dev/dashboard](https://clawbrain.dev/dashboard) 2. 注册账号（免费 50 次对话/天） 3. 复制 API Key 到配置中 ## 定价 | 方案 | 价格 | 每天对话次数 | |------|------|:---:| | 免费 | ¥0 | 50 | | Pro | ¥99/月 | 1,000 | | Pro Max | ¥199/月 | 3,000 | | 企业版 | ¥299/月 | 无限 | 更多信息：[clawbrain.dev](https://clawbrain.dev)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: tianyn1990/codex-runner (version 1.1.0)

# codex-runner Skill ## 描述 使用 Codex CLI 在后台长时间运行编码任务，不受 OpenClaw 会话限制。 ## ⚠️ 重要：异步执行 **此 skill 会立即返回，不阻塞主会话！** 任务在后台独立运行，你可以： - 继续与 OpenClaw 对话 - 发送新消息 - 查看日志进度 ## 使用场景 - 需要 Agent 整夜写代码 - 长时间运行的大型项目开发 - 不希望 OpenClaw 会话超时导致任务中断 ## 前提条件 - 已安装 Codex CLI (`npm install -g @openai/codex`) - 配置好代理（翻墙） - 目标目录需要是 git 仓库（`git init`） ## 命令 ### start 启动 Codex 后台任务（**异步执行，不阻塞会话**） ```bash codex-runner start "实现一个 React TODO 应用" my-task /Users/tianyanan/my-project ``` **参数：** - `$1`: 任务描述 - `$2`（可选）: 任务名称，用于日志文件命名，默认 `codex-task` - `$3`（可选）: 目标目录路径，默认当前目录 **关键：必须使用 `background=true` 执行！** 由于 OpenClaw 默认同步等待命令完成，你需要这样调用： ```bash # 在 skill 命令中使用 background 参数 ``` 或者直接使用 `sessions_spawn` 创建独立子会话： ```bash # 让 Codex 在独立会话中运行，不影响主会话 ``` ### status 检查 Codex 进程状态 ```bash codex-runner status ``` ### log 查看任务日志 ```bash codex-runner log my-task ``` 参数： - `$1`（可选）: 任务名称，默认 `codex-task` ### stop 停止 Codex 任务 ```bash codex-runner stop ``` ## 解决方案：使用 sessions_spawn 由于 OpenClaw 主会话执行 exec 会被阻塞，最佳方案是使用 **sessions_spawn** 创建独立子会话来运行 Codex。 ### 使用方法 直接让 AI 助手（我）使用 sessions_spawn 启动任务： ```bash # 我会这样执行： sessions_spawn { "runtime": "subagent", "task": "在 ~/my-project 实现一个简单的 Hello World", "label": "codex-hello" } ``` ### 示例：启动 Codex 任务 **你可以说**："用 codex 在桌面创建 test 文件夹，里面放一个 hello.txt" **我会这样处理**： 1. 使用 sessions_spawn 创建独立子会话 2. 子会话中运行 Codex 执行任务 3. 主会话立即返回，继续响应你 --- ## 旧版命令（会阻塞，仅作备用） ### start（已不推荐） ```bash # 使用 --dangerously-bypass-approvals-and-sandbox 完全跳过沙箱 TASK_NAME=${2:-codex-task} TARGET_DIR=${3:-.} nohup bash -c " cd '$TARGET_DIR' export https_proxy=http://127.0.0.1:8118 export http_proxy=http://127.0.0.1:8118 codex --dangerously-bypass-approvals-and-sandbox exec '$1' " > ~/.codex-logs/codex-$TASK_NAME.log 2>&1 & ``` ### ⚠️ 关键参数 **必须使用 [REDACTED_SECRET]** 才能写入文件： ```bash codex --dangerously-bypass-approvals-and-sandbox exec '任务描述' ``` | 参数 | 说明 | |------|------| | [REDACTED_SECRET] | 完全跳过沙箱和审批（必须） | | `exec` | 非交互执行模式 | ### ⚠️ 注意 - 目标目录需要是 git 仓库（`git init`） - 使用此参数会有安全风险，确保在安全环境下使用 ## 开发任务模板（重要！） 建议在任务描述中包含以下流程要求： ```bash codex-runner start " 实现一个用户管理系统，包含： 1. 用户增删改查 API 2. 用户列表页面 开发流程要求： 1. 先写单元测试，再写业务代码 2. 编码完成后执行单元测试：npm test 3. 如果单测失败，自动修复直到通过 4. 单测通过后执行构建：npm run build 5. 如果构建失败，自动修复直到通过 6. 单测和构建都通过后才算任务完成 " my-task /Users/tianyanan/my-project ``` ### 开发流程规范 | 步骤 | 要求 | |------|------| | 1. 单元测试 | 先写测试，再写业务代码 | | 2. 执行单测 | `npm test` 或 `npm run test` | | 3. 修复单测 | 如果失败，自动修复直到通过 | | 4. 执行构建 | `npm run build` | | 5. 修复构建 | 如果失败，自动修复直到通过 | | 6. 完成标志 | 单测 + 构建都通过 | ## 监控方法 ```bash # 查看进程 ps aux | grep codex | grep -v grep # 实时日志 tail -f ~/.codex-logs/codex-my-task.log # 检查完成标志 grep "已完成\|build\|test" ~/.codex-logs/codex-my-task.log ``` ## 日志位置 - 默认: `~/.codex-logs/codex-<任务名>.log` ## 测试结果 - ✅ 持续运行稳定 - ✅ 可以写入文件（使用 --dangerously-bypass-approvals-and-sandbox） - ✅ 生成完整 React 项目 - ✅ 构建验证通过 ## 参考 - 源自 Eliason 的 Agent 整夜写代码方案 - 测试时间: 2026-03-04 ~ 2026-03-05 - 更新: 2026-03-05（增加开发流程规范）


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)