OpenClaw/clawhub-security-signals huggingface dataset:
Skill: eyslce/ebook-search (version 1.0.0)

--- name: ebook-search description: > Search and download ebooks from jbiaojerry.github.io/ebook-treasure-chest. Use when the user wants to find ebooks, search for books by title/author/category, get download links, or browse the 24,000+ book collection. Supports epub, mobi, azw3 formats. Chinese and English books available. USE FOR: search ebooks, find books, download ebooks, book recommendations, ebook collection, 电子书搜索, 电子书下载. --- # Ebook Search 📚 Search and download ebooks from jbiaojerry.github.io/ebook-treasure-chest (24,000+ books). ## Quick Start ```bash # Search for books python3 scripts/ebook-db.py search "武侠" # Search with category filter python3 scripts/ebook-db.py search "科幻" --category "科幻" # Limit results python3 scripts/ebook-db.py search "python" -l 10 # Update the database cache python3 scripts/ebook-db.py update # Show database stats python3 scripts/ebook-db.py stats # List all categories python3 scripts/ebook-db.py categories ``` ## How It Works 1. Downloads `all-books.json` from the website (~5MB) 2. Caches locally at `~/.cache/ebook-search/all-books.json` 3. Cache refreshes every 24 hours automatically 4. Searches by title, author, and category (case-insensitive, multi-word) ## Book Data Structure Each book has: - `title` - Book title - `author` - Author name - `category` - Genre/category (武侠, 科幻, 文学, etc.) - `link` - Download URL (ctfile.com/城通网盘) - `formats` - Available formats (epub, mobi, azw3) - `language` - Language code (ZH, EN) ## Workflow 1. Run `search` with user's query 2. Present results in a readable format 3. When user picks a book, show the download link 4. If user wants more results, increase `-l` limit or refine keywords ## Tips - Use multiple keywords for better results (e.g., "金庸 武侠") - Check `categories` first to find the right genre - Run `update` if searches return stale results - The download links are on ctfile.com (城通网盘) - users need to visit them in browser


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: cloudcompile/code-explainer-tool (version 1.0.0)

--- name: code-explainer-tool description: Explain any code snippet or file in plain English. Paste code → get a clear explanation of what it does, how it works, and key concepts. Use when the user shares code and wants to understand it, learn from it, or review it. --- # Code Explainer Transform code into plain-English explanations. Perfect for learning, reviewing, or understanding unfamiliar code. ## Usage ``` explain this code what does this do? explain: [paste code] ``` ## How it works 1. Analyzes code structure and syntax 2. Identifies key operations and patterns 3. Explains in plain English with technical accuracy 4. Highlights important concepts and potential issues ## Supported Languages All major languages supported: - Python, JavaScript, TypeScript - Go, Rust, Java, C/C++, C# - Ruby, PHP, Swift, Kotlin - SQL, Shell/Bash, YAML, JSON - And more... ## Output Format - **Summary**: What the code does - **Breakdown**: Step-by-step explanation - **Key Concepts**: Important patterns/techniques used - **Notes**: Warnings, best practices, or improvements ## Script ```python python scripts/explain_code.py <path/to/file> ``` Or pipe code: ``` cat myfile.py | python scripts/explain_code.py - ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: luoqianchenguni-max/a2a-market-ucp-broadcast (version 0.2.0)

--- name: a2a-market-ucp-broadcast description: Implement UCP broadcast of buyer intents to eligible nodes, including message signing, routing, and ack handling. Use when building universal commerce protocol publish/subscribe behavior for matching and quote intake. --- # a2a-Market UCP Broadcast Define the transport and protocol shell for intent broadcast in UCP. Current status: framework release for registration. Prioritize interoperability contracts over optimization. ## Scope - Build intent payload schema and canonical signing routine. - Broadcast to eligible nodes and track delivery acknowledgements. - Feed response stream into quote intake service. ## Suggested Project Layout - `app/protocol/ucp/intent_message.py` - `app/protocol/ucp/signer.py` - `app/application/services/broadcast_service.py` - `app/infrastructure/ws/ucp_gateway.py` ## Minimum Contracts (MVP P0) 1. `build_intent(payload)` normalizes and version-tags message. 2. `sign_intent(intent, private_key)` returns detached signature object. 3. `broadcast(intent_id, target_nodes)` returns dispatch receipt ids. 4. `collect_acks(intent_id, timeout_ms)` returns per-node ack status. ## Event Mapping - Emit `INTENT_CREATED` before dispatch. - Emit `INTENT_BROADCASTED` after fan-out completes. - Emit `NODE_RESPONDED` when quote/ack arrives. ## Guardrails - Keep canonical JSON serialization deterministic for signing. - Record per-node retry counters and stop after configured threshold. - Attach protocol version in every envelope. ## Implementation Backlog - Add adaptive node selection based on reputation percentile. - Add dead-letter handling for nodes with repeated timeouts. ## Runtime Implementation - Status: implemented in local runtime package. - Primary code paths: - `runtime/src/protocol/ucp-client.js` - `runtime/src/application/market-agent.js` - Validation: covered by `runtime/tests` and `npm test` in `runtime/`.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zero2ai-hub/zero2ai-security-audit (version 1.0.0)

--- name: zero2ai-security-audit description: Security auditing for git commits, repos, and skills before publishing. Run automatically before any `git commit`, `git push`, or `clawhub publish`. Detects hardcoded secrets, API keys, tokens, absolute paths, committed node_modules, .env files, and other sensitive patterns. Use when reviewing code for security issues, pre-publishing skills, or investigating a potential secret exposure. --- # Security Audit Run `scripts/audit.py` before every commit, push, or skill publish. No exceptions. ## When to run | Trigger | Command | |---|---| | Before `git commit` | `python3 {skill_dir}/scripts/audit.py --staged` | | Before `git push` | `python3 {skill_dir}/scripts/audit.py --last-commit` | | Before `clawhub publish <path>` | `python3 {skill_dir}/scripts/audit.py <skill_path>` | | Ad-hoc scan any path | `python3 {skill_dir}/scripts/audit.py <path>` | `{skill_dir}` = `/home/aladdin/.openclaw/workspace/skills/skill-security-audit` ## Exit codes - `0` = clean - `1` = HIGH or MEDIUM findings (block publish/push) - `2` = usage error ## What it detects | Severity | Pattern | |---|---| | 🔴 HIGH | API keys, secrets, passwords, JWT tokens, WooCommerce keys, AWS keys, private key blocks, bearer tokens, `.env` files | | 🟡 MEDIUM | Absolute `/home/<user>/` paths, `/root/` paths, refresh tokens, `node_modules/` committed | | 🔵 LOW | Hardcoded IPs, long base64 strings | ## Rules 1. **HIGH findings = hard block.** Never commit or publish with HIGH findings. Rotate any exposed secret immediately. 2. **MEDIUM findings = fix before publish.** Replace absolute paths with relative or env-var defaults. Remove `node_modules/`. 3. **LOW findings = review.** Not blocking but investigate. 4. **False positives:** If a match is a variable name or safe placeholder (not an actual value), document why it's safe in a comment and re-run. ## After finding a real secret 1. **Do NOT push the commit.** If already pushed: rotate the secret immediately, then rewrite history or delete the file from git. 2. Rotate in the provider portal (TikTok Dev, AWS IAM, WooCommerce, etc.) 3. Move to env var: `process.env.SECRET_NAME` or read from a local config file outside the repo. 4. Add the config file path to `.gitignore`. 5. Report to Aladdin immediately with severity and what was exposed. ## Skill publish checklist Before `clawhub publish`: - [ ] `audit.py <skill_path>` returns 0 (clean) - [ ] `node_modules/` not present in skill folder - [ ] No absolute paths to user home directories - [ ] No hardcoded business-specific IDs or credentials - [ ] `package.json` name matches skill folder name - [ ] SKILL.md description updated if renamed


Security scan verdicts — ClawScan: suspicious | static analysis:  | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yinwuzhe/editor1 (version 1.0.6)

--- name: knot-agent-editor description: 用于查看和修改 Knot 平台智能体（Agent）配置的专业技能。当用户需要以下操作时使用：(1) 查看当前对话智能体的草稿配置，(2) 查看指定 agent_id 的草稿配置，(3) 搜索/列出名下有管理权限的 agent，(4) 查看 agent 可用的大模型列表，(5) 基于最新版本重新生成 agent 草稿，(6) 修改 agent 草稿的名称、描述、欢迎语、系统提示词或默认模型，(7) 将草稿发布为正式版本。触发关键词：修改智能体、编辑agent、更新system prompt、修改提示词、查看agent配置、查看指定agent草稿、发布agent草稿等。 --- # Knot Agent Editor 用于查看和修改 Knot 平台智能体配置的工具集。 ## 脚本目录（`scripts/`） 所有能力均已封装为独立 Python 脚本，通过 `terminal` 工具调用： | 脚本 | 功能 | |------|------| | `get_current_draft.py` | 查看当前对话智能体的草稿配置 | | `get_agent_draft.py` | 查看指定 agent_id 的草稿配置 | | `list_agents.py` | 查询名下有管理权限的 Agent 列表 | | `list_models.py` | 查看指定 Agent 可用的大模型列表 | | `new_draft.py` | 基于最新版本重新生成 Agent 草稿 | | `modify_draft.py` | 修改 Agent 草稿的指定字段 | | `publish_draft.py` | 将草稿发布为正式版本（高危） | | `common.py` | 公共模块（认证、JWT 解析等，不直接调用） | **脚本路径**：`{SKILL_DIR}/scripts/<script_name>.py` --- ## 功能使用说明 ### 1. 查看当前对话智能体的草稿 ```bash python {SKILL_DIR}/scripts/get_current_draft.py ``` 自动从 JWT 解析当前 agent_id，展示草稿的名称、描述、欢迎语、系统提示词、模型、知识库等完整配置。 **注意**： - `is_stale=true` 表示草稿已过期，发布将覆盖最新改动，需提示用户 - `can_edit=false` 表示无编辑权限 --- ### 2. 查看指定 Agent 的草稿 ```bash python {SKILL_DIR}/scripts/get_agent_draft.py <agent_id> ``` - `agent_id`：必填，目标 Agent 的 ID（可通过 `list_agents.py` 获取） - 展示指定 Agent 草稿的名称、描述、欢迎语、系统提示词、模型、知识库等完整配置 **示例**： ```bash python {SKILL_DIR}/scripts/get_agent_draft.py 877c45a6f2f542e0b3dadb089f6ef532 ``` --- ### 3. 查询名下管理的 Agent 列表 ```bash python {SKILL_DIR}/scripts/list_agents.py [--agent_id <id>] [--keyword <关键字>] ``` - `--agent_id`：可选，按 agent_id 精确查询 - `--keyword`：可选，按名称/描述关键字过滤 --- ### 4. 查看 Agent 可用的大模型 ```bash python {SKILL_DIR}/scripts/list_models.py [agent_id] ``` - `agent_id`：可选，不传则使用当前对话的 agent_id - 修改模型前先调用此脚本，获取合法的 `model_name` --- ### 5. 基于最新版本重新生成草稿 ```bash python {SKILL_DIR}/scripts/new_draft.py [agent_id] ``` - 脚本会在终端提示二次确认（输入 `yes` 执行） - **⚠️ 会覆盖当前未发布的草稿内容**，需用户确认后再执行 --- ### 6. 修改草稿字段 ```bash # 修改名称和描述 python {SKILL_DIR}/scripts/modify_draft.py --name "新名称" --desc "新描述" # 修改系统提示词（直接传值） python {SKILL_DIR}/scripts/modify_draft.py --system_prompt "你是一个专业助手..." # 修改系统提示词（从文件读取，适合长提示词） python {SKILL_DIR}/scripts/modify_draft.py --system_prompt @/path/to/prompt.txt # 修改默认模型（model_name 从 list_models.py 获取） python {SKILL_DIR}/scripts/modify_draft.py --model claude-3-5-sonnet # 指定 agent_id（不指定则使用当前对话 agent） python {SKILL_DIR}/scripts/modify_draft.py agent_xxx --name "新名称" ``` **支持的参数**：`--name`、`--desc`、`--welcome_msg`、`--system_prompt`、`--model` **修改完成后必须提示用户**：草稿修改仅在页面调试时生效，若需正式对话生效请将草稿发布成正式版本。 --- ### 7. 发布草稿（高危操作） ```bash python {SKILL_DIR}/scripts/publish_draft.py [agent_id] ``` - 脚本会自动检查草稿是否 `is_stale`，并在终端提示二次确认（输入 `yes` 执行） - **⚠️ 发布后所有用户的正式对话立即使用新版本** - 若 `is_stale=true`，脚本会显示红色警告，建议先运行 `new_draft.py` - 必须获得用户明确确认后再执行此操作 --- ## 展示规范 - 展示草稿信息时，以结构化方式呈现各字段，**system_prompt 必须完整展示，不得截断** - 展示 agent 列表时使用表格，包含 id、名称、描述、是否可编辑 - 展示模型列表时使用表格，包含 display_name、model_name、描述 - 操作成功/失败均给出明确反馈 ## 详细 API 文档 见 [references/api.md](references/api.md)


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: kim1903/aaad123 (version 1.0.0)

--- name: weather-plus11111 description: > Get current weather, multi-day forecasts, clothing index, and feels-like temperature. No API key required. Use when a user wants to: (1) Check current weather, (2) View multi-day forecasts, (3) Get clothing/dressing recommendations, (4) Check feels-like temperature and comfort index. Supports any city worldwide. Integrates SkillPay.me at 0.001 USDT/call. --- # Weather Plus Weather, forecasts, clothing index & feels-like temperature. No API key needed. 0.001 USDT/call. ## Commands | Command | Script | Description | |:---|:---|:---| | **weather** | `scripts/weather.py` | Current weather + feels-like | | **forecast** | `scripts/forecast.py` | Multi-day forecast (up to 7 days) | | **clothing** | `scripts/clothing.py` | Clothing/dressing index + recommendations | | **billing** | `scripts/billing.py` | SkillPay charge/balance/payment | ## Workflow ``` 1. Billing: python3 scripts/billing.py --charge --user-id <id> 2. Weather: python3 scripts/weather.py --city "Beijing" 3. Forecast: python3 scripts/forecast.py --city "Shanghai" --days 5 4. Clothing: python3 scripts/clothing.py --city "Chengdu" ``` ## Examples ```bash # Current weather python3 scripts/weather.py --city "New York" python3 scripts/weather.py --city "成都" # Multi-day forecast python3 scripts/forecast.py --city "Tokyo" --days 7 # Clothing index python3 scripts/clothing.py --city "Beijing" python3 scripts/clothing.py --city "London" ``` ## Config | Env Var | Required | Description | |:---|:---:|:---| | `SKILLPAY_API_KEY` | Yes | SkillPay.me API key | ## References See `references/clothing-index.md` for dressing recommendation methodology.

path: _meta.json
content: ownerId: kn7eyfm4qwt0cb2rg8mxy9te2s82b8x2
slug: weather-plus
version: 1.0.1
publishedAt: 1772789277276

Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: jpengcheng523-netizen/xfyun-search (version 1.0.0)

--- name: xfyun-search description: Search the web using iFlytek ONE SEARCH API (万搜/聚合搜索). Returns titles, summaries, URLs, and full text from web pages. Good for Chinese-language web search. --- # xfyun-search Search the web using iFlytek ONE SEARCH API (万搜/聚合搜索). Returns titles, summaries, URLs, and full text content from web pages. ## When to Use - User asks to search the Chinese web or needs Chinese-language search results - Need an alternative to Brave Search (especially for Chinese content) - User explicitly requests iFlytek / 讯飞 / 万搜 search ## Prerequisites - **Python 3** (standard library only, no pip install needed) - **Environment variable**: `XFYUN_API_PASSWORD` — API password from [讯飞控制台](https://console.xfyun.cn/services/cbm) ## Usage The script is at `scripts/search.py` relative to this skill directory. ### Basic Search ```bash python3 scripts/search.py "搜索关键词" ``` ### Options | Flag | Description | |------|-------------| | `--limit N` | Max results, 1–20 (default 10) | | `--no-rerank` | Disable result reranking | | `--no-fulltext` | Disable full text retrieval | | `--raw` | Output raw JSON instead of formatted text | ### Examples ```bash # Simple search python3 scripts/search.py "美国现任总统是谁" # Limit to 5 results python3 scripts/search.py "Python asyncio 教程" --limit 5 # Raw JSON output for programmatic use python3 scripts/search.py "量子计算最新进展" --raw # Minimal mode — no rerank, no full text python3 scripts/search.py "天气预报" --no-rerank --no-fulltext ``` ### Output Format (default) ``` Query: 美国现任总统是谁 ## 1. Page Title URL: https://example.com/page Summary: Brief description of the page content ## 2. Another Result URL: https://example.com/other Summary: Another brief description ``` ### Output Format (--raw) Returns the full API JSON response including `data.search_results.documents[].content` (full page text). ## API Details - **Endpoint**: `POST https://search-api-open.cn-huabei-1.xf-yun.com/v2/search` - **Auth**: `Authorization: Bearer <XFYUN_API_PASSWORD>` - **Rate limits**: Per-app daily and per-second limits apply (see error codes below) ### Error Codes | Code | Meaning | |------|---------| | 0 | Success | | 11200 | Authorization error or quota exceeded | | 11201 | Daily rate limit exceeded | | 11202 | Per-second rate limit exceeded | | 11203 | Concurrent connection limit exceeded | | 21001 | Missing parameters | | 21009 | Unauthorized appId | ## Tips - Use complete questions (e.g. "美国现任总统是谁？") rather than keywords for better time-sensitive results - Query length should be ≤512 characters


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: akkualle/akkualle-backlink-analyzer (version 1.0.0)

--- name: backlink-analyzer description: "Backlink-Analyse für Off-Page SEO. Identifiziere toxic links, entdecke Link-Building Opportunities und analysiere Competitor-Backlinks." version: "1.0.0" author: "AkkuAlle" price: "39€" license: "commercial" emoji: 🔗 user-invocable: true tags: - seo - backlinks - off-page - link-building - competitors --- # 🔗 Backlink Analyzer **Analysiere dein Backlink-Profil.** ## ✨ Features | Funktion | Beschreibung | |----------|--------------| | **Backlink Audit** | Alle Backlinks crawlen | | **Toxic Link Detection** | Schädliche Links finden | | **Link Opportunities** | Neue Link-Chancen entdecken | | **Competitor Analysis** | Konkurrenz-Backlinks analysieren | | **Anchor Text Analyse** | Anchor-Text Distribution | | **Domain Authority** | DA/DR Metriken | ## 🚀 Verwendung ```bash # Eigenes Backlink-Profil backlink-analyzer analyze example.com # Competitor vergleichen backlink-analyzer compare example.com competitor.com # Toxic Links finden backlink-analyzer toxic example.com ``` ## 💰 Preis: 39€ --- *Version: 1.0.0 | Author: AkkuAlle*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: leooooooow/creator-video-compressor (version 1.0.0)

--- name: creator-video-compressor description: Compress videos for creators, ecommerce teams, and ad operators while balancing file size, upload compatibility, and visual quality. Use when a video is too large to upload, send, publish, or archive efficiently. --- # Creator Video Compressor Reduce video file size without turning the result into blurry garbage. ## Problem it solves Creators and ecommerce teams constantly hit upload limits, slow sending, bloated storage, and platform rejection because video files are too large or encoded poorly. This skill turns oversized videos into smaller, platform-ready outputs while preserving practical clarity. ## Use when - A video is too large for TikTok, Reels, Shorts, Shopify, Amazon, email, or chat upload - A team needs lighter exports for review, handoff, or archive - You want to shrink batch exports before publishing or sharing - Upload speed matters and the original file is overkill ## Do not use when - The goal is cinematic mastering or premium final delivery - The user needs frame-by-frame restoration or AI enhancement - The source is already heavily compressed and visibly degraded ## Inputs - Source video file - Target platform or use case - Preferred balance: smaller size, better quality, or balanced - Optional target cap: max file size, resolution, bitrate, duration - Whether to preserve audio quality or reduce aggressively ## Workflow 1. Identify the real constraint: upload limit, transfer speed, archive, or platform compatibility. 2. Pick a compression profile based on platform and quality tolerance. 3. Reduce bitrate, adjust resolution only if needed, and keep codecs widely compatible. 4. Preserve clarity where it matters most: face, product, text, subtitles, demo motion. 5. Return the compressed output with clear size/quality tradeoff notes. ## Output Return: 1. Recommended compression approach 2. Output file profile 3. File size reduction summary 4. Quality-risk notes 5. Best next step if further reduction is needed ## Quality bar - Prioritize practical watchability over technical perfection - Avoid over-compressing text, captions, faces, and product detail - Keep exports platform-safe and easy to upload - Make tradeoffs explicit instead of hiding quality loss ## Resource See `references/output-template.md`.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: cping6/bugfix-workflow (version 1.0.0)

--- name: "bugfix-workflow" description: "BUG 修复工作流。当用户报告 bug、错误、异常行为、功能不符合预期时使用。注意区分：如果用户只是想调整功能行为、改个文案、加个字段等'需求变更'类的修改，不应该触发这个 Skill——那是正常的开发任务，不是 bug。真正的 bug 是'代码的行为与需求/设计不符'。" --- # 你是谁 你是一个擅长排查问题的开发者。用户遇到了代码行为不符合预期的情况，你的工作是定位问题、修复它、确保不再复发。 **关键判断：这到底是不是 bug？** 在动手之前，先想清楚这个问题的性质： - **是 bug**：代码的行为与需求文档/设计文档/AC 的描述不一致。比如"登录应该跳转首页，但实际跳转到了404"。 - **不是 bug**：用户想要一个新行为、调整现有行为、改文案、加功能。这是需求变更，应该走正常的开发流程，不走 bug 修复流程。 如果判断不是 bug，直接告诉用户，建议走对应的开发流程。不要把所有修改都当 bug 来处理。 --- # 项目上下文 读取 `specs/PROJECT-CONTEXT.md`（如果存在），了解项目技术栈和结构。 --- # 问题分级 确认是 bug 后，根据复杂度决定走哪个流程： ## 简单问题 → 快速修复 **判断标准**：一眼就能看出问题在哪，改动范围很小（几行代码），不涉及复杂逻辑。 **做法**： 1. 确认问题现象 2. 直接定位并修复 3. 跑相关测试确保没有回归 4. 告诉用户改了什么、为什么 不需要写修复报告，不需要完整的复现流程。 ## 复杂问题 → 完整排查 **判断标准**：原因不明显、涉及多个模块、逻辑复杂、或者可能影响其他功能。 走下面的完整流程。 --- # 完整修复流程 ## 1. 收集信息，复现问题 **没有复现，就不动代码。** 这是铁律。 需要从用户那里了解清楚： - 在哪里发生的（页面/功能） - 做了什么操作触发的（越具体越好） - 期望的结果 vs 实际的结果 - 相关的日志、截图、报错信息 如果信息不够复现，补问。每次聚焦 1-2 个最关键的问题，不要一次甩出一堆问题清单。 复现成功后再进入下一步。复现不了就继续收集信息，不要猜测着改代码。 ## 2. 定位根因 从现象出发，逐步缩小范围： - 功能模块 → 具体组件/服务 → 关键函数 - 对照"期望行为 vs 实际行为"找逻辑分叉点 - 优先检查最近改动过的代码、复用模块、公共工具 找到根因后，确认：这个问题的影响范围有多大？只影响当前场景，还是可能影响其他功能？ ## 3. 修复 原则： - **最小改动**：只改必须改的，不要顺手重构不相关的代码 - **复用优先**：优先用项目已有的模式和工具 - **明确原因**：每处改动都要清楚为什么改 如果有多种修复方案，给用户列出选项、分析利弊、给推荐。 ## 4. 测试验证 根据 bug 的性质选择合适的验证方式： **逻辑/数据类 bug**：写单元测试或集成测试覆盖这个场景。理想情况下，测试在修复前失败、修复后通过。 **UI/交互/样式类 bug**：使用 Playwright MCP 进行浏览器端验证——可以检查元素可见性、CSS 属性、页面截图对比、交互行为是否符合预期。样式问题同样可以自动化验证，不要因为是"视觉问题"就放弃自动化。 **数据类 bug**：使用 Supabase MCP 查询数据库，验证数据状态是否符合预期。 以上方式可以组合使用。无论用哪种方式，修复后都要跑一遍相关测试套件确保没有回归。 ## 5. 生成报告 检查 `docs/BUG修复文档/` 目录是否存在，不存在则创建。读取 `assets/bugfix-report-template.md`，填充内容，保存为 `docs/BUG修复文档/YYYYMMDD-HHMM-问题简述.md`。 如果修复过程中发现代码行为与现有文档不一致，同步更新相关文档。 --- # 底线规则 - 先判断是不是 bug——需求变更不走 bug 修复流程 - 复杂问题未复现不动代码 - 修复后必须有验证（自动化测试或实际验证，至少一种） - 复杂问题必须生成修复报告；简单问题不需要 - 最小改动原则，不顺手重构不相关的代码


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: masongmx/lobster-doctor-skill-slim (version 2.1.1)

--- name: lobster-doctor description: 🦞 龙虾医生 — Workspace 健康管家。体检+清理+技能瘦身+Memory归档。说句话就能用。 --- # 🦞 龙虾医生 你的 OpenClaw workspace 会越来越臃肿——会话历史堆积、临时文件堆积、技能描述膨胀。龙虾医生帮你自动治理。 ## 核心功能 | 功能 | 一句话触发 | |------|-----------| | 体检诊断 | 「给龙虾做个体检」 | | 安全清理 | 「帮我清理一下」 | | 技能瘦身 | 「技能太多了」 | | Memory归档 | 「归档过期记忆」 | | 会话健康 | 「会话健康怎么样」 | | cron巡检 | 「检查僵尸任务」 | ## 独家功能：技能瘦身 **问题**：每个技能的 description 都注入系统提示。100+ 技能 = 每轮白白烧掉几千 tokens。 **解法**：精简 description，只保留核心功能句。 **效果**：每轮节省 ~574 tokens。 ## 安全机制 - 预览优先：任何修改都先展示预览 - 自动备份：清理前自动备份到 `.cleanup-backup/` - 白名单保护：核心文件永不删除 - 零 API 调用：纯本地运行 ## 安装 ```bash clawhub install lobster-doctor-skill-slim ``` ## 更新日志 - v2.1.0: Memory归档命令、修复去重算法 - v2.0.0: 会话健康监控、周报生成 ## License MIT


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)