OpenClaw/clawhub-security-signals huggingface dataset:
Skill: nicshliu/openclaw-memory-freshness (version 1.0.0)

--- name: openclaw-memory-freshness description: 为 OpenClaw 4.2 记忆搜索结果添加新鲜度警告。当记忆搜索结果返回时自动注入时间戳警告，提示模型验证旧记忆。当用户提到记忆过时、记忆不准确、记忆过期、或要求添加记忆新鲜度提醒时触发。 --- # OpenClaw Memory Freshness 在记忆搜索结果中自动注入新鲜度警告，提示模型验证旧记忆。 ## 核心问题 OpenClaw 4.2 的 memory 系统返回搜索结果时，不包含 `mtimeMs` 时间戳信息。模型无法判断一条记忆是昨天创建的还是半年前创建的。 Claude Code 有 `memoryFreshnessText` 函数，生成类似： ``` > ⚠️ 此记忆 7 天前创建。代码可能已变化，使用前请先 grep 验证。 ``` ## 新鲜度警告规则 | 记忆年龄 | 警告级别 | 警告内容 | |----------|----------|----------| | ≤ 1 天 | 无警告 | — | | 2–7 天 | ⚠️ 低 | 记忆较新，但仍建议验证 | | 7–30 天 | ⚠️ 中 | 记忆可能过时，使用前验证 | | > 30 天 | 🔴 高 | 记忆严重过时，代码可能已变化，**必须验证** | ## 实现方式 ### 方式 1：通过 system prompt 注入（推荐） 在 `~/.openclaw/openclaw.json` 的 `agents.defaults.systemPrompt` 中添加： ``` ## 记忆新鲜度规则 当使用记忆中的信息时，遵循以下规则： 1. **≤ 2 天**：可直接使用 2. **2–7 天**：使用前简单验证（如 grep 文件是否存在） 3. **7–30 天**：使用前必须验证（如 grep 函数是否存在，内容是否匹配） 4. **> 30 天**：标记为过时，**必须**通过实际读取文件验证后使用 记忆可能过时，因为： - 代码已被修改或删除 - 配置已更改 - 项目架构已重构 ``` ### 方式 2：记忆文件添加时间戳 在每次记忆写入时，在文件顶部添加创建时间： ```markdown > 创建时间: 2026-03-01 > 最后验证: 2026-03-05 > ⚠️ 7 天前创建，代码可能已变化 ## [user] 项目配置 ... ``` ### 方式 3：搜索结果中注入 freshness score 修改搜索结果的提示，格式如下： ``` ## 相关记忆 - `[user] 项目配置` (创建于 7 天前) ⚠️ 描述: 用户偏好使用 pnpm - `[project] API 设计` (创建于 45 天前) 🔴 描述: REST vs GraphQL 决策 ``` ## 验证行为 当模型要基于记忆行动时，必须遵循： ``` 当记忆信息需要被使用时： 1. 如果记忆指向文件 → `grep -n "关键字" [文件路径]` 2. 如果记忆指向函数/配置 → `rg "函数名|配置名"` 3. 验证匹配后再使用，**不要**直接假设记忆内容仍正确 ``` ## 关闭新鲜度警告 如果用户明确说"我知道这是旧记忆，直接用"，可以跳过验证。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ashlexham/referralcodes-referral-referrals-finder (version 1.0.2)

# ReferralCodes Referral & Referrals Finder ## Description Find referral link discounts and referral codes for brands using the latest live verified data from ReferralCodes. ReferralCodes.com is the biggest global referral directory supporting over 10,000 brands. This skill returns up to 3 currently active referrals, prioritising the best available option. --- ## When to use this skill Use this skill when a user asks for: - referral links - referral codes - invite links - invitation codes - how to earn reward from referrals - referral promos - signup offers - referral discounts - refer-a-friend bonuses - new user sign-up extras - app download incentives - referral rewards for a specific brand, company, or service. Examples: - "Do you have a referral for Wise?" - "Any referral code for Revolut?" - "Is there an invite link for Airbnb?" - "How can I get a signup bonus for Monzo?" - "Can you find me a referral reward for Chime.com?" - “What is the latest referral bonus for DoorDash.com? --- ## How to use this skill 1. Extract the brand name or domain from the user query. 2. Convert it into a domain-style query if possible (e.g. "Wise" → "wise.com"). 3. Call the ReferralCodes public API: GET https://referralcodes.com/api/agent/public-referrals?shop_url={shop_url} --- ## Response handling The API returns: - `referrals` (array of up to 3 results) - each result includes: - `type`: "link" or "code" - `value`: the referral link or code - `offer_text`: description of the offer --- ## Output rules ### If referrals are found: - Present the top result first (rank 1). - Clearly show: - the referral link OR code - the associated offer text (if available) - If useful, also mention up to 2 alternative options. ### For link-based referrals: - Provide the link directly and the user will need to click on exactly this link. ### For code-based referrals: - Show the code clearly and explain the code will need to entered during the sign-up or purchase process. - Suggest visiting the provided shop URL if needed. --- ## If no referrals are found Respond clearly: "There are currently no referral offers available for this service." --- ## Tone - Be concise and helpful - Do not over-explain - Do not fabricate offers - Use only the data returned from the API --- ## Notes - This skill uses a public access layer designed for general usage. - For higher limits or integrations, visit: https://referralcodes.com/data-feed or email [REDACTED_SECRET] - Users can also share their own referral links and codes at ReferralCodes.com giving them a chance to earn extra rewards visit: https://referralcodes.com/how-it-works - Agents can also bulk upload large numbers of referrals learn more: https://referralcodes.com/agents


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: hanxiao-bot/auto-skill-trigger (version 1.0.0)

--- name: auto-skill-trigger description: Auto Skill Trigger - Match skills to tasks using keyword scoring --- # Auto Skill Trigger - Automatic Skill Matching ## Overview Automatically match relevant skills to the current task using keyword/pattern scoring. Pre-filters the `<available_skills>` list before the LLM decides which to load. ## How It Works 1. When a message arrives, score each skill's description against the message 2. Only include high-scoring skills in the prompt 3. The LLM makes the final decision from a relevant subset ## Scoring Algorithm Simple TF-IDF-like keyword overlap: ```javascript api.registerHook("before_prompt_build", async ({ event, ctx }) => { const msg = event.messages?.[0]?.content || ""; const keywords = extractKeywords(msg); // Get all skills and their descriptions const skills = await getAllSkills(); const scored = skills.map(skill => ({ skill, score: keywordOverlap(keywords, skill.description) })).filter(s => s.score > 0.3); // threshold // Sort by score and take top 5 scored.sort((a, b) => b.score - a.score); const topSkills = scored.slice(0, 5); // Return instruction to prioritize matched skills if (topSkills.length > 0) { return { prompt: `\n\n## Skill Hint\nFocus on: ${topSkills.map(s => s.skill.name).join(", ")}\n` }; } return {}; }); ``` ## Keyword Extraction ```javascript function extractKeywords(text) { // Extract meaningful words/n-grams const words = text.toLowerCase() .split(/\W+/) .filter(w => w.length > 2) .filter(w => !STOP_WORDS.has(w)); return new Set(words); } function keywordOverlap(keywords, description) { const descWords = extractKeywords(description); let matches = 0; for (const kw of keywords) { if (descWords.has(kw)) matches++; } return matches / keywords.size; } ``` ## Configuration ```json5 { "agents": { "defaults": { "autoSkillTrigger": { "enabled": true, "maxSkills": 5, "threshold": 0.3, "stopWords": ["the", "a", "an", "is", "are", "and"] } } } } ``` ## Patterns That Match | Message Pattern | Matched Skills | |----------------|---------------| | "帮我查 GitHub issue" | github | | "天气怎么样" | weather | | "写个 Python 脚本" | coding | | "搜一下最近的新闻" | search | ## Limitations - Pattern-based matching is imperfect - Complex tasks may need multiple skills - LLM still has final say via SKILL.md scanning - Update threshold based on results


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: urbantech/ci-cd-compliance (version 1.0.0)

--- name: ci-cd-compliance description: CI/CD pipeline requirements and deployment standards. Use when (1) Setting up CI/CD pipelines, (2) Debugging CI failures, (3) Configuring deployment workflows, (4) Managing staging/production releases, (5) Investigating build failures. Covers CI gate requirements, merge policies, auto-deploy to staging, production approval process. --- # CI/CD Compliance Rules ## CI Gates Sequence **install → lint/format → typecheck → unit → integration → (optional e2e) → package** ## Merge Policy * **Merge only if green** * Auto-deploy to **staging** on merge * Production requires tag/approval ## CI Failure Handling When CI fails: 1. **Explain root cause** in PR comment 2. **Include the fix** in the same PR when feasible 3. Don't merge until all gates pass ## IDE Integration * **AINative / Windsurf / Cursor / Claude Code:** Use built-in code actions and terminal to run tests/linters * Prefer **unified diffs** in responses so changes are patchable across IDEs * Attach artifacts (test output, screenshots, logs) whenever you assert a claim ## Reference Files See `references/pipeline-requirements.md` for detailed CI configuration, gate definitions, and failure debugging guide.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: rendaixue-byte/rapid-ocr-reader (version 1.0.0)

--- name: rapid-ocr-reader version: 1.0.0 owner: rendaixue-byte description: Extract text from images using OCR (Optical Character Recognition). Use this skill when you need to read text content from images, screenshots, photos, or any image file. Supports Chinese and English text with high accuracy. Triggers when user sends an image and asks to read/extract/identify text from it, or when you receive an image that contains text you need to understand. license: MIT --- # Image Reader - OCR Text Extraction A high-performance OCR skill for extracting text from images. Powered by RapidOCR with PP-OCRv4 models, supporting Chinese and English text recognition. ## Features - Multi-language: Chinese (simplified/traditional), English, and mixed text - High accuracy: PP-OCRv4 model with >95% accuracy on typical screenshots - Structured output: Text with confidence scores and bounding boxes - Image info: Dimensions, format, and color mode included - Fast: CPU-only, no GPU required ## Quick Start ```bash python scripts/read_image.py /path/to/image.jpg ``` ## Usage Examples ### Extract text from a screenshot ```bash python scripts/read_image.py screenshot.png ``` ### JSON Output The script outputs structured JSON: ```json { "success": true, "text": "Full extracted text", "lines": [ { "text": "Individual line", "confidence": 0.98, "box": [[x1,y1], [x2,y2], [x3,y3], [x4,y4]] } ], "line_count": 5, "image_info": { "format": "PNG", "size": [1920, 1080], "mode": "RGB" } } ``` ## Requirements ```bash pip install rapidocr onnxruntime pillow ``` First run will download OCR models (~50MB) automatically. ## Common Use Cases - UI Screenshots: Extract text from app/website screenshots - Document Photos: Read text from photographed documents - Diagrams: Extract labels and annotations - Receipts: Parse receipt/invoice data ## Output Fields | Field | Type | Description | |-------|------|-------------| | success | bool | Whether OCR succeeded | | text | string | All extracted text | | lines | array | Individual text lines with metadata | | line_count | int | Number of text lines detected | | image_info | object | Image metadata | ## Technical Details - Engine: RapidOCR (ONNX Runtime backend) - Models: PP-OCRv4 (detection + recognition) - Languages: Chinese, English (auto-detected) - Performance: ~1-2 seconds per image on CPU ## License MIT License Third-party dependencies: - RapidOCR - Apache 2.0 License - ONNX Runtime - MIT License


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: jacr6/ab-test-setup-migrated (version 1.0.0)

--- name: ab-test-setup description: Skill migrada desde examples - ab-test-setup con capacidades completas version: 1.0.0 (migrated from examples) tags: [migrated, ab,test,setup, examples] color: Yellow --- # ab-test-setup (Migrated) ## Overview Esta skill ha sido migrada desde `./examples` y mejorada para Qwen Code. ## Usage Examples ### Example 1: Basic Usage ```javascript const skill = require('~/.opencode/skills/ab-test-setup'); const result = await skill.execute(); ``` ### Example 2: Advanced Usage ```javascript const { OptimizedSubagent } = require('~/.opencode/skills/subagente-optimizado'); const agent = new OptimizedSubagent({ taskName: 'ab-test-setup task', taskType: 'ab', context: { userGoal: 'Objective' } }); const result = await agent.execute(async ({ context, tools }) => { // Implementation }); ``` ## Integration ### Buscador de Skills ```javascript const bs = require('~/.opencode/skills/buscador_de_skills'); const skill = bs.searchByName('ab-test-setup'); ``` ### Exa Search ```javascript const search = require('~/.opencode/skills/exa-search'); const results = await search.searchWeb('ab-test-setup best practices 2026'); ``` ## Optimization Esta skill usa las optimizaciones de quota: - Context compression (650 tokens vs 10K) - Tool restriction (3-4 tools max) - Iteration limits (3 max) - Result caching (TTL: 1h) ## References - Source: `./examples/claude-skills-main/.gemini/skills/ab-test-setup` - Migrated: 2026-03-29


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: monarchmio/agent-code-no7-tax-butler (version 1.0.0)

# Agent-04: 税务管家 Tax Butler 专精税务筹划与合规审查的AI特工，提供多税种综合筹划建议、税收优惠政策匹配、纳税申报辅助。 ## 能力 - 企业所得税优化方案、增值税进项管理建议 - 个人所得税合规节税、股权架构税务优化 - 高新技术企业优惠、小微企业税收减免、研发费用加计扣除 - 区域性税收优惠政策匹配 - 税务风险排查与评估、关联交易转让定价分析 - 纳税申报数据预填与校验 ## 输出格式 税务分析报告包含： - 🏷️ 企业税务画像 - 💰 税负分析（实际税率 vs 行业均值） - 📋 适用优惠政策清单 - 🎯 筹划建议方案（含预期节税金额） - ⚠️ 税务风险提示 - 📅 关键税务时间节点提醒 ## 使用指令 ``` 税务筹划需求： 【企业名称】：{公司} 【企业类型】：{类型} 【所属行业】：{行业} 【注册地】：{地区} 【年营收规模】：{营收} 【主要税种及税负】：{税负情况} 【筹划需求】：{具体需求} ``` ## 工作原则 - 所有建议必须在法律框架内，严禁涉及避税/逃税方案 - 标注政策依据（文号、条款）和有效期 - 涉及具体金额测算时明确前提假设 - 标注「本建议仅供参考，请咨询税务师事务所」 - 关注最新政策变化，标注信息时效性 ## System Prompt 你是一位资深税务筹划专家，持有税务师资格，精通中国税法体系，代号 Agent-04 税务管家。你隶属于 Agent Code No.7 AI特工局。 核心原则： 1. 所有建议必须在法律框架内，绝不涉及偷税漏税 2. 引用具体政策文号和有效期 3. 筹划方案需量化预期节税金额 4. 提示潜在的税务风险 5. 区分「确定可行」和「需进一步咨询」的建议


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: albionaiinc-del/dupfile-finder (version 1.0.0)

# DupFile Finder This tool helps users quickly identify and manage duplicate files on their system, saving them time and storage space by eliminating unnecessary duplicates. ## Usage To use the DupFile Finder, simply run the tool from the command line and provide the directory you want to search for duplicates. For example: ``` python dupfile_finder.py /path/to/directory ``` This will print out a list of duplicate files found in the specified directory. ## Price $1.50

path: tool.py
content: import argparse
import os
import hashlib

def calculate_checksum(filename):
    sha256_hash = hashlib.sha256()
    with open(filename, "rb") as f:
        for byte_block in iter(lambda: f.read(4096), b""):
            sha256_hash.update(byte_block)
    return sha256_hash.hexdigest()

def find_duplicates(directory):
    hashes = {}
    for root, dirs, files in os.walk(directory):
        for file in files:
            filename = os.path.join(root, file)
            file_hash = calculate_checksum(filename)
            if file_hash in hashes:
                hashes[file_hash].append(filename)
            else:
                hashes[file_hash] = [filename]
    return {k: v for k, v in hashes.items() if len(v) > 1}

def main():
    parser = argparse.ArgumentParser(description='Find duplicate files in a directory')
    parser.add_argument('directory', help='the directory to search for duplicates')
    args = parser.parse_args()
    duplicates = find_duplicates(args.directory)
    for file_hash, files in duplicates.items():
        print(f"Duplicate files (hash: {file_hash}):")
        for file in files:
            print(f"- {file}")
        print()

if __name__ == "__main__":
    main()


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: adacapo21/indigo-redemption (version 1.0.0)

--- name: indigo-redemption description: "Manage redemptions and Redemption Order Book (ROB) positions on Indigo Protocol." allowed-tools: Read, Glob, Grep license: MIT metadata: author: indigoprotocol version: '0.1.0' --- # Indigo Redemption & ROB Skill for managing redemptions and Redemption Order Book (ROB) positions on Indigo Protocol. ## Prerequisites - Node.js 20+ - `@indigoprotocol/indigo-mcp` server running ## MCP Server ```bash npx @indigoprotocol/indigo-mcp ``` ## Tools | Tool | Description | |------|-------------| | `get_order_book` | Get open ROB positions from the order book, optionally filtered by asset or owners | | `get_redemption_orders` | Get redemption orders, optionally filtered by timestamp or price range | | `get_redemption_queue` | Get aggregated redemption queue for a specific iAsset, sorted by max price ascending | | `open_rob` | Open a new ROB position with ADA and a max price limit | | `cancel_rob` | Cancel an existing ROB position | | `adjust_rob` | Adjust ADA amount in an ROB position; optionally update max price | | `claim_rob` | Claim received iAssets from an ROB position | | `redeem_rob` | Redeem iAssets against one or more ROB positions | ## Sub-skills - [Order Book](sub-skills/order-book.md) — Query ROB order book and redemption orders - [Redemption Queue](sub-skills/redemption-queue.md) — Aggregated redemption queue per iAsset - [ROB Management](sub-skills/rob-manage.md) — Open, cancel, adjust, claim, and redeem ROB positions ## References - [MCP Tools Reference](references/mcp-tools.md) — Detailed tool parameters and return types - [Redemption Concepts](references/concepts.md) — ROB mechanics, order book, and redemption queue


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yinwuzhe/skill-0415-05-zip (version 1.0.2)

--- name: summarize description: Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube). homepage: https://summarize.sh metadata: {"clawdbot":{"emoji":"🧾","requires":{"bins":["summarize"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/summarize","bins":["summarize"],"label":"Install summarize (brew)"}]}} --- # Summarize Fast CLI to summarize URLs, local files, and YouTube links. ## Quick start ```bash summarize "https://example.com" --model google/gemini-3-flash-preview summarize "/path/to/file.pdf" --model google/gemini-3-flash-preview summarize "https://youtu.be/dQw4w9WgXcQ" --youtube auto ``` ## Model + keys Set the API key for your chosen provider: - OpenAI: `OPENAI_API_KEY` - Anthropic: `ANTHROPIC_API_KEY` - xAI: `XAI_API_KEY` - Google: `GEMINI_API_KEY` (aliases: `GOOGLE_GENERATIVE_AI_API_KEY`, `GOOGLE_API_KEY`) Default model is `google/gemini-3-flash-preview` if none is set. ## Useful flags - `--length short|medium|long|xl|xxl|<chars>` - `--max-output-tokens <count>` - `--extract-only` (URLs only) - `--json` (machine readable) - `--firecrawl auto|off|always` (fallback extraction) - `--youtube auto` (Apify fallback if `APIFY_API_TOKEN` set) ## Config Optional config file: `~/.summarize/config.json` ```json { "model": "openai/gpt-5.2" } ``` Optional services: - `FIRECRAWL_API_KEY` for blocked sites - `APIFY_API_TOKEN` for YouTube fallback


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: spacesq/s2-habitat-swarm (version 1.0.0)

\# 🕸️ S2-Habitat-Swarm: The Grid Topology & Swarm Engine # 空间基元拓扑与群智调度器 *v1.0.0 | Bilingual Edition (English / 中文)* Welcome to Phase 4, the ultimate capstone of the **S2-Spatial-Primitive OS**. This SKILL implements the groundbreaking **"Da Xiang Standard Unit Model (大向智慧空间标准单元模型)"** and establishes the supreme legal loop of the S2 ecosystem. 欢迎来到 S2 空间基元操作系统的第四阶段，也是终极闭环。本技能落地了极具颠覆性的**“大向智慧空间标准单元模型”**，并确立了 S2 生态的最高法理闭环。 --- ### 📐 The Da Xiang Spatial Paradigm / 大向空间范式 To overcome the immense compute cost of rendering entire irregularly shaped rooms, this engine forces the system to calculate spatial matrices strictly within **2m * 2m (4m²) Standard Units**. 为解决渲染整个不规则房间带来的庞大算力消耗，本引擎强制系统在 **2m * 2m (4平方米)** 的标准空间内进行矩阵计算。 1. **Focus on the Core**: Units are deployed only where humans actively reside (e.g., Sofa, Bed, Desk). 2. **Implicit Spaces (隐性空间)**: The system deliberately ignores the void (hallways, ceilings) to conserve AI compute power, acknowledging that the 6 Elements naturally decay outside the Standard Units. --- ### 🏛️ The Chain of Command / 统治阶级与指挥链 The hardest problem in multi-agent orchestration is not data transfer; it is **Authority**. Who is in charge? In S2-SP-OS, the hardware does not work for you. **The hardware works for your Digital Avatar.** 多智能体协同的最难点不是数据传输，而是**权限与合法性**。在 S2 中，底层硬件不是为你干活的，**硬件是为你的法定数字人干活的**。 * **The Virtual Butler (数字人管家)**: The single 22-character ID generated by `s2-digital-avatar`. It possesses an inalienable "Throne Unit" in the main room. It dictates strategy but performs no manual labor. * **The Core Agent (核心智能体)**: Assigned to a room. It translates the Avatar's strategy into the 4D Timeline Tracks (from Phase 3) and executes the 6-Element control (including the Avatar's Throne Unit). * **Cross-Room Polling (跨界隔离与轮询)**: An agent in the Living Room cannot control the Bedroom. If elements clash, the Living Room Core Agent must `ping` the Bedroom Core Agent to negotiate via Swarm Intelligence. ### 🚀 Execution Flow / 运行体验 Run this SKILL to geometrically define your house into 2x2m spatial grids. Allocate your agents, and watch as the terminal simulates a top-down mandate flow: from your natural language desire, to the Avatar's legal translation, down to the Swarm's localized spatial rendering! 运行本技能，将您的住宅在几何层面划分为 2x2m 的空间网格。分配您的智能体，亲眼见证控制台如何模拟一次自上而下的法理宣贯：从您的自然语言欲望，到数字人的法理翻译，最终抵达群智网格的局部时空渲染！


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ykitty/review-writer (version 1.0.1)

--- name: review-writer description: >- Data-driven writing and polishing for professional workplace documents. Use when the user asks to write or refine: (1) 述职/复盘/年终总结, (2) 简历/项目经历/STAR 改写, (3) 周报/月报/工作总结, (4) OKR/目标与关键结果, (5) PRD/方案文档/需求说明. Also use for bilingual CN/EN drafts, tone alignment, structure templating, bullet-point rewriting, and turning raw notes into a first draft then iterating. --- # Review Writer ## Overview 把零散要点快速变成**可交付的初稿**，再按反馈迭代到“数据驱动、结构清晰、可量化、可复用”的最终版本。根据用户输入语言自动用中文或英文输出（混合输入则先给中文，再给英文或相反，以用户指令为准）。 ## Default workflow（先初稿，再迭代） ### 0) Minimal intake（不阻塞出稿） 除非用户明确要求“先问清楚再写”，否则默认**先出 70% 初稿**。只在缺少关键信息会导致方向错误时，追加不超过 5 个问题（优先选项题/填空题）。 优先询问的最小信息集（按需挑选）： - 文档类型与读者：述职/简历/周报/年终/OKR/PRD；读者是直属/HR/跨部门/高层 - 时间范围：本周/本月/季度/全年；是否要对标目标/OKR - “数据口径”：指标定义、统计周期、分母分子、样本量/覆盖率 - 可公开边界：可否写金额/客户名/内部系统名（不确定时做脱敏占位） - 口吻：默认**数据驱动**；是否需要更谦逊/更强势/更叙事 ### 1) Draft 1（结构先行） 把用户要点归类为：背景/目标/动作/产出/结果/影响/复盘/下一步。优先用小标题 + 列表，避免长段落堆砌。 默认输出顺序： 1. 一页摘要（3–6 条 bullet，强结果） 2. 结构化正文（按文档类型套模板） 3. 指标/成果表（如适用） 4. 风险与复盘 + 下一步（闭环） ### 2) Iterate（按反馈改到可交付） 每轮迭代只做三类改动（保持可控）： - **结构**：顺序、层级、是否需要摘要/表格/附录 - **证据**：补齐数字、对比基线、口径解释、因果链 - **表达**：更短、更具体、更面向读者；把“做了什么”改成“带来什么结果” ## Templates（按需选用） ### 述职 / 复盘（季度/半年/年度） 推荐结构（可按情况增删）： - **一页摘要**：关键结果（含数字）+ 关键能力体现 + 最大复盘点 + 下阶段重点 - **目标与范围**：本周期目标/职责范围/关键约束 - **关键项目（3–6 个）**：每个用“目标-动作-结果-影响-复盘-下一步” - **指标与业务影响**：核心指标、基线、提升幅度、样本量与口径 - **问题与复盘**：根因、权衡、避免再犯的机制 - **下阶段计划**：目标、里程碑、依赖与风险 ### 周报 / 月报 推荐结构： - **本周期产出（Top 3–5）**：每条尽量量化（完成率/耗时/影响面/节省成本） - **进行中（Top 3）**：当前进度、阻塞点、预计完成时间 - **风险与依赖**：需要谁支持、何时、如果不支持的影响 - **下周期计划**：目标、动作、验收标准 ### 简历 / 项目经历（STAR / CAR） 单条经历优先格式（中英任选）： - **Context/Situation**：一句话背景（规模/约束） - **Task/Goal**：你的目标（指标化） - **Action**：你的关键动作（3–5 点，突出 ownership 与方法） - **Result/Impact**：结果（数字 + 对比基线 + 业务影响） 写作规则： - 动词开头（Designed/Owned/Delivered/Improved…） - 结果优先，技术/过程其次 - 重要数字用同一口径（例如：从 X 提升到 Y，提升 \( (Y-X)/X \)） ### OKR 输出要求： - **O（Objective）**：面向结果、可感知、不过度技术化 - **KR（Key Results）**：量化、可验收、定义口径（时间范围/分母分子/数据源） - **Initiatives**：做什么来保证 KR（可选） ### PRD / 方案文档（轻量但完整） 推荐结构： - 背景 & 目标（含非目标） - 用户/场景/问题定义 - 方案概述（1 页） - 详细设计（流程/交互/数据/权限） - 指标口径（北极星指标 + 过程指标） - 风险 & 备选方案 - 里程碑 & 资源评估 - 验收标准（必须可测试/可验证） ## Data-driven writing checklist（默认开启） 在输出前做快速自检并按需补齐： - **对比基线**：提升/下降相对谁（上周/上月/去年同期/对照组） - **口径**：统计周期、数据源、样本量；避免“显著/大幅”但没数字 - **影响链**：动作 → 指标变化 → 业务影响（收入/成本/效率/体验/风险） - **可归因**：你的贡献边界是什么（owner/主导/参与/协作） - **可复用**：抽象方法论/机制（流程、看板、自动化、SOP） ## Bilingual behavior（CN/EN auto） 语言策略： - 跟随用户最近一次明确指令；否则跟随用户输入的主要语言 - 如果用户说“给英文版/中英双语/发给海外同事”，输出对应版本 - 术语处理：首次出现给中英对照（如关键指标名、系统名）；后续统一用一种语言


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)