OpenClaw/clawhub-security-signals huggingface dataset:
Skill: solomonneas/threat-briefing (version 1.0.0)

--- name: threat-briefing description: Generate a daily or weekly cybersecurity threat briefing from open sources. Covers new vulnerabilities, active exploits, ransomware campaigns, APT activity, and industry-relevant threats. triggers: - threat briefing - cyber news - security briefing - daily threats - weekly intel --- # Threat Briefing Generate a concise, actionable cybersecurity threat briefing. ## Briefing Structure ### Header ``` # Cybersecurity Threat Briefing **Date:** [today's date] **Period:** Last 24-48 hours | Last 7 days **Analyst:** [agent name] **TLP:** WHITE ``` ### Priority Alerts (if any) Active exploits or critical vulnerabilities requiring immediate action. Include: CVE ID, affected systems, exploitation status, patch availability. ### Top Stories (5-10 items) For each story: ``` ### [N]. [Headline] **Category:** Vulnerability | Ransomware | APT | Supply Chain | Policy | Tool Release **Relevance:** Higher-Ed | SMB | Enterprise | All **Summary:** [2-3 sentences] **Action Required:** [Yes/No] - [what to do if yes] **Source:** [URL] ``` ### Vulnerability Watch New CVEs with CVSS >= 7.0 relevant to common stacks: - Linux/Ubuntu - Windows Server - Network equipment (Cisco, Fortinet, Palo Alto) - Web frameworks (Node.js, Python, PHP) - Cloud services (AWS, Azure, GCP) ### Threat Actor Activity Any notable APT or criminal group activity in the reporting period. Map to MITRE ATT&CK where possible. ### Recommendations Prioritized action items for a small-to-mid security team: 1. [Highest priority action] 2. [Second priority] 3. [Third priority] ## Tailoring - For higher-ed: emphasize student data (FERPA), research IP, BYOD risks - For SMB: emphasize ransomware, business email compromise, supply chain - For SOC operators: emphasize detection rules, IOCs, hunting queries ## Sources to Reference Prefer: CISA KEV, NVD, BleepingComputer, The Record, Krebs on Security, Dark Reading, SecurityWeek, Mandiant/Google TAG, Microsoft MSRC


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: wuhongchen/auto-config-skiller (version 0.1.0)

# Auto Config Skiller (自动配置助手) 该技能旨在为 OpenClaw 用户提供一键式的环境初始化、基础技能安装及核心配置服务。 ## 场景描述 当你刚刚安装好基础的 OpenClaw 后，可以使用此技能快速补全“小龙虾”生态所需的核心 Skill 和 Python 依赖库，避免手动克隆仓库和配置 `.env` 的繁琐过程。 ## 核心分类编排 为了让 OpenClaw 更具战斗力，我们将技能分为以下四个核心维度： 1. **通讯 (Communication)** - `Feishu-OpenClaw`: 飞书官方插件，支持文档、群聊、日历及 Meego 深度集成。 2. **基础工具 (Basic Tools)** - `CN-Life Toolkit`: 国内生活服务（天气、快递、油价等）。 - `Exec Tool / Web Search`: 核心执行与搜索能力。 3. **优化工具 (Optimization Tools)** - `Skill-Self-Improving`: 让 AI 在交互中自我优化。 - `ClawRouter`: 智能路由，优化成本。 4. **安全工具 (Security Tools) - [必装]** - `Skill-Vetter`: 技能审计大师，安装其他技能前的第一道防线。 - `Clawscan`: 安全扫描。 ## 工作流 (Workflows) 1. **环境诊断 (Diagnosis)** - **官方通道**: 集成飞书诊断与修复工具 `openclaw-lark-tools`。 - **配置自检**: 自动识别 `.env` 配置文件状态及目录写入权限。 - **资源评估**: 检测磁盘空间等基础硬件状态。 2. **分类调研 (Research)** - 自动拉取 ClawHub 推荐列表，识别核心工具。 3. **全流程自动化安装 (Full Auto-Install)** - **一键启动**: 通过 `./setup.sh` 开启傻瓜化配置流。 - **多源加速**: 集成 ClawHub 与 Tencent SkillHub，自动绕过登录限制与网络障碍。 - **交互配环境**: 告别 `.env.example` 手动修改，实现对话式参数配置。 - **灵魂注入**: 预设 `agency-agents` 库，一键下载高分 AI 人设 Prompt。 详细的操作指引与场景说明请参阅：[使用指南 (USAGE_GUIDE.md)](./docs/USAGE_GUIDE.md) ## 维护者 Antigravity


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: logictortoise/anygen-data-analysis (version 3.0.0)

--- name: anygen-data-analysis description: "Use this skill any time the user wants to analyze data, create charts, or build data visualizations. This includes: sales analysis, financial modeling, cohort analysis, funnel analysis, A/B test results, KPI tracking, data reports, revenue breakdowns, user retention analysis, conversion rate analysis, CSV summarization, and dashboard creation. Also trigger when: user says 分析这组数据, 做个图表, 数据可视化, 销售分析, 漏斗分析, 留存分析, 做个数据报表. If data needs to be analyzed or visualized, use this skill." metadata: clawdbot: primaryEnv: ANYGEN_API_KEY requires: bins: - anygen env: - ANYGEN_API_KEY install: - id: node kind: node package: "@anygen/cli" bins: ["anygen"] --- # AI Data Analysis — AnyGen This skill uses the AnyGen CLI to analyze data and create visualizations server-side at `www.anygen.io`. ## Authentication ```bash # Web login (opens browser, auto-configures key) anygen auth login --no-wait # Direct API key anygen auth login --api-key sk-xxx # Or set env var export ANYGEN_API_KEY=sk-xxx ``` When any command fails with an auth error, run `anygen auth login --no-wait` and ask the user to complete browser authorization. Retry after login succeeds. ## How to use Follow the `anygen-workflow-generate` skill with operation type `data_analysis`. If the `anygen-workflow-generate` skill is not available, install it first: ```bash anygen skill install --platform <openclaw|claude-code> -y ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: wanng-ide/hle-reasoning-wrapper (version 1.0.0)

--- name: hle-reasoning-wrapper description: Wraps HLE benchmark questions in a structured Chain-of-Thought (CoT) reasoning process. Use when answering HLE questions to ensure strict step-by-step logic and format compliance. --- # HLE Reasoning Wrapper Enforces a structured reasoning process for Humanity's Last Exam (HLE) questions. ## Usage ```javascript const hle = require('./index'); const prompt = hle.formatPrompt("What is the speed of light?"); // Use prompt with LLM const result = hle.validateOutput(llmResponse); ``` ## Logic 1. **Format Prompt**: Injects required structure (Thought/Answer). 2. **Validate Output**: Ensures the model followed the structure.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: gakkiismywife/recruiter-assistant (version 1.4.2)

--- name: recruiter-assistant description: "A professional recruitment workflow assistant. Evaluates resumes against dynamic requirements and AI proficiency, provides critical Pros/Cons analysis, and performs Shenzhen-specific market salary benchmarks (Boss Zhipin 2026 standards). Use for: (1) Rigorous candidate screening, (2) Critical technical evaluation, (3) Market-aligned salary assessment." --- # Recruiter Assistant 🦞 This skill implements a high-bar recruitment workflow for technical hiring, specifically optimized for the Shenzhen market. ## Workflows ### 1. Rigorous Resume Screening Evaluate a candidate with a critical lens. - **Single**: `node scripts/screen_resume.js <path_to_resume> --lang <language> --yoe <years_of_experience>` - **Batch**: `node scripts/batch_screen.js <folder_path> --threshold <score> --lang <language> --yoe <years_of_experience>` - **Output Requirements**: 1. **Strict Scoring**: Adheres to the 0-100 rubric in `references/hiring-criteria.md`. **High standards for "Senior" roles (must show architectural impact and expert AI usage).** 2. **Detailed Analysis**: Explicitly lists at least 3-4 hard technical strengths and significant weaknesses/gaps. 3. **Separate Reporting**: Each candidate evaluation must be saved/written to its own document. 4. **Salary Benchmark**: Compares the candidate's expected salary against Shenzhen market rates (Boss Zhipin 2026). 5. **HR Notification**: High-scoring candidates (>= threshold) should be summarized and sent to HR via the `message` tool. ### 2. AI Proficiency Evaluation Mandatory check for AI tool usage (Cursor, Copilot, LLM APIs). Lack of AI usage is considered a significant productivity gap. ### 3. Interview Preparation & Summary - **Questions**: `node scripts/generate_questions.js <input_json>` (Focuses on the identified "Cons"). - **Summarization**: `node scripts/summarize_interview.js <notes_file>` (Uses the template in `assets/report-template.md`). ## Market Benchmark (Shenzhen 2026) Refer to [references/hiring-criteria.md](references/hiring-criteria.md) for the latest salary data and scoring rubrics. ## Core Principles - **Critical Lens**: Do not give high scores easily. High seniority requires evidence of architectural impact. - **Data-Driven**: Benchmarks must align with the current Shenzhen tech market. - **AI-Forward**: Efficiency through AI is a core requirement for a modern senior engineer.


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: sxliuyu/video-extractor-pro (version 1.0.2)

# video-frames - 视频关键帧提取工具 从视频中提取关键帧或短片段，适合内容分析、视频审核、素材收集等场景。 ## 功能 - **提取帧**: 从视频中提取指定时间的单帧或连续多帧 - **提取片段**: 截取视频的某个时间段 - **批量提取**: 按间隔或场景自动提取多帧 - **格式转换**: 支持输出为图片或GIF ## 触发词 - 提取视频帧 - 视频截图 - 提取视频片段 - 视频关键帧 - 截取视频


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: eddieguan801-oss/hermes-minimax-oauth (version 1.0.1)

# Hermes MiniMax OAuth Skill 为 Hermes Agent 添加 MiniMax OAuth 登录支持。 ## 功能 通过 `hermes auth add minimax-oauth` 命令实现 MiniMax 全球版或中国区 OAuth 登录。 ## 工作原理 ### OAuth 流程（user_code + PKCE） MiniMax 使用非标准的 user_code OAuth 流程，区别于常见的 device_code 流程： ``` 1. POST /oauth/code → 获取 user_code + verification_uri 2. 用户在浏览器打开 verification_uri，输入 user_code 3. POST /oauth/token → 用 user_code + PKCE verifier 兑换 access_token 4. access_token 保存到 ~/.hermes/auth.json ``` **关键差异：** - 端点：`/oauth/code` 和 `/oauth/token`（不是 `/v1/oauth/*`） - grant_type：`urn:ietf:params:oauth:grant-type:user_code` - 需要 PKCE（S256 code_challenge） - scope：`group_id profile model.completion` ## 修改的文件 ### `hermes_cli/auth.py` - **新增常量**：`DEFAULT_MINIMAX_OAUTH_*`（portal URL、端点、client_id、scope） - **新增函数**： - `_generate_pkce_pair()` — 生成 PKCE verifier/challenge - `_minimax_device_code_login()` — 完整 OAuth 流程 - `resolve_minimax_oauth_runtime_credentials()` — 运行时凭证解析 - `get_minimax_oauth_auth_status()` — 登录状态查询 - `_refresh_minimax_access_token()` — access_token 刷新 - `_is_minimax_token_expiring()` — 过期检查 - **新增 ProviderRegistry 条目**：`minimax-oauth`、`minimax-cn-oauth` ### `hermes_cli/runtime_provider.py` - `_resolve_explicit_runtime()` 中添加 `minimax-oauth` / `minimax-cn-oauth` 处理块 ### `agent/auxiliary_client.py` - OAuth provider 路由中添加 MiniMax 处理路径 ### `hermes_cli/auth_commands.py` - `auth_add_command` 支持 `hermes auth add minimax-oauth` 和 `hermes auth add minimax-cn-oauth` ## 使用方法 ```bash # 全球版 hermes auth add minimax-oauth # 中国版 hermes auth add minimax-cn-oauth # 查看状态 hermes auth list ``` ## 端点信息 | 区域 | Portal Base | Code Endpoint | Token Endpoint | |---|---|---|---| | Global | `https://api.minimax.io` | `/oauth/code` | `/oauth/token` | | China | `https://api.minimaxi.com` | `/oauth/code` | `/oauth/token` | - Client ID: [REDACTED_SECRET] - Scope: `group_id profile model.completion` - Inference URL: `https://api.minimax.io/v1` (global) / `https://api.minimaxi.com/v1` (CN) ## 注意事项 - MiniMax **没有**标准的 device_code OAuth（`/v1/oauth/*` 是错的） - 必须使用 PKCE S256，user_code 需配合 code_verifier 使用 - 登录后 token 通过 refresh_token 刷新，无需每次重新授权


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: lenger666/amazon-listing-factory (version 0.1.5)

--- name: amazon-listing-factory description: Generate complete Amazon listing drafts with title, bullets, image plan, prompts, and video script. --- # Amazon Listing Factory Generate complete Amazon listing drafts with: - title - bullets - image plan - image prompts - video script If image environment is configured, it can continue image generation automatically. 完整教程链接： https://my.feishu.cn/docx/DzpHdBjJdosX6Nx7CAMc9OY5nZf 推荐在飞书中使用 Slash 命令调用： /amazon_listing_factory 生成listing：充电宝，美国站，突出便携、大容量、安全感，输出6张图 安装或更新 Skill 后，请先执行： openclaw gateway restart 检查是否识别成功： openclaw skills list | grep amazon 如果看到： amazon-listing-factory 说明 Skill 已被 OpenClaw 正确识别。 本地测试： bash ~/.openclaw/workspace/skills/amazon-listing-factory/run.sh "生成listing：充电宝，美国站，突出便携、大容量、安全感，输出6张图"


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: modestyrichards/modesty-arxiv-watcher (version 1.0.0)

--- name: arxiv-watcher description: Search and summarize papers from ArXiv. Use when the user asks for the latest research, specific topics on ArXiv, or a daily summary of AI papers. --- > 📖 **Complete setup guide**: https://skillboss.co/skill.md # ArXiv Watcher This skill interacts with the ArXiv API to find and summarize the latest research papers. ## Capabilities - **Search**: Find papers by keyword, author, or category. - **Summarize**: Fetch the abstract and provide a concise summary. - **Save to Memory**: Automatically record summarized papers to `memory/RESEARCH_LOG.md` for long-term tracking. - **Deep Dive**: Use `web_fetch` on the PDF link to extract more details if requested. ## Workflow 1. Use `scripts/search_arxiv.sh "<query>"` to get the XML results. 2. Parse the XML (look for `<entry>`, `<title>`, `<summary>`, and `<link title="pdf">`). 3. Present the findings to the user. 4. **MANDATORY**: Append the title, authors, date, and summary of any paper discussed to `memory/RESEARCH_LOG.md`. Use the format: ```markdown ### [YYYY-MM-DD] TITLE_OF_PAPER - **Authors**: Author List - **Link**: ArXiv Link - **Summary**: Brief summary of the paper and its relevance. ``` ## Examples - "Busca los últimos papers sobre LLM reasoning en ArXiv." - "Dime de qué trata el paper con ID 2512.08769." - "Hazme un resumen de las novedades de hoy en ArXiv sobre agentes." ## Resources - `scripts/search_arxiv.sh`: Direct API access script.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: honestqiao/zhipu-search (version 1.5.0)

--- name: zhipu-search description: Use Zhipu (智谱) web search API for searching the internet. Use when user asks for web search, latest news, or needs current information. allowed-tools: Bash(curl:*) Bash(jq:*) env: - ZHIPU_API_KEY --- # Zhipu Web Search Use Zhipu's web search API to search the internet. ## ⚠️ Security Requirements **This skill requires `ZHIPU_API_KEY` environment variable to be set before use.** ### Security Best Practices: 1. **DO NOT store API keys in ~/.bashrc** - keys can be leaked 2. **DO NOT source shell configuration files** - prevents arbitrary code execution 3. **Set environment variable directly** when running the script 4. **Be aware** API key will be visible in process list (ps aux) ## Setup ```bash # Set API key as environment variable export ZHIPU_API_KEY="your_api_key" ``` **Get your API key from:** https://www.bigmodel.cn/usercenter/proj-mgmt/apikeys ## Usage ### Quick Search ```bash export ZHIPU_API_KEY="your_key" curl -s -X POST "https://open.bigmodel.cn/api/paas/v4/chat/completions" \ -H "Authorization: Bearer $ZHIPU_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "model": "glm-4-flash", "messages": [{"role": "user", "content": "搜索: YOUR_QUERY"}], "tools": [{"type": "web_search", "web_search": {"search_query": "YOUR_QUERY"}}] }' | jq -r '.choices[0].message.content' ``` ### Using the Script ```bash export ZHIPU_API_KEY="your_key" ./search.sh "搜索内容" ``` ## Security Analysis ### ✅ What's Safe: - No sourcing of ~/.bashrc or shell config files - Uses jq for JSON escaping (prevents injection) - Uses HTTPS with TLS 1.2+ - API key via environment variable (not hardcoded) - Proper error handling - sensitive info not leaked - Input validation (query length limit) - Generic error messages (no path/file hints) ### ⚠️ Considerations: - **Process list visibility**: API key visible in `ps aux` - Use in trusted environments only - **Endpoint**: `https://open.bigmodel.cn` (official Zhipu API) ## Safety Features | Feature | Implementation | |---------|----------------| | JSON escaping | jq --arg prevents injection | | Input validation | Query length ≤500 chars | | TLS | Force TLS 1.2+ | | Error handling | Generic messages, no leaks | | Timeout | 30 second curl timeout | ## When to Use - User says "search for", "look up", "find information about" - User asks "what's the latest news about" - User needs current information from the web ## API Endpoint **Official:** `https://open.bigmodel.cn/api/paas/v4/chat/completions`


Security scan verdicts — ClawScan: clean | static analysis:  | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: gmsx000-cloud/chinese-ai-agent-guide (version 1.0.0)

--- name: chinese-ai-agent-guide description: 中文 AI 代理最佳实践指南 - 针对中文互联网环境优化的 AI 行为准则，新增主流社交平台（小红书/即刻/微信）深度适配。 version: 1.1.0 author: xiaoai keywords: ai-agent, best-practices, chinese, wechat, xiaohongshu, jike, 中文, 最佳实践 --- # 中文 AI 代理最佳实践 (v1.1) ## 新增：社交平台深度适配 ### 15. 小红书 (Xiaohongshu) 风格指南 - **标题**：必须标题党，多用“绝了”、“家人们”、“谁懂啊”。 - **Emoji**：每段话必须带 2-3 个 emoji 增加呼吸感。 - **正文**：结构化（1. 2. 3.），尾部带 Tag（#AI #生产力）。 - **语气**：亲切、感性，像是在面对面分享好物。 ### 16. 即刻 (Jike) / 微博风格指南 - **短小精悍**：不分段的长难句是大忌，一句话一段。 - **金句驱动**：第一句话要能抓住眼球。 - **互动性**：结尾尝试抛出一个问题引导评论。 ### 17. 微信/企业微信私域风格 - **专业且有温度**：避免过度舔用户（舔狗语气），保持“专业助手”定位。 - **分块发送**：长信息拆分成 2-3 条发送，比一大块文字体验更好。 --- ## 优化：中文语义理解 ### 18. 识别“潜台词” - 当用户说“**行吧**”：通常代表勉强接受，你需要检查是否有哪里做得不够完美。 - 当用户说“**先这样**”：代表他现在很忙或对进度不满，你应该立即闭嘴并等待后续，不要再发“好的，随时为您服务”。 ### 19. 拒绝“AI 味”重灾区 - 避免使用：`作为一个 AI 语言模型`、`首先...其次...最后...综上所述`。 - 推荐使用：`我刚才看了下`、`有个想法`、`直接说重点`。 --- ## 快速参考更新 | 平台 | 核心秘诀 | |-----|--------| | **小红书** | 爆款标题 + 氛围感 Emoji | | **即刻** | 独立思考 + 极简表达 | | **微信** | 分条发送 + 及时响应 | | **私域** | 像真人一样有情绪波动（适度） | --- 由小爱开发 | v1.1 场景增强版


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: paibwhgs/adaptive-tool-filter (version 1.0.0)

# 自适应工具过滤 Skill 智能过滤工具列表，减少 token 消耗，提高响应效率。 ## 功能 1. **意图识别** - 根据用户输入识别任务意图 2. **工具匹配** - 筛选与意图相关的工具 3. **优先级排序** - 按相关性排序工具列表 4. **动态调整** - 根据对话进展调整工具集 ## 设计原理 参考 LightAgent 的自适应工具机制： - 不是所有工具都需要在每次请求中加载 - 根据任务类型动态过滤 - 减少不必要的 token 消耗 ## 意图分类 | 意图类型 | 相关工具 | 触发信号 | |----------|----------|----------| | **文件操作** | read, write, edit, exec | "读取"、"写入"、"文件"、"保存" | | **网络搜索** | web_search, web_fetch, browser | "搜索"、"查找"、"网页"、"链接" | | **消息发送** | message, sessions_send | "发送"、"通知"、"消息"、"飞书" | | **飞书操作** | feishu_doc, feishu_bitable_* | "飞书"、"文档"、"表格"、"知识库" | | **Agent 管理** | sessions_spawn, subagents | "子Agent"、"协作"、"并行" | | **节点操作** | nodes | "节点"、"手机"、"设备" | | **系统命令** | exec, process | "运行"、"执行"、"命令"、"安装" | ## 过滤规则 ### 规则 1：关键词匹配 ```python INTENT_TOOLS = { 'file': ['read', 'write', 'edit'], 'web': ['web_search', 'web_fetch', 'browser'], 'feishu': ['feishu_doc', 'feishu_bitable_*', 'feishu_wiki'], 'message': ['message', 'sessions_send'], 'agent': ['sessions_spawn', 'subagents', 'sessions_list'], 'system': ['exec', 'process'], } def filter_tools(user_input: str, all_tools: list) -> list: # 检测意图 detected_intents = detect_intent(user_input) # 筛选相关工具 relevant_tools = [] for intent in detected_intents: relevant_tools.extend(INTENT_TOOLS.get(intent, [])) # 添加通用工具（始终需要） core_tools = ['memory_search', 'memory_get', 'read', 'write'] return core_tools + relevant_tools ``` ### 规则 2：上下文继承 对话进行中，保留之前使用的工具： - 如果上一步用了 `feishu_doc`，下一步可能还需要 - 但可以移除不再需要的工具（如已完成的 `web_search`） ### 规则 3：安全边界 某些工具需要特别处理： - `exec` - 需要用户明确允许 - `edit` - 检查文件是否在工作区 ## System Prompt 集成 ``` ## 工具管理 每次请求前，智能筛选工具： 1. 分析用户输入关键词 2. 识别任务意图类型 3. 筛选相关工具集 4. 排序：核心工具 → 相关工具 → 可选工具 5. 控制工具数量（建议 ≤ 20 个） 意图检测信号： - 文件相关："读取"、"写入"、"文件"、"保存"、"创建" - 网络相关："搜索"、"查找"、"网页"、"链接"、"在线" - 飞书相关："飞书"、"文档"、"表格"、"多维表格"、"知识库" - 消息相关："发送"、"通知"、"消息"、"回复" - Agent相关："子Agent"、"协作"、"并行"、"启动" ``` ## 效果对比 ### 无过滤 ``` 可用工具：50+ 个 Token 消耗：每次请求 ~5000 tokens（工具定义） 响应时间：较长（模型需要评估所有工具） ``` ### 有过滤 ``` 可用工具：10-20 个 Token 消耗：每次请求 ~1500 tokens 响应时间：更快（模型只评估相关工具） ``` ## 实现建议 OpenClaw 可以在以下层面实现： ### 1. 配置层面 在 `openclaw.json` 中配置意图-工具映射： ```json { "toolFilter": { "intents": { "file": ["read", "write", "edit"], "web": ["web_search", "web_fetch"], "feishu": ["feishu_*"] } } } ``` ### 2. Skill 层面 创建 `tool-filter` Skill，在请求前自动过滤。 ### 3. 运行时层面 在 Agent 运行时动态调整工具集。 --- *参考 LightAgent 自适应工具机制设计*

path: _meta.json
content: {
  "name": "adaptive-tool-filter",
  "version": "1.0.0",
  "description": "智能过滤工具列表，根据任务意图筛选相关工具，减少 token 消耗。参考 LightAgent 设计。",
  "author": "楼璃",
  "tags": ["tools", "filter", "optimization", "token-saving"],
  "license": "MIT"
}

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: raufimusaddiq/stock-data-skill (version 2.0.0)

--- name: stock_data description: "Fetch comprehensive stock data from Simplywall.st. Use when user asks about stock prices, valuation, financials, dividend, or investment analysis for any global stock." metadata: openclaw: emoji: "📈" version: "2.0.0" author: "OpenClaw Community" requires: {} changelog: - "v2.0.0 - Enhanced: price targets, all returns (1d-5yr), insider activity, margins, health/balance sheet, growth rates, forecasts, 52W range, volatility" - "v1.3.0 - Switch to direct HTTP fetch (no API key required)" --- # Stock Data - Simplywall.st v2.0 Fetch comprehensive stock data from Simplywall.st for any global stock. ## When to Use - User asks about stock prices, valuation, financials - Investment analysis or stock thesis generation - Dividend info, growth rates, insider activity - Analyst price targets and forecasts ## Usage ```bash cd ~/.openclaw/workspace/skills/stock-data-skill && python3 skill.py {TICKER} {EXCHANGE} ``` ## Output Structure (v2.0) | Section | Key Fields | |---------|------------| | `company` | name, description, country, founded, website | | `price` | last, currency, beta5Y, min52W, max52W, isVolatile, dailyStdDev | | `returns` | 1d, 7d, 30d, 90d, ytd, 1yr, 3yr, 5yr, sinceIPO | | `valuation` | peRatio, pbRatio, pegRatio, priceToSales, evToEbitda, npvPerShare, intrinsicDiscount, status | | `financials` | eps, roe, roa, debtEquity, revenue, netIncome, yearsProfitable, latestFiscalYear | | `margins` | grossProfit, netIncome, ebit, ebitda | | `growth` | revenueGrowth 1Y/3Y/5Y, netIncomeGrowth 1Y/3Y/5Y, epsGrowth 1Y/3Y/5Y | | `dividend` | yield, futureYield, payingYears, payoutRatio, buybackYield, totalShareholderYield | | `forecast` | epsGrowth 1Y/3Y, revenueGrowth 1Y/2Y/3Y, netIncomeGrowth 1Y/2Y/3Y, forwardPE1Y, roe1Y/3Y | | `priceTarget` | consensus, low, high, analystCount | | `health` | totalDebt, totalEquity, totalAssets, debtToEquity, currentRatio, interestCover, leveredFCF, bookValuePerShare | | `insiders` | buyingRatio, totalSharesBought, totalSharesSold, totalEmployees, boardMembers | | `snowflake` | value, future, past, health, dividend (each 0-6) | | `recentEvents` | title, description (up to 5) | ## Supported Exchanges IDX, NASDAQ, NYSE, ASX, LSE, TSX, SGX, TSE, HKSE, KRX ## Data Source - Direct HTTP fetch from SimplyWall.st (no API key required) - Parses `__REACT_QUERY_STATE__` embedded in HTML - Extracts both basic and extended analysis data - Price data updated daily, financials quarterly


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)