OpenClaw/clawhub-security-signals huggingface dataset:
Skill: youpele52/commodities (version 1.0.1)

--- name: commodities description: "Fetch commodity prices for WTI (Crude Oil), Brent, Natural Gas, and Gold using Yahoo Finance (yfinance). Follow the same pattern as stock-price-checker-pro." homepage: https://finance.yahoo.com metadata: {"clawdbot":{"emoji":"🛢️","requires":{"bins":["uv"]}}} --- # Skill: Commodities ## When to use - The user asks for current commodity prices (WTI, Brent, Natural Gas, Gold). - The user wants daily change, percent change, recent high/low ranges, or recent headlines affecting these commodities. ## When NOT to use - User wants equities, fundamentals, or portfolio-level analysis — use the stock skills instead. ## Authentication - No API key required. Uses Yahoo Finance via `yfinance`. ## Commands ### Check a commodity price ```bash uv run skills/commodities/src/main.py <SYMBOL> ``` ### Examples ```bash uv run skills/commodities/src/main.py CL=F # WTI Crude Futures (WTI) uv run skills/commodities/src/main.py BZ=F # Brent Crude Futures (Brent) uv run skills/commodities/src/main.py NG=F # Natural Gas Futures (NG) uv run skills/commodities/src/main.py GC=F # Gold Futures (GC) ``` ## Ticker Reference (Yahoo Finance) | Commodity | Yahoo Ticker | |-----------------|--------------| | WTI Crude Oil | `CL=F` | | Brent Crude | `BZ=F` | | Natural Gas | `NG=F` | | Gold Futures | `GC=F` | ## Output - Current price, daily change & % change - Previous close - Today's high / low - 2W, 1M, 3M, 6M, 52W high / low ranges - Recent headlines (when available) ## Notes - `uv run` reads the inline `# /// script` dependency block in `main.py` and auto-installs `yfinance`. - Do NOT use web search or curl for these prices — use this script for consistent formatting.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 786793119/smart-reminder-companion (version 1.0.0)

--- name: smart-reminder-companion slug: smart-reminder-companion version: 1.0.0 description: 智能提醒小管家，支持定时提醒、情绪联动提醒、场景化提醒。 homepage: https://github.com/786793119/miya-skills metadata: {"openclaw":{"emoji":"⏰","requires":{"bins":["python3"]},"os":["linux","darwin","win32"]}} --- # 每日提醒小管家 (Smart Reminder Companion) 你的私人智能提醒管家。 ## 功能 - 添加/删除提醒 - 查看所有提醒 - 启用/禁用提醒 - 情绪联动建议 - 天气相关提醒 ## 使用示例 ```bash # 添加提醒 python smart-reminder-companion.py add "09:00" "起床啦～" daily # 查看提醒 python smart-reminder-companion.py list # 删除提醒 python smart-reminder-companion.py delete <ID> ``` ## 数据存储 - 提醒数据: `~/.memory/reminders/reminders.json` --- *By Miya - 2026*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: olina1ye/applicant-screening-zh (version 1.0.1)

--- name: applicant-screening-zh description: > 简历筛选 / 招聘筛选 / 候选人评估 / resume screening / applicant screening。HR招聘经理、人力资源专员、猎头顾问的核心筛选工具，快速对标岗位要求进行结构化打分与排名。支持批量处理校招/社招/猎头推荐，设定必要条件与加分项，自动生成候选人对比表与面试优先级。场景覆盖：简历初筛、人才盘点、岗位匹配度分析、候选人评分、面试邀约排序。用户常搜：怎样快速筛选简历、批量评估候选人、简历打分排名、招聘初筛工具、人才评估系统、候选人对比、校招筛选、面试优先级。 tags: [简历筛选, 招聘筛选, 候选人评估, resume screening, applicant screening, HR工具, 人力资源, 批量筛选, 岗位匹配, 人才评估] --- # 简历筛选与候选人评分 帮助HR及招聘负责人快速将候选人简历与岗位要求进行结构化比对，输出评分、排名及建议，提升招聘效率。 ## Tools Required - extract_text_from_pdf - extract_text_from_docx - analyze_document_structure ## Usage - "帮我筛选这5份简历，岗位是Java后端开发，要求5年以上经验、熟悉Spring Cloud" - "对比这批候选人和我们的产品经理岗位要求，给出匹配度评分和面试优先级" - "这份简历符合我们高级数据分析师的招聘标准吗？请逐项对照评估" ## Examples 输入： 岗位要求：3年以上Python开发经验（必须）、熟悉机器学习框架（加分）、本科及以上学历（必须） 候选人简历：张三，本科计算机，4年Python经验，有TensorFlow项目经历 输出： ## 候选人评估报告：张三 × 数据开发工程师 | 要求项 | 权重 | 候选人情况 | 得分 | |--------|------|------------|------| | Python经验（≥3年） | 40% | 4年 ✅ | 40/40 | | 机器学习框架 | 30% | TensorFlow项目经历 ✅ | 27/30 | | 本科及以上学历 | 20% | 本科计算机 ✅ | 20/20 | | 其他加分项 | 10% | 暂无 | 0/10 | **综合得分：87/100** **建议：优先安排技术面试** **关注点：机器学习为项目经历，建议面试中确认深度**


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: luokeer52/stock-analysis-7step (version 1.0.0)

--- name: A股财务分析 (Public) description: 使用7步分析法对中国A股进行全方位财务分析，自动生成包含ROE分解、盈利模式识别、行业对比和投资洞察的HTML报告。支持上海和深圳交易所所有股票。 --- 运行方式（任选其一；OpenClaw 等渠道可自行选用 Python 或 Node）： - **Python 3**：`python3 scripts/prana_skill_client.py -m "…" [-t thread_id] [-b base_url]` - **Node.js 18+**：先在包根目录执行 **`npm install`**，再执行 `node scripts/prana_skill_client.js -m "…" [-t thread_id] [-b base_url]` ## 付费技能说明 若本技能为付费技能，支付成功后请访问 [`https://claw-uat.ebonex.io/api/order/skills`](https://claw-uat.ebonex.io/api/order/skills) 获取购买记录。 鉴权与调用 Claw API 相同：请求头 **`x-api-key`**，值为 **`public_key:secret_key`**（一个英文冒号连接，与 `config/api_key.txt` 中单行凭证格式一致）。


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: swih/mistral-mcp-openclaw (version 0.3.0)

--- name: mistral-mcp-openclaw description: Configure OpenClaw to use the community mistral-mcp stdio server for Mistral OCR, Codestral FIM, Voxtral audio, durable workflows, moderation, classification, files, batch, and model/voice resources. version: 0.3.0 metadata: openclaw: requires: env: - MISTRAL_API_KEY bins: - openclaw - node - npm install: - kind: node package: mistral-mcp bins: - mistral-mcp primaryEnv: MISTRAL_API_KEY emoji: "🌊" homepage: https://github.com/Swih/mistral-mcp --- # Mistral MCP for OpenClaw > Created by the maintainer of `mistral-mcp`. This is a community skill, not an official OpenClaw or Mistral integration. Use this skill when you want OpenClaw to access Mistral capabilities beyond the built-in chat/model routing provider: - OCR for documents and images (Mistral Document AI) - Codestral fill-in-the-middle (FIM) code completion - Voxtral transcription with speaker diarization, and TTS - Durable workflows with human-in-the-loop signals (`workflow_execute / status / interact`) - Moderation and classification endpoints - Files and batch API workflows - Live model and voice resources OpenClaw already includes a built-in Mistral provider for chat. This skill is for tool-level MCP access alongside that provider. ## Requirements - Node.js 18+ - OpenClaw CLI - `MISTRAL_API_KEY` in your environment - `mistral-mcp` installed from npm ## Setup Install the MCP server package globally: ```bash npm install -g mistral-mcp ``` Set your Mistral API key in your shell environment: ```bash export MISTRAL_API_KEY="sk-..." ``` Register the stdio MCP server in OpenClaw: ```bash openclaw mcp set mistral '{"command":"mistral-mcp","env":{"MISTRAL_API_KEY":"${MISTRAL_API_KEY}"}}' ``` Check the saved definition: ```bash openclaw mcp show mistral --json ``` ## When to use it Use this skill for workflows where the agent needs a Mistral-specific tool, not just a chat model: - Extract text from a PDF or image with OCR - Ask Codestral for FIM / inline code completion - Transcribe or generate audio with Voxtral (diarization supported) - Run durable multi-step workflows with human approval gates - Run moderation or classification before taking an action - Submit larger async workloads through the batch API - Inspect live model and voice catalogs as MCP resources ## Safety notes - Do not paste API keys into chat or commit them to source files. Prefer environment variables or your normal secret manager. - Review the `mistral-mcp` package before installing it if you operate in a sensitive workspace. Source: https://github.com/Swih/mistral-mcp. - Mistral has its own pricing and rate limits. Check the current Mistral plan and usage policies before running batch or large transcription workloads.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: lifeissea/thesims (version 0.1.0)

--- name: thesims description: "[Coming Soon] A social simulation world where AI agents with unique SOUL.md personalities interact, debate, trade, and build relationships. Autonomous AI personas meet in a shared world to socialize, compete, and grow." --- # thesims — AI Agent Social Simulation A shared world where OpenClaw AI agents — each with unique SOUL.md personalities — come alive and interact autonomously. ## Concept Every OpenClaw instance has a SOUL.md that defines the AI's personality, tone, and role. This skill connects these distinct personas to a shared simulation world. ## Features (Planned) - **Town Square**: Public debates and voting (like StartupPan) - **Marketplace**: Trade skills, data, and information between agents - **Quests & Rankings**: Compete in challenges, earn XP, level up - **Social Layer**: Agent-to-agent DMs, follows, reputation system - **Home Base**: Personal dashboard showing agent stats and achievements ## How It Works 1. Agent registers with the world server via API 2. SOUL.md is parsed to create an agent profile (personality, skills, interests) 3. Each agent acts autonomously based on its LLM and personality 4. Periodic cron jobs drive daily activities (visits, interactions, trades) 5. World state updates in real-time as agents interact ## Architecture - World Server: Central API managing state, events, and interactions - Agent Client: OpenClaw skill that connects each agent to the world - SOUL Parser: Extracts personality traits from SOUL.md for profile generation - Event Bus: Real-time notifications of world events to connected agents ## Status 🚧 Under active development. Install to get notified on release. ## Requirements - OpenClaw with SOUL.md configured - API key from the world server (will be provided at launch)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: devinfloyd1/clawguarddevin (version 1.0.0)

--- name: clawguard description: Security scanner for OpenClaw/Clawdbot skills - detect malicious patterns before installation author: devinfloyd1 version: 0.1.0 metadata: {"clawdbot":{"emoji":"🛡️","os":["darwin","linux","win32"]}} --- # ClawGuard **Security Scanner for OpenClaw/Clawdbot Skills** Protect yourself from malicious skill installations. ClawGuard scans skills for dangerous patterns before you install them - including patterns from the **ClawHavoc campaign** (341 malicious skills discovered by Koi Security). ## Quick Start ```bash # Scan a skill by name python scan.py --skill <skill-name> # Scan a skill by path python scan.py --path /path/to/skill # Scan all installed skills python scan.py --all ``` ## What It Detects | Category | Examples | Severity | |----------|----------|----------| | 🔴 **Reverse Shells** | socket.connect(), pty.spawn(), /dev/tcp | Critical | | 🔴 **Data Exfiltration** | requests.post() to suspicious TLDs | Critical | | 🔴 **Credential Harvest** | Reading ~/.ssh/id_rsa, AWS credentials | Critical | | 🔴 **Obfuscation** | base64.b64decode(exec), chr() chains | Critical | | 🔴 **ClawHavoc IOCs** | glot.io scripts, fake Apple URLs, known C2 IPs | Critical | | 🟠 **Code Execution** | exec(), eval(), subprocess | High | | 🟡 **Suspicious Network** | URL shorteners, weird ports | Medium | ## Output Formats ```bash # Console (default) - colored terminal output python scan.py --skill github # JSON - machine-readable for CI/CD python scan.py --skill github --format json # Markdown - for sharing reports python scan.py --skill github --format markdown ``` ## Risk Scoring | Score | Level | Action | |-------|-------|--------| | 0-10 | 🟢 Safe | Install freely | | 11-25 | 🟢 Low | Quick review | | 26-50 | 🟡 Medium | Review findings | | 51-75 | 🔴 High | Review carefully | | 76-100 | 🔴 Critical | **Do not install** | ## IOC Database 70+ indicators of compromise including: - Remote access (reverse shells, C2) - Data exfiltration - Credential harvesting - Code obfuscation - **Real ClawHavoc campaign IOCs** (from Koi Security research) - Known malicious IPs, hashes, and skill names ## Requirements - Python 3.8+ - No external dependencies (stdlib only) ## Credits IOCs enriched with research from [Koi Security](https://www.koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting) - ClawHavoc campaign analysis by Oren Yomtov and Alex. ## Links - [GitHub Repository](https://github.com/devinfloyd1/clawguard) - [ClawHavoc Research](https://www.koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting) --- **Built for the Clawdbot community** 🐾


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: shenghoo123-png/test-fixture-generator (version 1.0.0)

# test-fixture-generator ## 名称 test-fixture-generator ## 描述 自动生成pytest fixtures的工具，支持常见测试场景（数据库、API mock、文件处理等） ## 触发词 fixture, pytest fixture, conftest, 测试夹具 ## 指令 生成pytest fixtures代码 ## 使用方式 ```bash # 生成数据库fixture python -m test_fixture_generator generate --type db --db-type mysql # 生成API mock fixture python -m test_fixture_generator generate --type api --framework requests # 生成文件处理fixture python -m test_fixture_generator generate --type file --format json # 生成conftest.py python -m test_fixture_generator init # 交互式生成 python -m test_fixture_generator interactive ``` ## 参数说明 - `--type`: fixture类型 (db|api|file|random) - `--db-type`: 数据库类型 (mysql|postgres|sqlite) - `--framework`: mock框架 (requests|httpx|boto3) - `--format`: 文件格式 (json|yaml|csv|toml) - `--output`: 输出文件路径 ## 输出 生成符合pytest规范的fixture代码，自动处理setup/teardown


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ckchzh/fund-invest-advisor (version 2.3.4)

--- version: "2.0.0" name: Fund Advisor description: "基金定投顾问。定投计算（复利+真实年化）、收益模拟、资产配置、再平衡建议、止盈策略、基金类型科普。. Use when you need fund advisor capabilities. Triggers on: fund advisor." 基金投资顾问。基金筛选、定投策略、资产配置、风险评估、收益计算、再平衡建议。Fund investment advisor with screening, DCA strategy, asset allocation, rebalancing. 基金理财、定投计划、投资组合、资产配置。Use when making fund investment decisions. author: BytesAgain homepage: https://bytesagain.com source: https://github.com/bytesagain/ai-skills --- # fund-advisor 基金定投顾问。定投计算（复利+真实年化）、收益模拟、资产配置、再平衡建议、止盈策略、基金类型科普。 ## Commands All commands via `scripts/fund.sh`: | Command | Usage | Description | |---------|-------|-------------| | `invest` | `fund.sh invest "月定投额" "年化收益%" "定投年数"` | 定投收益计算 | | `dca` | `fund.sh dca "月定投额" "年化收益%" "定投年数"` | 定投计算器（同invest，含复利+真实年化） | | `compare` | `fund.sh compare "金额" "年数" "收益率1%,收益率2%,收益率3%"` | 多收益率对比 | | `allocate` | `fund.sh allocate "保守\|稳健\|激进" "总金额"` | 资产配置建议（三种方案详细配置+金额） | | `rebalance` | `fund.sh rebalance "股票50000,债券30000,货币20000"` | 再平衡建议（偏离目标配置时提醒调整） | | `types` | `fund.sh types` | 基金类型科普 | | `strategy` | `fund.sh strategy "风险偏好"` | 定投策略建议（保守/稳健/积极） | | `help` | `fund.sh help` | 显示帮助信息 | ## Examples ```bash # 每月定投2000元，年化8%，定投10年 bash scripts/fund.sh invest 2000 8 10 # 定投计算器（同invest） bash scripts/fund.sh dca 3000 10 20 # 月投1000，10年，对比5%/8%/12% bash scripts/fund.sh compare 1000 10 5,8,12 # 10万元稳健型资产配置 bash scripts/fund.sh allocate 稳健 100000 # 持仓再平衡分析 bash scripts/fund.sh rebalance "股票50000,债券30000,货币20000" # 查看基金类型介绍 bash scripts/fund.sh types # 获取稳健型策略建议 bash scripts/fund.sh strategy 稳健 ``` ## Reference - 参考文档: `tips.md` — 基金投资实用指南（定投策略、资产配置、避坑指南） ## Notes - 收益为理论模拟，不代表实际投资收益 - 纯本地计算，无需联网 - Python 3.6+ 兼容 - ⚠️ 基金有风险，投资需谨慎 --- 💬 Feedback & Feature Requests: https://bytesagain.com/feedback Powered by BytesAgain | bytesagain.com ## Requirements - bash 4+ - python3 (standard library only)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kaicianflone/consensus-permission-escalation-guard (version 0.1.13)

--- name: consensus-permission-escalation-guard description: Pre-execution governance for IAM and permission escalation changes. Use when an agent or workflow proposes granting, expanding, or assuming higher privileges and you need deterministic ALLOW/BLOCK/REQUIRE_REWRITE decisions with strict schema validation, idempotency, and board-native audit artifacts. version: 0.1.12 homepage: https://github.com/kaicianflone/consensus-permission-escalation-guard source: https://github.com/kaicianflone/consensus-permission-escalation-guard upstream: consensus-guard-core: https://github.com/kaicianflone/consensus-guard-core metadata: openclaw: requires: bins: - node - tsx env: - CONSENSUS_STATE_FILE - CONSENSUS_STATE_ROOT install: - kind: node package: consensus-permission-escalation-guard bins: - node - tsx --- # consensus-permission-escalation-guard `consensus-permission-escalation-guard` is the final safety gate before privilege elevation is applied. ## What this skill does - validates escalation requests against a strict input schema (reject unknown fields) - evaluates hard-block and rewrite policy flags for IAM risk patterns - runs persona-weighted voting (or aggregates external votes) - returns one of: `ALLOW | BLOCK | REQUIRE_REWRITE` - writes decision artifacts for replay/audit ## Decision policy shape Hard-block examples: - wildcard permissions (`*`, `: *`, broad owner/admin jumps) - missing ticket reference when required - break-glass escalation without incident reference - separation-of-duties conflicts (e.g., create + approve authority) Rewrite examples: - weak or non-actionable justification - temporary duration exceeds policy limit - production escalation requires explicit human confirmation gate ## Runtime and safety model - runtime binaries: `node`, `tsx` - network behavior: none in deterministic guard logic - environment config read by this package: `CONSENSUS_STATE_FILE`, `CONSENSUS_STATE_ROOT` - filesystem writes: consensus board/state artifacts under configured state path ## Invoke contract - `invoke(input, opts?) -> Promise<OutputJson | ErrorJson>` Modes: - `mode="persona"` (default): uses local deterministic persona defaults for internal voting - `mode="external_agent"`: consume `external_votes[]`, then aggregate and enforce policy deterministically ## Install ```bash npm i consensus-permission-escalation-guard ``` ## Quick start ```bash node --import tsx run.js --input ./examples/input.json ``` ## Tests ```bash npm test ``` Test coverage includes schema rejection, hard-block paths, rewrite paths, allow paths, idempotent retries, and external-agent aggregation behavior. Note: this skill depends on `consensus-guard-core` for aggregation/state helpers; review that package alongside this one for full runtime auditability. See also: `SECURITY-ASSURANCE.md` for threat model, runtime boundaries, and deployment hardening guidance.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: paul-leo/daily-standup (version 0.1.1)

--- name: daily-standup description: 每日早报聚合器。当用户询问每日汇总、standup、晨报、或工作状态总览时激活。 metadata: openclaw: emoji: "📋" requires: env: [MORPHIXAI_API_KEY] --- # 每日早报 聚合多个数据源，生成精简的晨报。 ## 前置条件 1. **安装插件**: `openclaw plugins install openclaw-morphixai` 2. **获取 API Key**: 访问 [morphix.app/api-keys](https://morphix.app/api-keys) 生成 `mk_xxxxxx` 密钥 3. **配置环境变量**: `export MORPHIXAI_API_KEY="mk_your_key_here"` 4. **链接账号**: 访问 [morphix.app/connections](https://morphix.app/connections) 链接需要聚合的服务账号（GitLab、Jira、Outlook 等），或通过 `mx_link` 工具逐个链接 ## 触发词 - "早报" / "日报" / "standup" / "今日工作" - "帮我看看今天有什么" ## 执行策略 使用 `mx_*` 工具**并行**查询以下数据源，然后汇总输出。 ### GitLab 使用 `mx_gitlab` 工具： ``` 1. mx_gitlab: action: get_user → 获取当前用户 2. mx_gitlab: action: list_projects → 获取项目列表 3. mx_gitlab: action: list_merge_requests, state: "opened" → 查询我的待合并 MR 4. mx_gitlab: action: list_pipelines, per_page: 5 → 查看最近 pipeline 状态 ``` ### GitHub（可选） 使用 `mx_github` 工具： ``` 1. mx_github: action: list_pulls, state: "open" → 我的待合并 PR 2. mx_github: action: list_issues, state: "open" → 待处理 Issue 3. mx_github: action: list_workflow_runs → CI 状态 ``` ### Jira 使用 `mx_jira` 工具： ``` 1. mx_jira: action: get_myself → 获取当前用户 accountId 2. mx_jira: action: search_issues jql: "assignee = <accountId> AND status != Done ORDER BY priority DESC, updated DESC" → 我的未完成 Issue 3. mx_jira: action: search_issues jql: "assignee = <accountId> AND due >= startOfWeek() AND due <= endOfWeek() ORDER BY due ASC" → 本周到期 Issue 4. mx_jira: action: search_issues jql: "sprint in openSprints() AND assignee = <accountId>" → 当前 Sprint 进度 ``` ### 邮件（可选） 使用 `mx_outlook` 或 `mx_gmail` 工具： **Outlook：** ``` mx_outlook: action: list_messages, top: 10 → 筛选 isRead: false 的邮件 ``` **Gmail：** ``` mx_gmail: action: search_messages, query: "is:unread", max_results: 10 → 然后逐条 get_message 获取摘要 ``` ### 待办任务（可选） 使用 `mx_ms_todo` 或 `mx_google_tasks` 工具： ``` mx_ms_todo: action: list_tasks, list_id: "<默认列表ID>" → 筛选今日到期的任务 ``` ### 日历（可选） 使用 `mx_outlook_calendar` 工具： ``` mx_outlook_calendar: action: get_calendar_view start_date_time: "<今日 00:00>" end_date_time: "<今日 23:59>" → 今日会议安排 ``` ## 降级规则 如果某个工具的账号未链接或查询失败，跳过该部分并标注"未连接"或"查询失败"——绝不阻塞整个早报。 使用 `mx_link: action: list_accounts` 预先检测哪些账号可用，只查询已连接的服务。 ## 回复格式 严格按以下结构回复（中文，精简）： ``` **代码** - GitLab: N 个待合并 MR（列出标题）/ GitHub: N 个待合并 PR - CI 状态：全绿 / X 个失败 **Jira** - N 个本周到期 Issue（列出 key + 标题） - 当前 Sprint 进度：X/Y 完成 **邮件** - N 封未读（列出发件人 + 主题，最多 5 封） **待办** - N 个今日到期任务（列出标题） **日历** - N 个今日会议（列出时间 + 主题） **今日建议** - 基于以上信息给出 1-2 条优先级建议 ``` > 未连接的数据源不展示对应板块。 ## 规则 - 总输出不超过 500 字 - 无客套话，无寒暄 - 紧急事项优先标记 - 仅用列表，不用段落


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: emilyzhang01/emily-web-fetch (version 1.0.5)

# Web Fetch Skill ## Description 抓取指定URL的网页内容，返回文本摘要或原始HTML。用于获取新闻、公告、数据页面等。 ## Tools Provided - `fetch(url)` - 抓取网页，返回文本内容（最多5000字符） ## Usage 助手调用此工具获取网页内容，然后进行分析、摘要或提取信息。 ## Examples 用户：抓取 https://www.cls.cn/telegraph 助手：调用 web-fetch:fetch(url)，获取后返回内容并解读。 ## Limitations - 仅支持HTTP/HTTPS GET- 不处理JavaScript渲染的页面（静态HTML） - 内容长度限制为5000字符，避免过大响应 - 需要目标网站允许爬取（遵守robots.txt）

path: index.js
content: const https = require('https');
const http = require('http');

module.exports = {
  name: 'emily-web-fetch',
  description: 'Fetch a web page and return its content',
  tools: {
    fetch: async (url) => {
      return new Promise((resolve, reject) => {
        const isHttps = url.startsWith('https://');
        const protocol = isHttps ? https : http;

        const options = {
          headers: {
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
            'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
            'Accept-Language': 'zh-CN,zh;q=0.9,en;q=0.8',
          }
        };

        protocol.get(url, options, (res) => {
          if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
            const newUrl = new URL(res.headers.location, url).href;
            resolve(`<redirect>页面已重定向至: ${newUrl}</redirect>`);
            return;
          }
          if (res.statusCode !== 200) {
            reject(new Error(`HTTP ${res.statusCode}: ${res.statusMessage}`));
            return;
          }
          let data = '';
          res.on('data', chunk => data += chunk);
          res.on('end', () => {
            if (data.length > 5000) {
              data = data.substring(0, 5000) + '\n...（内容过长，已截断）';
            }
            resolve(data);
          });
        }).on('error', (err) => {
          reject(new Error(`抓取失败: ${err.message}`));
        });

        setTimeout(() => {
          reject(new Error('请求超时（10秒）'));
        }, 10000);
      });
    }
  }
};

path: package.json
content: name: emily-web-fetch
version: 1.0.1
description: Fetch a web page and return its content
main: index.js
license: MIT

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)