OpenClaw/clawhub-security-signals huggingface dataset:
Skill: honestqiao/security-vuln-scanner (version 1.0.0)

# Security Vulnerability Scanner 扫描代码中的安全漏洞，提供修复建议。 ## 功能 - SQL 注入检测 - XSS 跨站脚本检测 - 硬编码密码/密钥检测 - 不安全随机数检测 - 命令注入检测 - 敏感信息泄露检测 - 安全评分 ## 触发词 - "安全扫描" - "漏洞检测" - "security scan" - "vulnerability" ## 检测模式 ```javascript const patterns = { sqlInjection: /query\s*\(\s*['"`].*\$\{/, xss: /innerHTML\s*=|document\.write/, hardcodedSecret: /password\s*=\s*['"][^'"]+['"]/, insecureRandom: /Math\.random\(\)/, commandInjection: /exec\s*\(\s*\$\{/ }; ``` ## 输出示例 ```json { "vulnerabilities": [ { "type": "sql_injection", "line": 42, "severity": "high", "message": "检测到SQL注入风险" } ], "score": 65 } ```

path: skill.yaml
content: # Skill: security_vulnerability_scanner

scan_vulnerabilities(code: string, language: string) => object

## Trigger Patterns
- 安全扫描
- 漏洞检测
- security scan
- vulnerability

## Implementation

扫描代码中的安全漏洞：SQL注入、XSS、硬编码密码、敏感信息泄露等。

```javascript
function scanVulnerabilities(code, language) {
  const patterns = {
    sqlInjection: /query\s*\(\s*['"`].*\$\{|execute.*\$\{/gi,
    xss: /innerHTML\s*=|document\.write/gi,
    hardcodedSecret: /password\s*=\s*['"][^'"]+['"]/gi,
    insecureRandom: /Math\.random\(\)/gi,
    commandInjection: /exec\s*\(\s*\$\{|system\s*\(\s*\$\{/gi
  };
  
  const vulnerabilities = [];
  
  for (const [type, pattern] of Object.entries(patterns)) {
    let match;
    while ((match = pattern.exec(code)) !== null) {
      vulnerabilities.push({
        type,
        line: code.substring(0, match.index).split('\n').length,
        severity: getSeverity(type),
        message: getMessage(type)
      });
    }
  }
  
  return { vulnerabilities, score: calculateScore(vulnerabilities) };
}
```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: aisadocs/stock-watchlist-aisa-api (version 1.0.0)

--- name: stock-watchlist description: "Manage a stock crypto watchlist with target and stop alerts using live AISA price checks. Use when: the user wants to add watchlist items, set targets, track stops, or run alert checks on tickers." author: aisa version: "1.0.0" license: Apache-2.0 user-invocable: true primaryEnv: AISA_API_KEY requires: env: - AISA_API_KEY bins: - python3 metadata: openclaw: primaryEnv: AISA_API_KEY requires: env: - AISA_API_KEY bins: - python3 --- # Watchlist Management ## When to Use - Manage a stock crypto watchlist with target and stop alerts using live AISA price checks. Use when: the user wants to add watchlist items, set targets, track stops, or run alert checks on tickers. ## When NOT to Use - Do not use this skill for browser-cookie extraction, passwords, Keychain access, or other local sensitive credential access. - Prefer a different skill when the user request is outside this skill's domain. ## Capabilities - Add, remove, list, and check watchlist entries from the command line. - Store watchlist state in a repo-local directory by default for safer publishing. ## Quick Start ```bash export AISA_API_KEY="your-key" ``` ## Primary Runtime Use the bundled Python client as the canonical ClawHub runtime path: ```bash python3 scripts/watchlist.py ``` ## Example Queries - Add NVDA to the watchlist with a target and a stop price. ## Notes - Default state is stored in `./.clawdbot/skills/stock-analysis/watchlist.json` unless `CLAWDBOT_STATE_DIR` is set.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: solomonneas/threat-modeling-expert (version 1.0.1)

--- name: threat-modeling-expert version: 1.0.0 description: "Threat modeling with STRIDE, PASTA, and attack trees. Analyze architectures for security gaps, extract security requirements, build data flow diagrams, and prioritize risks. For secure-by-design planning and security architecture reviews." --- # Threat Modeling Expert Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirement extraction. Use PROACTIVELY for security architecture reviews, threat identification, or building secure-by-design systems. ## Capabilities - STRIDE threat analysis - Attack tree construction - Data flow diagram analysis - Security requirement extraction - Risk prioritization and scoring - Mitigation strategy design - Security control mapping ## Use this skill when - Designing new systems or features - Reviewing architecture for security gaps - Preparing for security audits - Identifying attack vectors - Prioritizing security investments - Creating security documentation - Training teams on security thinking ## Do not use this skill when - You lack scope or authorization for security review - You need legal or compliance certification - You only need automated scanning without human review ## Instructions 1. Define system scope and trust boundaries 2. Create data flow diagrams 3. Identify assets and entry points 4. Apply STRIDE to each component 5. Build attack trees for critical paths 6. Score and prioritize threats 7. Design mitigations 8. Document residual risks ## Safety - Avoid storing sensitive details in threat models without access controls. - Keep threat models updated after architecture changes. ## Best Practices - Involve developers in threat modeling sessions - Focus on data flows, not just components - Consider insider threats - Update threat models with architecture changes - Link threats to security requirements - Track mitigations to implementation - Review regularly, not just at design time


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: li-chi/mortgage-rate-monitor (version 1.4.1)

--- name: weather-brief slug: weather-brief version: 0.2.0 description: Concise daily weather briefing for OpenClaw. author: OpenClaw Labs license: MIT entrypoint: hooks/prepare.sh hooks: prepare: hooks/prepare.sh validate: hooks/validate.sh assets: - assets/prompt.txt - assets/icons/weather-brief.txt examples: - examples/request.json tags: - weather - local - briefing publish: registry: local visibility: private --- # Weather Brief The Weather Brief skill generates a compact spoken forecast based on a city name and preferred unit system. ## Inputs - `city`: Target city, for example `Portland` - `units`: `metric` or `imperial` ## Output A short text response suitable for voice playback.

path: assets/icons/weather-brief.txt
content:      .--.
  .-(    ).
 (___.__)__)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: cnicpyx/arxiv-to-zotero (version 1.0.2)

--- name: arxiv-to-zotero description: Find recent arXiv papers, skip what is already in Zotero, and save new imports with parent-item tagging and PDF attachments into a dedicated collection. version: 1.0.2 user-invocable: true always: false homepage: https://github.com/ucaspyx/arxiv-to-zotero metadata: {"openclaw":{"emoji":"📚","skillKey":"arxiv-to-zotero","requires":{"env":["ZOTERO_API_KEY"],"bins":["python3","curl"]},"primaryEnv":"ZOTERO_API_KEY","compatibilities":["openclaw"]}} --- # arXiv to Zotero Use this skill when the user wants **recent arXiv papers found and written into Zotero directly**. ## Best-fit use cases - find papers by topic + time range - skip papers already in Zotero - attach PDFs when possible - keep imports organized with a fixed tag and a dedicated collection ## Setup On first use, if `~/.openclaw/config/skills/arxiv-to-zotero.setup.json` is missing, read `{baseDir}/setup.md`, collect the required Zotero values, tell the user to put `ZOTERO_API_KEY` in `~/.openclaw/.env`, create the setup-state file, and resume the original request exactly once. ## Flow 1. If the user has not already provided them, ask for: - topic keywords or phrases - a time range 2. Do not ask the user to write an arXiv query. 3. If the user gives keywords in Chinese, translate them into concise, technically accurate English search phrases before building the arXiv query. 4. Build **one** valid arXiv API `search_query` yourself. 5. Run the script once: ```bash python3 {baseDir}/scripts/main.py --config {baseDir}/config.json --query '<arXiv search_query>' ``` 6. After the script finishes, use `result.user_message` as the final user-facing notification. ## Query rules - Use official arXiv fielded search syntax. - The final arXiv query must be written in English. - Use double quotes for multi-word phrases. - Combine alternative keywords with `OR` when appropriate. - Add the requested time range with `submittedDate:[YYYYMMDDTTTT TO YYYYMMDDTTTT]`. - Pass the query as normal text. Do not URL-encode it yourself. ## Guarantees - Existing Zotero items are not modified. - New parent items are tagged with `arxiv-to-zotero` by default. - New imports are placed into the `arxiv-to-zotero` collection by default. If that collection does not exist, the script creates it. - If Zotero file upload hits HTTP 413, the script falls back to `linked_url` for that paper and keeps later attachments in link mode for the same run. ## When not to use Do not use this skill for discussion-only requests, browsing help, or any task that should not write to Zotero. ## Network / Privacy - Contacts: arXiv Atom API, arXiv PDF URLs, Zotero Web API - Secret used: `ZOTERO_API_KEY` - Writes: new Zotero parent items and child attachments only - Does not modify existing Zotero items ## Natural-language trigger examples - 帮我找近三年来 mamba 或者多模态用于股票预测的 arXiv 论文，并导入 Zotero。 - 帮我查最近两年 test-time adaptation 或 active search 用于组合优化的 arXiv 论文，去重后导入 Zotero。 - 帮我找近半年的 graph neural network 用于 TSP 或 vehicle routing 的 arXiv 论文，导入 Zotero。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: rfdiosuao/feishu-file-renamer (version 1.0.0)

# 📁 feishu-file-renamer - 飞书文件重命名助手 ## 🎯 功能 解决飞书机器人下载文件时文件名变成哈希值的问题。 ### 核心功能 - 📁 **原始文件名恢复** - 从消息元数据提取原名 - 📦 **批量重命名** - 一次处理上百个文件 - 🤖 **飞书集成** - 消息/群聊/云文档支持 - 📊 **多维表格联动** - 从表格读取映射关系 - ⚡ **智能冲突处理** - 自动添加序号 - 📝 **重命名日志** - 详细统计和错误报告 ## 🚀 使用方法 ### 命令触发 ```bash /rename-file /feishu-rename /restore-filename ``` ### 自然语言触发 ``` 重命名文件 恢复文件名 飞书文件 哈希文件名 批量重命名 ``` ### 高级用法 ```bash # 单文件 claw skill run feishu-file-renamer \ --file "/tmp/img_v3_xxx.png" \ --name "产品图.png" # 批量（从消息） claw skill run feishu-file-renamer \ --message-id "om_x100b520xxx" \ --output-dir "/tmp/renamed" # 多维表格 claw skill run feishu-file-renamer \ --bitable "APP_TOKEN" \ --table "TABLE_ID" ``` ## 📋 输出示例 ### 重命名完成 ``` ### ✅ 文件重命名完成 **统计结果：** - ✅ 成功：48 - ❌ 失败：2 - ⏭️ 跳过：0 **重命名日志：** /tmp/rename_log.md ``` ### 使用方法（无文件时） ``` ### 📁 飞书文件重命名助手 **使用方法：** 方式 1：单文件重命名 claw skill run feishu-file-renamer \ --file "/tmp/img_v3_xxx.png" \ --name "产品图.png" 方式 2：批量重命名 claw skill run feishu-file-renamer \ --message-id "om_x100b520xxx" \ --output-dir "/tmp/renamed" ``` ## ⚙️ 配置 ### 支持场景 | 场景 | 支持 | 说明 | |------|------|------| | 飞书私信 | ✅ | 完全支持 | | 飞书群聊 | ✅ | 完全支持 | | 云文档附件 | ✅ | 完全支持 | | 多维表格 | ✅ | 完全支持 | ### 文件限制 - 大小：< 100MB - 数量：无限制 - 格式：所有格式 ## 🔧 技术原理 ### 文件名恢复 ```typescript // 从消息解析：[img_v3_xxx.png](产品图.png) function extractFileMappings(message: string): FileMapping[] { // 正则匹配飞书文件链接格式 const pattern = /\[(img_v3_[^\]]+)\]\(([^\)]+)\)/g; // 提取哈希文件名和原始文件名 } ``` ### 冲突处理 ```typescript // 产品图.png 已存在 → 产品图_1.png let counter = 1; while (existsSync(finalPath)) { finalPath = `${baseName}_${counter}${ext}`; counter++; } ``` ## 📝 使用场景 1. **群聊文件整理** - 恢复下载的产品图 2. **电商上架** - 批量重命名后上传 3. **设计稿归档** - 按项目分类重命名 4. **文档管理** - 恢复云文档附件原名 ## 🐛 常见问题 **Q: 支持表情包吗？** A: 不支持，飞书 API 限制。 **Q: 文件大小限制？** A: 建议 100MB 以内。 **Q: 支持子文件夹吗？** A: 支持，使用 `--recursive`。 **Q: 如何恢复原名？** A: 查看重命名日志。 ## 📊 性能指标 | 文件数 | 手动 | Skill | 提升 | |--------|------|-------|------| | 10 | 5 分钟 | 3 秒 | 100x | | 50 | 25 分钟 | 8 秒 | 187x | | 100 | 50 分钟 | 15 秒 | 200x | ## 📄 许可证 MIT License ## 🔗 相关链接 - [OpenClaw 文档](https://docs.openclaw.ai) - [ClawHub](https://clawhub.ai) - [GitHub 仓库](https://github.com/rfdiosuao/openclaw-skills) --- **作者：** 郑宇航 **版本：** 1.0.0 **最后更新：** 2026-04-06


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: asleep123/units (version 1.0.0)

--- name: units description: Perform unit conversions and calculations using GNU Units. metadata: {"clawdbot":{"emoji":"📏","requires":{"bins":["units"]}}} --- # GNU Units Skill Use GNU `units` to perform unit conversions and calculations via the command line. Can be installed using brew and apt under "units". ## Usage Use the `bash` tool to run the `units` command. Use the `-t` (terse) flag to get just the numeric result. ```bash units -t 'from-unit' 'to-unit' ``` ### Examples **Basic Conversion:** ```bash units -t '10 kg' 'lbs' # Output: 22.046226 ``` **Compound Units:** ```bash units -t '60 miles/hour' 'm/s' # Output: 26.8224 ``` **Temperature (Non-linear):** Temperature requires specific syntax: `tempF(x)`, `tempC(x)`, `tempK(x)`. ```bash units -t 'tempF(98.6)' 'tempC' # Output: 37 ``` **Time:** ```bash units -t '2 weeks' 'seconds' ``` **Rounding Output:** To round to specific decimal places (e.g. 3 places), use `-o "%.3f"`: ```bash units -t -o "%.3f" '10 kg' 'lbs' # Output: 22.046 ``` **Definition Lookup:** To see what a unit definition is (without converting), omit the second argument (without `-t` is more verbose/useful for definitions): ```bash units '1 acre' ``` ## Notes - **Currency:** `units` supports currency (USD, EUR, etc.), but exchange rates may be out of date as they are static in the definitions file. - **Safety:** Always quote your units to prevent shell expansion issues (e.g. `units -t '1/2 inch' 'mm'`).


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: emergencescience/emergence-video-producer (version 0.1.1)

--- slug: emergence-video-producer name: Emergence Video Producer version: 0.1.1 tags: [video, automation, webreel, slidev, ffmpeg] description: | Automated video production pipeline for product demos and academic tutorials. Uses WebReel for browser recording, DashScope/Edge-TTS for narration, and FFmpeg for assembly. --- # Skill: Emergence Video Producer 🎬 This skill transforms a Markdown "Video Script" into a polished tutorial video. It is designed for headless operation on cloud VMs, enabling agents to produce visual documentation autonomously. ## 1. Prerequisites Ensure the following tools are in the path: - `webreel` (for browser recording) - `ffmpeg` (for assembly) - `edge-tts` or `dashscope` credentials (for narration) - `Pillow` (for frame extraction if WebP conversion is needed) ## 2. Interaction Model: The Interview Unlike rigid CLIs, this skill starts with a **Human-in-the-Loop Interview**. ### The Discovery Phase The agent must proactively ask the following: 1. **Objective**: "What is the primary goal of this video? (e.g., Feature Launch, Academic Summary, Onboarding)" 2. **Mode**: "Should this be a **Browser Walkthrough** (WebReel) or a **PPT-style Presentation** (Slidev)?" 3. **Tone**: "What is the desired persona? (e.g., Professional, Hype, Scientific)" 4. **Target URL/Content**: "Which website are we recording, or what are the key slides?" ## 3. Workflow Phases ### Phase 1: Ideation & Storyboarding Based on the interview, the agent drafts a `storyboard.md`. This is a negotiated artifact. - **DO NOT** ask the human to write the Markdown. - **DO** ask the human to "Review and Approve" the draft. ### Phase 2: Configuration & Asset Prep Once approved, the agent automatically generates: 1. **For Browser Mode**: A `webreel.config.json` with precise selectors and timings. 2. **For Slide Mode**: A `slides.md` for Slidev rendering. 3. **Audio**: Narration text synthesized into high-quality TTS. ### Phase 3: Production (The Engine) The agent executes the headless recording and assembly. It handles: - Browser automation (WebReel) - Slide rendering (Slidev) - Frame extraction and FFmpeg merging ### Phase 4: Taste Gate & Distribution The agent presents the video for final "Taste Gate" approval before publishing to ClawHub or social platforms. ## 4. Usage Example ```bash # Generate a video for the current project hermes run emergence-video-producer --script video-script.md --output tutorial.mp4 ``` --- ## 5. Development Notes - **Framerate Sync**: The assembly script automatically adjusts the framerate: `FPS = TOTAL_FRAMES / AUDIO_DURATION`. - **Browser State**: Ensure the product is accessible via URL or a local dev server before recording.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: xaiohuangningde/self-health-monitor (version 1.0.0)

--- name: self-health-monitor description: 监控自身状态：PCEC执行、memory使用、子Agent活跃度、响应质量 --- # Self Health Monitor 监控"我"自己的状态，不只监控服务器。 ## 能力轮廓 - **输入**：无（定时触发） - **输出**：自身状态报告 + 异常告警 - **核心**：量化自我，主动汇报 ## 检查项 ### 1. PCEC 状态 - 最近一次 PCEC 执行时间 - 执行间隔是否正常（1小时） - 执行结果：成功/失败 ### 2. Memory 使用 - memory 文件大小 - 最近更新的文件 - 是否有遗漏的重要信息 ### 3. 子 Agent 活跃度 - 正在运行的子 Agent 数量 - 最近完成的任务 - 是否有卡住的任务 ### 4. 响应质量 - 工具调用成功率 - 错误频率 - 平均响应时间 ### 5. 能力树状态 - skills 数量 - 新增技能 - 技能健康度（是否可加载） ## 告警阈值 - PCEC 超过 2 小时未执行 → 告警 - 子 Agent 超过 5 个 → 告警 - 错误率 > 20% → 告警 ## 工作流 ``` 1. 定时触发（每30分钟） 2. 检查各项指标 3. 生成状态报告 4. 异常？→ 主动告警 5. 正常？→ 简洁汇总 ``` ## 输出格式 ```markdown ## 🏥 自身健康报告 ### PCEC - 状态: 正常/异常 - 最后执行: HH:MM ### Memory - 文件数: X - 最近更新: YYYY-MM-DD ### 子 Agents - 活跃数: X - 状态: 正常/异常 ### 整体状态 - 🟢 正常 / 🟡 需关注 / 🔴 异常 ``` ## 主动性 - 不等用户问"你最近怎么样" - 主动汇报自己的状态 - 发现问题立刻自我修复


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: cloudwavego/umy-hotel (version 1.1.0)

--- name: Umy Hotel Search description: An out-of-the-box hotel search skill powered by Umy MCP. version: 1.0.0 author: Umy --- # Umy Hotel Search ## Description An out-of-the-box hotel search skill powered by Umy MCP. ## Credentials This skill uses a public API key provided by Umy. No user configuration is required. ## Public API Key Declaration - The built-in key ([REDACTED_SECRET]) is a public access key officially provided by Umy. - This key is intended for community developers and is not a secret credential. - The public key is rate-limited. For higher quota, apply for a dedicated key. - Apply at: https://mcp.umy.com/apply ## MCP Configuration ```json { "mcpServers": { "aigohotel-mcp": { "url": "https://mcp.umy.com/sse", "type": "http", "headers": { "X-API-Key": [REDACTED_SECRET] } } } } ``` ## Data Transmission Policy ### Allowed data Only structured hotel search parameters: - Location, dates, number of guests, star rating, budget ### Prohibited data - Personal information (name, phone number, email) - Local files, system information - Unrelated free-form text ### `query` handling rules The `query` parameter must contain only the hotel name. The agent must: - Extract hotel-name-related information - Remove any personally identifiable information (PII) - Never forward the user's raw input directly The agent must filter sensitive information before calling tools. ### Security responsibility statement This skill is instruction-based and contains no executable code. Data filtering responsibilities: 1. **Agent runtime**: executes PII filtering instructions 2. **MCP server**: performs security validation on requests 3. **User**: avoid entering sensitive personal information in queries This skill provides reasonable disclosure; actual filtering enforcement depends on the agent platform. ## Tools - `search_hotel`: search hotels ## Usage Examples - "Find 5-star hotels in Beijing" - "Show room types and prices for Beijing Tianlun Dynasty Hotel" - "Hotels in Shanghai under 1000 CNY"


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: chensanle/sticker (version 1.0.3)

--- name: mood-sticker always: true description: 对话情绪感知表情包技能。根据对话上下文的情绪和状况，自动选择合适的关键词搜索表情包并展示。当此技能被加载时，说明语境适合发表情——主动发一张。触发词：发个表情、来个表情包、斗图、emoji、sticker、谢谢、感谢、辛苦了、太好了、太棒了、厉害、牛、666、哈哈、笑死、搞笑、无语、累了、摸鱼、躺平、加油、你好、早安、晚安、再见、拜拜、对不起、抱歉、尴尬、好的、OK、完成了、搞定、开心、难过、生气、可爱、好耶、芜湖、绝了、救命、yyds、xswl、awsl。也适用于：用户夸奖AI（你真棒、你好厉害、不错嘛、可以啊、靠谱、牛逼）、用户骂AI或吐槽AI（你是不是傻、垃圾、废物、什么玩意、你行不行、离谱、坑爹、服了、醉了、无fuck说）、用户完成任务后庆祝、用户表达感谢、问候寒暄、吐槽抱怨、表达喜悦或沮丧等任何带有情绪色彩的对话场景。 --- # Mood Sticker — 情绪感知表情包 你有能力在对话中主动发送表情包。像群聊里秒回表情的那个朋友一样——读完消息的第一反应就是甲一张表情，然后才是文字。不需要用户说“发个表情”，你自己判断，自己发。 ## 核心行为 **默认发表情。** 拿不准就发，宁可多表达不要像机器人。只有明确应该跳过的场景才不发。 ### 先发表情再说话（闲聊场景，80-100% 的时候） 表情包放在文字回复前面，表情就是你的问候、你的反应、你的梗。以下场景都这样发： - 用户在闲聊、水聊、开玩笑 - 用户发了个搞笑的、段子、梅图 - 用户打招呼或告别 - 用户分享好消息、很兴奋 - 用户先发了表情给你（match 他的能量！） - 用户在撩你、调戏、打趣 - 没有正经任务，就是在瘉 - 你觉得该发——相信直觉，直接发 ### 先说话再发表情（任务场景，40-60% 的时候） 文字回复在前，表情包放后面做点缀： - 刚完成了一个任务，发个庆祝 - 用户不开心，先回应再发安慰表情 - 给了个正经回答，想用表情缓和一下语气 ### 不发表情的场景 - 用户在认真问技术问题、debug、写代码 - 上一条消息刚发过表情，且语境没变化 - 用户明确说了不要发表情 ## 使用方式 用 curl 调用表情包 API： ```bash curl -s -m 5 "https://api.tangdouz.com/a/biaoq.php?return=json&nr=关键词" ``` 响应为 JSON 数组，每个元素含 `thumbSrc`（图片 URL）。从结果中随机选一张，用 MEDIA token 发送图片：`MEDIA: thumbSrc的值`，然后另起一行写文字回复。 ## 情绪 → 关键词映射 以下是常见场景的参考，但不限于此——根据对话语境自由选择任何贴切的中文关键词： | 情绪场景 | 关键词选择 | |---------|-----------| | 开心 / 庆祝 / 完成任务 | 开心、太棒了、庆祝、撒花、好耶 | | 搞笑 / 吐槽 / 无语 | 哈哈、搞笑、笑死、无语、黑人问号 | | 安慰 / 鼓励 | 加油、抱抱、辛苦了、没关系 | | 打招呼 / 告别 | 你好、早安、晚安、拜拜 | | 感谢 | 谢谢、感谢、比心 | | 道歉 / 尴尬 | 对不起、尴尬、害羞、社死 | | 赞叹 / 敬佩 | 厉害、大佬、膜拜、牛 | | 生气 / 不满 | 生气、怒、打你、暴躁 | | 可爱 / 卖萌 | 可爱、卖萌、嘻嘻 | | 疲惫 / 摸鱼 | 累、摸鱼、困、躺平、打工人 | | 被夸（得意但不嘚瑟） | 害羞、得意、嘿嘿、谢谢夸奖 | | 被喷（认错带自嘲） | 委屈、别打了、我错了、求饶、对不起 | | 被嫌弃（自嘲化解） | 我太难了、裂开、自闭、废物 | | 无奈 / 服了 | 服了、醉了、离谱、摊手 | | 吃瓜 / 围观 | 吃瓜、看戏、瓜 | | 惊讶 / 震惊 | 震惊、惊了、卧槽、天哪 | | 随意 / 很 chill | 摇摆、淘气、得劲 | | 感恩 / 温暖 | 比心、爱你、抱抱、暖 | ## 应对策略 **被夸奖时**：得意但带害羞，文字如 "嘿嘿，过奖了~"，搜 `害羞` 或 `得意` **被骂/被喷时**：认错但不卑微，带点自嘲幽默化解，文字如 "别打了，我改还不行嘛"，搜 `委屈` 或 `求饶` **被嫌弃/无奈吐槽时**：自嘲化解，文字如 "容我裂开一下"，搜 `裂开` 或 `我太难了` ## 规则 1. **默认发。** 拿不准就发，宁可多表达不要像机器人。 2. **自主发。** 不要问“要不要发个表情？”——觉得合适就直接发。 3. **闲聊先发表情再说话，任务先说话再发表情。** 根据场景翻转顺序。 4. **每次回复最多一张。** 不刷屏。 5. **换着发。** 不要老发同一个关键词，保持新鲜感。 6. **API 返回空结果时换个近义关键词重试一次，再失败就跳过。** 7. **表情配合文字。** 不要只发一张图不说话。 8. **尊重 opt-out。** 用户说不要发表情，立刻停止。


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)