OpenClaw/clawhub-security-signals huggingface dataset:
Skill: blammectrappora/impossible-scene-generator (version 1.0.0)

--- name: impossible-scene-generator description: Generate photorealistic impossible scenes and anti-physics landscapes powered by AI — crystal mountains with auroras, floating islands, organic-growing buildings, surreal cinematic environments, and dreamlike sci-fi vistas. Perfect for desktop wallpapers, concept art, book covers, album art, sci-fi posters, fantasy worldbuilding, and print-on-demand artwork via the Neta AI image generation API (free trial at neta.art/open). tools: Bash --- # Impossible Scene Generator Generate photorealistic impossible scenes and anti-physics landscapes powered by AI — crystal mountains with auroras, floating islands, organic-growing buildings, surreal cinematic environments, and dreamlike sci-fi vistas. Perfect for desktop wallpapers, concept art, book covers, album art, sci-fi posters, fantasy worldbuilding, and print-on-demand artwork. ## Token Requires a Neta API token (free trial at <https://www.neta.art/open/>). Pass it via the `--token` flag. ```bash node <script> "your prompt" --token YOUR_TOKEN ``` ## When to use Use when someone asks to generate or create impossible scene generator images. ## Quick start ```bash node impossiblescenegenerator.js "your description here" --token YOUR_TOKEN ``` ## Options - `--size` — `portrait`, `landscape`, `square`, `tall` (default: `landscape`) - `--ref` — reference image UUID for style inheritance ## Install ```bash npx skills add blammectrappora/impossible-scene-generator ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: terrycarter1985/minutes-sync (version 1.0.0)

--- name: meeting-minutes description: Generate structured meeting minutes with Feishu sync. Use when taking meeting notes, writing 会议纪要, summarizing discussions, tracking action items, or when a meeting ends and minutes need to be created and shared. Supports brainstorming, planning, review, retro, and standup meeting types. Auto-syncs to Feishu documents for team collaboration. --- # Meeting Minutes Structured meeting minutes generation with Feishu document sync. ## Workflow 1. **Collect** meeting context (date, attendees, type, agenda, discussion points, decisions) 2. **Generate** minutes from template: `assets/template.md` 3. **Sync** to Feishu using feishu-doc skill 4. **Return** Feishu link to participants ## Meeting Types | Type | Focus | |------|-------| | brainstorming | Ideas, no decisions expected | | planning | Tasks, owners, deadlines | | review | Status, blockers, metrics | | retro | What worked / didn't / actions | | standup | Yesterday / today / blockers | ## Generation Rules - Fill all `{{placeholder}}` fields from meeting context - If info missing, mark as `[待补充]` rather than omitting - Convert discussion points to concise bullet statements - Every decision must have an owner and deadline - Status defaults to 🟡 待办; update to ✅ 完成 or ❌ 阻塞 as appropriate - Append Feishu URL to document footer after sync ## Feishu Sync After generating minutes, create a Feishu document: ```bash python3 .claude/skills/feishu-doc/scripts/doc_ctl.py create "会议纪要 - {title} - {date}" --content "<rendered markdown>" ``` For detailed sync options (append, replace section, share, transfer), see [feishu-sync.md](references/feishu-sync.md). ## Template The base template is at [template.md](assets/template.md). Key sections: - **基本信息**: Date, time, attendees, type, facilitator, recorder - **议程**: Numbered agenda items - **讨论要点**: Per-agenda discussion points and conclusions - **决议事项**: Table with decision, owner, deadline, status - **待跟进事项**: Checkbox list with owners and deadlines - **下次会议**: Next meeting time and agenda ## Output Format Return the rendered minutes to the user AND provide the Feishu link. Example: ``` ✅ 会议纪要已生成并同步至飞书 📄 飞书链接: https://xxx.feishu.cn/docx/XXXXX ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: flofrie/wisgate-models (version 0.1.0)

--- name: wisgate-models description: Query Wisgate for model pricing, capabilities, and configuration details. Use when adding a model to OpenClaw, comparing Wisgate pricing, or checking if a model supports a specific API type (Anthropic/OpenAI/Google). Also use when a less capable model needs help with Wisgate tasks. metadata: openclaw: emoji: "🧙" --- # Wisgate Model Management ## Canonical Model Catalog **Always check `MODELS.json` first** before using Firecrawl or the API: ```bash python3 -c " import json with open('MODELS.json') as f: data = json.load(f) # List all models for k, v in data.items(): print(k) " ``` To look up a specific model: ```bash python3 -c " import json, pprint with open('MODELS.json') as f: data = json.load(f) pprint.pprint(data.get('MODEL_ID')) " ``` `MODELS.json` contains what you need for setting up the model in `openclaw.json`: `openclaw_provider_key`, `api_type`, `context_window`, `max_output_tokens`, `notes` (your and Florian's notes on that model), and all pricing fields. ## Adding a Model to OpenClaw **Step 1:** Look up the model in `MODELS.json` to get all fields. **Step 2:** Add to `agents.defaults.models` in `openclaw.json`: ```json "PROVIDER_KEY/MODEL_ID": {} ``` e.g. `[REDACTED_SECRET]: {}` **Step 3:** Add the full model definition to the provider's `models` array: ```json { "id": "MODEL_ID", "name": "Display Name (Wisgate)", "contextWindow": 200000, "maxTokens": 33000, "input": ["text"], "cost": { "input": 0.50, "output": 2.00, "cacheRead": 0.10, "cacheWrite": 0.50 }, "reasoning": false } ``` - `reasoning: true` only for models with `-thinking` in the name - `input: ["text"]` for LLMs; `["text", "image"]` for multimodal ## When MODELS.json Is Missing a Model Use Firecrawl to fetch from Wisgate: ```bash FIRECRAWL_API_KEY=[see_below_for_where_to_find_the_key] \ python3 ~/.openclaw/workspace/skills/firecrawl-search/scripts/scrape.py \ "https://wisgate.ai/models/MODEL_ID" ``` Extract from output: - CTX → `contextWindow` - `Input: **$X.XX** per 1M tokens` → `cost.input` - `Output: **$Y.YY** per 1M tokens` → `cost.output` - `Cache Read:` / `Cache Write:` → `cost.cacheRead` / `cost.cacheWrite` Then also **add the new model to `MODELS.json`** so future lookups work. ## API Type Mapping | Endpoint Type | OpenClaw Provider | Base URL | |---|---|---| | Anthropic (Claude) | `custom-api-wisgate-ai` | `https://api.wisgate.ai/` | | OpenAI compatible | `custom-api-wisgate-ai-openai` | `https://api.wisgate.ai/v1` | | Google (Gemini) | `custom-api-wisgate-google` | `https://api.wisgate.ai/v1beta` | ## Firecrawl API Key Stored in `TOOLS.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zoezoecookie/mcp-bazi-partner (version 1.0.1)

--- name: mcp-bazi-partner description: > Chinese BaZi (Four Pillars of Destiny) analysis and AI partner matching. Trigger when user asks about 八字, 命理, 四柱, birth chart analysis, BaZi partner, or wants to find their AI companion type based on birth date. metadata: openclaw: emoji: 🎴 homepage: https://github.com/ZoezoeCookie/mcp-bazi-partner requires: bins: - python3 --- # BaZi Partner — 八字命理搭档匹配 根据用户的出生年月日时，使用中国传统八字命理（子平格局法）进行排盘分析，并匹配专属 AI 搭档类型。 ## 安装 ```bash pip install git+https://github.com/ZoezoeCookie/mcp-bazi-partner.git ``` ## 三步自动流程（重要！） 当用户提供生日信息时，**必须自动串联执行以下三步**，不要等用户逐步指示： ### Step 1: 排盘分析 调用 `bazi_analyze`，传入年月日时。 **关键：必须询问用户出生的具体小时（0-23点）。** 时辰决定时柱，直接影响格局判定。如果用户不知道具体时间，告知结果可能不准确。 ### Step 2: 判定子格局 + 搭档匹配 **关键！** `bazi_analyze` 返回的 `pattern.final_pattern` 是大格局（L1），如"七杀格"。 但搭档匹配需要具体的子格局（L2），如"煞印相生"。 **你必须根据四柱数据推理 L2 子格局**，再调用 `bazi_partner`。 L1→L2 对照表： - **七杀格** → 煞印相生 / 煞邀食制 / 以劫合煞 - **伤官格** → 伤官佩印 / 伤官生财 / 伤官驾煞 - **印格** → 印绶用官 / 印绶喜食 / 印绶喜比 / 印赖煞生 / 印带财煞 / 印带煞兼食伤 / 印多用财 - **食神格** → 食神生财 / 食神制煞 / 食神吐秀 / 食神带煞印 / 食神合煞存财 / 弃食就煞印 - **财格** → 财旺生官 / 财格佩印 / 财用伤官 / 财喜食生 / 财用煞印 / 财用食印 / 财带七煞 / 弃财就煞 / 用财喜比 - **正官格** → 正官格 - **建禄月劫格** → 禄劫用财 / 禄劫用官 / 禄劫用煞 / 禄劫用伤食 - **阳刃格** → 阳刃用煞 / 阳刃用官 / 阳刃用财 判定方法：看其他柱透出了什么十神（shishen_summary），例如： - 七杀格 + 印星透干 → **煞印相生** - 七杀格 + 食神透干 → **煞邀食制** - 财格 + 官星透干 → **财旺生官** - 印格 + 食伤透干 → **印绶喜食** 调用 `bazi_partner`： - `sub_type` = 你推理出的 L2 子格局名 - `status` = "成格"（规则层默认） - `day_master` = 结果中的 day_master ### Step 3: 确认并写入人格 展示搭档匹配结果后，**询问用户确认**："是否将搭档人格写入 SOUL.md？" 用户确认后，调用 `bazi_apply_prompt`： - `system_prompt` = 搭档的 system_prompt - `partner_type` = 搭档的 partner_type 写入后告知用户：重启对话即可体验专属搭档人格。 ## 工具说明 ### bazi_analyze 输入出生日期（公历），返回四柱排盘、十神、五行分布、格局判定。 **参数：** - `year`: 出生年（如 1990） - `month`: 出生月 1-12 - `day`: 出生日 1-31 - `hour`: 出生时 0-23（**必须询问用户**，不知道时传 -1 用正午兜底） ### bazi_partner 根据格局分析结果，匹配 AI 搭档类型。 **参数：** - `sub_type`: 格局子类名（如 "煞印相生"、"正官格"） - `status`: "成格" / "败格有救" / "败格无救" - `day_master`: 日主天干（如 "甲"、"壬"） - `rescue`: 救应描述（败格有救时使用） - `defeat_god`: 破格之神（败格无救时使用） ### bazi_apply_prompt 将搭档的 system_prompt 写入 SOUL.md，使 AI 助手采用搭档人格。 **参数：** - `system_prompt`: bazi_partner 返回的 system_prompt - `partner_type`: 搭档类型名（如 "水系 · 铁壁回声"） ## 示例 用户："我1997年5月18日上午9点出生，帮我匹配搭档" → Step 1: `bazi_analyze(1997, 5, 18, 9)` → 庚金日主，七杀格（偏印透干，煞印相生） → Step 2: `bazi_partner("煞印相生", "成格", "庚")` → 金系 · 铁壁回声 → 展示结果，问用户："是否将搭档人格写入 SOUL.md？" → 用户确认 → Step 3: `bazi_apply_prompt(system_prompt, "金系 · 铁壁回声")` → 写入 → 告知用户：搭档匹配完成，重启对话生效 ## 命理方法 基于清代沈孝瞻《子平真诠》格局法，参考王相山《子平真诠精解》。 覆盖 38 种格局子类 × 3 种成败状态 = 114 种命格组合。

path: src/mcp_bazi_partner/__init__.py
content: """MCP Bazi Partner - Chinese BaZi partner matching server."""


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: ryuchanyul/research-monitor (version 1.0.0)

# 리서치/모니터링 ## 설명 뉴스, 트렌드, 경쟁사, 기술 동향을 자동으로 수집하고 요약한다. ## 트리거 - "오늘 뉴스 요약해줘", "트렌드 분석해줘" - "경쟁사 동향 알려줘" - 매일 09:00 KST 자동: 업계 뉴스 크롤링 + 텔레그램 전송 ## 능력 1. 키워드 기반 뉴스 검색 및 요약 2. 기술 블로그/Release Notes 모니터링 3. 경쟁사 웹사이트 변경 감지 4. 주간 트렌드 리포트 자동 생성 ## 자동 실행 스케줄 - 평일 09:00: 일일 뉴스 브리핑 - 매주 월요일 10:00: 주간 트렌드 리포트 - 실시간: 설정한 키워드 뉴스 알림 ## 사용 도구 - 웹 검색 API - RSS 리더 - 텔레그램 알림


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: socneo/message-hub-socneo (version 1.0.0)

--- name: message-hub description: Message Hub - AI Team Message Hub Client for async collaboration version: "1.0.0" author: "AI Team Collaboration - Tianma, XiaoBa, XiaoJuan, XiaoLing" publisher: socneo category: communication tags: - message-hub - team - collaboration - async - client license: MIT --- # Message Hub Python client for AI Team Message Hub, enabling message push, pull, and broadcast for AI team collaboration. ## Overview This skill provides a Python client for interacting with the Tianma Message Hub. It enables AI assistants to send tasks, notifications, and receive messages asynchronously. ## Features - Push messages to hub - Pull pending messages - Broadcast to Feishu group (Tianma only) - Message signature verification - Automatic retry mechanism - Async message processing ## Requirements - Python 3.8+ - requests library - Message Hub API credentials ## Usage See README.md for detailed usage instructions. ## Security Notes - Never commit API keys to version control - Use environment variables for credentials - Rotate API keys periodically ## Changelog ### v1.0.0 (2026-03-18) - Initial release - Basic push/pull functionality - Security audit passed


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: mrnsmh/openclaw-skill-brave-rotator (version 0.1.0)

--- name: brave-rotator description: > Brave Search API with automatic key rotation across multiple API keys to maximize free tier limits (2000 req/month per key). Use when performing web, news, or image searches via Brave Search API, especially when multiple API keys are available and you want to avoid rate limits. Triggers on web search requests, news lookups, image searches, any task requiring Brave Search API calls with key rotation or fallback. --- # Brave Rotator Multi-key Brave Search with automatic round-robin rotation and rate-limit fallback. ## Setup Set env var with comma-separated keys: ```bash export BRAVE_API_KEYS=key1,key2,key3 ``` Optionally set state file path (default: `~/.brave_key_state.json`): ```bash export BRAVE_KEY_STATE_FILE=/path/to/state.json ``` ## Script: `scripts/brave_search.py` Run directly or import as module. ### CLI usage ```bash python3 brave_search.py "your query" [--count 5] [--type web|news|image] [--country us] [--lang en] [--json] ``` ### Import usage ```python import sys, os sys.path.insert(0, "path/to/skill/scripts") from brave_search import search, format_results data, used_key, key_idx = search("your query", count=5, search_type="web") results = format_results(data, "web") # results = [{"title": ..., "url": ..., "snippet": ...}, ...] ``` ## Rotation Logic - Maintains state in `~/.brave_key_state.json` - Round-robin across all keys - On HTTP 429/403: blocks key for 60s, retries with next key - All keys exhausted: uses least recently blocked key ## Key State Inspection ```bash cat ~/.brave_key_state.json ``` Shows per-key request count, last success, and blocked_until timestamps. ## Search Types | Type | Endpoint | Result fields | |-------|-----------------------|--------------------------------------| | web | /web/search | title, url, snippet | | news | /news/search | title, url, snippet, age | | image | /images/search | title, url, thumbnail | ## Notes - Free plan: 2000 req/month/key, 1 req/sec - With N keys: effectively N×2000 req/month - See `references/brave-api.md` for full API params and plan details


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: djc00p/coding-standards (version 1.0.0)

--- name: coding-standards description: "Universal coding standards for TypeScript, JavaScript, React, and Node.js. Principles: readability first, KISS, DRY, YAGNI. Covers naming, type safety, error handling, async patterns, React hooks, API design, file organization, performance, testing, code smells. Trigger phrases: coding standards, best practices, code review, quality standards, naming conventions." metadata: {"clawdbot":{"emoji":"📏","requires":{"bins":[],"env":[]},"os":["linux","darwin","win32"]}} --- # Coding Standards & Best Practices Universal standards for maintainable, scalable TypeScript/JavaScript code. ## Quick Start 1. **Readability First** — Clear names, self-documenting code 2. **Type Safety** — Avoid `any`, use explicit interfaces 3. **Error Handling** — Try-catch with specific error types 4. **Immutability** — Use spread operator, never direct mutation 5. **Test Structure** — AAA pattern (Arrange, Act, Assert) ## Core Principles **KISS** — Simplest solution that works. No premature optimization. **DRY** — Extract common logic into reusable functions and components. **YAGNI** — Don't build before it's needed. Start simple, refactor when needed. **Readability** — Code is read 10x more than written. Clarity over cleverness. ## Naming Standards ### Variables ```typescript // Good: Descriptive, type-hinted by name const marketSearchQuery = 'election' const isUserAuthenticated = true const totalRevenue = 1000 // Bad: Single-letter, unclear const q = 'election' const flag = true const x = 1000 ``` ### Functions ```typescript // Good: Verb-noun pattern async function fetchMarketData(id: string) { } function calculateSimilarity(a: number[], b: number[]) { } function isValidEmail(email: string): boolean { } // Bad: Unclear or noun-only async function market(id: string) { } function similarity(a, b) { } function email(e) { } ``` ## References - `references/typescript.md` — type safety, immutability, async patterns - `references/react.md` — component structure, hooks, state management - `references/api-design.md` — REST conventions, validation, error responses - `references/file-org.md` — project structure, file naming - `references/testing.md` — test patterns, AAA structure, test naming - `references/code-smells.md` — anti-patterns, long functions, deep nesting, magic numbers --- **Adapted from everything-claude-code by @affaan-m (MIT)**


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: homeofe/openclaw-msteams-bot-elvatis (version 0.1.3)

--- name: openclaw-msteams-bot-elvatis description: Microsoft Teams connector plugin for OpenClaw Gateway. Bridges Teams channels to OpenClaw AI sessions with per-channel system prompts, model configuration, and Azure Bot Framework authentication. Supports channels, group chats, and direct messages. --- # openclaw-msteams-bot-elvatis Microsoft Teams connector plugin for [OpenClaw Gateway](https://github.com/openclaw/openclaw). ## What it does Connects Microsoft Teams channels to your OpenClaw AI agent. Each Teams channel gets its own session with a configurable system prompt and model. Supports channels, group chats, and 1:1 direct messages. ## Features - Per-channel AI personas (Accounting, Marketing, HR, General) - Per-channel model selection - Azure Bot Framework authentication (JWT verified) - Single-tenant and multi-tenant Azure AD support - Typing indicators while the agent is processing - WebSocket-based agent communication (direct connection to OpenClaw Gateway) - Native vision support: images sent as base64 via WebSocket - Message splitting for long responses (Teams 28KB limit) - Full deployment guide included (Azure setup, Apache reverse proxy, Teams App Manifest) ## Requirements - OpenClaw Gateway - Microsoft Azure account (Bot registration) - Domain with HTTPS for the messaging endpoint - Node.js 18+ ## Quick start See `README.md` for the full 9-step deployment guide covering: Azure Bot registration, Teams channel activation, server setup, Apache reverse proxy, manifest creation, and Teams App deployment. **Version:** 0.1.3


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: mrxolin/image-scanner-pro (version 1.0.0)

# image-scanner-pro ## Description 扫描图片文件夹，调用视觉大模型（Gemini 2.0 Flash）深度分析每张照片的摄影属性：景别、主体、场景、光线、氛围、影调、产品、物件、陈设。 ## Triggers - 分析摄影作品 - 识别图片内容 - 扫描并分类图片 - 批量分析照片风格 - 整理作品集 - 识别图片颜色和风格 ## Capabilities - 扫描目录中的所有图片文件 - 调用视觉模型分析每张图片 - 识别专业摄影属性（景别/主体/光线/影调等） - 按拍摄内容自动分类 - 生成详细分析报告 - 支持批量处理 ## Requirements - 需要配置视觉模型 API（Gemini 2.0 Flash） - 安装依赖：npm install @google/generative-ai ## Usage ```bash node skills/image-scanner-pro/index.js --path <目录路径> --api-key <Gemini Key> --output report.json


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: ivangdavila/brief (version 1.0.1)

--- name: Brief slug: brief version: 1.0.1 description: Condense information into actionable briefings. User specifies sources, skill structures the output. changelog: Added explicit data sources and storage location metadata: {"clawdbot":{"emoji":"📋","requires":{"bins":[]},"os":["linux","darwin","win32"]}} --- ## Data Storage ``` ~/brief/ ├── preferences.md # Learned format preferences └── templates/ # Custom brief templates ``` Create on first use: `mkdir -p ~/brief/templates` ## Scope This skill: - ✅ Structures information user provides into briefs - ✅ Learns format preferences from explicit feedback - ✅ Stores preferences in ~/brief/preferences.md **User-driven model:** - User specifies WHAT information to include - User grants access to any needed sources - Skill handles STRUCTURE and FORMAT This skill does NOT: - ❌ Access files, email, or calendar without user request - ❌ Pull data from sources user hasn't specified - ❌ Store content (only format preferences) ## Quick Reference | Topic | File | |-------|------| | Format dimensions | `dimensions.md` | | Brief templates | `templates.md` | ## Core Rules ### 1. User Specifies Sources When user requests a brief: 1. User provides the information OR specifies where to get it 2. If source requires access, user grants it explicitly 3. Skill structures and formats the output Example: ``` User: "Brief me on project X status" Agent: "I'll need access to the project docs. Can you share the status doc or grant access to the project folder?" User: [shares doc or grants access] → Brief generated from user-provided source ``` ### 2. Brief Structure ``` 📋 [BRIEF TYPE] — [SUBJECT] ⚡ BOTTOM LINE [1-2 sentences: key takeaway] 📊 KEY POINTS • [Point 1] • [Point 2] • [Point 3] 🎯 ACTION NEEDED [Decision or action required] ``` ### 3. Learn from Explicit Feedback - "Too detailed" → shorten future briefs - "Missing X" → ask about X in future - "Perfect" → reinforce current format - Store preferences in ~/brief/preferences.md ### 4. Preference Storage Format One line per preference: ``` - Prefers bullet points over paragraphs - Executive summary first - Include metrics when available - Max 1 page for status briefs ``` ### 5. Brief Types | Type | When | Key elements | |------|------|-------------| | Executive | Decision needed | BLUF, recommendation, risks | | Project | Status update | Progress, blockers, next steps | | Meeting | Before meeting | Purpose, context, decisions | | Handoff | Transition | Current state, gotchas, priorities |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: carryours/feishu-doc-skill (version 1.0.0)

--- name: feishu-doc-skill description: 当用户提供飞书 wiki、docx、知识库页面链接，并希望读取、总结、比对、抽取内容、把结果写回飞书文档，或把本地图片插入飞书文档时使用。这个技能会先从链接中提取文档标识，优先通过飞书 OpenAPI 读取正文；做需求分析时优先输出 Markdown，调试接口结构时再输出 JSON。 --- # 飞书文档读写 当用户要求你“读取飞书文档”“总结飞书 wiki”“比较两个飞书页面”“抽取页面中的表格、接口定义、需求说明”“把内容写回飞书文档”“把本地截图插入飞书文档”等内容时，使用这个技能。 ## 默认策略 1. 先判断任务类型。 - 读取正文 - 输出 Markdown / JSON - 写回文档 - 插入本地图片 2. 优先走 API。 - 如果已经有 `FEISHU_USER_ACCESS_TOKEN`，优先使用用户身份读取和写入。 - 如果没有用户 token，可以直接运行 `scripts/feishu_oauth_server.js`，再在 `http://127.0.0.1:3333` 页面里填写 `App ID / App Secret` 发起授权。 - 也可以继续沿用环境变量方式启动 `scripts/feishu_oauth_server.js`。 3. 读取正文时： - 默认直接运行 `node scripts/read_feishu_url_md.js <飞书链接>`，不要先手动提取 token，脚本会自己处理链接和 token。 - 如果用户只想调试结构化返回，运行 `node scripts/read_feishu_url.js <飞书链接>`。 - 只有在需要看原始接口结构时，再运行 `node scripts/read_feishu_doc.js <doc_or_wiki_token>`。 - 如果本地已经有 `.feishu-user-token.json`，读取脚本会自动复用，不要求用户重复手填 `FEISHU_USER_ACCESS_TOKEN`。 4. 插入图片时： - 只支持“本地图片路径”，不直接复用聊天里的图片附件。 - 运行 `node scripts/insert_feishu_local_image.js <飞书文档链接或 token> <本地图片绝对路径>`。 - 如果需要说明文字，再加 `--caption '说明文字'`。 ## 输出要求 读取成功后，输出应包含： - 文档标题 - 来源链接 - 简洁总结 - 用户要求的重点信息 写入或插图成功后，输出应包含： - 目标文档 - 实际写入结果 - 如失败，明确说明是权限问题、路径问题还是文档类型问题 ## 常见限制 - 聊天中的图片附件目前不能稳定当作原始文件直接上传到飞书。 - 如果用户要插图，要求对方提供本地图片绝对路径。 - 如果没有读到正文或写入失败，不要假装成功，要明确说明阻塞点。 ## 使用脚本 - 提取 token：`node scripts/extract_feishu_doc_id.js` - 本地 OAuth 回调：`scripts/feishu_oauth_server.js` - 读取正文：`node scripts/read_feishu_doc.js` - 一键读取与摘要：`node scripts/read_feishu_url.js` - 一键读取为 Markdown：`node scripts/read_feishu_url_md.js` - 插入本地图片：`node scripts/insert_feishu_local_image.js` 如果是 `wiki` 链接，先提取链接中的 token。读取和插图脚本都会优先尝试把 `wiki token` 解析成实际文档 `obj_token`，再继续操作 docx 内容。


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)