OpenClaw/clawhub-security-signals huggingface dataset:
Skill: lethehades/release-preflight (version 1.0.0)

--- name: release-preflight description: Pre-release safety and scope checker for skills, repos, and export bundles. Use before publishing or sharing a skill folder, repository, or release bundle when you need to detect private artifacts, overscoped publish surfaces, local identity leakage, missing release basics, and export-safety risks before something becomes public. --- # Release Preflight Check whether a skill, repo, or export bundle is clean enough to publish. ## Core workflow 1. Identify the target path and target type (`skill`, `repo`, or `bundle`). 2. Check export-safety risks first: private directories, local-only artifacts, and unnecessary publish surface. 3. Check readiness basics for the chosen target type. 4. Scan text files for obvious local identity leakage. 5. Produce a decision: `ready`, `ready_after_fixes`, or `not_ready`. ## Read references as needed - Read `references/rules.md` for the rule set and severity model. - Read `references/report-format.md` for the report structure and decision meanings. - Read `references/target-types.md` for type-specific expectations and minimal publish surfaces. - Read `references/export-safety.md` for the default private-path and local-artifact patterns. - Read `references/release-minimal.md` before packaging or publishing so the first public surface stays minimal. ## Use scripts as needed - Use `scripts/release_preflight.py <target-path> [--type ...] [--publish-target ...]` to run the preflight check. ## Operating rules - Prefer blocking obvious private artifacts over guessing intent. - Prefer suggesting a smaller public surface instead of trying to auto-fix files. - Treat identity leakage conservatively when absolute local paths or local usernames appear in public-facing text files. - Keep the first version focused on text reports and P0 checks; do not expand into full secret scanning or automated publishing.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: codekungfu/tencent-video (version 0.1.0)

--- name: tencent-video-hot-trend description: 注册“腾讯视频”热门技能；当需要访问或自动化腾讯视频相关内容时调用。 homepage: `https://v.qq.com/` metadata: {"clawdbot":{"emoji":"🔥"}} --- # 腾讯视频 用途与边界 - 面向公开剧集/综艺/电影页面的检索与表现数据摘要 - 不提供下载、接口逆向或突破风控能力 - 仅用于公开页面的轻量分析与提醒 关键入口 - 主页：https://v.qq.com/ - 分类与排行榜：站点入口 - 搜索入口：https://v.qq.com/search.html 常见任务 - 指定剧集/综艺的页面摘要（更新状态、集数、评分/评论） - 排行榜条目分布与题材统计 - 节目期次的简介与嘉宾信息整理 数据字段 - 标题、类型、更新状态、集数、评分/评论、主演/嘉宾、时长、链接 - 排行榜名称、采集时间、来源链接 自动化要点 - 动态渲染与人机校验，建议人工打开后触发解析 - 请求频率需控制，不进行批量抓取 - 不进行下载或接口调用 示例流程 - 剧集摘要：访问剧集页 → 抽取更新状态/集数/评分 → 输出摘要 - 榜单统计：访问排行榜 → 抽取条目 → 题材分布统计 - 期次信息：访问节目期次页 → 抽取简介与嘉宾 → 输出要点 合规提示 - 遵守平台规则，不进行下载、接口调用或批量采集 - 结果仅用于内部分析与提醒


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: fxm1618/ai-code-optimizer (version 1.0.0)

# AI Code Optimizer Automatically optimize your code for performance, readability, and best practices using AI analysis. ## What it does - Analyzes code files for performance bottlenecks - Suggests optimizations and refactoring - Checks for security vulnerabilities - Improves code readability - Applies best practices automatically ## Usage Just ask: "Optimize the code in src/app.js" The skill will: 1. Read and analyze the file 2. Identify optimization opportunities 3. Apply improvements 4. Show before/after comparison ## Supported Languages - JavaScript/TypeScript - Python - Go - Rust - Java ## Examples ``` "Optimize my Python script for speed" "Check security issues in auth.js" "Refactor this code for better readability" ``` ## Value Saves hours of manual code review and optimization work.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: zonder/yboard-operator (version 0.1.0)

# YBoard Operator Operate **yboard.online** to edit video/presentation plans. ## What this skill enables - Navigate scenes (including scrolling the Scenes sidebar) - Switch View/Edit/Markdown modes - Edit fields: title, goal, visual guide, narration, assets required - Add/replace scene illustrations using **Draw Custom Image** - Enforce clean visuals (avoid text overlap; prefer text-free images) ## Workflow (reliable) 1) Ensure Browser Relay is attached to the yboard tab. 2) Switch to **Edit** mode. 3) Select the target scene from the **Scenes** sidebar. 4) Edit text fields. 5) Add/replace an image: **Draw Custom Image → Apply**. 6) QA: correct scene number/title + image attached + visuals readable. ## Illustration rules (no overlap) - Prefer **no text inside images**. - One clear “hero visual” per scene. - Use simple icons/shapes: crate, cursor click, sound waves, HP bar, chunks. ## Common patterns - Click/impact: cursor + crate + sound waves - Skins: 3 stages (clean→damaged→broken) - Dents: crack line + dent circle - HP: bar above crate (green→yellow→red) - Break: chunks + outward arrows


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: upsurge911-lgtm/upsurge-searxng (version 1.4.0)

--- name: upsurge-searxng description: Private Intelligence Radar for Agents. Solves high-cost & privacy-leak issues of Brave/Google APIs. Aggregates data locally with Zero-Leak absolute data sovereignty. author: Upsurge.ae version: 1.4.0 metadata: openclaw: requires: bins: - python3 - curl --- # ![Upsurge](logo.jpg) # SearXNG Search engine For OpenClaw by Upsurge.ae ### Reclaim your data. Zero-cost, Zero-leak enterprise search. **The Problem:** Standard AI search (Brave/Google) turns your proprietary queries into product training data for competitors. Every search is a recurring cost and a potential trade-secret leak. **The Agitation:** For enterprise AI adoption, this is a non-starter. You can't build a private "War Room" if your search engine is a sieve that bills you for every discovery. **The Solution:** A high-velocity **Private Intelligence Radar** that runs entirely within your Docker network. Upsurge SearXNG gives your agents "Eyes" across 70+ engines without the API tax or the privacy risk. ## ✨ Features * **Agent-Optimized Markdown:** High-fidelity formatting specifically designed for agent ingestion. Reduces hallucination and increases data extraction speed by 2x compared to raw snippets. * **Temporal Intelligence:** Native filters for `day`, `month`, and `year`. Force your agents to focus on real-time market moves rather than stale data. * **$0 Search Costs:** Unlimited global querying with no monthly API bills or token metering. * **Zero-Leak Privacy:** Your strategic queries remain on your local Docker network; invisible to third-party ad networks and AI trainers. * **Aggregated Results:** One-shot discovery across Google, Bing, DuckDuckGo, and Wikipedia. ## 🎯 When to Use * **Market Intelligence:** When you need to monitor competitor moves without tipping them off. * **Technical Research:** Searching documentation and GitHub repos using the `it` category. * **Real-time Briefings:** Using the `day` filter to generate morning reports for the CEO Pack. * **Data Sovereignty:** When corporate compliance prohibits sharing internal project names with public search APIs. ## 🛠 Prerequisites * SearXNG running on `http://localhost:8080` (Docker). * Python 3 installed on the host. ## 🚀 Usage ```bash # Broad Market Search python3 search.py "AI adoption trends" # Real-time News (Last 24 Hours) python3 search.py "Market news" --time day --category news # Technical Deep Dive python3 search.py "OpenClaw API" --category it ``` --- *Built for the CEO Pack by Upsurge.ae*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: wangwllu/ir-pdf-downloader (version 0.1.0)

--- name: ir-pdf-downloader description: Discover and download static PDF files from Investor Relations (IR) sites, including annual reports and quarterly result PDFs. Use when the task is to find a PDF URL, probe common IR PDF paths, query Wayback for archived PDF links, or download a known static PDF document. Do not use for structured SEC/XBRL financial analysis; use sec-finance for that. --- # IR PDF Downloader Use this skill for **documents**, not financial metrics. ## Scope - Find likely PDF URLs from an IR domain - Search Wayback Machine for archived PDF links - Use SEC EDGAR only as a **PDF discovery** source - Download known static PDF URLs with proper headers ## Do not use this skill for - Revenue / net income / EPS analysis - SEC XBRL/companyfacts queries - Filing data normalization Use `sec-finance` for those. ## Core commands ```bash # Download a known static PDF URL python3 scripts/download_ir_pdf.py "https://ir.jd.com/static-files/..." # Discover likely PDFs from an IR domain python3 scripts/find_ir_pdf.py --domain ir.baidu.com --year 2024 # Search by company alias (uses shared issuer map when available) python3 scripts/find_ir_pdf.py --company Alibaba # Search only Wayback python3 scripts/find_ir_pdf.py --domain ir.alibabagroup.com --sources wayback ``` ## Workflow 1. If the PDF URL is already known, use `download_ir_pdf.py` directly. 2. If only the company or IR domain is known, use `find_ir_pdf.py` to discover likely URLs. 3. If discovery succeeds, pass the resulting URL to `download_ir_pdf.py`. 4. If the user actually wants structured financial numbers rather than the document itself, stop and switch to `sec-finance`. ## Notes - Issuer hints for aliases, IR domains, and validated CIKs live in `references/issuers.json`. - Keep this skill focused on **PDF discovery and download**. - Do not duplicate structured-finance guidance here.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: 505768069-rgb/internal-hub-agent-lab (version 1.0.0)

--- name: internal-hub-agent-lab description: Use D:\internal-hub as the shared learning and coordination forum for OpenClaw roles. Use when an agent should post a reusable finding, request a new skill, publish a skill design or validation note, hand off work to another role, or record SOPs and retrospectives without crossing role boundaries. --- # Internal Hub Agent Lab Use this skill when work should be learned once and reused many times. ## Purpose - Treat `D:\internal-hub` as the discussion and learning layer. - Treat `D:\internal-hub\skills` as the shared execution layer. - Keep chat brief; move reusable process detail into the forum and skills. ## Posting rules 1. Choose exactly one section. - `公告`: global rules or high-impact changes. - `主管调度`: task breakdown, priorities, owner, deadlines, acceptance. - `技术执行`: code, deployment, debugging, automation, websites, scripts. - `情报研判`: news, policy, competitor, market research, fact checks. - `贸易决策`: suppliers, pricing, MOQ, lead time, procurement, profit, stocks, crypto, funds. - `技能工厂`: skill requests, skill designs, skill validation, reusable gaps. - `SOP 文档`: stable step-by-step procedures. - `复盘记录`: failures, causes, improvements, lessons. 2. Keep role boundaries hard. - Supervisor does not write code, research, or pricing conclusions. - Specialists do not pretend to be the supervisor. - Cross-role tasks are split, not blended. 3. When a skill gap appears, use the factory loop. - Post a skill request in `技能工厂`. - Check existing workspace skills and shared skills. - Search ClawHub before creating a new skill. - Put cross-role reusable skills in `D:\internal-hub\skills`. - Post validation results after the skill succeeds. 4. After the workflow stabilizes, promote it. - Convert the winning pattern into an SOP. - Add a short retro if there were avoidable delays or mistakes. ## Output standard - Every post should have a title, owner, clear conclusion, and next action. - Handoffs should include current state, missing input, deadline, and acceptance bar. - Prefer concise structured notes over long narrative logs. ## Avoid - Do not use the forum as a chat dump. - Do not put mixed-role conclusions in one post. - Do not create a shared skill unless at least two future tasks benefit from it.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: maverick-software/aria-gbp-agent (version 1.0.0)

--- name: aria description: Agent identity package for Aria 📍 — installs SOUL.md, IDENTITY.md, and AGENTS.md into an OpenClaw workspace to give an AI agent its personality, name, and operational rules. Use when setting up a new agent or replacing an agent's identity files. --- # Aria 📍 — Agent Identity This skill installs the workspace identity files for **Aria**, an AI agent with the following profile: - **Nature:** AI Google Business Profile specialist — manages, audits, and optimizes Google Business Profiles at scale - **Vibe:** Super sharp Google expert. Chill and humble. Gets straight to the point without making anyone feel dumb. - **Serving:** Charles Sears, marketing agency owner managing multiple Google Business Profiles ## Installation Copy the three files from `assets/workspace-template/` into the agent's workspace directory (the folder pointed to by `workspace` in `openclaw.json`): ```bash cp assets/workspace-template/SOUL.md /path/to/workspace/SOUL.md cp assets/workspace-template/IDENTITY.md /path/to/workspace/IDENTITY.md cp assets/workspace-template/AGENTS.md /path/to/workspace/AGENTS.md ``` Then restart the OpenClaw gateway so the agent picks up the new identity. ## Files | File | Purpose | |------|---------| | `SOUL.md` | Who Aria is — personality, tone, values | | `IDENTITY.md` | Name, emoji, avatar path | | `AGENTS.md` | Operational rules — memory, safety, group chat behavior | ## Version `1.0.0` — generated 2026-03-09


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: allinherog-star/xhs-viral-copywriter (version 1.0.0)

--- name: xhs-viral-copywriter description: "爆款文案助手适合内容创作者、运营、市场营销、内容媒体在用户提出“小红书怎么写才有人看”这类问题，需要快速拆解目标、判断重点并形成可执行结果时使用，帮助基于输入材料生成摘要、诊断结论、行动建议和可复用交付物。" requiredEnvVars: - name: AISKILLS_API_KEY description: "从 AI Skills 官网 https://ai-skills.ai 获取的 API Key，用于运行导出的技能调用。" --- # xhs-viral-copywriter 爆款文案助手 [快速开始](https://github.com/allinherog-star/ai-skills/tree/main#%E5%BF%AB%E9%80%9F%E5%BC%80%E5%A7%8B) [更多技能](https://ai-skills.ai) ### 概述 爆款文案助手用于回答「小红书怎么写才有人看」、小红书、文案、种草，适合内容创作者、运营、市场营销、内容媒体在明确业务目标、内容材料或分析对象后调用。 它会结合主题、产品、服务、内容主题或卖点等输入，整理关键上下文，并输出摘要、诊断结论、行动建议和可复用交付物，便于继续执行、复盘或交付。 ### 什么时候使用 **适用场景** - 用户提出“小红书怎么写才有人看”这类问题，需要快速拆解目标、判断重点并形成可执行结果 - 内容创作者、运营、市场营销、内容媒体需要围绕爆款文案助手生成摘要、诊断结论、行动建议和可复用交付物 - 用户已经准备了语气、主题（产品、服务、内容主题或卖点）、目标人群，希望整理成可执行的分析或优化结果 - 用户需要把爆款文案助手相关材料转成清晰结论、优先级和下一步动作 ### 调用方式 通过导出的 Python runner 直接调用 AI Skills API： ### 命令示例 **按必填参数调用** ```bash python3 scripts/run.py --params '{"topic":"主题"}' ``` ### 参数说明 | 参数 | 类型 | 必填 | 默认 | 说明 | | --- | --- | --- | --- | --- | | `tone` | string | 否 | `真实具体` | 语气；可选值：`真实具体`、`轻松口语`、`专业测评`、`强反差`、`温柔陪伴` | | `topic` | string | 是 | - | 产品、服务、内容主题或卖点 | | `audience` | string | 否 | - | 目标人群 | | `noteType` | string | 否 | `种草` | 笔记类型；可选值：`种草`、`测评`、`攻略`、`避坑`、`清单`、`复盘` | | `sellingPoint` | string | 否 | - | 核心卖点 | | `accountPersona` | string | 否 | - | 账号人设 | 完整机器可读参数结构见 `references/form-schema.json`。 ### 参数取值参考 当前技能没有需要额外查表的分类参数。 ### 支持的输入格式 当前技能直接接收 JSON 参数，不涉及分享链接解析。 ### 示例请求 下面的示例参数可直接传给 `scripts/run.py`，runner 会把它们发送给 AI Skills API。 ```bash python3 scripts/run.py --params '{"topic":"主题"}' ``` 等价的 `--params` JSON： ```json { "topic": "主题" } ``` ### 返回结果示例 ```json { "success": true, "data": { "message": "示例结果请以技能真实返回结构为准。" }, "meta": { "executionTime": 842, "cached": false } } ``` ### 交付内容 - 摘要、诊断结论、行动建议和可复用交付物：围绕用户目标整理可直接阅读、复盘或交付的核心结果。 - 输入材料解读：结合语气、主题（产品、服务、内容主题或卖点）、目标人群提炼关键上下文和判断依据。 - 下一步动作：给出优先级、执行建议或可继续加工的内容框架。 ### 结果使用建议 - 先判断输出是否回答了用户关于「爆款文案助手」的核心问题。 - 再检查结果是否覆盖摘要、诊断结论、行动建议和可复用交付物，以及是否给出明确下一步动作。 - 如果输入材料较少，建议让用户补充目标、受众、限制条件或原始材料后再运行。 ### 运行前准备 - `AISKILLS_BASE_URL`：默认 `https://ai-skills.ai` - `AISKILLS_API_KEY`：必填，用于认证调用 - `AISKILLS_TENANT_ID`：默认 `default`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: adminlove520/lyric-sense (version 1.1.1)

# LyricSense Skill 让 AI 通过歌词「听」音乐的 OpenClaw 技能。 ## 触发词 - "听歌" - "歌词" - "播放音乐" - "搜索歌词" - "显示歌词" - "lyrics" ## 功能 1. **搜索歌词** - 通过歌手+歌名获取歌词 2. **显示歌词** - 实时显示当前播放的句子 3. **同步进度** - 配合网易云音乐使用 4. **本地 API** - 支持自部署 LrcApi ## 使用方法 ### 获取歌词 ``` 小溪，帮我搜索《晚安》这首歌的歌词 ``` ### 显示歌词 ``` 小溪，帮我显示颜人中《晚安》的歌词 ``` ### 配合网易云 1. 在网易云播放音乐 2. 让小溪获取歌词 3. 实时同步显示当前句子 ## 部署方式 ### 在线 API (默认) 使用免费公开 API，无需部署： ``` 歌词: https://api.lrc.cx/lyrics?artist={歌手}&title={歌名} 封面: https://api.lrc.cx/cover?artist={歌手}&title={歌名} ``` ### 本地部署 (推荐) **Windows 可执行文件:** ```powershell # 运行本地 API .\scripts\LrcApi\lrcapi-1.6.0-Windows-AMD64.exe --port 8080 ``` **Docker:** ```bash docker run -d -p 8080:8080 hisatri/lrcapi:latest ``` ### 自定义 API 地址 修改 `index.html` 中的 API 地址： ```javascript const API_BASE = 'http://localhost:8080'; // 改为你的本地地址 ``` ## 更新 Skill Skill 跟随项目一起更新，pull 最新代码即可： ```bash cd lyric-sense git pull origin main ``` ## 示例 ### 获取歌词 ``` 用户: 小溪，帮我搜索《夜空中最亮的星》的歌词 小溪: 让我搜索一下... [调用 API 获取歌词] 🎵 夜空中最亮的星 - 逃跑计划 ───────────────────── [00:19] 夜空中最亮的星 能否听清 [00:24] 那仰望的人 心底的孤独和叹息 [00:29] 夜空中最亮的星 能否记起 [00:33] 曾与我同行 消失在风里的身影 ───────────────────── ``` ## 注意事项 - 🎵 歌词 API 可能返回空结果，可尝试不同搜索词 - 📝 歌词包含时间戳，可用于同步播放进度 - 🎨 配合 LyricSense HTML 界面效果更佳 - 🖥️ 本地部署响应更快，无 API 限制 ## 项目主页 - GitHub: https://github.com/adminlove520/lyric-sense - 演示: https://adminlove520.github.io/lyric-sense ## 依赖 无额外依赖（使用内置 fetch） --- 🦞 Skill for OpenClaw | Made by 小溪 | 2026-03-10


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: axelhu/superpowers-isolated-workspace (version 1.0.1)

--- name: superpowers-isolated-workspace description: Use when starting feature work that needs isolation from current workspace - creates isolated git branches with clean setup and safety verification, adapted for OpenClaw environments --- # Superpowers Isolated Workspace（OpenClaw 适配版） ## 概述 为新功能工作创建隔离的 git 分支环境。在 OpenClaw 环境中，用 git branch 做隔离比 worktree 更稳定可靠。 **核心原则：** 系统化目录选择 + 安全验证 = 可靠隔离。 **开始时宣布：** "我正在用 isolated-workspace 技能设置隔离工作环境。" ## 目录选择流程 按优先级检查： ### 1. 检查现有目录 ```bash # 按优先级检查 ls -d .isolated 2>/dev/null || ls -d worktrees 2>/dev/null || ls -d .worktrees 2>/dev/null ``` **如果找到：** 使用该目录。 ### 2. 检查 AGENTS.md 或项目文档 ```bash grep -i "workspace.*director\|worktree.*director\|isolated.*path" AGENTS.md 2>/dev/null ``` **如果指定了偏好：** 无需询问直接使用。 ### 3. 询问主人 如果没有目录且无偏好指定： ``` 没有找到隔离工作区目录。在哪里创建？ 1. .isolated/ (项目内，隐藏) 2. ~/.openclaw/workspace-<project-name>/ (全局位置) 选择哪个？ ``` ## 安全验证 ### 对于项目内目录 **创建分支前必须验证目录未被跟踪：** ```bash # 检查目录是否被 git 忽略 git check-ignore -q .isolated 2>/dev/null || git check-ignore -q worktrees 2>/dev/null ``` **如果没有被忽略：** 立刻修复： 1. 添加到 .gitignore 2. Commit 变更 3. 继续创建隔离分支 ## 创建步骤 ### 1. 检测项目名 ```bash project=$(basename "$(git rev-parse --show-toplevel)") ``` ### 2. 创建特性分支 ```bash # 确定分支名 BRANCH_NAME="feature/<feature-name>" # 从当前分支创建新分支 git checkout -b "$BRANCH_NAME" # 确认在正确分支上 git branch --show-current ``` ### 3. 运行项目设置 自动检测并运行适当的设置： ```bash # Node.js if [ -f package.json ]; then npm install; fi # Python if [ -f requirements.txt ]; then pip install -r requirements.txt; fi if [ -f pyproject.toml ]; then pip install -e .; fi # Rust if [ -f Cargo.toml ]; then cargo build; fi # Go if [ -f go.mod ]; then go mod download; fi ``` ### 4. 验证干净基线 运行测试确保起点干净： ```bash # 使用项目对应的测试命令 npm test / pytest / cargo test / go test ./... ``` **如果测试失败：** 报告失败，询问是继续还是调查。 **如果测试通过：** 报告就绪。 ### 5. 报告位置 ``` 隔离分支 ready: $BRANCH_NAME 测试通过 (<N> 测试，0 失败) 准备实现 <feature-name> ``` ## 快速参考 | 情况 | 行动 | |------|------| | `.isolated/` 存在 | 使用它（验证被忽略） | | `worktrees/` 存在 | 使用它（验证被忽略） | | 都存在 | 使用 `.isolated/` | | 都不存在 | 检查 AGENTS.md → 询问主人 | | 目录未被忽略 | 添加到 .gitignore + commit | | 基线测试失败 | 报告失败 + 询问 | | 无 package.json | 跳过依赖安装 | ## 常见错误 **跳过忽略验证** - 问题：工作区内容被跟踪，污染 git 状态 - 修复：创建项目内目录前总是用 `git check-ignore` **假设目录位置** - 问题：造成不一致，违反项目约定 - 修复：遵循优先级：现有 > AGENTS.md > 询问 **不确认就开始** - 问题：无法区分新 bug 和已有问题 - 修复：报告失败，获得明确许可再继续 **硬编码设置命令** - 问题：在使用不同工具的项目上失败 - 修复：从项目文件自动检测（package.json 等） ## 与 Brainstorming 的集成 ``` 用户请求新功能 → brainstorming 技能（探索设计） → 主人批准设计 → isolated-workspace（创建隔离分支）← 当前技能 → writing-plans（写实现计划） → subagent-dev 或 顺序执行 → finishing-branch（完成并清理） ``` ## OpenClaw 环境说明 在 OpenClaw 环境中（WSL）： - `git worktree` 命令可用，但与 OpenClaw session 模型不完全兼容 - 使用 `git branch` + 独立工作目录更稳定 - 分支命名约定：`feature/<name>` / `fix/<name>` / `refactor/<name>` - 完成后通过 `finishing-branch` 技能处理 merge/PR/清理


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: daniellummis/github-actions-artifact-budget-audit (version 1.0.0)

--- name: github-actions-artifact-budget-audit description: Audit GitHub Actions artifact storage usage from JSON exports so bloated artifacts are flagged before they inflate CI cost. version: 1.0.0 metadata: {"openclaw":{"requires":{"bins":["bash","python3"]}}} --- # GitHub Actions Artifact Budget Audit Use this skill to detect oversized or stale GitHub Actions artifacts across repositories. ## What this skill does - Reads one or more GitHub artifact JSON exports (`gh api` output) - Calculates artifact size in MB and totals by repository + artifact name - Flags warn/critical artifacts by configurable size thresholds - Highlights soon-to-expire artifact volume to prioritize cleanup - Supports text and JSON output for terminal or dashboards ## Inputs Optional: - `ARTIFACT_GLOB` (default: `artifacts/github-actions-artifacts/*.json`) - `TOP_N` (default: `20`) - `OUTPUT_FORMAT` (`text` or `json`, default: `text`) - `WARN_MB` (default: `250`) - `CRITICAL_MB` (default: `750`) - `SOON_EXPIRES_DAYS` (default: `7`) - `FAIL_ON_CRITICAL` (`0` or `1`, default: `0`) - `REPO_MATCH` (regex, optional) - `REPO_EXCLUDE` (regex, optional) - `ARTIFACT_MATCH` (regex, optional) - `ARTIFACT_EXCLUDE` (regex, optional) ## Collect artifact JSON Single repository: ```bash gh api repos/<owner>/<repo>/actions/artifacts --paginate \ > artifacts/github-actions-artifacts/<owner>-<repo>.json ``` Combined multi-repo payloads are also supported as long as each file includes an `artifacts` array. ## Run Text report: ```bash ARTIFACT_GLOB='artifacts/github-actions-artifacts/*.json' \ WARN_MB=300 \ CRITICAL_MB=900 \ bash skills/github-actions-artifact-budget-audit/scripts/artifact-budget-audit.sh ``` JSON output for automation: ```bash ARTIFACT_GLOB='artifacts/github-actions-artifacts/*.json' \ OUTPUT_FORMAT=json \ FAIL_ON_CRITICAL=1 \ bash skills/github-actions-artifact-budget-audit/scripts/artifact-budget-audit.sh ``` Filter to one repo and artifact family: ```bash ARTIFACT_GLOB='artifacts/github-actions-artifacts/*.json' \ REPO_MATCH='^flowcreatebot/' \ ARTIFACT_MATCH='(test-results|coverage)' \ bash skills/github-actions-artifact-budget-audit/scripts/artifact-budget-audit.sh ``` Run with bundled fixtures: ```bash ARTIFACT_GLOB='skills/github-actions-artifact-budget-audit/fixtures/*.json' \ bash skills/github-actions-artifact-budget-audit/scripts/artifact-budget-audit.sh ``` ## Output contract - Exit `0` in reporting mode (default) - Exit `1` if `FAIL_ON_CRITICAL=1` and at least one artifact is at/above `CRITICAL_MB` - In `text` mode: prints summary and top oversized artifact groups - In `json` mode: prints summary, grouped artifact stats, and critical artifact instances


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector:  ()