OpenClaw/clawhub-security-signals huggingface dataset:
Skill: a2mus/stitch-ui-designer (version 1.0.0)

--- name: stitch-ui-designer version: 1.0.0 description: Design, preview, and generate UI code using Google Stitch (via MCP). Helps developers choose the best UI by generating previews first, allowing iteration, and then exporting code. metadata: openclaw: emoji: 🎨 requires: bins: ["npx", "mcporter"] --- # Stitch UI Designer This skill allows you to design high-quality user interfaces using Google Stitch. ## Workflow Follow this process to help the user design a UI: 1. **Setup (First Time Only)** - Check if the `stitch` server is configured in `mcporter`. - If not, configure it: `mcporter config add stitch --command "npx" --args "-y stitch-mcp-auto"` - Ensure the user is authenticated with Google Cloud (the tool may prompt for `gcloud auth`). 2. **Generate & Preview** - Ask for a description of the interface (e.g., "Login screen for a crypto app"). - Use `stitch.generate_screen_from_text` with the prompt. - **Important**: This returns a `screenId`. - Immediately fetch the preview image using `stitch.fetch_screen_image(screenId)`. - Show the image to the user. Do **not** fetch the code yet. 3. **Iterate & Customize** - Ask the user for feedback on the preview. - If changes are needed, use `stitch.generate_screen_from_text` again (potentially using `stitch.extract_design_context` from the previous screen to maintain style) or just refine the prompt. - Show the new preview. 4. **Export Code** - Once the user approves the design ("This looks great"), fetch the code. - Use `stitch.fetch_screen_code(screenId)`. - Present the HTML/CSS code or save it to a file as requested. ## Tools (via mcporter) Call these using `mcporter call stitch.<tool_name> <args>`: - **generate_screen_from_text** - Args: `prompt` (string), `projectId` (optional, usually auto-detected by `stitch-mcp-auto`) - Returns: `screenId`, `name`, `url` - *Use this to start a design.* - **fetch_screen_image** - Args: `screenId` (string) - Returns: Image data (display this to the user). - *Use this to show the preview.* - **fetch_screen_code** - Args: `screenId` (string) - Returns: `html` (string), `css` (string), etc. - *Use this ONLY after user approval.* - **create_project** - Args: `name` (string) - *Use if no project exists.* ## Tips - **Project Context**: `stitch-mcp-auto` tries to manage the project ID automatically. If you get errors about missing project IDs, ask the user to create or select a Google Cloud project first using `create_project` or by setting the `GOOGLE_CLOUD_PROJECT` env var. - **Preview First**: Always prioritize the visual preview. Generating code for a bad design wastes tokens and time. - **Stitch MCP Auto**: We use `stitch-mcp-auto` because it handles the complex Google auth setup more gracefully than the standard package.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: violin/china-holiday (version 1.0.0)

--- name: china-holiday description: 中国大陆日历服务 - 识别法定节假日、周末、调休，各地寒暑假、春秋假 homepage: https://github.com/your-repo/china-holiday metadata: {"clawdbot":{"emoji":"📅","requires":{"bins":["python3"]}}} --- # China Holiday 中国大陆日历服务，判断任意日期的假期状态。 ## 功能 - **法定节假日**：元旦、春节、清明、五一、端午、中秋、国庆 - **调休**：识别补班日 - **周末**：自动识别周六日 - **寒暑假**：支持主要城市 - **春秋假**：部分地区 ## 使用示例 ```bash # 判断今天是否上班 python holiday.py today # 判断指定日期 python holiday.py 2026-01-01 # 查询北京暑假时间 python holiday.py vacation 北京 # 查询某年所有节假日 python holiday.py list 2026 ``` ## API 调用 ```python from holiday import is_holiday, is_workday, get_holiday_name # 判断是否为假日 is_holiday("2026-01-01") # True (元旦) # 判断是否上班 is_workday("2026-01-28") # True (春节前调休) # 获取假日名称 get_holiday_name("2026-01-01") # "元旦" ``` ## 支持城市 - 北京、上海、广州、深圳 - 更多城市陆续添加...


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: aviclaw/token-budget-monitor (version 1.0.0)

--- name: token-budget-monitor version: "1.0.0" description: Track and control token consumption across OpenClaw cron jobs author: aviclaw tags: - token - budget - monitor - openclaw --- # token-budget-monitor Track and control token consumption across OpenClaw cron jobs, fallback chains, and sessions. ## Installation ```bash openclaw skills install aviclaw/token-budget-monitor ``` ## Usage ```bash # Check current usage node track-usage.js status # Check budget for a specific job node track-usage.js check daily-tweet # Alert if over budget node track-usage.js alert # Get model recommendations node track-usage.js recommend ``` ## Integration Add to cron jobs to track usage: ```javascript // After LLM call completes const usage = result.usage; exec('node /path/to/track-usage.js track <job-name> ' + usage.input_tokens + ' ' + usage.output_tokens + ' ' + model); ``` ## Configuration Edit `config.json`: ```json { "dailyLimit": 100000, "jobLimits": { "daily-tweet": 5000, "rss-brief": 15000 }, "alertThreshold": 0.8, "freeModels": [ "nvidia/moonshotai/kimi-k2.5", "google/gemini-2.0-flash-exp" ] } ``` ## Features - Per-job token tracking - Daily budget limits - Per-job custom limits - Alert when threshold exceeded - Recommend free model alternatives ## Author - GitHub: @aviclaw ## License MIT


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: hgta23/n (version 1.0.0)

name: n version: 1.0.0 description: "A minimalist note-taking skill for creating, managing, and syncing notes across devices. Use when: user wants to take quick notes, organize thoughts, or access notes from anywhere." --- # n Skill A minimalist note-taking skill for creating, managing, and syncing notes across devices. ## Features - Create new notes with simple commands - Organize notes by tags or categories - Search notes by keywords - Sync notes across multiple devices - Share notes with other users - Set reminders for important notes ## Usage Examples - "Create a new note about project ideas" - "Add tag 'work' to my last note" - "Search notes for 'meeting' - "Sync my notes" - "Share note 123 with John" ## Benefits - Quick and easy note-taking without complex interfaces - Seamless sync across all your devices - Powerful search functionality to find notes quickly - Simple sharing options for collaboration - Minimalist design focused on functionality ## How It Works The n skill uses a lightweight backend to store and sync notes, ensuring that your data is always up-to-date across all devices. It leverages natural language processing to understand your commands and execute them efficiently. ## Installation Simply install the n skill from clawhub.ai and start taking notes immediately. No configuration required - just start using it!


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: civictechuser/civic-nexus-openclaw (version 0.1.0)

--- name: civic-nexus description: "Connect to Civic Nexus MCP for 100+ integrations." metadata: {"openclaw":{"requires":{"env":["NEXUS_URL","NEXUS_TOKEN"],"anyBins":["mcporter","npx"]},"primaryEnv":"NEXUS_TOKEN"}} --- # Civic Nexus MCP Bridge > **⚠️ DISCLAIMER: Use at your own risk. For official documentation, visit [docs.civic.com](https://docs.civic.com).** Connect to [Civic Nexus](https://nexus.civic.com) for 100+ integrations including Gmail, PostgreSQL, MongoDB, Box, and more. ## Setup ### 1. Get your Nexus credentials 1. Go to [nexus.civic.com](https://nexus.civic.com) and sign in 2. Get your **MCP URL** and **access token** from your profile settings ### 2. Configure in OpenClaw Add to `~/.openclaw/openclaw.json`: ```json { "skills": { "entries": { "civic-nexus": { "enabled": true, "env": { "NEXUS_URL": "https://nexus.civic.com/hub/mcp?accountId=YOUR_ACCOUNT_ID&profile=YOUR_PROFILE", "NEXUS_TOKEN": "your-access-token" } } } } } ``` ### 3. (Optional) Configure mcporter If you have mcporter installed (`npm install -g mcporter`), add to `~/.openclaw/workspace/config/mcporter.json`: ```json { "mcpServers": { "nexus": { "baseUrl": "https://nexus.civic.com/hub/mcp?accountId=YOUR_ACCOUNT_ID&profile=YOUR_PROFILE", "headers": { "Authorization": "Bearer YOUR_TOKEN", "User-Agent": "openclaw/1.0.0" } } } } ``` ## Instructions for the Agent When the user asks to interact with external services through Nexus, try mcporter first. If it fails, fall back to the TypeScript script. ### Using mcporter ```bash # List tools mcporter list nexus # Search tools mcporter list nexus | grep gmail # Call a tool mcporter call 'nexus.google-gmail-search_gmail_messages(query: "is:unread")' ``` ### Fallback: TypeScript script ```bash # List tools npx tsx {baseDir}/nexus-tool-runner.ts --list # Search tools npx tsx {baseDir}/nexus-tool-runner.ts --search gmail # Get tool schema npx tsx {baseDir}/nexus-tool-runner.ts --schema google-gmail-search_gmail_messages # Call a tool npx tsx {baseDir}/nexus-tool-runner.ts --call google-gmail-search_gmail_messages --args '{"query": "is:unread"}' ``` ### Authorization flows Some tools require OAuth on first use. When you see an authorization URL: 1. Show the URL to the user 2. After they authorize, continue: ```bash # mcporter mcporter call 'nexus.continue_job(jobId: "JOB_ID")' # script npx tsx {baseDir}/nexus-tool-runner.ts --call continue_job --args '{"job_id": "JOB_ID"}' ``` ## Notes - API calls can take 10-15 seconds (server-side latency) - Tokens expire after ~30 days — regenerate from Nexus if needed - Gmail batch requests limited to 5-25 messages per call ---


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: adainthelab/skulk-skill-scanner (version 1.0.1)

--- name: skulk-skill-scanner description: "Scan OpenClaw skill folders for security red flags before installing or publishing. Detects data exfiltration, credential theft, prompt injection, destructive commands, obfuscation, privilege escalation, and supply chain risks. Use when: evaluating a skill from ClawHub before install, auditing your own skills before publishing, or reviewing any SKILL.md for safety. NOT for: general code review or vulnerability scanning of non-skill codebases." --- # Skill Scanner Security scanner for OpenClaw agent skills. Static analysis for red flags. ## Usage ```bash node scripts/scanner.js <path-to-skill> [--verbose] [--json] [--summary] [--ignore <path>] [--include-self] ``` ## Examples ```bash # Scan a downloaded skill folder before enabling it clawhub inspect some-skill node scripts/scanner.js ./skills/some-skill --verbose # Scan your own skill before publishing node scripts/scanner.js ./skills/my-skill # JSON output for automation node scripts/scanner.js ./skills/my-skill --json # One-line summary output for heartbeat checks node scripts/scanner.js ./skills/my-skill --summary # Include scanner internals (off by default to reduce self-scan noise) node scripts/scanner.js ./skills/skulk-skill-scanner --include-self ``` ## What It Catches | Severity | Flags | |----------|-------| | 🔴 Critical | Data exfiltration, credential access, safety overrides, destructive commands | | 🟠 High | Obfuscation (base64/eval), unknown network access, env scanning, privilege escalation, hidden instructions | | 🟡 Medium | Writes outside workspace, package installs (supply chain), messaging on user's behalf, persistent timers/automation | | 🔵 Info | API key references, broad tool access requests | ## Scoring - Each unique rule deducts points: critical=30, high=15, medium=5, info=0 - Score 75-100: ✅ PASS - Score 50-74: ⚠️ WARN - Score 0-49 or any critical: ❌ FAIL - Exit code 1 on FAIL (CI-friendly) ## Safe Domain Allowlist Known legitimate API domains are allowlisted to reduce false positives on network-related rules. Edit the `SAFE_DOMAINS` array in `scripts/scanner.js` to customize. ## Limitations This is static pattern matching — it catches obvious and moderately obfuscated attacks but cannot detect: - Sophisticated multi-step social engineering - Runtime-generated URLs or dynamic exfiltration - Attacks that look identical to legitimate skill behavior It's a first line of defense, not a guarantee. Always review skills manually before granting sensitive access.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: banalit/luke-agent-directory (version 1.0.0)

--- name: agent-directory version: 1.1.0 description: The directory for AI agent services. Discover tools, platforms, and infrastructure built for agents. homepage: https://ctxly.com metadata: emoji: "🔍" category: "discovery" api_base: "https://ctxly.com" --- # ctxly.com > The directory for AI agent services Find tools, platforms, and infrastructure built for agents. Every listed service has a skill.md you can read. **Base URL:** `https://ctxly.com` ## For Agents ### Get All Services (JSON) ```bash curl https://ctxly.com/services.json ``` Returns: ```json { "directory": "ctxly.com", "version": "1.0", "services": [ { "name": "Moltbook", "url": "https://www.moltbook.com", "skill": "https://www.moltbook.com/skill.md", "description": "The front page of the agent internet", "category": "social", "icon": "🦞", "api_base": "https://www.moltbook.com/api/v1" }, ... ], "categories": [ {"id": "social", "name": "Social", "icon": "👥"}, {"id": "chat", "name": "Chat", "icon": "💬"}, ... ] } ``` ### Get a Service's skill.md Each service has a `skill` field with its skill.md URL: ```bash # Get Moltbook's skill.md curl https://www.moltbook.com/skill.md # Get Ctxly Memory's skill.md curl https://ctxly.app/skill.md ``` ### Categories | Category | Description | |----------|-------------| | social | Social networks, forums, communities | | chat | Real-time messaging, chat rooms | | jobs | Bounties, task boards, hiring | | identity | Verification, profiles, reputation | | memory | Context storage, recall, persistence | | tokens | Crypto, payments, earning | | tools | Utilities, productivity, misc | ## Workflow 1. **Discover** — `curl ctxly.com/services.json` 2. **Learn** — Fetch the skill.md for services you need 3. **Use** — Follow the skill.md to integrate ## Submit a Service Email [REDACTED_SECRET] with: - Service name - URL - skill.md URL - One-line description - Category (social/chat/jobs/identity/memory/tokens/tools) ## Related Services - **Ctxly Memory** — https://ctxly.app — Cloud context storage - **Ctxly Chat** — https://chat.ctxly.app — Private chat rooms - **Home** — https://home.ctxly.app — Agent profiles - **Grove** — https://grove.ctxly.app — Slow reflection space --- *ctxly.com — find what you need*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: henry4c/za-car-insurance (version 1.0.0)

--- name: 车险投保skill description: 众安车险投保 — 车辆信息 → 报价 → 确认核保 → 支付 → 出单。 version: 1.0.0 argument-hint: "[车牌号]" --- # 众安车险投保skill --- ## 服务域名 > ⚠️ 使用前将全文所有 `<gateway域名>` 替换为如下取值。 **gateway 域名**：`car.zhongan.com` 所有接口（鉴权、报价、核保、出单查询）均走此单一域名，无其他依赖服务。 --- ## 固定配置（首次使用必填） > ⚠️ **占位符护栏**：以下字段若为 `xx`，视为**未配置**。启动时逐一检查，未配置则立即停止向用户索取真实值，**严禁猜测**。 - **car_api_key**：`xx`（首次获取后写入，当日有效） - **手机号**：`xx`（首次使用后写入） - **车主姓名**：`xx`（首次使用后写入） - **车主证件号**：`xx`（首次使用后写入） - **投保人/被保人**：默认与车主相同 --- ## 支持的能力 | 能力 | 说明 | 参考文件 | |------|------|---------| | 验证码登录 | 手机号+验证码获取 car_api_key | `auth.md` | | 快速报价 | 一键完成绑车+询价+报价 | `quote.md` | | 方案调整 | 修改险种、保额、不计免赔 | `quote.md` | | 核保+支付 | 自动完成核保并获取支付链接 | `proposal.md` | | 出单查询 | 支付后查询保单号 | `proposal.md` | --- ## 主流程概览 ``` Step 0：检查 car_api_key ├─ $CAR_API_KEY 存在 → 继续 └─ 不存在或过期（401）→ 发验证码 → 用户填验证码 → 获取 car_api_key 详见 auth.md Step 1：占位符校验 检查固定配置中手机号、车主姓名、车主证件号是否已填写 详见 auth.md Step 2：快速报价（核心） POST <gateway域名>/api/quickInsure/quickQuote 一键完成绑车+填表+询价+报价 详见 quote.md Step 3：用户确认/调整方案 详见 quote.md Step 4：核保+获取支付链接 POST <gateway域名>/api/quickInsure/quickConfirmAndPay 详见 proposal.md Step 5：打开支付页面 Chrome DevTools MCP 打开 zaPayUrl 详见 proposal.md Step 6：出单结果查询 POST <gateway域名>/api/quickInsure/getCreatePolicy 详见 proposal.md ``` --- ## 通用规则 详见 `auth.md`「通用规则」章节。核心要点： 1. **静默执行**：调用接口时不在对话中打印请求参数、响应原文；仅输出面向用户的结论或下一步提示；出错时只展示简洁的错误描述，不暴露原始报文。 2. **鉴权**：每次请求带 `car_api_key: $CAR_API_KEY`，401 时重新走验证码流程 2. **上下文保持**：`vehicleNo`、`insureFlowCode`、投保人信息对话中缓存 3. **每次操作实时调接口** 4. **接口传参按文档**，禁止猜测字段含义 5. **错误重试**：同一报错每阶段最多 3 次；接口繁忙时直接展示返回的提示文案，不重试 6. **客服引导**：接口报错无法自动恢复、或流程阻塞无法继续时，告知用户可联系专属客服，并询问"是否在浏览器中打开客服链接？"，仅在用户确认后才调用 Chrome DevTools MCP 打开客服页面 7. **终止性错误**：`P11002`、`已投保` 立即终止 8. **用户指定车辆不得替换** --- ## 用户数据交互汇总 | 环节 | 用户需提供 | 备注 | |------|--------------------|------| | 首次登录 | 手机号 + 验证码 | 获取 car_api_key，写入配置 | | 快速报价（已绑车） | 车牌号 | 投保地后端自动推断 | | 快速报价（未绑车） | 车牌号 | 车主信息自动从配置获取 | | 车五项补全 | VIN/发动机号/注册日期/品牌型号 | 按 `missingFiveInfoFields` 引导 | | 确认方案 | 回复「确认投保」或调整 | — | | 支付 | 无（点击支付链接） | 浏览器内完成 | **最少交互路径**（已绑车 + 配置已填写）：车牌 → 确认核保 → 支付，共 **2 轮对话**。 --- ## 场景索引 | Step | 场景 | 关键接口 | 参考文件 | |------|------|---------|---------| | 0 | 获取 car_api_key | `POST /api/quickInsure/open/auth/sendCode` + `verifyCode` | `auth.md` | | 1 | 占位符校验 | — | `auth.md` | | 2 | 快速报价 | `POST /api/quickInsure/quickQuote` | `quote.md` | | 3 | 确认/调整方案 | — | `quote.md` | | 4 | 核保+支付 | `POST /api/quickInsure/quickConfirmAndPay` | `proposal.md` | | 5 | 出单查询 | `POST /api/quickInsure/getCreatePolicy` | `proposal.md` |


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: whatsonyourmind/oraclaw-bandit (version 1.0.0)

--- name: oraclaw-bandit description: A/B testing and feature optimization for AI agents. Pick the best option automatically using Multi-Armed Bandits and Contextual Bandits (LinUCB). No data warehouse needed — works from request #1. version: 1.0.0 metadata: openclaw: requires: env: - ORACLAW_API_KEY primaryEnv: ORACLAW_API_KEY emoji: "🎰" homepage: https://oraclaw.dev/bandit tags: - optimization - ab-testing - feature-flags - experimentation - machine-learning price: 0.01 currency: USDC --- # OraClaw Bandit — AI-Powered A/B Testing You are an optimization agent that uses Multi-Armed Bandits to find the best option from a set of choices. ## When to Use This Skill Use this when the user or another agent needs to: - Choose the best variant from multiple options - Run A/B tests without predetermined sample sizes - Optimize feature flags, prompts, email subjects, or any choice - Make context-aware selections (different best option for different situations) ## How to Use ### Step 1: Set Up the MCP Connection Add the OraClaw MCP server to get the `optimize_bandit` and `optimize_contextual` tools: ```json { "mcpServers": { "oraclaw": { "command": "npx", "args": ["tsx", "path/to/oraclaw-mcp/index.ts"] } } } ``` ### Step 2: Use `optimize_bandit` for Simple A/B Testing Call with a list of options (arms) and their historical performance: ```json { "arms": [ { "id": "variant-a", "name": "Short Email", "pulls": 500, "totalReward": 175 }, { "id": "variant-b", "name": "Long Email", "pulls": 300, "totalReward": 126 }, { "id": "variant-c", "name": "Video Email", "pulls": 100, "totalReward": 48 } ], "algorithm": "ucb1" } ``` The response tells you which variant to show next, balancing exploration (trying new options) and exploitation (using what works). ### Step 3: Use `optimize_contextual` for Personalized Selection When the best choice depends on CONTEXT (time, user type, situation): ```json { "arms": [ { "id": "deep-work", "name": "Deep Work Block" }, { "id": "quick-tasks", "name": "Quick Task Batch" }, { "id": "meetings", "name": "Meeting Block" } ], "context": [0.75, 0.8, 0.3, 0.0], "history": [ { "armId": "deep-work", "reward": 0.9, "context": [0.25, 0.9, 0.1, 0.0] }, { "armId": "quick-tasks", "reward": 0.7, "context": [0.75, 0.4, 0.8, 1.0] } ] } ``` Context vector represents situation features (e.g., time of day, energy, urgency, number of pending items). The algorithm learns which option works best in each context. ## Rules 1. Always include historical data when available — more data = better selections 2. Use `ucb1` algorithm for most cases. Use `thompson` when you need more exploration early on. 3. Record rewards after each decision to improve future selections 4. Context vectors must be consistent length across all calls 5. Rewards should be normalized to 0-1 range ## Pricing $0.01 per optimization call (USDC on Base via x402). Free tier: 3,000 calls/month with API key.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: adamwgp/our-autoskills (version 1.0.0)

--- name: our-autoskills description: AutoSkills - 智能AgentSkills自动检测与安装系统。自动检测项目类型（Web/Python/学术/金融等），推荐并安装对应的AgentSkills。触发词：autoskills、项目类型检测、智能安装。 metadata: openclaw: homepage: https://github.com/adamwgp/our-autoskills --- # AutoSkills - 智能AgentSkills系统 ## 功能 ### 1. 项目技术栈自动检测 支持检测以下项目类型： - 🌐 **Web项目**: React/Vue/Angular/Next.js/Nuxt.js - 🐍 **Python项目**: Django/Flask/FastAPI/Pandas - 📚 **学术项目**: LaTeX论文/ArXiv/Thesis - 💰 **金融项目**: 股票/加密货币/量化交易 - 📈 **营销项目**: CRM/Sales/Pipeline - 🎬 **媒体项目**: 视频/音频/字幕处理 ### 2. 智能Skills匹配 根据检测到的项目类型，自动推荐最合适的AgentSkills： - Web → agent-reach, playwright-scraper, web-research-assistant - Python → csv-analyzer, stock-analysis, pymupdf-pdf-parser - Academic → phd-revision-agent, humanizer-pipeline, verification-gate-phd - Finance → jarvis-invest, stock-analysis, yahoo-finance-cli, personal-cfo - Marketing → sains-crm, sales-pipeline-tracker, social-media-manager ### 3. 一键安装 ```bash npx our-autoskills ``` ### 4. 与Hunter Agent集成 - Finance项目自动激活Jarvis-Invest - Marketing项目自动激活Sains CRM ## 命令 ```bash npx our-autoskills # 完整检测+推荐+集成 npx our-autoskills detect # 仅检测项目类型 npx our-autoskills install # 安装推荐的Skills npx our-autoskills list # 查看所有可用Skills npx our-autoskills doctor # 系统检查 ``` ## 系统检查 ```bash npx our-autoskills doctor ``` 检查项： - Node.js 版本 - ClawHub CLI 状态 - Skills 目录状态 - 已安装Skills统计 ## 安装 ```bash npm install -g our-autoskills # 或 npx our-autoskills ``` ## 技术栈检测算法 检测器使用多维度评分： 1. **文件模式匹配** (权重: 2) - package.json → Web项目 - requirements.txt → Python项目 - *.tex, *.bib → 学术项目 2. **关键词扫描** (权重: 1) - README.md内容分析 - 代码文件关键词 ## Skills注册表 内置27+个预配置Skills： - System级: token-manager, model-router, structured-context-compressor, clawflow - Web级: agent-reach, web-research-assistant, playwright-scraper - Academic级: phd-revision-agent, humanizer-pipeline, verification-gate-phd - Finance级: jarvis-invest, stock-analysis, yahoo-finance-cli - Marketing级: sains-crm, sales-pipeline-tracker, closing-deals


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)