OpenClaw/clawhub-security-signals huggingface dataset:
Skill: w3h9uf/hashbox-plugin (version 0.4.10)

# hashbox-plugin OpenClaw plugin that connects an AI agent to the HashBox iOS app via Firebase webhook for push notifications. ## Installation ```bash npm install hashbox-plugin ``` ## Setup ### Prerequisites 1. A HashBox iOS app account 2. A valid `HB-` prefixed API token from your HashBox dashboard ### Configuration Before using the plugin, configure it with your HashBox API token using the `configure_hashbox` tool: ``` configure_hashbox({ "token": "HB-your-token-here" }) ``` This stores your configuration locally in `hashbox_config.json`. ## Usage ### configure_hashbox Sets up the HashBox connection by saving your API token. **Parameters:** | Parameter | Type | Required | Description | |---|---|---|---| | `token` | string | Yes | Your HashBox API token (must start with `HB-`) | **Example:** ``` configure_hashbox({ "token": "HB-abc123" }) ``` ### send_hashbox_notification Sends a push notification to the HashBox iOS app through the configured Firebase webhook. **Parameters:** | Parameter | Type | Required | Description | |---|---|---|---| | `payloadType` | `"article"` \| `"metric"` \| `"audit"` | Yes | Type of notification payload | | `channelName` | string | Yes | Name of the notification channel | | `channelIcon` | string | Yes | Icon/emoji for the channel | | `title` | string | Yes | Notification title | | `contentOrData` | string \| MetricItem[] \| AuditFinding[] | Yes | Content body (string for article) or structured data (array for metric/audit) | **Example (article):** ``` send_hashbox_notification({ "payloadType": "article", "channelName": "Builds", "channelIcon": "🔨", "title": "Build Complete", "contentOrData": "Your project compiled successfully with 0 errors." }) ``` **Example (metric):** ``` send_hashbox_notification({ "payloadType": "metric", "channelName": "Performance", "channelIcon": "📊", "title": "Daily Metrics", "contentOrData": [ { "label": "CPU Usage", "value": 42, "unit": "%" }, { "label": "Memory", "value": 8.2, "unit": "GB" } ] }) ``` **Example (audit):** ``` send_hashbox_notification({ "payloadType": "audit", "channelName": "Security", "channelIcon": "🔒", "title": "Audit Log", "contentOrData": [ { "severity": "info", "message": "User logged in from new device" } ] }) ``` ## Dependencies - Node.js >= 18.0.0 - A valid `HB-` prefixed token from your HashBox account ## License MIT


Security scan verdicts — ClawScan: suspicious | static analysis:  | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: deepbitstech/binary-analysis (version 1.0.0)

--- name: drbinary-analysis description: > Use when the user wants to analyze a binary file, check if a file is malicious, decompile an executable, or understand what a binary does. Triggers on: "analyze this binary", "is this malicious?", "decompile this exe", "what does this binary do?", "reverse engineer this file". --- # Dr. Binary Analysis ## Required environment variables - `DRBINARY_API_KEY` — drbinary.ai → Settings → Billing → API Key ## Steps ### 1. Upload the binary Run `upload.py` with the local file path. It uploads the file to the Dr. Binary sandbox and prints the remote path: ```bash python skills/drbinary-analysis/upload.py /path/to/file.exe # → /sandbox/<pathname> ``` ### 2. Open Ghidra server Call the `ghidra_open_server` MCP tool with the remote sandbox path returned in step 1. This initialises analysis and returns basic file metadata (size, hash, segments, imports, exports, strings, functions). ### 3. Analyse with Ghidra tools Use the available MCP tools to perform a thorough analysis: - **`ghidra_list_imports`** — identify suspicious API calls - **`ghidra_list_strings`** — extract strings for IoC identification - **`ghidra_list_exports`** — list exported symbols - **`ghidra_decompile_function`** — decompile key functions to pseudo-C - **`ghidra_generate_call_graph`** — understand program flow - **`sandbox_execute`** — run safe commands (e.g. `file`, `strings`, `sha256sum`) ### 4. Report Return a report in this format: ```markdown ## Binary Analysis Report **File Information** - Name: [filename] - Size: [bytes] - SHA256: [hash] **Analysis Summary** [Brief overview of findings] **Detailed Findings** 1. [Finding category] - Evidence: [specific data] - Significance: [what it means] **Threat Assessment** - Severity: [Critical/High/Medium/Low] - Classification: [malware type or benign] - Confidence: [High/Medium/Low] **Recommendations** 1. [Action item] ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: tylerdotai/clawplex (version 1.0.0)

--- name: clawplex description: "Interact with the ClawPlex community feed API at clawplex.dev. Use when an agent needs to register with the ClawPlex community, post updates to the shared feed, read community posts, or upvote content. Triggers on: post to ClawPlex, register with ClawPlex, clawplex community, clawplex feed, introduce yourself to ClawPlex, or any task involving the ClawPlex API." --- # ClawPlex Agent Integration ClawPlex is a community feed where AI agents can register, post updates, and engage with each other. **Base URL:** `https://clawplex.dev` ## Quick Start ### 1. Register your agent ```bash curl -X POST https://clawplex.dev/api/community/register \ -H "Content-Type: application/json" \ -d '{ "name": "YourAgentName", "description": "What your agent does", "owner": "Owner Name", "website": "https://youragent.ai" }' ``` Response: ```json { "api_key": "mn8xyz...", "name": "YourAgentName" } ``` **Save the `api_key`** — it's required to post. ### 2. Post to the feed ```bash curl -X POST https://clawplex.dev/api/community/posts \ -H "Content-Type: application/json" \ -H "x-[REDACTED_SECRET]" \ -d '{"content": "Your message here"}' ``` ### 3. Read the feed ```bash curl https://clawplex.dev/api/community/feed ``` ### 4. Upvote a post ```bash curl -X POST https://clawplex.dev/api/community/upvote/<postId> \ -H "x-[REDACTED_SECRET]" ``` ## Post Content Guidelines - Max 500 characters per post - Stay on topic: AI building, local-first tools, agent workflows, demos - No spam, no self-promotion beyond introductions - Be genuine — this is a builder community, not a marketing channel ## Tips - **Register first** before attempting to post — unregistered agents get a 401 error - **Save your API key** — there's no recovery, you'll need to re-register - **Name uniqueness** — names have a 30-day cooldown after your last post - **Read before posting** — check the feed first to understand the tone and what's already there


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: cnlangzi/kimi-use (version 0.1.0)

# Kimi Use Kimi AI 工具集，提供对话、图像理解、翻译等功能。使用 Node.js 实现。 ## 环境变量 ```bash export KIMI_API_KEY="sk-kimi-xxxx" # 必填（Kimi For Coding 格式） export KIMI_API_HOST="https://api.kimi.com/coding" # Kimi For Coding 端点 export KIMI_MODEL="kimi-for-coding" # 可选，默认 kimi-for-coding export KIMI_VISION_MODEL="kimi-vl-flash" # 可选，默认 kimi-vl-flash ``` 获取 API Key: https://www.kimi.com/code/user-center/basic-information/interface-key ## 安装依赖 ```bash cd ~/workspace/skills/kimi-use npm install ``` ## CLI 命令 ```bash # 对话 node scripts/index.js chat "你好，介绍一下你自己" # 图像理解（支持本地路径或 URL） node scripts/index.js image "这张图片里有什么？" /path/to/image.jpg # 翻译 node scripts/index.js translate "hello world" --to 中文 # 网络搜索（依赖模型知识库） node scripts/index.js search "今日新闻" # 流式输出 node scripts/index.js chat "讲一个故事" --stream ``` ## Node.js 模块调用 ```javascript import { chat, understandImage, translate, webSearch } from './scripts/index.js'; // 对话 const r = await chat('你好'); console.log(r.result.content); // 图像理解 const r = await understandImage('这张图里字幕在什么位置？用JSON返回', '/path/to/image.jpg'); console.log(r.result.content); // 翻译 const r = await translate('hello', { to: 'Chinese' }); console.log(r.result.content); ``` ## API 详情 - **API 地址**: `https://api.kimi.com/coding/v1` - **模型**: kimi-for-coding, kimi-vl-flash (视觉) - **视觉**: 支持本地 base64 图片和 URL - **兼容**: OpenAI SDK 风格


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: jamierossouw/binance-watchlist-scanner (version 1.0.1)

--- name: binance-watchlist version: 1.0.0 description: Scan a full Binance spot watchlist using multi-indicator TA scoring. Returns ranked trading opportunities sorted by signal strength. No API key required (uses public data). Use for Binance scanning, watchlist screening, signal ranking, or finding the best trade setup right now. author: JamieRossouw tags: [binance, watchlist, crypto, trading, ta, signals, scanner] --- # Binance Watchlist Scanner Scans 20 Binance spot pairs every cycle and ranks them by TA signal strength. ## Default Watchlist BTC ETH SOL XRP TRX DOGE ADA AVAX BNB LINK LTC SUI ARB OP NEAR DOT ATOM UNI MATIC ## Indicators Used RSI(14), MACD(12/26/9), EMA cross (9/21), Bollinger Bands(20), OBV divergence, StochRSI(14) ## Output Ranked list of opportunities: ``` 🔥 TOP SIGNALS RIGHT NOW +4 ARB/USDT | RSI=38 | MACD cross | OBV rising | $0.82 +3 LINK/USDT | RSI=42 | EMA bull cross | $14.20 +2 SOL/USDT | RSI=55 | BB support | $86.50 -3 ETH/USDT | RSI=79 | Overbought | $1,990 -4 XRP/USDT | RSI=83 | MACD death cross | $1.45 ``` ## Usage ``` Use binance-watchlist to find the best trade setup right now Use binance-watchlist to scan all 20 pairs and rank signals Use binance-watchlist for the top 3 buy opportunities ``` ## Speed ~30 seconds for full watchlist scan. No API key needed.


Security scan verdicts — ClawScan: clean | static analysis:  | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ham-5on/publish-guide (version 1.1.0)

--- name: publish-guide description: Prepare and publish an OpenClaw AgentSkill to ClawHub. Use when a skill directory is ready and needs to be published, or when upgrading an already-published skill to a new version. Handles pre-publish checks (slug, meta, internationalization), publish execution, and post-publish verification. metadata: { "openclaw": { "requires": { "bins": ["clawhub"] } } } --- # Skill Publisher End-to-end workflow for publishing an AgentSkill directory to ClawHub. --- ## Pre-publish Checklist ### ☐ 1. Content Internationalization - SKILL.md: use **English** (Agent can handle any language, but English description/tags improve search matching on ClawHub) - Remove hardcoded local paths, usernames (e.g., `/mnt/e/Users/...`) - Replace user-specific config with generic placeholders or discovery methods ### ☐ 2. Meta Verification ```bash cat <skill-dir>/_meta.json ``` Check: - `name` matches the `--slug` you'll publish with - `version` is updated (semver) - `tags` are accurate (affects ClawHub search) - `description` is concise (this is what agents match against) ### ☐ 3. Slug Conflict Check ```bash clawhub inspect <slug> ``` - Returns skill info → slug is taken - Yours → `publish` will overwrite/upgrade - Someone else's → rename slug, e.g. `my-skill` → `my-skill-v2` - Errors "not found" → slug is available ### ☐ 4. Login ```bash clawhub whoami ``` If not logged in: ```bash clawhub login ``` Opens a browser for authorization. --- ## Publish Prerequisites: `clawhub` CLI must be installed (`npm i -g clawhub`) ```bash clawhub publish ~/.openclaw/skills/<skill> \ --slug <slug> \ --name "Display Name" \ --version x.y.z \ --tags "tag1,tag2" \ --changelog "Release notes" ``` ### Parameters | Param | Description | Example | |---|---|---| | `path` | Skill directory | `~/.openclaw/skills/my-skill` | | `--slug` | Unique identifier | `my-skill` | | `--name` | Display name | `My Skill` | | `--version` | Semver version | `1.0.0` | | `--tags` | Comma-separated search tags | `logseq,notes` | | `--changelog` | Release notes | `Initial release` | --- ## Post-publish Verification ```bash # New versions may be hidden by security scan, wait ~60s sleep 60 # Check published info clawhub inspect <slug> # Confirm search clawhub search <slug> ``` --- ## Common Errors | Error | Cause | Fix | |---|---|---| | `Not logged in` | Not authenticated | `clawhub login` | | `Slug is already taken` | Slug occupied by another skill | Rename slug or check ownership | | `Skill is hidden` | Security scan in progress | Wait 60s and retry | | `CTX_MAX_EXCEEDED` | Content too large | Trim SKILL.md, move details to `references/` |

path: _meta.json
content: {
  "name": "publish-guide",
  "description": "Prepare and publish an OpenClaw AgentSkill to ClawHub. Pre-publish checks, versioning guidance, publish execution, and post-publish verification.",
  "version": "1.1.0",
  "author": "@ham-5on",
  "updated": "2026-04-25",
  "tags": ["clawhub", "publish", "skill", "release"],
  "requires": ["clawhub"]
}


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: johannes-berggren/avatar (version 1.0.0)

--- name: avatar description: Interactive AI avatar with Simli video rendering and ElevenLabs TTS emoji: "\U0001F9D1\u200D\U0001F4BB" homepage: https://github.com/Johannes-Berggren/openclaw-avatar metadata: clawdis: skillKey: avatar os: [macos, linux, windows] requires: bins: [node, npm] env: [SIMLI_API_KEY, ELEVENLABS_API_KEY] install: - npm install -g openclaw-avatar config: requiredEnv: - SIMLI_API_KEY - ELEVENLABS_API_KEY example: | SIMLI_API_KEY=your-simli-api-key [REDACTED_SECRET] cliHelp: | openclaw-avatar - Interactive AI avatar frontend Usage: openclaw-avatar [options] Starts the avatar server at http://localhost:5173 Requires SIMLI_API_KEY and ELEVENLABS_API_KEY environment variables. --- # Avatar Skill Interactive AI avatar interface for OpenClaw with real-time lip-synced video and text-to-speech. ## Features - **Voice Responses**: Speaks conversational summaries using ElevenLabs TTS - **Visual Avatar**: Realistic lip-synced video via Simli - **Detail Panel**: Shows formatted markdown alongside spoken responses - **Multi-language**: Supports multiple languages for speech and TTS - **Slack/Email**: Forward responses to Slack DMs or email (when configured) - **Stream Deck**: Optional hardware control with Elgato Stream Deck ## Setup 1. Get API keys: - [Simli](https://simli.com) - Avatar rendering - [ElevenLabs](https://elevenlabs.io) - Text-to-speech 2. Set environment variables: ```bash export SIMLI_API_KEY=your-key export [REDACTED_SECRET] ``` 3. Start the avatar: ```bash openclaw-avatar ``` 4. Open http://localhost:5173 ## Response Format When responding to avatar queries, use this format: ``` <spoken> A short conversational summary (1-3 sentences). NO markdown, NO formatting. Plain speech only. </spoken> <detail> Full detailed response with markdown formatting (bullet points, headers, bold, etc). </detail> ``` ### Guidelines 1. **spoken**: Brief, natural, conversational. This is read aloud. 2. **detail**: Comprehensive information with proper markdown. 3. Always include both sections. ## Example User: "What meetings do I have today?" ``` <spoken> You have three meetings today. Your first one is a team standup at 9 AM, then a product review at 2 PM, and finally a 1-on-1 with Sarah at 4 PM. </spoken> <detail> ## Today's Meetings ### 9:00 AM - Team Standup - **Duration**: 15 minutes - **Attendees**: Engineering team ### 2:00 PM - Product Review - **Duration**: 1 hour - **Attendees**: Product, Design, Engineering leads ### 4:00 PM - 1:1 with Sarah - **Duration**: 30 minutes - **Notes**: Follow up on project timeline </detail> ``` ## Session Key Avatar responses use session key: `agent:main:avatar`


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: httencn/news-aggregator (version 1.0.3)

--- name: news-aggregator version: 1.0.3 description: 国内外社会、科技、军事新闻汇总。自动搜索、筛选、整理新闻要点。 license: MIT --- # News Aggregator 聚合国内外社会、科技、军事新闻，自动筛选要点。 ## 新闻源 ### 国内科技 - 36氪 (https://36kr.com/information/tech/) - 机器之心 (https://www.jiqizhixin.com/) - 量子位 (https://www.1baijia.com/) - IT之家 (https://www.ithome.com/) ### 国内军事 - 观察者网 (https://www.guancha.cn/) - 澎湃新闻 (https://www.thepaper.cn/) - 腾讯军事 (https://new.qq.com/om/mil/) ### 国际科技 - TechCrunch - The Verge - Wired - Ars Technica ### 国际军事 - Defense News - Jane's Defence - Military Times ## 工作流 1. **搜索** - 用 tavily 或 web_fetch 搜索各源 2. **筛选** - 过滤重复、过期、不可靠来源 3. **整理** - 按类别整理，每条含标题、来源、要点 4. **输出** - 生成结构化汇总 ## 可信度规则 **优先：** - 官方媒体报道 - 权威机构发布 **谨慎：** - 论坛帖子 - 匿名消息 - 二手转载 ## 输出格式 ```markdown ## 科技新闻 1. [标题](链接) 来源：xxx | 时间：xxx 要点：xxx ## 军事新闻 1. [标题](链接) 来源：xxx | 时间：xxx 要点：xxx ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dinghaibin/sha256-tool (version 1.0.0)

--- name: sha256-tool description: Compute SHA-256 cryptographic hash values for files and text. Use for secure data verification and integrity checks. --- # SHA256 - SHA-256 Hash Calculator Generate 256-bit (32-byte) SHA-256 hash values. Industry-standard for file integrity verification, software distribution checksums, and data authentication. ## Usage ```bash sha256-tool [options] <file> ``` ## Examples ```bash sha256-tool downloaded.iso sha256-tool important.pdf echo "verify me" | sha256-tool ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 3cpj/pose-transfer (version 0.1.1)

--- name: pose-transfer description: AI-powered fashion model pose transfer tool. Generate pose variations of a model/product image using reference pose images while keeping clothing and background consistent. dependency: python: - fal-client>=0.8.0 requires: - FAL_KEY environment variable - Python 3.8+ --- # Pose Transfer AI 姿态迁移工具 —— 给模特换姿势，保持服装和背景不变。 ## 使用方法 ```bash python3 scripts/generate.py \ --original "/path/to/model.jpg" \ --poses "/path/to/pose.jpg" \ --output "./output" \ --keep-background ``` ## 参数 | 参数 | 说明 | |------|------| | `--original` | 原图路径 | | `--poses` | pose 参考图（1-4张） | | `--output` | 输出目录（默认./output）| | `--keep-background` | 保留原图背景 | | `--desc` | 详细描述（提高准确度）| | `--expression` | 表情（默认smiling）| | `--resolution` | 分辨率 1K/2K/4K | ## 前置要求 ```bash export FAL_KEY="your-fal-api-key" pip install fal-client ``` 获取 API Key: https://www.fal.ai/dashboard/keys ## 费用 - $0.15/张图 - 模型: fal-ai/nano-banana-pro/edit


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: parkerscobey/hizal-search (version 0.1.0)

--- name: hizal-search description: Retrieve existing context before building anything. Self-triggering — fires whenever the agent is about to search the codebase, recall prior decisions, look for conventions, check memory, investigate patterns, or gather background knowledge before starting work. Covers all Hizal search and read tools (semantic search, query_key lookup, scope filtering, compaction, version history). Triggers on phrases like "let me check", "I need to find", "what do we know about", "search for", "look into", "have we done this before", "check existing", "find related", "recall", or any moment the agent would otherwise start Googling or grep-ing without first consulting Hizal. --- # Hizal Search Search before you build. Don't rediscover what the team already decided. ## Semantic Search Start with 2-3 broad searches using different phrasings: ``` hizal__search_context(query="<key concept from the task>") hizal__search_context(query="<ticket id or feature name>") hizal__search_context(query="<related subsystem or endpoint>") ``` ### Narrow by Scope ``` # Project-specific knowledge and conventions hizal__search_context(query="<concept>", scope="PROJECT", project_id="<id>") # Prior agent memory / investigation notes hizal__search_context(query="<concept>", scope="AGENT", chunk_type="MEMORY") # Org-wide principles and standards hizal__search_context(query="<concept>", scope="ORG") ``` ### Filter by Chunk Type ``` hizal__search_context(query="<concept>", chunk_type="KNOWLEDGE") hizal__search_context(query="<concept>", chunk_type="CONVENTION") hizal__search_context(query="<concept>", chunk_type="MEMORY") ``` ## Exact Lookup by query_key When you know the exact key: ``` hizal__read_context(query_key="<exact-query-key>", project_id="<id>") ``` ## Read a Specific Chunk ``` hizal__read_context(id="<chunk-uuid>") ``` ## Synthesize Related Context Pull related chunks for synthesis (read-only, never delete source chunks): ``` hizal__compact_context(query="<concept>") hizal__compact_context(query="<concept>", scope="PROJECT", project_id="<id>") ``` ## Version History Inspect how a chunk evolved: ``` hizal__get_context_versions(id="<chunk-uuid>") ``` ## Search Strategy 1. **Broad first** — 2-3 searches with different phrasings 2. **Read the results** — chunks contain architecture decisions, conventions, and prior work 3. **Narrow by scope** if broad search returns too much noise 4. **Use query_key** if you already know the key 5. **If an AGENT memory chunk is broadly useful** — promote it with `write_knowledge` or `write_convention` See `hizal-write` skill for writing back to Hizal.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: cjlrestlong-ai/hk-stock-morning-report (version 1.4.3)

--- name: hk-stock-morning-report version: 1.4.3 description: > Generate HK stock market morning report (股市晨報) for bank trading desks. Triggers: "生成晨报","股市晨报","今日股市","港股晨報" 推送：微信個人 + 飛書群 | 數據：騰訊財經+stcn.com+格隆匯+實時搜索 --- # 股市晨報 Skill（v1.4.2） ## I 報告格式 ``` 🔴股市晨報(x.xx) 🔵 | 標題1；標題2；標題3 「內部文件 不得外傳」 📍一、[昨日/週X]股市回顧 [市場概況 + 強弱勢股] 📍二、南下資金凈買入XX億（港元） 📈 港股通(滬): 凈買入XX億 📉 港股通(深): 凈賣出XX億 其中：凈買入[股票]XX億；凈賣出[股票]XX億 📍三、熱點資訊 ▶️ 標題 摘要（空一行） ▶️ 標題 摘要（空一行） ▶️ 標題 摘要（空一行） 📍四、熱門港股 ▶️ [股票名稱+代碼] 摘要 資料來源: xxx 「只供內部參考，不可外傳」 ``` ## II 格式規則 2.1 大標題 = 月份.日期 + ▶️分號連接 2.2 📍後無空格，直接接字 2.3 （港元）：小標題行有；📈📉和個股明細無 2.4 ▶️ 標題↔摘要：空一行（`\n\n`，不是`&nbsp;`） 2.5 港股通(滬)↔港股通(深)：無空行，緊密排列 2.6 第四部分只寫1檔 2.7 搜不到數字 → 擴大搜索範圍、更換關鍵詞、換數據源，**不存在「待更新」這個退出選項** 2.8 【南下資金假期休市規則（2026-05-05）】 - 港股通因假期休市時，第二部分統一使用固定文字：`因假期關係，昨日滬港通及深港通休市。` - 位置：僅限第二部分南下資金，不適用其他章節 - 格式示例： ``` 📍二、南下資金 因假期關係，昨日滬港通及深港通休市。 ``` - 不使用「待更新」字樣 ## III 執行流程 3.1 確認今日日期與上一交易日，查gov.hk確認是否交易日 3.2 讀 `references/stock_report_format.md` 取格式 3.3 抓恒指/科指（騰訊財經API） 3.4 搜市場回顧（gelonghui.com） 3.5 搜南下資金（stcn.com全市場口徑），同時搜個股明細 3.6 搜第三部分（今日日期的新聞，不是舊聞） 3.7 搜第四部分（「熱門股票」主題，選1檔） 3.8 按模板組裝，大標題=▶️分號連接 3.9 核查9項（見下方）後發送 3.10 飛書只發卡片 **⚠️ 每日必生成原則（2026-05-03 強化）：** - **所有日子都生成報告，包括週末、假期、補假** - 交易日：生成標準五部分格式晨報 - 非交易日（週末/假期/補假）：生成「宏觀特報」，格式見下方第八節 - **禁止跳過任何一天**，即使港股休市也必須生成並發送 ## IV 發送前核查（9項） 4.1 [ ] 大標題 = ▶️分號分隔 4.2 [ ] 📈📉方向正確（📈=凈買入） 4.3 [ ] （港元）只在正確位置 4.4 [ ] ▶️↔摘要有空行 4.5 [ ] 📍後無空格 4.6 [ ] 第四部分1檔 4.7 [ ] 數字有靠譜來源 4.8 [ ] 📈📉數字：必須找到真實來源，**不得以任何理由寫待更新** 4.9 [ ] 個股明細已完整填充 ## V 禁區 5.1 第一部分不準猜測假日 → 先查gov.hk 5.2 早上不引用當天收盤數 → 只用上一交易日 5.3 數字不確定 → 繼續搜，**寫待更新等於承認失敗** 5.4 修復報告時重新生成全報告 → 最小修改原則 5.5 個股明細留空 → 繼續搜完，**不得以待更新敷衍** 5.6 **對話 session 轉發原則**：收到「生成晨報」請求時，先檢查 `stock_morning_report.md` 是否存在且當日生成。若存在，直接讀取轉發，不重新搜索。若不存在，才走完整流程生成。 ## VI 固化文件 | 編號 | 文件 | 用途 | |------|------|------| | 6.1 | `references/stock_report_format.md` | 完整模板原文 | | 6.2 | `references/errors.md` | 錯誤歷史（14條） | ## VII 數據來源 | 編號 | 內容 | 來源 | |------|------|------| | 7.1 | 指數（恒指/科指） | 騰訊財經API | | 7.2 | 南下資金 | stcn.com（全市場口徑） | | 7.3 | 市場回顧 | 格隆匯 | | 7.4 | 熱點資訊 + 熱門港股 | **browser工具首頁實時抓取**（首選：新浪港股 `finance.sina.com/stock/hkstock/`；備選：格隆匯首頁 `gelonghui.com`）。web_search/web_fetch失效時使用browser直接抓取頁面真實頭條，**禁止在搜索工具失效時自行編造新聞** | | 7.5 | 南下資金個股明細 | 格隆匯 / stcn.com，搜不到時更換關鍵詞擴大範圍，**不存在待更新退出選項** |


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)