OpenClaw/clawhub-security-signals huggingface dataset:
Skill: veeramanikandanr48/spec-miner (version 0.1.0)

--- name: spec-miner description: Use when understanding legacy or undocumented systems, creating documentation for existing code, or extracting specifications from implementations. Invoke for legacy analysis, code archaeology, undocumented features. triggers: - reverse engineer - legacy code - code analysis - undocumented - understand codebase - existing system role: specialist scope: review allowed-tools: Read, Grep, Glob, Bash output-format: document --- # Spec Miner Reverse-engineering specialist who extracts specifications from existing codebases. ## Role Definition You are a senior software archaeologist with 10+ years of experience. You operate with two perspectives: **Arch Hat** for system architecture and data flows, and **QA Hat** for observable behaviors and edge cases. ## When to Use This Skill - Understanding legacy or undocumented systems - Creating documentation for existing code - Onboarding to a new codebase - Planning enhancements to existing features - Extracting requirements from implementation ## Core Workflow 1. **Scope** - Identify analysis boundaries (full system or specific feature) 2. **Explore** - Map structure using Glob, Grep, Read tools 3. **Trace** - Follow data flows and request paths 4. **Document** - Write observed requirements in EARS format 5. **Flag** - Mark areas needing clarification ## Reference Guide Load detailed guidance based on context: | Topic | Reference | Load When | |-------|-----------|-----------| | Analysis Process | `references/analysis-process.md` | Starting exploration, Glob/Grep patterns | | EARS Format | `references/ears-format.md` | Writing observed requirements | | Specification Template | `references/specification-template.md` | Creating final specification document | | Analysis Checklist | `references/analysis-checklist.md` | Ensuring thorough analysis | ## Constraints ### MUST DO - Ground all observations in actual code evidence - Use Read, Grep, Glob extensively to explore - Distinguish between observed facts and inferences - Document uncertainties in dedicated section - Include code locations for each observation ### MUST NOT DO - Make assumptions without code evidence - Skip security pattern analysis - Ignore error handling patterns - Generate spec without thorough exploration ## Output Templates Save specification as: `specs/{project_name}_reverse_spec.md` Include: 1. Technology stack and architecture 2. Module/directory structure 3. Observed requirements (EARS format) 4. Non-functional observations 5. Inferred acceptance criteria 6. Uncertainties and questions 7. Recommendations ## Knowledge Reference Code archaeology, static analysis, design patterns, architectural patterns, EARS syntax, API documentation inference ## Related Skills - **Feature Forge** - Creates specs for new features - **Fullstack Guardian** - Implements changes to documented systems - **Architecture Designer** - Reviews discovered architecture


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: pazzilivo/fund-query (version 1.0.0)

--- name: fund-query description: 查询场外基金（公募基金）的实时估值、净值、基本信息。支持天天基金代码查询。当用户询问基金净值、基金估值、基金涨跌时使用。 metadata: requires: bins: [python3] --- # 场外基金查询 查询公募基金的实时估值、历史净值和基本信息。 ## 使用场景 - 用户询问基金净值："005827 净值多少？" - 用户询问基金估值："易方达蓝筹现在估值多少？" - 用户询问基金涨跌："招商白酒今天涨了还是跌了？" ## 使用方法 ```bash python3 {{SKILL_DIR}}/scripts/fund_query.py <基金代码> [命令] ``` **命令**： - `estimate` 或不传 - 查询实时估值（默认） - `info` - 查询基金基本信息 - `history` - 查询历史净值 **示例**： ```bash # 查询实时估值 python3 {{SKILL_DIR}}/scripts/fund_query.py 005827 # 查询基金信息 python3 {{SKILL_DIR}}/scripts/fund_query.py 005827 info # 查询历史净值 python3 {{SKILL_DIR}}/scripts/fund_query.py 005827 history ``` ## 支持的基金代码格式 - 6 位数字基金代码，如 `005827`、`110022`、`161725` - 天天基金/东方财富基金代码 ## 常见基金代码参考 | 基金名称 | 基金代码 | |----------|----------| | 易方达蓝筹精选混合 | 005827 | | 易方达消费行业 | 110022 | | 招商中证白酒 | 161725 | | 景顺长城新兴成长 | 260108 | | 中欧医疗健康混合A | 003095 | | 诺安成长混合 | 320007 | ## 数据来源 天天基金网（fund.eastmoney.com）公开 API ## 输出格式 查询成功后以紧凑格式展示： ``` 📊 **{基金名称}**（{基金代码}） 💰 实时估值：{估值} 元 | 📈 涨跌幅：{涨跌幅}% ↑/↓ 📅 估值时间：{时间} 📊 昨日净值：{昨日净值} 元（{净值日期}） ``` ## 注意事项 1. 实时估值仅在交易时段更新（9:30-15:00） 2. 非交易时段显示最近一次的净值数据 3. 基金代码必须为 6 位数字


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: fy39913/cn-weather-skill (version 1.0.1)

--- name: cn-weather description: 查询中国城市实时天气信息。当用户询问某个城市的天气、气温、湿度、风力、天气预报，或者说"今天天气怎么样"、"XX天气"、"帮我查天气"等时，必须使用此skill。支持全国所有城市，数据来自中国气象局官方接口，实时准确。即使用户只是提到某地天气或想了解出行穿衣建议，也应优先触发此skill获取实时数据。 --- # 天气查询 Skill 通过中国气象局官方接口，分两步查询城市实时天气信息。 --- ## 工作流程 ### 第一步：获取气象站点编号 调用站点查询接口，将城市名转为气象站点 ID： ```bash curl --location 'https://data.cma.cn/kbweb/home/getStationID' \ --header 'Content-Type: application/json' \ --data '{"city":"<城市名>"}' ``` **说明：** - `<城市名>` 替换为用户输入的城市，例如 `张家港`、`北京`、`上海` - 响应中提取站点编号字段（如 `stationID` 或类似字段） - 若返回多个站点，优先取第一个或与城市名最匹配的站点 **示例请求：** ```bash curl --location 'https://data.cma.cn/kbweb/home/getStationID' \ --header 'Content-Type: application/json' \ --data '{"city":"张家港"}' ``` --- ### 第二步：查询实时天气 使用上一步获取的站点编号，查询当前天气数据： ```bash curl --location 'https://weather.cma.cn/api/now/<站点编号>' \ --header 'Accept: application/json, text/javascript, */*; q=0.01' ``` **说明：** - `<站点编号>` 替换为第一步返回的站点 ID，例如 `58349` - 响应包含温度、湿度、风向、风速、天气现象等字段 **示例请求：** ```bash curl --location 'https://weather.cma.cn/api/now/58349' \ --header 'Accept: application/json, text/javascript, */*; q=0.01' ``` --- ## 结果展示规范 获取天气数据后，按以下格式整理并回复用户： ``` 📍 <城市名> 实时天气 ━━━━━━━━━━━━━━━━━━ 🌡️ 温度：XX°C 🤔 体感温度：XX°C 💧 湿度：XX% 🌬️ 风向：XX风 💨 风速：X级（XX m/s） ☁️ 天气：XX（晴/多云/小雨等） 👁️ 能见度：XX km ⏱️ 更新时间：XXXX-XX-XX XX:XX ``` - 若接口返回字段名为英文，对照常见字段进行中文映射（temperature→温度，humidity→湿度，windDirection→风向，windSpeed→风速，weather→天气现象等） - 若某字段缺失，跳过该行，不显示"未知"或空值 - 结尾可根据天气数据给出简短的出行或穿衣建议（1~2句话） --- ## 错误处理 | 情况 | 处理方式 | |------|----------| | 城市名无法识别 / 站点 ID 为空 | 告知用户未找到该城市的气象站点，建议尝试更换城市全称或相邻城市 | | 第二步接口请求失败 | 告知用户天气数据暂时无法获取，建议稍后重试 | | 返回数据字段异常 | 展示能解析的字段，忽略异常字段，不中断回复 | --- ## 注意事项 - 两步接口**必须按顺序执行**，第一步成功后才能执行第二步 - 城市名建议使用**中文全称**，如"张家港市"效果与"张家港"相同 - 本接口为中国气象局数据，**仅支持中国大陆城市**；若用户询问港澳台或境外城市，提示暂不支持并建议使用其他渠道


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: seanfeng1234/tts-voice-generator (version 1.3.0)

--- name: tts-voice-generator description: 文本转语音生成工具，支持浏览声音列表、选择声音、上传自定义音频（带文本内容）并命名保存、生成语音和查询任务状态等功能。 --- # TTS 语音生成器 ## 完整工作流程 ``` ┌─────────────┐ ┌──────────────────────┐ ┌─────────────┐ ┌─────────────┐ │ 1. 浏览声音 │ -> │ 2. 选择或上传声音 │ -> │ 3. 生成语音 │ -> │ 4. 获取结果 │ └─────────────┘ └──────────────────────┘ └─────────────┘ └─────────────┘ ``` **步骤说明：** 1. **浏览声音**：查看可用声音列表 2. **选择声音**： - 如果有合适的声音 → 说"用第 X 个声音"或"用 [声音名称]" - 如果没有合适的 → 上传自己的音频（需提供音频文件、声音名称、音频文本内容） 3. **生成语音**：提供文本内容，使用选中的声音生成 4. **获取结果**：等待任务完成，返回音频 URL --- ## 示例命令 ### 1. 浏览可用声音 ``` 列出所有可用的声音 ``` 输出示例： ``` 📋 可用声音列表： 1. 派蒙 - 平静 (定制声音) 试听文本：既然罗莎莉亚说足迹上有元素力... 2. 龙某洋 (定制声音) 试听文本：三十、功名尘与土八千里路云和月。 ... 💡 使用方式： • 选择声音：说'用第 X 个声音'或'用 [声音名称]' • 上传自定义声音：说'上传我的声音'并提供音频文件、名称和音频内容 共 10 个声音 ``` ### 2. 选择已有声音生成 ``` 用第 1 个声音生成：你好，这是测试文本 ``` 或 ``` 用派蒙生成：春眠不觉晓，处处闻啼鸟 ``` ### 3. 上传自定义声音 **格式：** ``` 上传我的声音：[文件路径]，名字叫"[声音名称]"，音频内容是"[音频文本]" ``` **示例 1 - 本地文件路径：** ``` 上传我的声音：C:/audio/my_voice.wav，名字叫"温柔女声"，音频内容是"春眠不觉晓，处处闻啼鸟" ``` **示例 2 - 相对路径：** ``` 上传这个音频文件作为参考声音：./sample.wav，命名为"我的声音"，文本内容是"白日依山尽，黄河入海流" ``` **说明：** | 参数 | 说明 | 要求 | |------|------|------| | 音频文件 | WAV 或 MP3 格式 | 建议 10-60 秒，一句话或一句诗词的录音 | | 声音名称 | 给声音起的名字 | 如"温柔女声"、"成熟男声"等 | | 音频内容 | 音频中朗读的文本 | 用于音色训练参考，必须与音频内容一致 | ### 4. 使用刚上传的声音生成 ``` 用温柔女声生成：欢迎使用我们的服务 ``` ### 5. 查询任务状态 ``` 查询任务状态：taskId_xxx ``` --- ## 触发方式 当用户请求以下内容时触发： | 类型 | 示例 | |------|------| | 生成语音 | "生成语音" / "TTS" / "文本转语音" | | 浏览声音 | "列出声音" / "获取声音列表" / "有哪些声音" | | 上传声音 | "上传音频" / "添加声音" / "自定义声音" / "上传我的声音" | | 查询状态 | "查询任务状态" / "检查 TTS 进度" | | 选择声音生成 | "用第 X 个声音生成：[文本]" / "用 [声音名称] 生成：[文本]" | | 直接转换 | 提供文本内容要求转换成语音 | --- ## 配置要求 ### 首次使用 需要在 `~/.openclaw/config.json` 中配置 API Key（与下载工具 Skill 共用）： ```json { "datamass_api_key": "您的 API Key" } ``` ### 获取 API Key 1. 访问 https://www.datamass.cn 2. 注册并登录 3. 创建 API Key 4. 复制生成的 API Key 到配置文件中 --- ## 功能特点 - ✅ 先浏览声音列表，再决定是否上传自定义声音 - ✅ 支持按序号选择声音（"用第 2 个声音"） - ✅ 支持按名称选择声音（"用温柔女声"） - ✅ 上传自定义音频时一步保存：音频文件 + 声音名称 + 音频文本 - ✅ 异步任务处理，无需等待 - ✅ 自动状态轮询 - ✅ 音频文件保存到 OSS，24 小时有效 - ✅ 自定义声音永久保存到数据库，可重复使用 --- ## 核心功能 | 方法 | 说明 | |------|------| | `start_tts_workflow()` | 启动引导式交互流程 | | `show_voice_list()` | 显示可用声音列表（格式化输出） | | `list_voices()` | 获取可用声音列表（原始数据） | | `select_voice(index)` | 根据序号选择声音 | | `generate_speech()` | 提交 TTS 任务（支持 voice_index/voice_name/media_path） | | `check_task_status()` | 查询任务状态 | | `upload_audio()` | 上传音频文件（支持 style_name 和 audio_text 参数） | | `add_custom_voice()` | 添加定制声音（保存到数据库） | | `upload_and_add()` | 一键上传并添加为定制声音（上传时同时保存音频文本） | --- ## 注意事项 ### 计费说明 - TTS 服务按生成音频时长计费 - 最低余额门槛：5 积分 - 100 字以内：2 积分，超出部分每 100 字加 1 积分 - 需要充值积分后使用 ### 上传要求 - **音频格式**：WAV 或 MP3 - **音频时长**：建议 10-60 秒 - **音频内容**：一句话或一句诗词的清晰录音 - **声音名称**：自定义，用于后续调用 - **音频文本**：必须与音频中朗读的内容一致，用于音色训练参考 ### 使用提示 - 自定义声音上传后永久保存到数据库，可重复使用 - 建议上传前先浏览可用声音列表，避免重复上传 - 生成语音时可指定声音序号或名称 - 任务提交后自动轮询状态，无需手动查询

path: requirements.txt
content: requests>=2.28.0


path: tts-voice-generator/requirements.txt
content: requests>=2.28.0


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: edxi/miniade-dispatchi (version 0.1.1)

--- name: dispatchi description: Launch non-blocking interactive Claude Code tasks for slash-only plugins like ralph-loop. Use when a task needs interactive slash commands and completion callback routing. --- Run `{baseDir}/scripts/run_dispatchi.sh` with user args. ## Contract - Format: `/dispatchi <project> <task-name> <prompt...>` - Workdir mapping: `${REPOS_ROOT:-/home/miniade/repos}/<project>` - Defaults: `max-iterations=20`, `completion-promise=COMPLETE` - Auto-exit: when completion promise appears on its own line, wrapper requests `/exit` and closes tmux session. ## Local config - optional env file: `${OPENCLAW_DISPATCH_ENV:-<workspace>/skills/dispatch.env.local}` - supports OpenClaw `skills.entries.dispatchi.env` injection - script is self-contained (bundled `claude_code_run.py`) ## Security disclosure - Reads only allowlisted env keys from `dispatch.env.local` using key=value parsing (no `source`). - Launches local tmux session and local Claude process; writes output to configured result paths. - Network callback is **disabled by default**; enable only with `ENABLE_CALLBACK=1` and explicit group settings. - No runtime download of external code. ## Behavior 1. Validate args and return usage if incomplete. 2. Start interactive dispatch in background (non-blocking). 3. Verify tmux session exists before returning started. 4. Use `/cancel <run-id>` to stop a running loop.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: smjai/trustloop (version 1.0.3)

--- name: trustloop description: AI governance layer — logs, audits, and enforces kill-switch rules on agent tool calls. Built by trustloop.live. license: MIT-0 metadata: openclaw: requires: env: - TRUSTLOOP_API_KEY primaryEnv: TRUSTLOOP_API_KEY homepage: https://trustloop.live tags: - governance - audit - compliance - security - mcp --- # TrustLoop — AI Governance for Your Agent **Operator:** trustloop.live (Soji Muyiwa, UK) — same owner as the Railway host. **Privacy:** Only tool name and arguments are sent. TrustLoop automatically masks PII (emails, phone numbers) and redacts secrets (API keys, tokens) before storing. No file contents or conversation history are transmitted. **Open dashboard:** app.trustloop.live shows everything logged — full transparency. ## Before Sensitive Tool Calls Before calling any tool that is destructive, external, financial, or bulk in nature, check with TrustLoop: ```bash curl -s -X POST https://api.trustloop.live/api/intercept \ -H "Content-Type: application/json" \ -H "x-[REDACTED_SECRET]" \ -d '{"tool_name": "<tool>", "arguments": <args_json>}' ``` **Important — before sending arguments:** Strip or mask any raw passwords, tokens, or private keys from the arguments object. Send only the fields needed to describe the action (e.g. recipient, subject, file path — not credentials). If response is `{"allowed": false}` — stop and inform the user. Do not execute. If response is `{"allowed": true}` — proceed. ## Which Tools Require a Check - Deleting, moving, or overwriting files - Sending emails, messages, or notifications - Any financial transaction or payment - Posting to social media or external services - Bulk operations (more than 5 records) - Running shell commands that modify the system ## Setup 1. Sign up free at app.trustloop.live 2. Copy your API key from the dashboard 3. `export TRUSTLOOP_API_KEY=tl_your_key_here` Data retention, privacy policy, and security docs: trustloop.live Full API reference (rules, kill-switches, approvals): see `api-reference.md`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: homeofe/openclaw-ops-elvatis (version 0.2.1)

--- name: openclaw-ops-elvatis description: Operational commands - dashboards, monitoring, and management for OpenClaw deployments. --- # OpenClaw Ops (Elvatis) Operational tooling for OpenClaw deployments: dashboards, monitoring, config validation, safe restarts, and deployment management. ## Extension Commands ### Config Commands (`config-commands.ts`) Validate and inspect OpenClaw configuration files. Ensures valid JSON, detects legacy keys, and guards against broken configs reaching production. ### Observer Commands (`observer-commands.ts`) Monitor gateway health, track plugin status, and surface operational metrics for running OpenClaw instances. ### Phase 1 Commands (`phase1-commands.ts`) Core operational commands for day-to-day management: status checks, restart orchestration, and deployment health verification. ### Skills Commands (`skills-commands.ts`) Manage installed skills: list, inspect, and verify skill integrity across the workspace. ### Legacy Commands (`legacy-commands.ts`) Backward-compatible command support for older OpenClaw configurations during migration periods. ## Scripts ### Config Validation (`openclaw-config-validate.py`) Validates `openclaw.json` against known schema rules — checks for valid JSON, forbidden legacy keys (e.g. `plugins.paths`), and verifies a golden master config exists. ### Safe Restart (`openclaw-safe-restart.sh`) Backup → validate → restart → restore-on-failure workflow. Prevents broken configs from taking down the gateway. ### GitHub Privacy Scanning Automated scanning of repos for accidentally committed private files (MEMORY.md, TODO.md, HEARTBEAT.md, .env). Runs via daily cron. ### Issue Triage (`triage_labels.py`) Automated GitHub issue labeling and triage for openclaw-* repositories. ## Installation Install via ClawHub: ```bash clawhub install openclaw-ops-elvatis ```


Security scan verdicts — ClawScan: suspicious | static analysis:  | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: yinwuzhe/apply-8138 (version 1.0.3)

--- name: summarize description: Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube). homepage: https://summarize.sh metadata: {"clawdbot":{"emoji":"🧾","requires":{"bins":["summarize"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/summarize","bins":["summarize"],"label":"Install summarize (brew)"}]}} --- # Summarize Fast CLI to summarize URLs, local files, and YouTube links. ## Quick start ```bash summarize "https://example.com" --model google/gemini-3-flash-preview summarize "/path/to/file.pdf" --model google/gemini-3-flash-preview summarize "https://youtu.be/dQw4w9WgXcQ" --youtube auto ``` ## Model + keys Set the API key for your chosen provider: - OpenAI: `OPENAI_API_KEY` - Anthropic: `ANTHROPIC_API_KEY` - xAI: `XAI_API_KEY` - Google: `GEMINI_API_KEY` (aliases: `GOOGLE_GENERATIVE_AI_API_KEY`, `GOOGLE_API_KEY`) Default model is `google/gemini-3-flash-preview` if none is set. ## Useful flags - `--length short|medium|long|xl|xxl|<chars>` - `--max-output-tokens <count>` - `--extract-only` (URLs only) - `--json` (machine readable) - `--firecrawl auto|off|always` (fallback extraction) - `--youtube auto` (Apify fallback if `APIFY_API_TOKEN` set) ## Config Optional config file: `~/.summarize/config.json` ```json { "model": "openai/gpt-5.2" } ``` Optional services: - `FIRECRAWL_API_KEY` for blocked sites - `APIFY_API_TOKEN` for YouTube fallback

path: _meta.json
content: ownerId: kn70pywhg0fyz996kpa8xj89s57yhv26
slug: summarize
version: 1.0.0
publishedAt: 1767545383635

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: a6590072/yuque (version 1.0.0)

--- name: yuque description: Manage Yuque (语雀) knowledge base documents and repositories. Use when users need to interact with Yuque for document operations including reading documents, listing repositories, searching content, creating documents, and managing knowledge bases. Supports both personal and team spaces. --- # Yuque Skill Interact with Yuque (语雀) knowledge base platform via the Yuque Open API. ## Prerequisites - Yuque API Token (stored in environment variable `YUQUE_TOKEN`) - Base URL: `https://www.yuque.com/api/v2` ## Authentication All API requests require an `X-Auth-Token` header with your Yuque token. ## Core Workflows ### 1. Get User Info ```bash curl -s -H "X-Auth-[REDACTED_SECRET]" https://www.yuque.com/api/v2/user ``` ### 2. List User Repositories ```bash curl -s -H "X-Auth-[REDACTED_SECRET]" https://www.yuque.com/api/v2/users/<login>/repos ``` ### 3. List Repository Documents ```bash curl -s -H "X-Auth-[REDACTED_SECRET]" https://www.yuque.com/api/v2/repos/<namespace>/docs ``` ### 4. Get Document Detail ```bash curl -s -H "X-Auth-[REDACTED_SECRET]" https://www.yuque.com/api/v2/repos/<namespace>/docs/<slug> ``` ### 5. Get Document Content (HTML/Markdown) ```bash # Get HTML content curl -s -H "X-Auth-[REDACTED_SECRET]" https://www.yuque.com/api/v2/repos/<namespace>/docs/<slug>?raw=1 # Get Markdown content curl -s -H "X-Auth-[REDACTED_SECRET]" https://www.yuque.com/api/v2/repos/<namespace>/docs/<slug>?raw=1 | python scripts/parse_yuque.py --format md ``` ### 6. Create Document ```bash curl -s -X POST \ -H "X-Auth-[REDACTED_SECRET]" \ -H "Content-Type: application/json" \ -d '{"title": "Document Title", "body": "Document content in Markdown"}' \ https://www.yuque.com/api/v2/repos/<namespace>/docs ``` ### 7. Update Document ```bash curl -s -X PUT \ -H "X-Auth-[REDACTED_SECRET]" \ -H "Content-Type: application/json" \ -d '{"title": "New Title", "body": "Updated content"}' \ https://www.yuque.com/api/v2/repos/<namespace>/docs/<id> ``` ### 8. Search Documents Yuque API doesn't have a direct search endpoint. Use list + filter approach: ```bash # List all docs in a repo and filter by title python scripts/search_yuque.py --namespace <namespace> --query "keyword" ``` ## Common Namespace Formats - Personal repo: `username/repo-slug` - Team repo: `teamname/repo-slug` ## Response Format All API responses are JSON with this structure: ```json { "data": { ... }, "meta": { ... } } ``` ## Error Handling Common HTTP status codes: - `401`: Unauthorized (check token) - `403`: Forbidden (no permission) - `404`: Resource not found - `429`: Rate limited (wait and retry) ## Helper Scripts Use the provided Python scripts for common operations: - `scripts/yuque_cli.py` - Full CLI for Yuque operations - `scripts/parse_yuque.py` - Parse Yuque HTML to Markdown - `scripts/search_yuque.py` - Search documents in repositories ## References - API Documentation: See [references/api.md](references/api.md) - Common Operations: See [references/examples.md](references/examples.md)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: yunneetoichoi/qwe (version 1.0.0)

--- name: ai-agent description: Facebook Publisher Skill (Automate Page Posts via Graph API) version: 1.0.1 env: - FB_APP_ID - FB_APP_SECRET - FB_PAGE_ID - FB_PAGE_ACCESS_TOKEN --- # Facebook Graph API Skill (Advanced) ## Purpose Production-oriented guide for building Facebook Graph API workflows for Pages: publishing posts (text + image), managing tokens, and operating Page content safely using direct HTTPS calls. ## Best fit - Page posting automation with images (DALL-E generated or external URL) - Token management (short-lived → long-lived → page token) - Retry-safe, rate-limit-aware production pipelines ## Not a fit - Personal profile posting (not supported by Graph API for third-party apps) - Ads / Marketing API workflows - Browser-based OAuth flows ## Quick orientation ``` agents/fb_token_helper.py ← Get & exchange tokens (run this first!) agents/fb_publisher_agent.py ← Post text / images to Page config.py ← All env vars test_fb_connection.py ← Verify token is working ``` ## Token Flow ``` Short-lived User Token (1-2h) ↓ GET /oauth/access_token?grant_type=fb_exchange_token Long-lived User Token (60 days) ↓ GET /me/accounts Page Access Token (never expires*) ``` *Until user changes password or revokes app. ## Required Environment Variables ```env FB_APP_ID=... # From Meta for Developers FB_APP_SECRET=... # App secret FB_PAGE_ID=... # Target Fanpage ID FB_PAGE_ACCESS_TOKEN=... # From fb_token_helper.py ``` ## Key API Endpoints ### Post text ``` POST /v21.0/{page_id}/feed message=... access_token={page_token} ``` ### Upload photo (unpublished) ``` POST /v21.0/{page_id}/photos url={image_url} published=false access_token={page_token} → Returns: { "id": "PHOTO_ID" } ``` ### Post with photo ``` POST /v21.0/{page_id}/feed message=... attached_media[0]={"media_fbid":"PHOTO_ID"} access_token={page_token} ``` ### Scheduled post ``` POST /v21.0/{page_id}/feed message=... scheduled_publish_time={unix_timestamp} published=false access_token={page_token} ``` ## Required Permissions | Permission | Purpose | |-----------|---------| | `pages_manage_posts` | Create/edit posts | | `pages_read_engagement` | Read reactions, comments | | `pages_show_list` | List managed pages | | `public_profile` | Basic user identity | ## Rate Limits - 200 calls/hour/user token - Implement retry with exponential backoff (see fb_publisher_agent.py) - POST 4-5 times/day max per Page for safety ## Security - Never log tokens or app secrets - Store all secrets in .env (ignored by git) - Validate webhook signatures if using webhooks - Monitor token validity daily with a cron job


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)