OpenClaw/clawhub-security-signals huggingface dataset:
Skill: jhc888007/kimi-search-simple (version 1.0.10)

--- name: kimi-web-search description: 通过 Kimi API 的 builtin_function $web_search 联网检索。用于新闻、实时信息、股价、公司动态等时效性内容；支持中英检索。先判断用户要「原始搜索结果条目」还是「综合总结」（默认总结），再调用脚本或相应参数。 --- # Kimi 联网搜索 用 Kimi 内置工具 `$web_search` 检索互联网最新信息。 ## 前置准备 在调用脚本前，您需要在 Moonshot 开放平台申请 **API Key**。 https://platform.moonshot.cn/ 请将 API Key 配置在系统的环境变量中。脚本会自动读取该变量（亦支持 `KIMI_API_KEY`）： ```bash # Linux / macOS export MOONSHOT_API_KEY="your_api_key_here" # Windows (CMD) set MOONSHOT_API_KEY="your_api_key_here" ``` ## 意图识别（先做这个） | 用户意图 | 表现 | 调用方式 | |---------|------|----------| | **总结**（默认） | 要结论、分析、简报、「帮我查一下并说明」 | `search(query)` 或 `python3 scripts/kimi_search.py -q "..."`，**不要**加 `--raw` | | **原始结果** | 要来源列表、逐条链接、摘录、引用、材料汇总、不要一句话概括 | `search(query, raw_output=True)` 或 `python3 scripts/kimi_search.py -q "..." --raw` | 未明确说「要原文/链接/逐条」时，按 **总结** 处理。 ## 前置条件 依赖： ```bash pip install openai httpx ``` 密钥（任选其一）： - 环境变量：`MOONSHOT_API_KEY` 或 `KIMI_API_KEY` - 文件：`~/.config/moonshot/api_key` 或 `~/.openclaw/credentials/moonshot-api-key` 申请地址：https://platform.moonshot.cn/ ## 用法 在 skill 根目录下执行（`scripts/kimi_search.py` 相对该目录）： **总结（默认）** ```bash python3 scripts/kimi_search.py -q "你的检索问题" ``` **原始搜索结果条目** ```bash python3 scripts/kimi_search.py -q "你的检索问题" --raw ``` **Python**（当前工作目录为 `scripts` 时） ```python from kimi_search import search print(search("快手 最新财报")) print(search("某主题", raw_output=True)) ``` ## 行为说明 - **总结**：系统提示为总结，模型在联网后给出综合回答与引用。 - **原始**：工具往返后会把系统提示换为中文严格格式，要求逐条输出 Title / Date / URL / Summary，禁止一句话概括；`temperature=0.3`。 - 模型默认 `kimi-k2-turbo-preview`，`max_tokens=8192`，`thinking` 关闭。 ## 故障排查 连接或 SSL：检查网络；可用 `curl https://api.moonshot.cn/v1/models -H "Authorization: Bearer $MOONSHOT_API_KEY"` 测通。 鉴权失败：在控制台核对密钥是否有效。 限流：间隔重试或缓存重复查询。 ## 许可 MIT


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kleberbaum/ts5 (version 0.1.0)

--- name: ts5 description: TS5 namespace for Netsnek e.U. TypeScript full-stack starter kit. Monorepo template with shared types, CI/CD pipelines, and one-click deployment. user-invocable: true version: 0.1.0 metadata: openclaw: os: [linux] permissions: [exec] --- # The TS5 Approach TS5 is the Netsnek e.U. full-stack TypeScript starter. One monorepo: shared types, frontend, backend, CI/CD, and deployment. ## Monorepo Structure ``` packages/ shared/ # Types and utilities web/ # Frontend (TSX) api/ # Backend (TS3) tools/ # Scripts and CI ``` ## Commands | Argument | Purpose | |----------|---------| | `--init` | Bootstrap monorepo layout | | `--packages` | Manage or list workspace packages | | `--deploy` | Trigger one-click deployment | ## From Zero to Deploy ```bash # Create monorepo ./scripts/monorepo-setup.sh --init # Verify packages ./scripts/monorepo-setup.sh --packages # Deploy ./scripts/monorepo-setup.sh --deploy ```

path: claw.json
content: {
  "name": "ts5",
  "version": "0.1.0",
  "description": "TS5 namespace for Netsnek e.U. TypeScript full-stack starter kit. Monorepo template with shared types, CI/CD pipelines, and one-click deployment.",
  "author": "netsnek",
  "license": "MIT",
  "tags": ["reserved", "netsnek", "fullstack"],
  "permissions": ["exec"],
  "entry": "SKILL.md",
  "scripts": ["scripts/monorepo-setup.sh"],
  "minOpenClawVersion": "0.8.0"
}


path: README.md
content: # TS5

Full-stack in one repo.

## What You Get

Monorepo template with shared types, frontend (TSX), backend (TS3), CI/CD pipelines, and one-click deployment.

## Bootstrap

```bash
claw install skill-ts5
./scripts/monorepo-setup.sh --init
```

## Deploy

```bash
./scripts/monorepo-setup.sh --deploy
```


path: scripts/monorepo-setup.sh
content: #!/usr/bin/env bash
set -e
echo "Copyright Netsnek e.U. 2026"

for arg in "$@"; do
  case "$arg" in
    --init)
      echo "Initializing monorepo..."
      ;;
    --packages)
      echo "Listing/syncing packages..."
      ;;
    --deploy)
      echo "Running deployment pipeline..."
      ;;
  esac
done


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: daniellummis/github-actions-cache-hardening-audit (version 1.0.0)

--- name: github-actions-cache-hardening-audit description: Audit GitHub Actions workflow cache usage for poisoning, keying, and secret-path risks. version: 1.0.0 metadata: {"openclaw":{"requires":{"bins":["bash","python3"]}}} --- # GitHub Actions Cache Hardening Audit Use this skill to statically audit `.github/workflows/*.yml` for risky cache patterns that can cause cache poisoning, stale cache churn, or secret leakage. ## What this skill checks - `actions/cache` usage on untrusted triggers (`pull_request_target`) - Cache keys that do not use `hashFiles(...)` - Overly broad `restore-keys` prefixes - Sensitive paths accidentally included in cache paths (`.aws`, `.ssh`, `.npmrc`, `.git`) - Floating cache action refs (`@main`, `@master`) ## Inputs Optional: - `WORKFLOW_GLOB` (default: `.github/workflows/*.y*ml`) - `TOP_N` (default: `20`) - `OUTPUT_FORMAT` (`text` or `json`, default: `text`) - `WARN_SCORE` (default: `3`) - `CRITICAL_SCORE` (default: `6`) - `WORKFLOW_FILE_MATCH` (regex, optional) - `WORKFLOW_FILE_EXCLUDE` (regex, optional) - `FAIL_ON_CRITICAL` (`0` or `1`, default: `0`) ## Run Text report: ```bash WORKFLOW_GLOB='.github/workflows/*.yml' \ bash skills/github-actions-cache-hardening-audit/scripts/cache-hardening-audit.sh ``` JSON output + fail gate: ```bash WORKFLOW_GLOB='.github/workflows/*.yml' \ OUTPUT_FORMAT=json \ FAIL_ON_CRITICAL=1 \ bash skills/github-actions-cache-hardening-audit/scripts/cache-hardening-audit.sh ``` Run against bundled fixtures: ```bash WORKFLOW_GLOB='skills/github-actions-cache-hardening-audit/fixtures/*.yml' \ bash skills/github-actions-cache-hardening-audit/scripts/cache-hardening-audit.sh ``` ## Output contract - Exit `0` by default (report mode) - Exit `1` when `FAIL_ON_CRITICAL=1` and at least one critical workflow is detected - Text mode prints a summary and top flagged workflows - JSON mode emits `summary`, `flagged_workflows`, and `critical_workflows`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: russellfei/vibe-3k (version 1.0.0)

--- name: vibe-3k description: Vibe Coding 最佳实践指南（vibe-3k）。AI 辅助开发的全流程规范：项目启动、PLAN/ACT 分离、多 Agent 协作、故障恢复、安全验收。Use when: (1) starting a new AI-assisted development project, (2) setting up multi-agent collaboration, (3) debugging with AI agents, (4) reviewing/accepting AI-generated code, (5) creating project rule files (CLAUDE.md/AGENTS.md). Triggers: "vibe coding", "vibe code", "vibe-3k", "AI 开发", "agent 协作", "多 agent", "PLAN ACT", "项目规则文件", "新项目启动", "故障处理", "代码验收". --- # Vibe Coding 最佳实践指南 > **vibe-3k** = Vibe Coding Best Practices v3.0（3K 行级全流程指南） > 你是主厨，AI 是厨房团队。你设计菜单、品尝每道菜，但不亲自切每根胡萝卜。 ## 10 条核心原则 1. **先想后 prompt** — 5 分钟思考省 5 小时迭代 2. **Plan ≠ Act** — 分离规划和执行，用不同模型/session 3. **Design Doc 是枢纽** — 压缩上下文，可审查，可交接 4. **小步提交** — 每个功能点一个 commit，Git 是安全网 5. **新功能新 session** — 上下文溢出是第一杀手 6. **循环修复就回退** — 3 次修不好 = 方案有问题 7. **安全不能 vibe** — Auth/支付/数据必须人工 review 8. **LOG.md 是续命药** — 记录进度，任何时候都能恢复 9. **多 Agent 分工明确** — PM 规划、Dev 执行、QA 审查 10. **验收有 checklist** — 自动化检查 + 人工确认 ## 参考文档（按需加载） | 文件 | 内容 | 何时读取 | |------|------|---------| | [references/01-quickstart.md](references/01-quickstart.md) | 核心概念 + 项目启动 + 规则文件 + 4 套项目模板 | 启动新项目时 | | [references/02-single-agent.md](references/02-single-agent.md) | PLAN/ACT 分离 + Design Doc + Prompt 技巧 + 上下文管理 | 单人 AI 开发时 | | [references/03-multi-agent.md](references/03-multi-agent.md) | 多 Agent 协作 + Git Worktree 并行 + Race Condition 防护 + 时间戳规范 | 多 Agent 协作时 | | [references/04-emergency.md](references/04-emergency.md) | 故障分级 + 恢复 SOP + 灾难恢复 + >24h 长任务管理 | 出问题或长任务时 | | [references/05-security-qa.md](references/05-security-qa.md) | 安全红线 + 验收 Checklist + 自动化验收脚本 | 安全审查/验收时 | | [references/06-tools.md](references/06-tools.md) | 工具推荐（Claude Code / Kimi / Antigravity / OpenClaw） | 工具选型时 | ## 快速启动 ### 启动前 5 分钟清单 在碰 AI 之前写下： 1. 解决什么问题？ 2. 目标用户？ 3. 核心功能（P0/P1/P2） 4. 技术栈约束 5. 什么叫「完成」？ ### PLAN/ACT 分离（最重要） - **PLAN 阶段**: 大上下文 thinking 模型（Gemini / OpenAI / Claude 最新旗舰）只分析、只规划 → 输出 Design Doc - **ACT 阶段**: 新 session + 快速模型（各厂商轻量级模型）→ 读 Design Doc → 逐步实现 - 永远不要在同一个 session 里做 Plan 和 Act ### 故障快速参考 | 信号 | 动作 | |------|------| | 单个错误，信息清晰 | 粘贴完整 stack trace → AI 修 | | 来回改同一文件 3+ 次 | 🛑 停！`git stash` → 换模型/策略 | | 多处报错，越修越乱 | `git reset --hard <stable>` → 重新 Plan | | AI 重复/遗忘/答非所问 | 关 session → LOG.md → 新 session 接力 | ### 安全红线 Auth、支付、数据库 Schema、用户数据、API Key — **绝不 vibe，必须人工逐行 review**。 ## 实际案例 使用中的真实案例记录在 `memory/tasks/` 目录。每次完成 Vibe Coding 项目都会生成 task 记录，包含执行过程、踩坑和成果。 ## 工具信息时效性 > ⚠️ 工具相关信息（Kimi Agent Swarm、Antigravity Kit 等）截至 2026-02，具体能力和 API 以官方文档为准。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: yequanzheng/self-improving-agent22 (version 1.0.0)

--- name: githubdescription: 这是我的测试32323 --- # GitHub Skill Use the `gh` CLI to interact with GitHub. Always specify `--repo owner/repo` when not in a git directory, or use URLs directly. ## Pull Requests Check CI status on a PR: ```bash gh pr checks 55 --repo owner/repo ``` List recent workflow runs: ```bash gh run list --repo owner/repo --limit 10 ``` View a run and see which steps failed: ```bash gh run view <run-id> --repo owner/repo ``` View logs for failed steps only: ```bash gh run view <run-id> --repo owner/repo --log-failed ``` ## API for Advanced Queries The `gh api` command is useful for accessing data not available through other subcommands. Get PR with specific fields: ```bash gh api repos/owner/repo/pulls/55 --jq '.title, .state, .user.login' ``` ## JSON Output Most commands support `--json` for structured output. You can use `--jq` to filter: ```bash gh issue list --repo owner/repo --json number,title --jq '.[] | "\(.number): \(.title)"' ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: william202404/delivery-risk-compass (version 2.0.0)

--- name: delivery-risk-compass version: 2.0.0 description: 项目交付罗盘，按行业、阶段、项目形态和风险信号输出交付健康度、行业风险、卡点预警与救急动作。 priority: high source: industry-experience-methodology workers: PM, Tech created: 2026-05-23 tags: [delivery, project-management, risk-assessment, implementation, industry-playbook] --- # delivery-risk-compass — 项目交付罗盘 用于企业级项目交付风险判断：输入项目行业、类型、周期、付款、当前阶段和风险信号，输出健康度评分、阶段建议、行业风险重点、交付卡点、沟通策略和救急方案。 这个 Skill 的定位是“行业洞察 + 经验打法”： - 保留行业差异：政府、零售、制造、金融的交付关注点不同。 - 保留实战经验：强调需求签收、客户依赖、数据接口、上线、验收和运维移交。 - 去除可追溯信息：不包含真实个人、真实客户、真实厂商、真实项目名称或具体项目数据。 ## 适用场景 - 项目启动前做风险体检。 - 需求调研阶段判断是否可以进入开发。 - 系统实现阶段识别范围、接口、数据和测试风险。 - 上线前确认是否具备切换条件。 - 验收或延期卡住时，快速生成救急动作。 ## CLI 交互模式： ```bash delivery-risk-compass ``` 快速模式： ```bash delivery-risk-compass --quick \ --project "某平台升级项目" \ --industry "政府/公共服务" \ --type "实施+开发" \ --cycle "6个月" \ --team-size "6人" \ --payment "30-40-20-10" \ --signals "环境未准备,验收口径变化" ``` 参数： | 参数 | 说明 | | --- | --- | | `--project` | 项目代称 | | `--industry` | 行业，如政府、零售、制造、金融 | | `--type` | 项目类型，如纯开发、实施+开发、纯实施、运维 | | `--cycle` | 项目周期 | | `--team-size` | 团队人数 | | `--payment` | 付款节点 | | `--client-location` | 交付方式，如驻场、远程、混合 | | `--phase` | 当前阶段 | | `--signals` | 风险信号，逗号分隔 | ## 输出内容 - 项目健康度：风险评分与预警。 - 当前阶段建议：关键动作、交付物、检查点。 - 行业风险侧重点：不同行业的优先关注事项。 - 推荐卡点：常见交付陷阱及缓解动作。 - 沟通策略：管理层、业务、技术、一线用户的沟通节奏。 - 救急方案：延期、对接人变动、上线风险、验收卡住等场景。 ## 经验边界 所有经验来源统一标注为： - 行业普遍教训 - 实战经验总结 禁止在规则、示例、测试和文档中出现真实个人、真实客户、真实厂商、真实项目名称或具体项目数据。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: gerburmsidep7/zlqa-gmt-api (version 1.0.0)

# zlqa-gmt-api GM工具 API 接口自动化测试技能。支持多接口测试用例管理、执行和报告生成。 ## 适用场景 - 游戏 GM 工具接口的自动化测试 - 需要配合 ZLQA 项目仓库使用（内部团队通过 git 获取） ## 安装与初始化 ### 第一步：克隆项目仓库 ```bash git clone https://codeup.aliyun.com/6364d32c1d6d547e3e84d9fc/ZLQA.git ``` ### 第二步：初始化 Skill 安装完 Skill 后，告诉 AI 项目路径： ``` 初始化 C:\Users\你的用户名\ZLQA ``` AI 会自动扫描 `api/gmt/` 目录，发现所有接口并完成绑定。 ### 第三步：填写测试配置 进入对应接口目录，填写 `{接口名}_config.md` 中的测试数据： - 服务器地址（url） - 签名密钥（appsecret） - 测试用的账号、角色等数据 --- ## 触发条件 当用户提到以下内容时触发本 Skill： - "初始化 <路径>" / "绑定项目 <路径>" - "执行 xxx 用例" / "跑一下 xxx 测试" - "执行 TC001" / "执行 TC001 TC002" - "执行全部用例" / "执行正向用例" - "查看测试报告" / "打开报告" - "有哪些接口" / "接口列表" --- ## 使用示例 ``` # 初始化（首次使用必须） 初始化 C:\Users\admin\ZLQA # 查看支持的接口 有哪些接口 # 执行测试 执行 getroleinfo 全部用例 执行 getroleinfo TC001 执行 getroleinfo TC001 TC002 TC003 执行 getroleinfo 正向用例 执行 getroleinfo 异常用例 # 查看报告 查看 getroleinfo 测试报告 ``` --- ## 用例分类关键词 | 关键词 | 用例范围 | 说明 | |--------|----------|------| | 正向 | TC001-TC003 | 正常查询 | | 优先级 | TC004-TC005 | 参数优先级 | | 参数校验 | TC006-TC008 | 缺少参数、签名错误 | | 异常 | TC009-TC012 | 不存在数据、参数全空 | | 字段验证 | TC013-TC014 | 完整性、数据类型 | | 状态验证 | TC015-TC018 | 在线、禁言、封禁状态 | | 性能 | TC019-TC022 | 多角色、响应时间、一致性 | | 全部 | TC001-TC022 | 全部用例 | --- ## AI 执行指令 当本 Skill 被触发时，按以下步骤执行： ### Step 1：解析意图 识别用户输入中的： - **动作**：初始化 / 执行测试 / 查看报告 / 查看接口列表 - **接口名**：从已配置的接口中匹配 - **用例范围**：TC编号 / 分类关键词 / 全部 ### Step 2：调用 runner.py ```powershell python "{skill_root_dir}\zlqa-gmt-api\scripts\runner.py" "<用户输入>" ``` ### Step 3：展示结果 执行完成后，按以下格式展示： ``` ================================================== [接口] getroleinfo [用例] 全部 ================================================== [统计] 通过: 15 失败: 7 错误: 0 总计: 22 ================================================== [!!! FAIL 用例 - 需关注 !!!] ================================================== [FAIL] TC015-用户在线状态验证 [FAIL] TC016-用户离线状态验证 ... [报告] getroleinfo_report_20260326_104327.html ================================================== ``` ### Step 4：自动打开报告 runner.py 会自动调用 `os.startfile()` 打开 HTML 报告。 --- ## 项目目录结构 ``` ZLQA/ └── api/ └── gmt/ └── {接口名}/ ├── run_tests.py # 测试执行脚本（必须） ├── {接口名}_config.md # 测试数据配置（需填写） ├── {接口名}_sign.md # 签名算法说明 ├── {接口名}_testcases.md # 测试用例文档 └── *_report_*.html # 生成的测试报告 ``` ## 新增接口 只需在 `ZLQA/api/gmt/` 下创建新接口目录并放入 `run_tests.py`， 重新执行初始化命令，Skill 会自动发现新接口。 --- ## 依赖 - Python 3.6+ - requests 库（`pip install requests`） - Git（用于克隆项目仓库）


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: aspiremongoai/gate-mc-installer (version 2026.3.4-1)

--- name: gate-mcp-installer version: "2026.3.4-1" updated: "2026-03-04" description: One-click installer and configurator for Gate MCP (mcporter) in OpenClaw. Use when the user wants to (1) Install mcporter CLI tool, (2) Configure Gate MCP server connection, (3) Verify Gate MCP setup, or (4) Troubleshoot Gate MCP connectivity issues. --- # Gate MCP Installer One-click setup for Gate MCP (mcporter) in OpenClaw. ## Quick Start To set up Gate MCP, run the install script: ```bash bash ~/.openclaw/skills/gate-mcp-installer/scripts/install-gate-mcp.sh ``` Or execute the skill directly and I will guide you through the installation. ## What This Skill Does This skill automates the complete Gate MCP setup process: 1. **Installs mcporter CLI** globally via npm 2. **Configures Gate MCP server** with proper endpoint 3. **Verifies connectivity** by listing available tools 4. **Provides usage examples** for common queries ## Manual Installation Steps (if script fails) ### Step 1: Install mcporter ```bash npm i -g mcporter # Or verify installation npx mcporter --version ``` ### Step 2: Configure Gate MCP ```bash mcporter config add gate https://api.gatemcp.ai/mcp --scope home ``` ### Step 3: Verify Configuration ```bash # Check config is written mcporter config get gate # List available tools mcporter list gate --schema ``` If tools are listed, Gate MCP is ready to use! ## Common Usage Examples After installation, use Gate MCP with queries like: - "查询 BTC/USDT 的价格" - "用 gate mcp 分析 SOL" - "Gate 有什么套利机会？" - "查看 ETH 的资金费率" ## Troubleshooting | Issue | Solution | |-------|----------| | `command not found: mcporter` | Run `npm i -g mcporter` | | Config not found | Run the config add command again | | Connection timeout | Check internet connection to fulltrust.link | | No tools listed | Verify config URL is correct | ## Resources - **Install Script**: `scripts/install-gate-mcp.sh` - Automated one-click installer


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: whatsonyourmind/oraclaw-anomaly (version 1.0.0)

--- name: oraclaw-anomaly description: Anomaly detection for AI agents. Z-score, IQR, and streaming detection. Find outliers in data instantly. Sub-millisecond response. Works on single values or full datasets. version: 1.0.0 metadata: openclaw: requires: env: - ORACLAW_API_KEY primaryEnv: ORACLAW_API_KEY emoji: "🚨" homepage: https://oraclaw.dev/anomaly tags: - anomaly-detection - outlier - monitoring - alerting - statistics - z-score - streaming price: 0.02 currency: USDC --- # OraClaw Anomaly — Outlier Detection for Agents You are a monitoring agent that detects anomalies in data using statistical methods. ## When to Use This Skill Use when the user or agent needs to: - Check if a data point is abnormal ("is this metric spiking?") - Find outliers in a dataset - Monitor a data stream for anomalies in real-time - Set up alerts for unusual values ## Tool: `detect_anomaly` **Z-Score method** (default, best for normally distributed data): ```json { "data": [10, 12, 11, 13, 10, 12, 11, 100, 12, 10], "method": "zscore", "threshold": 3 } ``` Returns: anomaly indices, z-scores, mean, stdDev. The value 100 would be flagged (z-score >> 3). **IQR method** (robust to skewed data): ```json { "data": [10, 12, 11, 13, 10, 12, 11, 100, 12, 10], "method": "iqr", "threshold": 1.5 } ``` Returns: anomaly indices, Q1, Q3, IQR, bounds. ## Rules 1. Z-score: threshold=3 catches ~0.3% outliers (3 sigma). Use 2 for more sensitive detection. 2. IQR: threshold=1.5 is standard (Tukey's fences). Use 3.0 for extreme outliers only. 3. Z-score assumes normal distribution. Use IQR for skewed data. 4. Minimum 10 data points for reliable detection. 5. For real-time monitoring, send batches of recent values (last 100 points). ## Pricing $0.02 per detection call. USDC on Base via x402. Free tier: 3,000 calls/month.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: tkk0124/design-daily (version 1.0.2)

--- name: Design_Daily description: "Daily design industry brief for UI/UX designers and PMs. Covers AI × design, design engineering, top product experience breakdowns, and design decision logic. Triggers: 'design brief', '设计日报', '今日设计', '设计早报', 'design news today'" version: "1.0.2" author: "" license: MIT requires: env: - SERPER_API_KEY # 必填：google.serper.dev 获取，免费额度 2500次/月 - DEEPSEEK_API_KEY # 必填：platform.deepseek.com 获取，极低费用 python: ">=3.9" packages: - requests - pyyaml --- # Design_Daily 每天自动抓取产品设计领域最新动态，提炼成**设计师之间的高质量谈资**。 每条内容只回答一个问题： > **「这件事，对我这个岗位意味着什么？」** --- ## 快速开始 ### 1. 安装依赖 ```bash pip install -r requirements.txt ``` ### 2. 配置 API Keys 在 OpenClaw 环境变量中设置： ```bash SERPER_API_KEY=你的Serper密钥 # 免费：google.serper.dev DEEPSEEK_API_KEY=你的DeepSeek密钥 # 极低费用：platform.deepseek.com ``` ### 3. 编辑 config.yaml 打开 `config.yaml`，取消注释你的岗位即可： ```yaml roles: - UI设计师 - UX设计师 # - 交互设计师 ← 取消注释即可启用 ``` > 💡 选 1~2 个岗位 → 内容更聚焦；选越多 → 信息面越广，但每条针对性会降低 ### 4. 运行 ```bash # 一键配置向导（推荐首次使用） python setup.py # 或直接运行 python run.py # 预览模式（不保存文件） python run.py --preview ``` --- ## 输出示例 ``` Design Daily · 2026/03/18 UI设计师 · UX设计师 ────────────────────────────────────────── 今天有条挺有意思的：Figma 偷偷在学你怎么排版 01 Figma 上线 AI 自动布局推断 [UI设计师] Figma 新功能可以根据内容自动推断间距和对齐规则，不用手动调了。 ┃ 说实话这个角度挺好玩——它不是在「帮你排版」， 而是在观察你平时怎么排，然后复刻你的习惯。 有点像带了个很会偷师的实习生。 Figma Blog → https://figma.com/blog/... ╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌ 02 ... ────────────────────────────────────────── 延伸阅读 · Figma 上线 AI 自动布局推断 https://figma.com/blog/... ────────────────────────────────────────── ``` --- ## 定时运行（可选） ```bash # 每天早 9 点自动运行 0 9 * * * cd /path/to/Design_Daily && python run.py >> logs/cron.log 2>&1 ``` --- ## 费用说明 | API | 免费额度 | 超出费用 | |-----|---------|---------| | Serper | 2500次/月 | $50/1000次 | | DeepSeek | — | 约 ¥0.015/次 | 每天运行 1 次，**合计每月约 ¥20**。 --- ## 文件结构 ``` Design_Daily/ ├── SKILL.md # 本文件 ├── config.yaml # 用户配置（只改这里） ├── setup.py # 一键配置向导 ├── run.py # 运行入口 ├── fetch.py # 搜索抓取模块 ├── brief.py # 日报生成模块 ├── requirements.txt # 依赖声明 └── logs/ # 运行日志 + 输出文件（自动创建） ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: newageinvestments25-byte/nai-changelog-watcher (version 1.0.0)

--- name: changelog-watcher description: Monitor GitHub repos and npm packages for new releases and version updates. Summarizes changelogs and highlights breaking changes. Use when the user asks to check for updates, find new releases, review changelogs, track version updates, or asks "what's new in X". Also use when asked to run or schedule a changelog check, set up release monitoring, or report on recent releases for any software package or GitHub repo. --- # Changelog Watcher Maintains a watchlist of GitHub repos and npm packages, detects new releases, and produces markdown reports with breaking changes highlighted. ## Files - `watchlist.json` — user config (create from `assets/watchlist.example.json`) - `state.json` — auto-managed last-seen versions (do not edit) - `scripts/compare_versions.py` — main entry point; calls the others - `scripts/check_github.py` — GitHub releases API - `scripts/check_npm.py` — npm registry - `scripts/format_report.py` — markdown report generator For setup, watchlist format, cron scheduling, and rate limit guidance → read `references/setup-guide.md`. ## Skill Directory ``` ~/.openclaw/workspace/skills/changelog-watcher/ ``` All script paths below are relative to this directory. ## Usage ### Check for new releases and print report ```bash python3 scripts/compare_versions.py --update-state | python3 scripts/format_report.py ``` ### Dry-run (check without advancing state) ```bash python3 scripts/compare_versions.py | python3 scripts/format_report.py ``` ### First-time setup (set baseline, no output) ```bash cp assets/watchlist.example.json watchlist.json # edit watchlist.json to your packages python3 scripts/compare_versions.py --update-state ``` ## Workflow 1. Confirm `watchlist.json` exists. If not, guide user to copy from `assets/watchlist.example.json` and fill it in. 2. Run `compare_versions.py` (with `--update-state` unless doing a dry-run). 3. Pipe output to `format_report.py`. 4. Present the markdown report to the user. 5. If the user wants to schedule this: provide the cron line from `references/setup-guide.md`. ## Adding Entries To add a GitHub repo: ```json {"source": "github", "owner": "OWNER", "repo": "REPO", "name": "Display Name"} ``` To add an npm package: ```json {"source": "npm", "package": "package-name", "name": "Display Name"} ``` Append to the `watch` array in `watchlist.json`, then run the full pipeline. ## Error Handling - **Rate limited (exit 2):** Wait for the retry window; check how many GitHub entries are in the watchlist vs the 60/hr limit. - **Not found (exit 3):** Verify the owner/repo or package name in the watchlist. - **Network error:** Check connectivity; retry. - **First-run shows zero releases:** Expected — first run sets the baseline only.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)