OpenClaw/clawhub-security-signals huggingface dataset:
Skill: kingofzhao/kingofzhao-decision-framework (version 1.0.0)

--- name: kingofzhao-decision-framework version: 1.0.0 author: KingOfZhao description: 决策框架 Skill —— 已知/未知驱动的结构化决策系统，置信度加权+红线拦截+决策记忆 tags: [cognition, decision-making, framework, risk-analysis, confidence, trade-offs] license: MIT homepage: https://github.com/KingOfZhao/AGI_PROJECT --- # Decision Framework Skill ## 元数据 | 字段 | 值 | |------|-----| | 名称 | decision-framework | | 版本 | 1.0.0 | | 作者 | KingOfZhao | | 发布日期 | 2026-03-31 | | 置信度 | 96% | ## 来源碰撞 ``` self-evolution-cognition (已知/未知分离) ⊗ entrepreneur-cognition (商业决策) ⊗ ai-growth-engine (度量化) ↓ decision-framework (通用决策系统) ``` ## 核心哲学 > 好决策 ≠ 好结果。好决策 = 在已知信息下，用结构化方法选择期望值最高的选项。 > 结果可能受运气影响，但决策过程可以优化。 ## 四步决策法（KUWR） ``` K — Known 已知: 列出所有已知事实，标注置信度 U — Unknown 未知: 列出所有未知项，评估影响和获取成本 W — Weigh 权衡: 对每个选项做已知/未知加权评分 R — Record 记录: 记录决策+理由+预期结果，事后对比 ``` ## 决策评分公式 ``` Option Score = (Known_Benefit × confidence) - (Known_Cost × confidence) + (Unknown_Upside × probability × 0.5) - (Unknown_Downside × probability × 1.5) 注意: 未知下行风险权重(1.5) > 未知上行收益权重(0.5) → 这是"不对称风险偏好": 优先避免灾难性错误 ``` ## 红线拦截 ``` 决策前自动检查红线: 🔴 此决策是否触碰职业红线？→ 如果是，自动拦截 🔴 此决策是否不可逆？→ 如果是，强制等待24h冷静期 🔴 此决策是否影响他人？→ 如果是，强制咨询受影响方 🔴 已知信息置信度是否 <50%？→ 如果是，建议先补充信息 ``` ## 决策记忆 ``` decisions/{date}_{id}.md - 问题描述 - 已知/未知列表 - 各选项评分 - 最终选择 + 理由 - 预期结果 - [事后] 实际结果 + 偏差分析 - [事后] 教训（更新决策参数） ``` ## 安装命令 ```bash clawhub install decision-framework ``` ## 调用方式 ```python from skills.decision_framework import DecisionFramework df = DecisionFramework(workspace=".") result = df.decide( problem="是否应该切换到新的技术栈？", options=["保持现状", "渐进迁移", "完全重写"], known=["当前技术栈稳定运行2年", "新栈性能提升40%", "团队3人熟悉新栈"], unknown=["迁移周期", "业务中断风险", "学习曲线"], redlines=["不中断生产服务"] ) print(result.rankings) # 选项排名 + 评分 print(result.redline_check) # 红线检查结果 print(result.recommendation) # 建议选择 + 理由 ``` ## 学术参考 1. [A Survey of Self-Evolving Agents](https://arxiv.org/abs/2507.21046) — 决策自进化 2. [SAGE: Multi-Agent Self-Evolution](https://arxiv.org/abs/2603.15255) — 多Agent决策 3. [Memory in the Age of AI Agents](https://arxiv.org/abs/2512.13564) — 决策记忆


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: zhangifonly/manus-agent (version 1.0.1)

--- name: "Manus Agent" version: "1.0.0" description: "Manus AI Agent 助手，精通通用 AI Agent 任务执行、浏览器操作、代码生成、数据分析" tags: ["ai", "agent", "manus", "automation", "browser"] author: "ClawSkills Team" category: "ai" --- # Manus Agent 助手 你是一个精通 Manus AI Agent 的助手，帮助用户理解和使用 Manus 的自主任务执行能力。 ## 身份与能力 - 精通 Manus 的通用 AI Agent 架构和工作原理 - 熟悉浏览器自动化、代码执行、文件处理等核心能力 - 掌握任务拆解、多步骤执行、结果交付的最佳实践 - 了解 Manus 与 ChatGPT、Claude、Devin 等产品的差异 ## 核心能力 ### 自主任务执行 Manus 能独立完成复杂多步骤任务： - 自动拆解任务为子步骤 - 在沙盒环境中执行代码 - 操作浏览器完成网页交互 - 生成文件并交付最终结果 ### 浏览器操作 - 自动浏览网页、填写表单、点击按钮 - 抓取和解析网页数据 - 登录网站执行操作（需用户授权） - 截图记录操作过程 ### 代码生成与执行 - 支持 Python、JavaScript 等主流语言 - 在安全沙盒中运行代码 - 自动安装依赖包 - 处理数据分析、可视化、文件转换等任务 ### 文件处理 - 读取和生成 PDF、Excel、Word、PPT 等格式 - 数据清洗和格式转换 - 图表生成和报告输出 ## 典型使用场景 ### 市场调研 "帮我调研中国新能源汽车市场 Top 10 品牌，整理成 Excel 表格，包含品牌、销量、市占率、主力车型" ### 数据分析 "分析这份 CSV 销售数据，生成月度趋势图和 Top 产品排名，输出 PDF 报告" ### 网页开发 "帮我做一个个人作品集网站，包含首页、项目展示、联系方式，风格简约现代" ### 竞品分析 "对比 Notion、飞书、语雀的功能差异，生成对比表格和分析报告" ## 与竞品对比 | 维度 | Manus | ChatGPT | Claude | Devin | |------|-------|---------|--------|-------| | 浏览器操作 | 原生支持 | 插件 | 无 | 有 | | 代码执行 | 沙盒 | 沙盒 | 无 | 沙盒 | | 文件交付 | 多格式 | 有限 | 无 | 代码 | | 多步骤任务 | 优秀 | 一般 | 一般 | 优秀 | | 中文理解 | 优秀 | 良好 | 优秀 | 一般 | | 免费额度 | 有限 | 有 | 有 | 无 | ## 最佳实践 - 任务描述要具体明确，包含预期输出格式 - 复杂任务建议分步骤描述，而非一句话概括 - 涉及网页操作时，提供具体 URL 和操作步骤 - 数据分析任务先上传数据文件，再描述分析需求 - 检查 Agent 的中间步骤，及时纠正方向偏差 - 敏感操作（登录、支付）需要人工确认 --- **最后更新**: 2026-03-22


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: prysm96/simmer-market-maker (version 1.3.0)

--- name: simmer-market-maker description: Places GTC limit orders on both sides (bid/ask) of liquid Polymarket markets. Finds active markets with >$10k 24h volume, mid-range prices, and ample time to resolve. Quotes spreads around the CLOB midpoint to capture bid/ask spread. Use when you want to passively earn spread as a market maker. metadata: author: "PrYsM96" version: "1.2.0" displayName: "Simmer Market Maker" difficulty: "intermediate" --- # Polymarket Market Maker A market-making strategy that places GTC (Good-Till-Cancelled) limit orders on both sides of liquid Polymarket prediction markets, capturing the bid/ask spread. ## Strategy 1. **Market Selection:** Finds active markets with: - 24h volume > $10,000 (liquid enough to fill) - Price (YES probability) between 0.15 and 0.85 (avoids near-certain outcomes) - Resolves > 4 hours away (enough time to get fills) - No taker fees (`is_paid=False`) — 10% fee kills the edge 2. **Pricing:** Fetches the live CLOB midpoint for each market and quotes: - YES buy limit at `mid - 0.02` (2¢ below mid) - NO buy limit at `(1 - mid) - 0.02` (2¢ below NO mid) 3. **Order Management:** Cancels existing open orders before placing new ones each run. 4. **Limits:** Max $5 per order, max 3 markets per run. ## Requirements **Environment variables (required):** | Variable | Required | Description | |----------|----------|-------------| | `SIMMER_API_KEY` | ✅ Yes | Your Simmer API key — get it at simmer.markets/dashboard → SDK tab | | `TRADING_VENUE` | Optional | `polymarket` (default) or `sim` for paper trading with virtual $SIM | **Python dependency:** `simmer-sdk` — install with `pip install simmer-sdk` ## Setup ```bash export SIMMER_API_KEY=sk_live_... # required export TRADING_VENUE=sim # optional: paper mode with $SIM pip install simmer-sdk ``` ## Usage ```bash # Dry run (default) python market_maker.py # Live trading python market_maker.py --live # Show current positions python market_maker.py --positions # Show config python market_maker.py --config # Set config python market_maker.py --set max_order_usd=10.0 ``` ## Config (env vars) | Env Var | Default | Description | |---------|---------|-------------| | `SIMMER_MM_MAX_ORDER_USD` | 5.0 | Max USD per limit order | | `SIMMER_MM_MAX_MARKETS` | 3 | Max markets per run | | `SIMMER_MM_MIN_VOL_24H` | 10000 | Min 24h volume filter | | `SIMMER_MM_SPREAD_OFFSET` | 0.02 | How far below mid to quote (2¢) | | `SIMMER_MM_MIN_PRICE` | 0.15 | Min YES price to consider | | `SIMMER_MM_MAX_PRICE` | 0.85 | Max YES price to consider | | `SIMMER_MM_MIN_HOURS_TO_RESOLVE` | 4 | Min hours to resolution |


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: stale | SkillSpector: suspicious (MEDIUM)
Skill: nissan/auth-preflight-checklist (version 1.0.0)

--- name: auth-preflight-checklist version: 1.0.0 description: "Preflight checklist for auth-dependent work: verify the active credential lane, runtime environment, scopes, and smallest safe live probe before writing, deploying, or debugging provider integrations." author: nissan tags: - auth - operations - preflight - security metadata: openclaw: emoji: "🔐" network: outbound: false --- # Auth Preflight Checklist Use before auth-dependent docs, troubleshooting, cron jobs, deploys, API integrations, or any task where the result depends on a token, service account, OAuth session, 1Password item, gateway model route, deploy key, or approval flag. ## Rule Do not infer auth from configuration alone. Prove the same runtime that will do the work can access the credential and complete the smallest safe live action. ## Checklist 1. Identify the active auth lane. - Human OAuth, Codex subscription, OpenClaw gateway, raw API key, 1Password service account, deploy key, GitHub App, or provider token. - Runtime: interactive shell, LaunchAgent, cron, OpenClaw gateway, subagent, CI, VPS, container, or browser session. 2. Verify secret source and runtime agree. - Confirm the expected vault/item/field or env var name. - Check presence only; never print secret values. - If the job runs under launchd/cron/container, verify inside that environment or with an equivalent env capture. 3. Run the smallest live probe. - Notion: retrieve bot/user or target database. - GitHub: read repo metadata or list app installation access. - Vercel/Coolify: read project/app metadata before deploy. - OpenClaw/Codex: run a tiny gateway model smoke test. - 1Password: read the exact item field with bounded retry. 4. Check scopes and target access. - Token exists is not enough. - Confirm the token can access the specific database, repo, branch, app, project, model route, or webhook target. 5. Fail with a useful blocker. - Include missing auth lane, expected secret reference, runtime, probe command, response class, and next owner/action. - Do not continue into writes/deploys after 401/403/missing scope unless the task explicitly asks for forensic collection only. ## Completion Evidence Auth work is not complete until one is true: - Preflight command passed in the same runtime lane. - Live action succeeded and produced the expected artifact. - Blocker is recorded with exact missing credential/scope/approval and next action. For OpenClaw model calls in scheduled scripts, prefer gateway/Codex routing. A missing raw OPENAI_API_KEY is not a failure if the OpenClaw gateway smoke test proves the Codex-backed route works.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: balkanblbn/neural-note-taker (version 1.0.0)

--- name: neural-note-taker description: Advanced associative memory helper for building relationships between facts and entities. Use when processing dense information to ensure context is preserved across long sessions. --- # Neural Note Taker Connect the dots in your memory. This skill implements a concept-linkage protocol. ## Core Process 1. **Entity Identification**: Extract names, tools, dates, and projects from current chat. 2. **Relationship Mapping**: Use `[[Target]] -> [[Related]]` notation. 3. **Context Weighting**: Assign priority based on recurrence. ## Commands - `memo_link [topicA] [topicB]`: Force a connection in long-term memory. - `memo_query [topic]`: Surface all associated nodes. ## Installation ```bash clawhub install neural-note-taker ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: trumppo/search-memory (version 0.1.0)

--- name: search-memory description: Local-first memory search and indexing for Openclaw. Use when you need to (1) index memory files, (2) search memory from the CLI, or (3) wire a slash command for memory lookup. --- # Search Memory ## Overview Index local memory files and run fast keyword search with recency boost. ## Quick Start 1) Build/update index (incremental cache): ```bash scripts/index-memory.py ``` 2) Search the index: ```bash scripts/search-memory.py "your query" --top 5 ``` ## Notes - Index includes `MEMORY.md` plus `memory/**/*.md`. - Cache lives under `memory/cache/`. - Search uses keyword scoring + recency boost (last 30/90 days).


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: tobeyrebecca/toby-generate-commercial-cleaning-company-client-education-handout (version 1.0.0)

--- name: Generate Commercial Cleaning Company Client Education Handout description: "Create a polished explainer handout with visuals, FAQs, and clear next steps for a commercial cleaning company. Use when handling client education work..." allowed-tools: Bash, Read metadata: openclaw: emoji: "📝" homepage: "https://www.skillboss.co/skills/generate-commercial-cleaning-company-client-education-handout" --- # Generate Commercial Cleaning Company Client Education Handout Create a polished explainer handout with visuals, FAQs, and clear next steps for a commercial cleaning company. Use when handling client education work... ## Use When Use this skill for client education work for commercial cleaning owners, ops managers. ## Workflow 1. Clarify the audience, business goal, constraints, and deliverable. 2. Produce the strongest first draft for the target use case. 3. Use the relevant SkillBoss capabilities to enrich assets or supporting data. 4. Refine the output for accuracy, readability, and actionability before delivery. ## SEO / GEO - Primary keywords: commercial cleaning company education handout, commercial cleaning company client explainer, commercial cleaning company FAQ guide, commercial cleaning company visual handout - Search intent: client education - Canonical slug: `generate-commercial-cleaning-company-client-education-handout` - Install query: Install Generate Commercial Cleaning Company Client Education Handout with SkillBoss ## APIs Used - `chat` - `image_generation` ## Suggested Prompt [Generate Commercial Cleaning Company Client Education Handout] for my commercial cleaning company ## Notes - Create a polished explainer handout with visuals, FAQs, and clear next steps for a commercial cleaning company - Review outputs before external publication or automated execution. ## SEO Keywords - commercial cleaning company education handout - commercial cleaning company client explainer - commercial cleaning company FAQ guide - commercial cleaning company visual handout


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: austindixson/doppleganger (version 1.0.0)

--- name: doppleganger displayName: Doppleganger description: Prevents duplicate subagent sessions running the same task. Saves tokens and reduces lag—no more "multiple Spidermen" doing the same work. version: 1.0.0 --- # Doppleganger ## Description Prevents duplicate subagent sessions running the same task. Saves tokens and reduces lag—no more "multiple Spidermen" doing the same work. # Doppleganger **One task, one agent.** Doppleganger stops duplicate subagent sessions from running the same task. That prevents token overspend, UI lag, and the chaos of five identical "task completed" announcements. ## Usage - The orchestrator **already runs** a duplicate check before `sessions_spawn` (see delegate rule); Doppleganger is the named skill for that behavior. - User says: "prevent duplicate agents", "stop dopplegangers", "why are so many agents doing the same thing?" - You want a single entry point to **check** whether a task is already running before spawning. ```bash python3 /Users/ghost/.openclaw/workspace/skills/doppleganger/scripts/doppleganger.py check "<task string>" [--json] python3 /Users/ghost/.openclaw/workspace/skills/doppleganger/scripts/doppleganger.py guard --task "<task>" [--json] ``` **JSON output:** - `{"duplicate": false, "doppleganger_ok": true}` → safe to spawn. - `{"duplicate": true, "reason": "running", "sessionId": "...", "key": "...", "doppleganger_ok": true}` → do not spawn; reply that the task is already running. **Exit codes:** 0 = no duplicate (or check ok). 1 = error. 2 = duplicate detected. ## What it does - **check** / **guard** — Given a task string (the same one you would pass to `sessions_spawn`), returns whether that task is already running. If yes, the orchestrator must not spawn again. - Uses the subagent-tracker's `check-duplicate` under the hood (one source of truth for runs/sessions). ## Orchestrator The delegate rule runs a duplicate check before every `sessions_spawn`; that check can be implemented by calling Doppleganger (or subagent-tracker `check-duplicate`) with the router's task string. If `duplicate: true`, do not call `sessions_spawn`. ## Name "Doppleganger" = the duplicate agent doing the same thing. One Spiderman is enough.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: liujialin1517-source/excel-sum (version 1.0.0)

--- name: excel-sum description: 计算 Excel 文件第一列数值的总和。当用户请求对 Excel 文件进行求和、统计第一列总和或类似操作时使用此技能。 --- # Excel 第一列求和技能 ## 技能概述 此技能用于读取 Excel 文件（.xlsx, .xls）并计算第一列所有数值的总和。 ## 使用场景 当用户请求以下操作时使用此技能： - "Excel 求和" - "计算 Excel 第一列总和" - "统计 Excel 第一列" - "Excel 第一列加起来是多少" ## 使用方法 ### 步骤 1：获取 Excel 文件路径 1. 询问用户 Excel 文件的完整路径 2. 如果用户没有提供文件路径，提示用户选择或输入文件路径 ### 步骤 2：执行求和脚本 运行 `scripts/sum_first_column.py` 脚本： ``` python scripts/sum_first_column.py <excel文件路径> ``` ### 步骤 3：返回结果 将计算结果以友好格式展示给用户，包括： - 总和值 - 求和的单元格数量 - 是否有非数值被跳过 ## 脚本说明 - `scripts/sum_first_column.py`: Python 脚本，使用 openpyxl 读取 Excel 文件并计算第一列总和 ## 依赖 - Python 3.x - openpyxl 库（用于读取 Excel 文件） 如需安装依赖： ```bash pip install openpyxl ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: 36kr-com/36kr-intro (version 1.0.0)

--- name: 36kr-intro description: 介绍36氪（36kr）公司概况、业务范围、企业文化等信息 --- # 36kr-intro 介绍36氪（36kr）公司的相关信息 ## When to use 当用户询问以下问题时激活此 skill： - 介绍36kr公司 - 36kr是什么公司 - 36氪公司怎么样 - 36kr的业务范围 - 36kr的企业信息 ## Instructions 1. 确认用户想了解36kr公司的哪个方面 2. 根据用户需求提供相关信息 3. 如需最新信息，可使用搜索工具查询 ## 36kr公司基本信息 **36氪（36kr）** 是中国领先的科技创新创业服务平台，相关信息包括： - **成立时间**：2010年 - **创始人**：刘成城 - **总部**：北京 - **定位**：科技创新创业服务平台 - **主要业务**： - 科技媒体与内容服务 - 创业孵化与投资 - 企业服务 - 数据研究 - **公司使命**：让一部分人先看到未来 - **发展历程**：从科技博客起步，逐步发展为综合性创业服务平台


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zlshiny/claw-shell-1-0-0 (version 1.0.0)

# claw-shell ALWAYS USES TMUX SESSION `claw`. ## PURPOSE - RUN SHELL COMMANDS INSIDE TMUX SESSION `claw` - NEVER TOUCH ANY OTHER SESSION - READ OUTPUT BACK TO THE AGENT ## INTERFACE ### Tool: `claw_shell_run` **Inputs:** - `command` (string, required): shell command to run inside session `claw`. **Behavior:** 1. Attach to tmux session `claw` (create it if missing: `tmux new -s claw -d`). 2. Send the command followed by Enter. 3. Capture the latest pane output. 4. Return the captured output to the agent. ## SAFETY - DO NOT RUN: - `sudo` - `rm` (without explicit user approval) - `reboot`, `shutdown`, or destructive system-level commands - IF THE COMMAND CONTAINS ANY OF THE ABOVE: - ASK USER FOR CONFIRMATION BEFORE EXECUTING. ## EXAMPLES - SAFE: - `ls -la` - `bird read https://x.com/...` - `git status` - DANGEROUS (ASK FIRST): - `rm -rf ...` - `docker system prune -a` - `chmod -R ...`


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ssidharhubble/web3-security-auditor (version 1.0.0)

--- name: smart-contract-security-auditor description: >- Automated smart contract security auditing tool for finding vulnerabilities in Solidity and Rust programs. Detects reentrancy bugs, integer overflows, access control flaws, price oracle manipulation, and rug pull patterns. Analyzes Ethereum, Solana, and BSC smart contracts. Generates professional audit reports with severity ratings and remediation recommendations. For Web3 developers, blockchain investors, and DeFi protocol teams doing security due diligence before investing or deploying. Integrates with Etherscan, Solscan, and on-chain data. Use cases: smart contract audit, security review, DeFi security, Solidity auditing, vulnerability scanning, blockchain security, rug pull detection, due diligence. version: 1.0.0


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: deliverydriver/notion-workflows (version 1.0.0)

--- name: notion-workflows description: Notion automations: Create/query/update pages/DBs, templates, summaries. Browser/playwright for UI. Triggers: \"notion db build\", \"notion page create\", \"notion summary\". Examples: Task DB, wiki pages.</description> --- # Notion Workflows ## Examples - \"Build Notion task DB\": browser → new DB, props (name/due/status). - \"Summarize Notion page\": snapshot → markdown extract. - \"Add tasks to DB\": canvas/A2UI form → insert rows. ## Workflow 1. browser action=open notion.so → auth if needed. 2. snapshot page/DB → parse structure. 3. act: click add row, fill fields. 4. Export: pdf/snapshot. refs/notion-selectors.md: Common aria-refs. scripts/notion-scrape.py: DB to CSV. assets/templates/task-db.json: Import schema.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: halfmoon82/halfmoon82-brand-marketing-workflow (version 2.1.0)

--- name: brand-marketing-workflow description: | 端到端品牌营销自动化工作流。从品牌输入到营销内容生产、竞品分析、 效果评估的完整闭环。支持小红书/微博/抖音多平台内容生成。 --- # Brand Marketing Workflow ## 功能概述 端到端品牌营销自动化工作流，将品牌输入转化为可发布的营销内容资产。 ### 核心模块 | 模块 | 功能 | 输出 | |------|------|------| | `normalize_brand_input.py` | 标准化品牌输入 | 结构化品牌参数 | | `workflow_orchestrator.py` | 工作流编排 | 品牌简报、内容策略 | | `content_producer.py` | 内容资产生产 | 多平台帖子/脚本/回复 | | `competitor_fetcher.py` | 竞品信号抓取 | 公开竞品信息 | | `competitor_ai_analyzer.py` | AI 竞品分析 | 营销洞察报告 | | `authorization_manager.py` | 授权边界管理 | 人机协作决策 | | `score_content_effect.py` | 内容效果评分 | 质量评估与优化建议 | ## 快速开始 ### 1. 配置 LLM 编辑 `~/.openclaw/openclaw.json`： ```json { "models": { "providers": { "kimi-coding": { "baseUrl": "https://api.moonshot.cn/v1", "apiKey": "${KIMI_API_KEY}", "api": "openai-completions" } } }, "agents": { "defaults": { "model": { "primary": "kimi-coding/k2p5" } } } } ``` ### 2. 运行 Demo ```bash python3 run.py --demo fashion ``` ### 3. 自定义输入 ```bash python3 run.py --input my_brand.json ``` ## 输入格式 ```json { "brand_name": "品牌名", "brand_positioning": "极简高端日常穿搭", "brand_tone": "冷静 犀利 诗意", "target_audience": ["都市白领", "25-40岁"], "use_cases": ["日常通勤", "轻社交场景"], "channels": ["xiaohongshu", "weibo", "douyin"], "content_goals": ["品牌认知", "社区建设"], "brand_dos": ["诗意短文案", "干净视觉语言"], "brand_donts": [" aggressive promotions"], "competitor_scope": ["竞品A", "竞品B"], "kpis": ["reach", "saves", "engagement_rate"] } ``` ## 技术特性 ### 性能优化 - **并行执行**: ThreadPoolExecutor 并行 content_producer + competitor_fetcher - **TTL 缓存**: 6小时缓存机制，减少 60% API 调用 - **指数退避**: 3次重试，2^n 退避间隔 ### 授权管理 - **风险分级**: low/medium/high 三级阈值 - **智能跳过**: 低风险 + 公开数据 = 自动放行 - **人工确认**: 发布/支付/登录等敏感操作强制确认 ### 边界合规 - 仅抓取公开数据 - 禁止绕过登录/验证码 - 禁止自动发布 - 禁止未经批准的支付 ## 验证状态 - ✅ 集成测试: 26/26 passed - ✅ Live Mode: fashion/tech/local 三个 demo 全部通过 - ✅ 智能 auth 跳过生效 - ✅ K2P5 模型调用正常 ## 项目结构 ``` brand-marketing-workflow/ ├── run.py # 主入口 ├── scripts/ │ ├── oc_llm_client.py # LLM 客户端（读取用户配置） │ ├── workflow_orchestrator.py │ ├── content_producer.py │ ├── competitor_fetcher.py │ ├── competitor_ai_analyzer.py │ ├── authorization_manager.py │ └── integration_test.py # 集成测试 ├── templates/ # 输出模板 ├── examples/ # 示例输入 └── evidence/ # 验证证据 ``` ## 依赖 - Python >= 3.9 - OpenClaw >= 1.0.0 - 可选: Brave Search API Key（竞品抓取） ## 许可证 MIT License - 作者: halfmoon82


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)