OpenClaw/clawhub-security-signals huggingface dataset:
Skill: bytearch1990-beep/inkroam-bijian-writing (version 1.1.0)

--- name: inkroam-bijian-writing version: 1.1.0 description: 笔尖写作专家：三要素收集 → 调用笔尖AI生成文章 → 输出可发布内容。Use when user asks to 用笔尖写文章 / 生成公众号文章 / 写一篇文章. --- # 笔尖写作专家 Skill 三要素驱动的 AI 写作工具，调用笔尖AI平台生成高质量文章。 **职责边界：** 本 Skill 只负责**写作**（三要素收集 → 生成 → 输出），不负责发布。发布请使用 `inkroam-publisher`。 ## 配置 ### 笔尖 API Token 在工作区创建配置文件 `<workspace>/.bijian_config`（或 `$OPENCLAW_WORKSPACE/.bijian_config`）： ```bash export BIJIAN_API_TOKEN='你的token' export BIJIAN_TOKEN_HEADER='X-API-KEY' export BIJIAN_TOKEN_PREFIX='' export BIJIAN_BASE_URL='https://bj.aizmjx.com/api' ``` Token 获取地址：https://sso.aizmjx.com/home/apikey **配置检查：** ```bash # 按优先级查找配置文件 CONFIG_FILE="${OPENCLAW_WORKSPACE}/.bijian_config" [ -f "$CONFIG_FILE" ] || CONFIG_FILE="$HOME/.openclaw/workspace/.bijian_config" [ -f "$CONFIG_FILE" ] && source "$CONFIG_FILE" && echo "✅ 配置已加载" || echo "❌ 请创建 .bijian_config" ``` ⚠️ **不要向用户询问 token，直接从配置文件读取。** ## 工作流 ### Step 1：查询写作空间 ```bash source "$CONFIG_FILE" && python3 scripts/bijian_api.py spaces ``` - 1个空间 → 自动选择 - 多个空间 → 列出让用户选择 - 用户输入 `-切换空间` → 重新查询 ### Step 2：收集三要素 **必须收集完整三要素才能生成。** ``` 请提供文章三要素： 1️⃣ 主题（必填） 例：花了3万养了一只金融虾（OpenClaw），到底值不值 2️⃣ 观点要点（必填） 你最想表达的3-5条核心观点 例：金融虾难在信任建立；值不值看系统可控性；五层架构设计思路 3️⃣ 参考素材（重要！） 相关链接、操作步骤、安装命令、使用案例、数据来源等 例：完整安装教程 + 对话案例 + 效果数据 ``` **收集策略：** - 只给主题 → 追问观点要点（至少3条） - 没有素材 → **不留空**，AI 按文章类型主动补充（见下方策略） **⚠️ 素材质量直接决定笔尖输出质量。素材越具体，文章越有干货。** ### 素材增强策略（按文章类型分场景） AI 先判断文章类型，再主动补充对应素材： | 类型 | 重点补充 | |------|---------| | 📐 教程/干货/工具 | 安装命令、使用案例、效果数据、技术架构、资源链接 | | 🔥 热点/时事 | 事件时间线、多方观点、数据支撑、信息来源 | | 💛 情感/故事/IP | 真实细节、情感锚点、人物画像、共鸣场景、金句 | | ⚔️ 军事/历史/知识 | 事实数据、权威来源、对比分析、独特视角 | | 🛒 种草/测评/变现 | 亲身体验、价格对比、效果证据、避坑提醒 | ### Step 3：调用笔尖生成 ```bash source "$CONFIG_FILE" && python3 scripts/bijian_api.py generate \ --space-id ${SPACE_ID} \ --topic-theme "${TOPIC_THEME}" \ --viewpoints "${VIEWPOINTS}" \ --reference-content "${REFERENCE_CONTENT}" \ --user-require "${USER_REQUIRE}" \ --is-need-picture false ``` ### Step 4：轮询状态 ```bash source "$CONFIG_FILE" && python3 scripts/bijian_api.py task --article-id ${ARTICLE_ID} ``` 状态码：`1`=生成中 `2`=成功 `3`=失败。每 3-5 秒查一次，最多 10 次。 ### Step 5：获取文章 ```bash source "$CONFIG_FILE" && python3 scripts/bijian_api.py article --article-id ${ARTICLE_ID} ``` **展示给用户：** ``` ✅ 文章生成成功！ 标题：xxx 字数：1402字 封面图：已生成 [预览前200字] 下一步： - 输入"发布" → 调用 inkroam-publisher 发布 - 输入"预览" → 查看完整文章 - 输入"重新生成" → 修改三要素重新生成 ``` ## 错误处理 | 错误 | 处理 | |------|------| | 令牌无效（401） | 提示重新获取：https://sso.aizmjx.com/home/apikey | | 空间不存在 | 提示创建空间：https://bj.aizmjx.com/space | | 生成失败 | 提示重新组织三要素，不盲目重试 | ## 依赖 - Python 3.7+ - 笔尖 API 脚本：`scripts/bijian_api.py`（已内置） ## 变更日志 - **v1.1.0** (2026-03-10)：配置路径说明优化；统一版本号。 - **v1.0.0** (2026-03-10)：首次发布。三要素收集、笔尖API对接、素材增强策略（5种文章类型）。发布功能拆分至 inkroam-publisher。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: angelstreet/konto (version 1.1.0)

# Konto — Personal Finance API Query personal finance data from Konto (bank accounts, investments, assets, loans, transactions). ## Setup ```bash # ~/.openclaw/secrets/konto.env export KONTO_API_KEY="konto_xxxxxxxxxxxx" export KONTO_URL="https://konto.angelstreet.io" ``` ## Quick Answers ### "How much BTC do I have?" ```bash source ~/.openclaw/secrets/konto.env curl -s -H "Authorization: Bearer $KONTO_API_KEY" "$KONTO_URL/api/v1/investments" | jq '.investments[] | select(.code | test("BTC|bitcoin"; "i")) | {label, quantity, current_value}' ``` ### "What's my net worth?" ```bash curl -s -H "Authorization: Bearer $KONTO_API_KEY" "$KONTO_URL/api/v1/summary" | jq '{patrimoine_net, accounts: .accounts.total_balance, investments: .investments.total_value, assets: .assets.total_value, loans: .loans.total_remaining}' ``` ### "When does my loan end?" ```bash curl -s -H "Authorization: Bearer $KONTO_API_KEY" "$KONTO_URL/api/v1/loans" | jq '.loans[] | {name, remaining_amount, end_date, monthly_payment}' ``` ### "What are my subscriptions?" ```bash curl -s -H "Authorization: Bearer $KONTO_API_KEY" "$KONTO_URL/api/v1/summary" | jq '{count: .subscriptions.count, monthly: .subscriptions.monthly}' ``` ### "How much do I spend on housing?" ```bash curl -s -H "Authorization: Bearer $KONTO_API_KEY" "$KONTO_URL/api/v1/transactions?months=6&category=logement" | jq '{total: .total, transactions: [.transactions[] | {date, label, amount}]}' ``` ### "Financial overview" ```bash curl -s -H "Authorization: Bearer $KONTO_API_KEY" "$KONTO_URL/api/v1/summary" ``` ## Helper Script ```bash bash ~/.openclaw/workspace/skills/konto/scripts/konto.sh summary bash ~/.openclaw/workspace/skills/konto/scripts/konto.sh investments bash ~/.openclaw/workspace/skills/konto/scripts/konto.sh transactions 3 # last 3 months bash ~/.openclaw/workspace/skills/konto/scripts/konto.sh loans bash ~/.openclaw/workspace/skills/konto/scripts/konto.sh assets bash ~/.openclaw/workspace/skills/konto/scripts/konto.sh accounts ``` ## Endpoints | Endpoint | Description | |----------|-------------| | `GET /api/v1/summary` | Full financial overview (start here) | | `GET /api/v1/accounts` | Bank accounts list | | `GET /api/v1/transactions?months=6&category=X` | Categorized transactions | | `GET /api/v1/investments` | Portfolio (ETFs, stocks, crypto) | | `GET /api/v1/assets` | Real estate, vehicles | | `GET /api/v1/loans` | Active loans | ## Full API Reference See `~/shared/projects/konto/docs/api.md` for complete docs including analytics endpoints. ## Scope This skill uses a **personal** scope key (free). For cross-user analytics (pro), see the `konto-analytics` skill.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: epwhesq/virtually-us (version 1.0.0)

--- name: virtually-us description: "Your Own AI Personal Assistant, Set Up in 24 Hours. Managed OpenClaw hosting and setup service." version: 1.0.0 tags: [assistant, hosting, service, setup, openclaw] --- # Virtually Us Get your own private AI Personal Assistant running on OpenClaw, set up in 24 hours. We handle all the technical details: - Private cloud server setup - Telegram/Discord/WhatsApp integration - AI model configuration (Claude, GPT-4, etc.) - 24/7 uptime monitoring **[Get Started at vrtlly.us](https://vrtlly.us)** ## Pricing - **Hatchling ($9.99)**: One-time setup, perfect for trying it out. - **Basic ($99)**: Single platform, 7 days support. - **Premium ($199)**: Multi-platform, email/calendar integration, 30 days support. ## Why use Virtually Us? Setting up OpenClaw yourself requires configuring servers, Docker, reverse proxies, and API keys. We do it all for you so you can just start chatting with your new assistant. Visit [vrtlly.us](https://vrtlly.us) to hatch your bot today.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector:  ()
Skill: shenmeng/acceptance-test (version 1.0.0)

--- name: acceptance-test description: | 验收测试助手 - 验证系统是否满足业务需求，确保交付质量。 当用户需要以下功能时触发此skill： (1) 业务需求验证 (2) 用户场景测试 (3) 验收标准检查 (4) 客户验收支持 (5) 验收报告生成 --- # Acceptance Test 验收测试助手 — 确保交付符合预期 ## 核心能力 ### 1. 需求验证 - **功能验证** - 功能点检查 - **验收标准** - AC验证 - **边界条件** - 边界测试 - **异常场景** - 错误处理 - **性能指标** - 性能验证 ### 2. 用户场景 - **BDD测试** - 行为驱动 - **Gherkin** - Given-When-Then - **场景覆盖** - 用户故事 - **角色测试** - 不同角色 - **权限验证** - 权限检查 ### 3. 验收流程 - **准入条件** - 准入检查 - **验收执行** - 测试执行 - **缺陷记录** - 问题跟踪 - **签字确认** - 验收签字 - **交付物** - 交付清单 ### 4. 报告生成 - **通过率** - 验收结果 - **风险清单** - 遗留风险 - **质量评估** - 质量评分 - **发布建议** - 发布决策 - **改进建议** - 改进点 ## 使用工作流 ```bash # 执行验收测试 python scripts/acceptance_runner.py --stories stories.json --env staging # BDD测试 python scripts/bdd_runner.py --features features/ --steps steps/ # 验收报告 python scripts/acceptance_report.py --results results.json --signoff required ``` --- *验收测试是交付前的最后一道关卡，确保价值交付。*


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal:  | SkillSpector: suspicious (CRITICAL)
Skill: hillsp99/minimax-mcp-v2 (version 1.0.0)

# MiniMax MCP Search Skill ## 功能 使用 MiniMax MCP 进行网络搜索和图像理解。通过 mcporter 调用 MiniMax Coding Plan MCP 服务。 ## 工具 ### 1. web_search - 网络搜索 使用 MiniMax MCP 进行实时网络搜索，返回搜索结果和相关链接。 **参数：** - `query` (string, 必需): 搜索关键词，建议 3-5 个关键词 **返回：** 搜索结果列表，包含标题、链接、摘要和日期 ### 2. understand_image - 图像理解 使用 MiniMax MCP 分析图片内容，支持本地文件路径和 HTTP/HTTPS URL。 **参数：** - `image_path` (string, 必需): 图片路径，支持本地路径或 URL - `prompt` (string, 必需): 分析要求 **支持格式：** JPEG、PNG、WebP ## 使用方法 **网络搜索示例：** ``` 搜索：最新AI新闻 ``` **图像理解示例：** ``` 分析图片：/path/to/image.jpg，描述图片内容 ``` ## 注意事项 - 需要先安装 mcporter：`npm install -g mcporter` - 首次使用需配置 MiniMax API Key（已在配置文件中设置） - 图像理解支持本地文件和 HTTP/HTTPS URL


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: gekacross/personal-notes (version 1.0.0)

--- name: personal-notes description: Acts as the user's note-taking and journaling assistant in the Notes topic. Captures thoughts, reflections, daily logs, random notes. Use when in Personal chat Notes topic, or when user mentions note, journal, diary, thought, reflection, log, record, or "write down". --- # Personal Notes (заметки и дневник) Роль: **твой персональный блокнот**. Записывает мысли, рефлексии, заметки, дневник — всё что не вписывается в другие топики. ## Перед ответом 1. **Прочитай** `knowledge/personal/notes.md` — там последние заметки. 2. **Учитывай историю чата**. 3. Если пользователь хочет **записать что-то** — добавь в `knowledge/personal/notes.md` с датой. ## Что умеет - **Быстрые заметки:** пользователь скинул мысль — записать с датой и временем. - **Дневник:** ежедневные записи — как прошёл день, что произошло, настроение. - **Рефлексия:** помочь осмыслить событие, задать вопросы для размышления. - **Поиск:** «что я писал про X?» — найти в заметках. - **Обзор:** показать заметки за день/неделю/месяц. - **Теги:** по желанию пользователя — #мысль, #рефлексия, #важно и т.д. ## Правила - Записывать дословно или близко к тексту — не переписывать мысли пользователя. - Не анализировать без запроса — иногда просто нужно записать. - Формат записи: ```markdown ### [YYYY-MM-DD HH:MM] Заметка Текст заметки... **Теги:** #тег ``` - Тон: нейтральный, без оценок. Это личное пространство. ## Файлы - **Память:** `knowledge/personal/notes.md` — читать в начале, добавлять новые записи.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: mtsatryan/ah-cloud-architect (version 1.0.0)

--- name: cloud-architect description: 'You are a cloud architect with expertise across major cloud platforms. Use when: aws, google cloud platform, azure.' --- # Cloud Architect You are a cloud architect with expertise across major cloud platforms. ## Cloud Platforms Expertise ### AWS - EC2, Lambda, ECS, EKS - S3, EFS, FSx - RDS, DynamoDB, Aurora - API Gateway, CloudFront, Route53 - VPC, Transit Gateway, Direct Connect - IAM, Cognito, Secrets Manager ### Google Cloud Platform - Compute Engine, Cloud Functions, GKE - Cloud Storage, Filestore - Cloud SQL, Firestore, Bigtable - Cloud Load Balancing, Cloud CDN - VPC, Cloud Interconnect - IAM, Cloud Identity ### Azure - Virtual Machines, Functions, AKS - Blob Storage, Files - SQL Database, Cosmos DB - Application Gateway, Front Door - Virtual Network, ExpressRoute - Active Directory, Key Vault ## Architecture Patterns - Microservices and serverless architectures - Event-driven architectures - Multi-region deployments - Hybrid cloud solutions - Edge computing architectures - Data lake and analytics platforms ## Cost Optimization - Reserved instances and savings plans - Spot/Preemptible instances usage - Auto-scaling strategies - Resource tagging and cost allocation - FinOps practices - Cost monitoring and alerts ## Security & Compliance - Zero-trust architecture - Network segmentation - Encryption at rest and in transit - Compliance frameworks (SOC2, HIPAA, GDPR) - Security hub/command center setup - Cloud security posture management ## Disaster Recovery - Backup strategies - Multi-region failover - RTO/RPO planning - Data replication strategies - Disaster recovery testing ## Approach 1. Assess business requirements and constraints 2. Design cloud-native architecture 3. Implement security best practices 4. Optimize for cost and performance 5. Plan for scalability and resilience 6. Document architecture decisions ## Output Format - Provide architecture diagrams - Include terraform/CloudFormation templates - Document cost estimates - Add security considerations - Include migration strategies ---


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zack-dev-cm/avito-outreach-manager (version 1.0.3)

--- name: avito-outreach-manager description: Review Avito message drafts for clarity, consent, respectful tone, one clear next step, and safe checkout wording before a human decides what to send. --- # Avito Message QA Reviewer Use this skill to review Avito message drafts before a human decides what to send. Keep the work to copy QA, safety wording, and a short human-send checklist. ## Inputs Collect: - item or service context, - seller-facing draft message, - intended package or offer, - allowed contact method, - checkout boundary. Do not request phone numbers, bank card numbers, payment account details, session cookies, private chat exports, or personal identifiers that are not needed for message review. ## Review Workflow 1. Check the message for: - respectful tone, - specific context, - one clear next step, - no pressure tactics, - no private payment details, - no workflow notes or scoring language. 2. Rewrite the message if needed. 3. Add a short human-send checklist. ## Output Return: - revised Avito message, - what changed, - human-send checklist, - payment-safety reminder. ## Guardrails - Keep all Avito account activity outside this skill. - Keep checkout wording inside Avito-supported safe flows. - Keep outbound text limited to what the recipient should see. - Do not advise off-platform payments.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: chellen021/personal-toutiao-pub (version 1.0.0)

--- name: personal-toutiao-pub description: 今日头条微头条自动发布工具。触发词："发布头条"、"发微头条"、"头条发布" version: 1.0.0 --- # 今日头条发布工具 自动发布微头条到今日头条，支持复用本地 Chrome 登录态，支持智能等待登录。 ## 功能特性 - ✅ **复用登录态**：连接本地 Chrome，无需重复登录 - ✅ **智能等待登录**：未登录时自动等待，登录成功后继续 - ✅ **智能内容扩展**：内容不足100字自动扩展 - ✅ **自动勾选选项**：自动勾选"个人观点，仅供参考" - ✅ **支持图片上传**：可附带图片发布 - ✅ **截图保存**：发布成功后自动截图保存到桌面 - ✅ **支持文件输入**：可从文件读取长文本内容 ## 触发方式 ``` 发布头条：今天天气真好 发微头条 今天学到了很多新知识 头条发布 "分享一个有趣的故事..." ``` ## 使用方法 ### 命令行使用 ```bash # 基本使用（发布默认内容） python3 toutiao_publish.py # 发布指定内容 python3 toutiao_publish.py "今天天气真好，心情也不错！" # 从文件读取内容 python3 toutiao_publish.py -f content.txt # 带图片发布 python3 toutiao_publish.py "内容" --image ~/Desktop/pic.jpg # 使用无头模式（新浏览器） python3 toutiao_publish.py "内容" --headless # 未登录时不等待，直接退出 python3 toutiao_publish.py "内容" --no-wait ``` ### 前置要求 **必须启动 Chrome 远程调试：** ```bash # Mac /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --remote-debugging-port=9222 # Windows "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 # Linux google-chrome --remote-debugging-port=9222 ``` ## 发布流程 1. 连接本地 Chrome 浏览器 2. 检查登录状态 - **已登录**：直接进入发布页面 - **未登录**：显示提示，自动等待登录（最长5分钟） 3. 打开发布页面 4. 输入内容（自动扩展到100字以上） 5. 上传图片（如提供） 6. 勾选发布选项： - 声明首发：头条首发（如存在） - 作品声明：个人观点，仅供参考 7. 点击发布按钮 8. 保存成功截图 ## 参数说明 | 参数 | 说明 | 示例 | |------|------|------| | `content` | 发布内容 | `"今天天气很好"` | | `-f, --file` | 从文件读取 | `-f post.txt` | | `-i, --image` | 图片路径 | `--image pic.jpg` | | `--headless` | 无头模式 | `--headless` | | `--no-wait` | 不等待登录 | `--no-wait` | ## 智能等待登录 当检测到未登录时，脚本会： 1. 显示提示信息： ``` ⏳ 等待登录... 请在 Chrome 浏览器中完成登录 登录成功后将自动继续... （最长等待 300 秒） ``` 2. 每2秒检查一次登录状态 3. 检测到登录成功后自动继续发布流程 4. 超过5分钟未登录则超时退出 **使用 `--no-wait` 参数可禁用等待功能，未登录时直接退出。** ## 输出 - **成功截图**：`~/Desktop/toutiao_publish_success.png` - **错误截图**：`~/Desktop/toutiao_error.png` ## 故障排除 | 问题 | 解决方案 | |------|----------| | 无法连接 Chrome | 确保 Chrome 已启动并开启 9222 端口 | | 未检测到登录 | 在 Chrome 中访问 mp.toutiao.com 完成登录 | | 等待登录超时 | 检查网络，重新运行脚本 | | 找不到输入框 | 页面结构可能变化，检查错误截图 | | 图片上传失败 | 检查图片路径和格式 | | 发布失败 | 检查网络连接，查看错误截图 | ## 依赖 ```bash pip3 install playwright --break-system-packages playwright install chromium ``` ## 文件结构 ``` skills/toutiao-publisher/ ├── SKILL.md # 本说明文件 └── toutiao_publish.py # 主脚本 ``` --- *Created: 2026-03-08* *Updated: 2026-03-08（新增智能等待登录）*


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: yfxa/ig-cropper (version 1.3.0)

--- name: ig-cropper description: Transforms cluttered Instagram mobile screenshots into clean, distraction-free architectural and design references. Use when you need to automate the extraction of pure imagery from Instagram so that building a visual inspiration archive remains effortless, focused, and aesthetically consistent. --- # IG Cropper This skill provides a surgical tool to extract pure photographs from Instagram mobile screenshots (dark mode). ## How it Works **Adaptive Extraction**: Instagram's dark mode uses a very specific background color: **RGB (12, 15, 20)**. The tool scans the screenshot row by row, identifying the interface elements by this color signature and isolating the largest continuous block of non-background imagery—the photograph itself. It extracts this frame flawlessly, regardless of how much the user has scrolled. ## Usage Run the Python script directly on any Instagram screenshot: ```bash python3 scripts/ig_crop.py input_screenshot.png output_pure_photo.png ``` ### Philosophy This tool intentionally does *not* attempt to algorithmically paint over watermarks or icons located *inside* the photograph (like pagination numbers or tagged-people indicators). We leave the integrity of the architectural textures untouched, delegating complex restorations to professional generative tools or manual human craftsmanship. ## Dependencies - Python 3 - Pillow (`pip install pillow`)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: paulshe/china-stock-analysis (version 1.0.0)

--- name: china-stock-analysis description: Analyze Chinese stock prices (A-shares, HK stocks) and provide investment recommendations. Use when the user asks about stock analysis for Chinese companies, including buying/selling recommendations and market trends. --- # Stock Analysis Analyze stock price movements and provide investment recommendations. ## Supported Markets | Market | Code Format | Example | |--------|-------------|---------| | A-shares (Shanghai) | XXXXXX.SH | 600519.SH (Moutai) | | A-shares (Shenzhen) | XXXXXX.SZ | 000001.SZ (Ping An) | | Hong Kong | XXXX.HK | 0700.HK (Tencent) | | US | TICKER | AAPL, TSLA, NVDA | ## Analysis Workflow When asked to analyze a stock: 1. **Search for current price data** using web search - Query format: "{股票名称} 股价 今日" or "{TICKER} stock price today" - Look for: current price, open, high, low, volume, change % 2. **Gather additional context** (if available) - Recent news affecting the stock - Industry trends - Market sentiment 3. **Present analysis in structured format**: ``` ## 📊 {股票名称}({代码}) 股价分析 ### 📈 核心数据 | 指标 | 数值 | 变化 | |------|------|------| | 收盘价 | XXX | +XX | | 涨跌幅 | XX% | 🔴/🟢 | | 最高/最低 | XX / XX | - | | 成交量 | XX万手 | - | ### 技术面分析 - 短期趋势：... - 关键支撑/压力位：... - 均线状态：... ### 💡 投资建议 **建议：买入/持有/卖出** - 理由：... - 操作策略：... - 风险提示：... ``` ## Recommendation Guidelines ### Buy Signals - 突破关键阻力位 - 成交量放大配合上涨 - 均线多头排列 - 基本面利好 ### Hold Signals - 趋势不明确 - 等待关键突破 - 已有持仓且趋势良好 ### Sell Signals - 跌破关键支撑位 - 成交量萎缩 - 均线空头排列 - 基本面恶化 ## Risk Disclaimer Always include: "分析仅供参考，不构成投资建议。投资有风险，入市需谨慎。" ## Common Chinese Stocks Reference See [references/china-stocks.md](references/china-stocks.md) for popular Chinese stock codes.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: dalomeve/gateway-token-doctor (version 1.0.0)

--- name: gateway-token-doctor description: Diagnose and fix gateway token mismatches causing 401 errors. Align tokens across config, service, and CLI surfaces. --- # Gateway Token Doctor Diagnose and fix 401 errors from token mismatches. ## Problem Gateway token inconsistencies cause: - 401 Unauthorized errors - CLI/UI authentication failures - Service startup failures - Silent auth degradation ## Workflow ### 1. Token Audit ```powershell # Check all token surfaces $cfg = Get-Content "$HOME/.openclaw/openclaw.json" -Raw | ConvertFrom-Json $auth = $cfg.gateway.auth.token $remote = $cfg.gateway.remote.token $service = $env:OPENCLAW_GATEWAY_TOKEN "auth.token = $auth" "remote.[REDACTED_SECRET]" "service.[REDACTED_SECRET]" if ($auth -and $remote -and $auth -ne $remote) { Write-Warning "Token mismatch: auth != remote" } ``` ### 2. Alignment Fix ```powershell # Generate or use existing token $token = $auth # Update config $cfg.gateway.auth.[REDACTED_SECRET] $cfg.gateway.remote.[REDACTED_SECRET] $cfg | ConvertTo-Json -Depth 10 | Out-File "$HOME/.openclaw/openclaw.json" -Encoding UTF8 # Update service startup script $servicePath = "$HOME/.openclaw/gateway.cmd" $content = Get-Content $servicePath -Raw $content = $content -replace 'OPENCLAW_GATEWAY_TOKEN=.*', "OPENCLAW_GATEWAY_TOKEN=$token" $content | Out-File $servicePath -Encoding UTF8 # Restart openclaw gateway restart ``` ### 3. Verification ```powershell # Test gateway access openclaw gateway status # Test CLI auth openclaw whoami ``` ## Executable Completion Criteria | Criteria | Verification | |----------|-------------| | All tokens aligned | auth == remote == service | | Gateway responds | `openclaw gateway status` succeeds | | CLI auth works | `openclaw whoami` returns user | | No 401 in logs | `Select-String "401" logs` returns nothing | ## Privacy/Safety - Never log actual token values - Redact tokens in output (show first 4 chars only) - Store tokens only in config files ## Self-Use Trigger Use when: - 401 errors appear - Gateway restart after config change - CLI shows auth mismatch - Service fails to start --- **Align tokens. Restore access.**

path: references/privacy-checklist.md
content: # Privacy Checklist

Before using this skill, verify:

- [ ] No apiKey values in files
- [ ] No token values in files
- [ ] No secret/password in files
- [ ] No personal emails
- [ ] No absolute user paths

**Scan Command**:
```powershell
Get-ChildItem . -Recurse -File | Select-String -Pattern 'apiKey|token|secret|password' -CaseSensitive:$false
```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (HIGH)