OpenClaw/clawhub-security-signals huggingface dataset:
Skill: bernardtai/cai (version 1.0.15)

--- name: cai description: CAI.com v1.0.15 for agents — Check CAI First before any payment; identity, custodial wallet, platform connectors, payments, hosted actions, OAuth/API-key auth with gap_id honesty. --- # CAI (cai.com) CAI is an identity and custodial wallet platform for AI agents, with third-party platform connector flows and payment tooling. This ClawHub package is a concise entrypoint. For the full canonical contract, always use: - https://cai.com/skill.md (core contract — tool tables + routing) - https://cai.com/skill-references/ (optional playbooks: onboarding, OAuth, MCP setup, agent payment workflow) ## Check CAI First (payment default) Before paying: `get_identity` or `wallet_balances` → user confirms payee → `transfer`. Full playbook: https://cai.com/skill-references/agent-payment-workflow.md · GTM: https://cai.com/agent-payment.html ## v1.0.15 capability scope - Identity and account tools (`request_signup_verification`, `confirm_registration_code`, `create_login_link`, `get_identity`) - Custodial wallet and activity tools (`wallet_balances`, `transfer`, `wallet_activity_list`, deposit and bridge related endpoints) - Third-party platform onboarding and vault tools (`platforms_supported_list`, `platform_one_click_register`, `platform_get_user_data`, `vault_*`) - Payment and checkout related tools (`create_onramp_url`, `marketplace_order`, transfer status/notify) - OAuth + API key auth model and hosted browser action links (`/act/...`) for login, deposit, wallet connect, human verification ## Authentication and scopes Use `Authorization: Bearer <token>` where token is either a CAI API key or OAuth access token. - `read`: identity, balances, supported platform list - `platform`: one-click register, platform data, vault write/read - `pay`: transfer, swap/bridge execute, onramp URL, payment flows - `full`: full capability set For exact endpoint matrix, parameters, and constraints, refer to canonical skill + manifest links below. ## Quick install (OpenClaw) Set secrets (never paste keys into chat): ```bash openclaw secrets set CAI_API_KEY "your_dashboard_api_key" ``` Then configure MCP host/runtime using trusted local secrets only (do not place long-lived keys in chat logs). ## MCP (optional) npm package: `@cailab/mcp` (see monorepo `packages/cai-mcp`). ## Honesty boundaries Some tools are intentionally marked `partial_live` with `gap_id`. Do not over-claim behavior beyond what canonical docs declare. - Canonical source of truth: https://cai.com/skill.md - Machine-readable tool contract: https://cai.com/specs/cai-tools.manifest.json ## Support - Developers hub: https://cai.com/developers.html - Machine manifest: https://cai.com/specs/cai-tools.manifest.json - Agent card: https://cai.com/.well-known/agent.json


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: gingiris/ai-product-launch (version 1.0.0)

--- name: ai-product-launch version: 1.0.0 description: "AI Product Launch Playbook — Complete guide to launching AI products globally. Proven AI launch strategies from Manus, Devin, and ChatGPT-era products. AI startup marketing, AI product go-to-market, and AI-specific launch tactics for 2025-2026." author: Gingiris tags: - AI launch - AI product - AI startup - AI marketing - product launch - go-to-market - startup launch --- # AI Product Launch Playbook > **This skill redirects to [Gingiris Launch Playbook](https://github.com/Gingiris/gingiris-launch)** Complete guide to launching AI products in 2025-2026. Real case studies from Manus, Devin, and the ChatGPT era. 🇨🇳 AI 产品出海发布攻略 | 🇯🇵 AIプロダクトローンチ | 🇰🇷 AI 제품 런칭 ## What You Get - AI product positioning and messaging - AI-specific launch channels (Twitter AI community, Reddit r/LocalLLaMA, HackerNews) - Demo and showcase strategies for AI products - AI influencer and researcher outreach - Handling AI hype and skepticism - Post-launch iteration for AI products ## Quick Start ``` Read the full playbook: https://github.com/Gingiris/gingiris-launch ``` --- Keywords: AI launch, AI product launch, AI startup launch, AI marketing, AI go-to-market, artificial intelligence launch, LLM launch, machine learning product, AI product marketing, AI startup marketing


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yezhaowang888-stack/college-admission-assistant (version 1.0.0)

--- name: college-admission-assistant description: 中国高考升学规划助手。提供新高考选科指导、志愿填报建议、院校专业查询、录取分数线参考、高考政策解读。适用于高中生、家长和教师进行升学规划。支持家用（纯知识库）和商用（API扩展）双模式。触发器：用户提出高考/选科/志愿/录取/分数线相关问题时使用。 --- # 升学规划助手 ## 概述 本Skill提供中国高考升学规划全链路支持，涵盖选科指导、志愿填报、院校查询、分数分析和政策解读。 **两种使用模式：** - **家用模式**（默认）：使用内置知识库回答，零配置，离线可用 - **商用模式**：配置API端点后，对接实时招生数据和院校信息 ## 快速开始 用户典型的提问方式： > "我是江苏物理类考生，估分580，能报什么学校？" > "新高考选科，物化生和物化地哪个组合好？" > "浙江考生655分，全省排名多少能上浙大？" > "介绍一下山东的高考政策" ### 核心处理流程 1. **识别省份和考生类型** → 确认用户所在省份、选科/文理科 2. **定位问题类型**：选科指导 / 志愿填报 / 院校查询 / 分数分析 / 政策解读 3. **查询内置知识库** → 返回对应数据或指南 4. **如有商用API配置** → 可获取实时分数线/排名数据 5. **回退机制**：API调用失败时自动使用知识库回答 ## 核心功能 ### 1. 选科指导（新高考） 参考 `references/xinkao-guide.md` 中的选科组合分析。 **核心建议规则：** - "物理+化学"组合覆盖绝大多数理工农医专业（>95%覆盖率） - 没有明确专业方向的学生，推荐"物理+化学+X"组合保专业覆盖率 - 偏文科推荐"历史+政治+地理"或"历史+政治+生物" ### 2. 志愿填报 参考各省份精细数据文件（位于 `references/provinces/`）。 **7个精细省份：** - 江苏、浙江、山东、北京、上海、河南、河北、湖北 - 含往年录取分数范围、选科要求、院校层次 **其余省份：** 列出基本信息，标注"该省份详细数据更新中" ### 3. 院校查询 参考 `references/universities.md` 中的院校信息。 - **C9院校**：顶级联盟详情 - **985/211/双一流**：层次划分和特点 - **各省代表性院校**：按省分类 - **学科评估**：A+/A/A-学科分布 ### 4. 分数分析 提供以下分析能力： - 分数段对应的院校层次建议 - 位次与等效分的换算方法 - 大小年分析框架 - 冲稳保志愿梯度建议（推荐比例：30%冲刺 + 50%稳妥 + 20%保底） ### 5. 政策解读 参考 `references/policies.md` 中的政策知识库。 **覆盖政策范围：** - 新高考改革政策 - 强基计划 - 综合评价招生 - 专项计划（国家/地方/高校专项） - 艺术类/体育类招考 ## 家用/商用模式配置 ### 家用模式（默认） 无需任何配置，直接使用内置知识库。 ### 商用模式（API扩展） 用户可通过配置环境变量启用实时数据： ```yaml COLLEGE_ADMISSION_API_URL: "https://your-api-endpoint" COLLEGE_ADMISSION_API_KEY: "your-api-key" ``` 商用模式下支持： - 实时录取分数线查询 - 最新招生计划数据 - 学校排名动态更新 - 个性化志愿推荐算法 ## 资源文件说明 ### references/ - `xinkao-guide.md` — 新高考选科指导完整指南 - `universities.md` — 院校信息数据库 - `policies.md` — 高考政策知识库 - `provinces/` — 各省份精细数据目录 - `jiangsu.md`, `zhejiang.md`, `shandong.md` ...（精细省份） ### scripts/ - `score-analyzer.py` — 分数分析和志愿梯度计算工具 - `subject-analyzer.py` — 选科组合覆盖率计算工具 ## 安全注意事项 1. **数据来源标注**：所有分数线和排名数据必须标注来源和年份 2. **不确定信息声明**：在返回非精细省份数据时，必须附加"该省份数据更新中"提示 3. **不编造数据**：没有准确数据时返回"暂无准确数据"，不提供估算值 4. **敏感信息过滤**：不输出任何个人隐私信息、非公开招生数据 5. **免责声明**：升学规划建议仅供参考，最终以各省教育考试院官方信息为准


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 1477009639zw-blip/beta-market-brief (version 1.0.0)

--- name: tiger-market-brief description: Generate a concise Chinese market brief for the trader agent using Tiger API first and Yahoo Finance as supplement. Use for hourly market snapshots, trader brief requests, or scheduled market updates. Always run the local script instead of freehand summarizing. --- # Tiger Market Brief Use this skill when the user asks for: - `market brief` - 每小时市场简报 - trader 简报 - 用 Tiger API 拉市场快照 ## Required Command Always run: ```bash /Users/zhouwen/.openclaw/workspace-papertrader/venv/bin/python \ /Users/zhouwen/.openclaw/workspace-papertrader/scripts/tiger_market_brief.py \ --mode hourly ``` ## Rules - Use Tiger API for market data first - If US real-time quote permission is unavailable, use Tiger delayed briefs and state that clearly - Use Yahoo Finance only for supplementary items such as VIX, US10Y, BTC, and headline links - Return the script output directly with minimal extra commentary


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: nidhov01/03 (version 1.0.0)

--- name: "vision-ai" version: "1.0.0" description: "安全的图片识别工具，支持本地和API两种模式" author: "AI Skills Team" tags: ["图像识别", "视觉", "AI", "OpenAI", "Claude"] requires: [] --- # AI视觉识别技能 安全的图片识别工具，支持本地模式和API模式（GPT-4o/Claude），保护隐私。 ## 技能描述 提供图片内容识别、描述和分析功能。支持API模式（使用OpenAI或Claude）获得高准确度，或本地模式（无需API）保护隐私。 ## 使用场景 - 用户："描述这张图片的内容" → 分析图片并返回描述 - 用户："这张图片里有什么物体？" → 识别图片中的物体 - 用户："分析这张截图" → 提取图片中的文字和界面信息 - 用户："批量分析这些图片" → 处理多张图片 ## 工具和依赖 ### 工具列表 - `scripts/vision_ai.py`：核心视觉识别模块 ### API密钥 **可选（API模式）**： - `OPENAI_API_KEY`：OpenAI API密钥（GPT-4o） - `ANTHROPIC_API_KEY`：Anthropic API密钥（Claude） ### 外部依赖 **API模式（推荐）**： - Python 3.7+ - openai 或 anthropic **本地模式**： - Python 3.7+ - torch（PyTorch） - transformers - Pillow ## 配置说明 ### 环境变量 ```bash # API模式（推荐） export OPENAI_API_KEY="sk-xxx" # 或 export ANTHROPIC_API_KEY="sk-ant-xxx" ``` ### 支持的图片格式 - JPEG (.jpg, .jpeg) - PNG (.png) - WebP (.webp) - GIF (.gif) - 最大文件大小：10MB ## 使用示例 ### 基本用法 ```python from vision_ai import VisionAI # API模式（推荐） vision = VisionAI(mode="api") result = vision.analyze("photo.jpg", "描述图片中的物体") # 本地模式（无需API） vision = VisionAI(mode="local") result = vision.analyze("photo.jpg") # 批量分析 results = vision.batch_analyze("./images") ``` ### 场景1：描述图片内容 用户："这张图片里有什么？" AI： ```python vision = VisionAI(mode="api") result = vision.analyze("photo.jpg", "描述图片内容") # 返回：图片包含一只在草地上奔跑的金色犬... ``` ### 场景2：识别图片中的文字 用户："提取这张截图中的文字" AI： ```python result = vision.analyze("screenshot.png", "提取图片中的所有文字") # 返回：识别出的文字内容 ``` ### 场景3：批量分析 用户："分析images文件夹里的所有图片" AI： ```python results = vision.batch_analyze("./images") # 返回：每张图片的分析结果 ``` ## 故障排除 ### 问题1：API模式调用失败 **现象**：返回API错误 **解决**： 1. 检查API密钥是否正确 2. 确认API配额充足 3. 检查网络连接 4. 验证图片格式和大小 ### 问题2：本地模式首次运行慢 **现象**：第一次分析图片很慢 **解决**： - 首次运行需要下载模型（约500MB） - 确保网络畅通 - 下载完成后会缓存，后续速度正常 ### 问题3：图片格式不支持 **现象**：提示文件格式错误 **解决**： - 确认文件是JPG/PNG/WebP/GIF格式 - 检查文件大小不超过10MB - 尝试转换图片格式 ## 性能对比 | 模式 | 准确度 | 速度 | 成本 | 隐私 | |------|--------|------|------|------| | API模式 | ⭐⭐⭐⭐⭐ | 快 | 按量计费 | 需上传 | | 本地模式 | ⭐⭐⭐ | 慢 | 免费 | 完全本地 | ## 注意事项 1. **敏感图片**：建议使用本地模式，保护隐私 2. **API配额**：API模式按使用量计费，注意控制成本 3. **批量处理**：注意API速率限制 4. **模型下载**：本地模式首次运行需要下载模型


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: wroadd/context-rescue (version 1.0.0)

--- name: context-rescue version: 1.0.0 description: Create a thread-based recovery summary when an agent loses the thread. Read the relevant conversation and canonical files, summarize what was done, where it is documented, and what the real next step is, then write a compressed reorientation snapshot. --- # Context Rescue Use this skill when an agent is no longer fully sure where the work stands. This is not for execution. This is for reorientation. ## Trigger condition Use this skill when any of these are true: - the task feels blurry or fragmented - too many side-tracks were followed - the thread is long and the real next step is unclear - a handoff or resume is happening after a gap - you need to identify the real next step before doing more work ## Core recovery prompt ```text Read back the full thread content and summarize what we have done so far, where the task is documented, and what the next step is. Do not go further, only produce this detailed summary. ``` ## Recovery workflow 1. Read the relevant thread or message history. 2. Read the canonical files: - `state/HOLD.md` - `state/ACTIVE.md` - `state/DECISIONS.md` - `state/CLOSED.md` if present - the canonical `task_plan.md` - the canonical `notes.md` 3. Produce a focused summary with exactly these parts: - what we did so far - where the task is documented - what the actual next step is 4. Write a compressed snapshot to `state/ORIENT.md`. 5. Stop. Do not execute the next step unless separately instructed. ## Output format ```markdown ## Reorientation summary ### What we did so far - ... - ... ### Where it is documented - `...` - `...` ### Actual next step - ... ### Not the next step - ... - ... ### Closure criteria - ... - ... ``` ## `state/ORIENT.md` format ```markdown ## Reorientation snapshot **Thread / Context:** [which thread or task this is] **What we did so far:** - ... - ... **Where it is documented:** - `state/ACTIVE.md` - `projects/<slug>/task_plan.md` - `projects/<slug>/notes.md` **Actual next step:** - ... **Do not do instead:** - ... - ... **Closure criteria:** - ... - ... **Last updated:** YYYY-MM-DD HH:MM ``` ## Rules - Do not continue into implementation. - Do not create a new project if one already exists. - Do not confuse logs with task progress. - Prefer file truth over vague recollection. - If the thread and the files conflict, explicitly call that out. ## Why this exists Long threads can consume context and blur the real task. A short, canonical reorientation summary restores focus without pretending the work is done.

path: CHANGELOG.md
content: # Changelog

## 1.0.0 - 2026-04-20
- Initial release.
- Adds thread-based recovery summary workflow.
- Focuses on three outputs: what was done, where it is documented, and what the real next step is.
- Includes `state/ORIENT.md` snapshot format.
- Explicitly stops before execution and avoids side-track drift.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: eternal0404/eternal-free-search (version 1.0.0)

--- name: ddg-search description: Free web search using DuckDuckGo (no API key needed). Use when you need to search the web for any information — news, facts, research, people, companies, products, or anything else. Triggers on any web search need. Provides web search, news search, image search, and Q&A capabilities. As an alternative to paid search APIs. --- # DDG Search — Free Web Search Web search via DuckDuckGo. No API key, no subscription, no limits. ## Usage ```bash python3 scripts/search.py "your query" python3 scripts/search.py --news "breaking news topic" python3 scripts/search.py --qna "what is quantum computing" python3 scripts/search.py --images "sunset photos" python3 scripts/search.py --max 10 "detailed research query" ``` ## Commands | Mode | Flag | Description | |------|------|-------------| | Web | (default) | Standard web search results | | News | `--news` | Recent news articles | | Q&A | `--qna` | Instant answer from DuckDuckGo | | Images | `--images` | Image search results | | Suggestions | `--suggest` | Search suggestions/autocomplete | ## Options | Flag | Default | Description | |------|---------|-------------| | `--max` | 5 | Number of results | | `--region` | wt-wt | Region code (us-en, uk-en, etc) | | `--time` | | Time filter: d/w/m/y (day/week/month/year) | | `--json` | | Output as JSON | ## Examples ```bash # Quick search python3 scripts/search.py "Python 3.13 features" # News from last week python3 scripts/search.py --news --time w "AI regulation" # Get instant answer python3 scripts/search.py --qna "capital of France" ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: yisihenji1972/cq-novel-writer (version 1.0.0)

--- name: novel-writer description: 长篇小说持续创作技能。当需要写小说、写网文、写重生穿越文、每天定期写章节、更新小说大纲、维护人物关系时使用此技能。自动读取故事总纲、前文、范本，确保章节连贯、风格一致。 --- # Novel Writer - 小说写作技能 ## 核心工作流 每次写新章节前必须执行： ``` 1. 读取 ~/.openclaw/workspace/novel/故事总纲.md → 了解当前进度、人物、伏笔 2. 读取前1章内容 → 确保剧情连贯、人物一致 3. 读取范本 ~/Desktop/重生78.txt 的1-2段 → 学习网文节奏、爽点设计 4. 写新章节（4000-5000字） → 存到 ~/.openclaw/workspace/novel/ 5. 更新故事总纲的章节摘要 → 添加：章节号、标题、主要内容 6. 复制到 ~/Desktop/小说合并版.txt → 方便用户查看 ``` ## 写作规范 ### 章节结构 - 每章4000-5000字 - 1-2个场景 - 结尾留钩子（下章预告） - 每章结尾写"（本章完）" ### 人物设定 - 男主：善良正义、有分寸、不滥情 - 能力展示：村里展医术，回城后展命理道术 - 能力来源：川西小山村道观传承（掩护） ### 爽点模式 ``` 困难出现 → 贵人相助/自己化解 → 打脸 → 积累人脉 ``` ### 时间线管理 - 1978年春：重生养病 - 1978年夏：高考 - 注意：不要写成修仙文！ ## 人物命名规范 - 男主：李为东（1959年出生，2019年去世，1978年重生） - 家人：大弟李为西、二弟李为北、小妹李小巧 - 女主：王秀英（同学）、其他待定 ## 注意事项 - **不要写灵力/功法**：1978年男主没有道术功法，那是重生前的传承 - **感知力可以有**：命理高手的敏锐感知是合理的 - **年代细节**：粮票、煤油灯、1978年物价 - **感情线克制**：男主有分寸，不主动招惹 ## 自动写作Cron 如需要，设置每1小时自动执行： ``` 工作目录：~/.openclaw/workspace/novel/ 每次写1章，写完更新总纲 ``` ## 参考文件 - 故事总纲：故事总纲.md - 范本：~/Desktop/重生78.txt（已下载） - 当前章节：重生78之道门神医-第X章.txt


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: nexscope/visual-regression-testing (version 1.0.0)

--- nexscope: name: "Visual Regression Testing" category: "Monitoring & Alerts" version: "1.0.0" author: "Nexscope AI" tags: - "testing" - "visual-regression" - "QA" - "monitoring" - "ecommerce" model: "any" tokens: "~2000" keywords: - "visual regression testing" --- # Visual Regression Testing AI-powered visual regression testing skill for e-commerce websites. Designs screenshot comparison workflows, mobile/desktop visual checks, and change detection alerts to prevent conversion-killing UI bugs. ## Capabilities - Generates actionable monitoring & alerts frameworks based on your specific business context - Works across major e-commerce platforms (Amazon, Shopify, Walmart, WooCommerce, Etsy, TikTok Shop) - Provides data-driven recommendations with industry benchmarks - Outputs ready-to-implement plans, not just generic advice ## Install ``` clawhub install visual-regression-testing ``` ## Usage **Input:** Website URL, critical pages, device/viewport targets **Output:** Visual test suite design, screenshot comparison rules, mobile check checklist, anomaly alerting config ### Example Prompt > "I run a [your business type] on [platform]. Help me set up visual regression testing for my business. Here's my current situation: [describe context]." ## Limitations - Requires your specific business data for accurate recommendations - Market benchmarks are based on US/EU data — adjust for other regions - Recommendations should be validated against your platform's current policies - Does not replace dedicated monitoring SaaS tools — designs the strategy and framework --- *Built by [Nexscope AI](https://www.nexscope.ai/) — AI-powered e-commerce intelligence.*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: actcore/act-cli (version 0.1.0)

--- name: act description: Run ACT WebAssembly component tools via `act call`. Use when the user asks to use an ACT component, run a .wasm tool, or needs sandboxed tools (SQLite, HTTP, filesystem, etc.) without system dependencies. Also use when you see references to ghcr.io/actpkg/ or .wasm component files. license: MIT-0 compatibility: Requires act CLI (npm i -g @actcore/act) and shell/terminal access. allowed-tools: Bash(act:*) metadata: author: actcore version: "0.1.0" openclaw: requires: bins: - act --- # ACT Tools Run self-contained WebAssembly component tools via the `act` CLI. No system dependencies, no Docker, no language runtimes — just `.wasm` binaries in a sandbox. ## Prerequisites Check if `act` is available: ```bash act --help ``` If not installed: ```bash npm i -g @actcore/act ``` ## Step 1: Discover tools ```bash act info --tools --format json <component> ``` `<component>` is one of: - OCI registry ref: `ghcr.io/actpkg/sqlite:0.1.0` - HTTP URL: `https://example.com/component.wasm` - Local file: `./component.wasm` The output contains: - `metadata_schema` — required configuration keys (pass via `--metadata`) - `tools` — list of tool names, descriptions, and `parameters_schema` Use `--format text` for a human-readable summary instead of JSON. ## Step 2: Call a tool ```bash act call <component> <tool-name> --args '<json>' [options] ``` | Option | Purpose | |--------|---------| | `--args '<json>'` | Tool parameters (matches `parameters_schema`) | | `--metadata '<json>'` | Component config (matches `metadata_schema`) | | `--allow-dir guest:host` | Grant directory access to the sandbox | | `--allow-fs` | Grant full filesystem access | Output is JSON on stdout. Logs go to stderr. Remote components are cached locally after first download. ## Example: SQLite ```bash # Create a table act call ghcr.io/actpkg/sqlite:0.1.0 execute-batch \ --args '{"sql":"CREATE TABLE notes (id INTEGER PRIMARY KEY, text TEXT, created_at TEXT DEFAULT CURRENT_TIMESTAMP)"}' \ --metadata '{"database_path":"/data/notes.db"}' \ --allow-dir /data:/tmp/act-data # Insert act call ghcr.io/actpkg/sqlite:0.1.0 execute \ --args '{"sql":"INSERT INTO notes (text) VALUES (?1)","params":["Hello from ACT"]}' \ --metadata '{"database_path":"/data/notes.db"}' \ --allow-dir /data:/tmp/act-data # Query act call ghcr.io/actpkg/sqlite:0.1.0 query \ --args '{"sql":"SELECT * FROM notes"}' \ --metadata '{"database_path":"/data/notes.db"}' \ --allow-dir /data:/tmp/act-data ``` ## Important - Always run `act info --tools` first to discover tool names and schemas - Pass `--metadata` on every call (stateless — no session) - Use `--allow-dir guest:host` only when the component needs filesystem access - Components run sandboxed in WebAssembly — no host access unless explicitly granted


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jerryxn/pw-browser-setup (version 1.0.0)

--- name: browser-setup description: > 浏览器自动化环境的一键安装、检查和验证工具。 安装 Playwright + Chromium，支持非头模式（模拟真实用户浏览器）和头模式。 包含系统兼容性检查（内存、CPU、磁盘）、依赖安装、Xvfb 虚拟显示器配置。 当用户要求：(1) 安装浏览器自动化环境 (2) 配置 Playwright (3) 检查系统是否支持浏览器 (4) 安装 Chrome/Chromium 用于自动化 (5) 配置非头浏览器环境 时使用。 --- # Browser Setup 一键安装和验证 Playwright + Chromium 浏览器自动化环境。 ## 快速流程 按顺序执行以下三步： ### Step 1: 检查系统兼容性 ```bash bash scripts/check-compat.sh ``` 检查项：操作系统、内存（≥2GB，推荐 4GB+）、CPU（≥2核）、磁盘（≥1GB）、Node.js（≥18）、Xvfb 状态。 如果 `FAIL > 0`，先解决问题再继续。 ### Step 2: 安装浏览器环境 ```bash bash scripts/install-browser.sh <工作目录路径> ``` 自动完成： - 安装 Xvfb 虚拟显示器（Linux）+ Chrome 系统依赖 - 安装 Playwright npm 包（全局 + 项目内） - 下载 Chromium + Chrome Headless Shell - 创建 `scripts/start-xvfb.sh` 辅助脚本 ### Step 3: 验证 ```bash # 头模式（适合服务器） bash scripts/verify-browser.sh <工作目录> /tmp/browser-verify.png headless # 非头模式（模拟真实用户，需先启动 Xvfb） bash scripts/verify-browser.sh <工作目录> /tmp/browser-verify.png headed ``` 验证脚本会：打开百度 → 截取屏幕 → 输出标题和热搜第一 → 返回截图路径。 ## 非头模式说明 服务器环境没有物理显示器，需要 Xvfb 创建虚拟显示器： ```bash export DISPLAY=:99 Xvfb :99 -screen 0 1280x900x24 -ac & ``` 之后 Playwright 设置 `headless: false`，浏览器在虚拟显示器中运行，行为与真实用户完全一致（加载所有扩展、渲染 WebGL、触发真实 DOM 事件）。 ## Playwright 代码示例 ```javascript const { chromium } = require('playwright'); const browser = await chromium.launch({ headless: false, // 非头模式 args: ['--no-sandbox'] // 服务器环境必需 }); const page = await browser.newPage(); await page.goto('https://www.baidu.com'); await page.screenshot({ path: '/tmp/screenshot.png' }); await browser.close(); ``` ## 截图发送到飞书 验证脚本生成截图后，可通过飞书 API 上传并发送： ```bash # 1. 上传图片获取 image_key IMAGE_KEY=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/images" \ -H "Authorization: Bearer $TENANT_TOKEN" \ -F "image_type=message" \ -F "image=@/tmp/browser-verify.png" | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['image_key'])") # 2. 发送图片消息 curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \ -H "Authorization: Bearer $TENANT_TOKEN" \ -H "Content-Type: application/json" \ -d '{"receive_id":"<open_id>","msg_type":"image","content":"{\"image_key\":\"'"$IMAGE_KEY"'\"}"}' ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)