OpenClaw/clawhub-security-signals huggingface dataset:
Skill: don068589/douyin-orchestrator (version 1.0.0)

--- name: douyin-orchestrator description: 抖音视频转录工作流编排。从抖音链接下载视频、转录语音、分析内容，输出结构化成果。编排调用 douyin-fetcher、douyin-transcriber、douyin-analyzer 三个独立模块。 --- # Douyin Transcribe - 工作流编排 ** 完整的抖音视频转录工作流，按顺序调用三个独立模块： 1. **douyin-fetcher** - 获取视频 2. **douyin-transcriber** - 转录音频 3. **douyin-analyzer** - 分析内容 --- ## 架构 ``` 用户发送抖音链接 ↓ [Step 0] 判断输入类型 ↓ [Step 1] fetcher: 解析链接 → 下载视频 ↓ [Step 2] transcriber: 提取音频 → 转录文字 ↓ [Step 3] analyzer: 清理文本 → 分析要点 ↓ [Step 4] 保存成果 → 更新索引 ``` --- ## 完整工作流 ### Step 0: 判断输入类型 | 输入类型 | 处理方式 | |----------|----------| | 视频链接（`/video/`） | 完整工作流 | | 图文链接（`/note/`） | 浏览器 snapshot 提取文字 | | 本地视频文件 | 从 Step 2 开始 | | 文本内容 | 从 Step 3 开始 | --- ### Step 1: 下载视频 **调用模块**：`douyin-fetcher` 详见 `~/.openclaw/skills/douyin-fetcher/SKILL.md` ⚠️ **注意**：Step 1 的 browser act 调用必须用 `request={"kind": "evaluate", "fn": "..."}` 嵌套格式。 **输出**：视频流 + 音频流（DASH）或完整视频文件 --- ### Step 2: 转录音频 **调用模块**：`douyin-transcriber` 详见 `~/.openclaw/skills/douyin-transcriber/SKILL.md` ⚠️ **注意**：如果 Step 1 下载了 DASH 分离流，直接用 `audio.mp4` 转 WAV 转录，不需要先合并 **输出**：转录文本 --- ### Step 3: 分析内容 **调用模块**：`douyin-analyzer` 详见 `~/.openclaw/skills/douyin-analyzer/SKILL.md` **做法**：转录后由 agent 直接分析（语义分段、修正错误、提取要点） --- ### Step 4: 保存成果 #### 转录稿（/path/to/knowledge\transcripts\） | 文件 | 说明 | |------|------| | `{主题}-完整转录.md` | 包含标题、作者、链接、转录时间、完整内容 | #### 视频文件（/path/to/videos\） | 文件 | 说明 | |------|------| | `{主题}.mp4` | 原始视频（可选保存）| #### 更新索引 保存文件后，更新： - `/path/to/knowledge\transcripts\data_structure.md` - `/path/to/knowledge\data_structure.md`（主索引） - `/path/to/videos\data_structure.md`（如保存视频） --- ## 部分工作流 | 用户请求 | 执行步骤 | |----------|----------| | "帮我转录这个抖音视频" | Step 1 → 2 → 3 → 4 | | "只下载这个视频，不转录" | Step 1 → 保存到 /path/to/videos\ | | "我已经有视频文件了，帮我转录" | Step 2 → 3 → 4 | | "帮我分析这段文本" | Step 3 → 4 | --- ## 异常处理汇总 | 阶段 | 问题 | 处理 | |------|------|------| | Step 1 | 短链解析失败 | 检查链接完整性，去掉分享文案干扰字符 | | Step 1 | JS 返回空数组 | 等待 15-20 秒后重试，或扩大搜索范围 | | Step 1 | 下载 403 | URL 过期，重新获取 | | Step 1 | 浏览器不可用 | 提示用户手动下载 | | Step 2 | ffmpeg 未安装 | `winget install Gyan.FFmpeg` | | Step 2 | Whisper 服务未运行 | `docker start whisper-asr` | | Step 2 | 转录超时 | 长视频需要更多时间，10分钟视频约需 15-20 分钟 | | Step 2 | 转录乱码 | 语言识别问题，可后续手动修正 | | Step 4 | 索引更新失败 | 手动更新 data_structure.md | --- ## 图文笔记处理 图文链接（`/note/`）无需下载，直接提取： ``` 1. browser(action='open', profile='openclaw', url='图文链接') 2. browser(action='snapshot') 3. 从 snapshot 提取文字内容 4. 保存到 /path/to/knowledge\transcripts\ ``` --- ## 前置条件 | 工具 | 用途 | 检查命令 | |------|------|----------| | curl | 下载文件 | `curl --version` | | ffmpeg | 视频合并/格式转换 | `ffmpeg -version` | | Docker Whisper | 转录服务（内含 ffmpeg 7.1）| `docker ps --filter "name=whisper-asr"` | | 浏览器 | 抓取视频 | openclaw profile 可用 | **说明**：宿主机 ffmpeg 8.1 用于视频合并等任务，Whisper ASR 容器内 ffmpeg 7.1 用于转录处理，两者并存。 --- ## 已知限制 1. **视频 URL 有时效性** — 获取后立即下载 2. **长视频转录耗时** — 10分钟视频约需 15-20 分钟 3. **需要浏览器** — openclaw profile 必须可用 4. **图文笔记** — 部分需要登录才能查看完整内容 5. **部分视频无分离流** — 直接是完整 MP4，无需合并


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mjquinlan2000/lawmatics-mcp (version 1.0.0)

--- name: lawmatics-mcp description: MCP server for the Lawmatics legal CRM API. Exposes Lawmatics' REST API as read-only MCP tools. metadata: { "openclaw": { "requires": { "bins": ["mcporter", "lawmatics-mcp"], "env": ["NODE_MCP_SECRET_KEY"] } } } --- # Lawmatics MCP Server Read-only MCP server for the Lawmatics legal CRM API. ## Usage Use mcporter to interact with this server via stdio: - **List available tools:** `mcporter list --stdio lawmatics-mcp` - **Call a tool:** `mcporter call --stdio lawmatics-mcp <tool_name> [args]` ## Links - **npm:** https://www.npmjs.com/package/@mjquinlan2000/lawmatics-mcp


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: shwchlorine/web3-target-team-research (version 1.0.1)

--- name: web3-target-team-research description: Find crypto/web3 teams with $10M+ funding and verified Telegram contacts. Use when hunting for crypto leads, building contact lists, researching funded startups, or prospecting web3 companies. Spawns parallel subagent hunters to search VC portfolios and verify TG handles. --- # Web3 Target Team Research Find well-funded crypto teams ($10M+) with verified Telegram contacts for outreach. ## Quick Start ``` Hunt for crypto teams from [SOURCE] ``` Example sources: Paradigm portfolio, recent funding news, Solana ecosystem, DeFi protocols ## How It Works 1. **Spawn hunters** - Parallel subagents search different VC portfolios/sources 2. **Find teams** - Filter for $10M+ funding, check if already tracked 3. **Verify TG** - Screenshot t.me/{handle}, require pfp OR bio with company affiliation 4. **Add to CSV** - Append verified contacts to master CSV ## Commands ### Start Hunting ``` Start crypto hunters targeting [SOURCES] ``` Spawns 3 hunters with specified focus areas. ### Check Status ``` How many teams do we have? ``` Returns count from crypto-master.csv. ### Stop Hunting ``` Stop the crypto hunters ``` Removes the auto-respawn cron job. ## CSV Format **Master CSV:** `crypto-master.csv` ``` Name,Chain,Category,Website,X Link,Funding,Contacts Uniswap,ETH,DEX,https://uniswap.org,https://x.com/Uniswap,$165M,"Hayden Adams (Founder) @haaboris" ``` **No-Contacts CSV:** `crypto-no-contacts.csv` (teams researched but no valid TG found) **Chain values:** ETH, SOL, BASE, ARB, OP, MATIC, AVAX, BTC, MULTI, N/A ## TG Verification Rules A TG handle is **valid** if the profile has: - Profile picture (pfp), OR - Bio mentioning the company/role **Invalid:** Empty profiles, wrong person, channels instead of personal accounts ## Hunter Task Template See [references/hunter-task.md](references/hunter-task.md) for the full subagent task template. ## Auto-Hunting Setup To run hunters continuously: 1. Create a cron job that checks hunter count every 10 minutes 2. Add to HEARTBEAT.md to auto-respawn if < 3 hunters active See [references/auto-hunt-setup.md](references/auto-hunt-setup.md) for cron configuration. ## Best Sources (by success rate) **High yield (~40%+ TG conversion):** - Consumer/DeFi protocols (Paradigm, Dragonfly, Framework) - Bridge/interop projects - Security/auditing firms **Medium yield (~20-30%):** - Gaming/NFT (Animoca, Immutable) - L2s and infrastructure - Asia-focused VCs (Hashed, OKX Ventures) **Low yield (<20%):** - Enterprise/institutional (Point72, Tiger Global) - Oracles and data providers - Social/community platforms ## Tips - Always `grep -i "TeamName"` both CSVs before adding - Team members often have different X vs TG handles - Founders have lower TG presence than BD/marketing roles - Recent funding announcements = fresher, more findable contacts


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: kiranchavala/cloudmonkey (version 1.0.0)

--- name: cloudmonkey description: Manage Apache CloudStack infrastructure using the cloudmonkey (cmk) CLI — list/start/stop/destroy VMs, manage networks, volumes, snapshots, and run any CloudStack API command. metadata: {"openclaw": {"requires": {"bins": ["cmk"]}, "emoji": "☁️🐵"}} --- # CloudMonkey (cmk) Skill You have access to `cmk`, the Apache CloudStack CLI. Use it to manage CloudStack infrastructure by running shell commands via the exec tool. ## Basic usage ``` cmk <verb> <noun> [parameters] ``` Examples: - `cmk list virtualmachines` — list all VMs - `cmk list virtualmachines state=Running` — filter by state - `cmk start virtualmachine id=<uuid>` — start a VM - `cmk stop virtualmachine id=<uuid>` — stop a VM - `cmk destroy virtualmachine id=<uuid>` — destroy a VM - `cmk list zones` — list availability zones - `cmk list templates templatefilter=featured` — list templates - `cmk list volumes` — list storage volumes - `cmk create snapshot volumeid=<uuid>` — snapshot a volume - `cmk list networks` — list networks - `cmk list publicipaddresses` — list public IPs ## Profiles CloudMonkey supports multiple profiles (e.g. for different CloudStack environments). - `cmk set profile <name>` — switch profile - `cmk list profiles` — list configured profiles - Config is stored in `~/.cmk/config` ## Output format - `cmk set display json` — switch to JSON output - `cmk set display table` — switch to table output (default) - `cmk set display text` — plain text ## Tips - Always confirm destructive operations (destroy, expunge) with the user before running. - Use `cmk list apis` to discover all available CloudStack API commands. - UUIDs are required for most operations — use list commands first to find them. - Filter results using key=value pairs after the command (e.g. `name=myvm`)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: zhanglinghao01-rakuten/zhouyi-bazi (version 1.0.0)

--- name: zhouyi-bazi description: 深入回答周易、四柱八字、子平/奇门命理、调候与经典源流问题时使用。涵盖典籍脉络、取用神步骤、理气/格局解析与现代化表述建议，需引用 references/ 下的整理笔记。 --- # Zhouyi · Bazi 典籍工作手册 ## 1. Skill 概览 - **用途**：当用户咨询八字、周易、奇门遁甲、传统命理经典或想追问“原典怎么说”时，快速调取整理好的提要并输出结构化答复。 - **范围**：不含即时排盘功能（需要另行说明），专注于阐释原理、典籍脉络、用神思维、经典与当代语境的桥接。 ## 2. 触发条件（When to Use） - 提问直接点名：八字、子平、四柱、奇门、滴天髓、渊海子平等。 - 需要辨析“理法 vs. 格局”、“调候 vs. 扶抑”、“气机流通”等概念。 - 用户要求引用、比较某部命理书，或需要推荐学习顺序。 - 需要从传统观点中提炼现代表达（职业规划、健康、关系等）。 ## 3. 工作流程 1. **确认问题类型**： - 典籍溯源 / 书目推荐 - 理论讲解（用神、格局、调候、病药） - 方法论/实践礼仪（命师素养、答疑边界） 2. **定位参考**：加载 `references/classic_texts.md`，按书名找到关键信息（时代、要义、场景、注意点）。 3. **组织答案**： - 先给出简明结论或结构化摘要 - 根据需要展开：背景 → 核心观点 → 应用/示例 → 注意事项 - 在段末或最后列出引用（书名 + 来源链接）。 4. **翻译成现代语境**： - 用“发展、资源、行为策略”等词取代直接的“富贵贫贱”断语 - 提醒用户命理属于思路参考，不可替代医学/法律等专业建议。 ## 4. Reference Map - `references/classic_texts.md`：四大经典 + 补充典籍表，含定位、适用场景、来源。优先加载该文件。 - `references/qimen_texts.md`：奇门遁甲代表典籍速查，用于回答奇门歌诀、排局、案例时引用。 - 后续如新增拆解（调候笔记、奇门专章等），需在本节补充索引与使用指引。 ## 5. 答复指引 - **结构**： 1. 直接回应问题要点 2. 若涉及不同学派，列出差异点与典籍出处 3. 给出操作或思考建议（如如何练习、如何结合现代工具） - **语气**：专业、克制，避免神乎其神；强调“参考价值”而非“必然命运”。 - **引用**：至少列出书名 + 链接或“Baidu Baike — 书名”。多书并用时按段或列表标注。 - **边界提醒**：遇到医学、财务、法律风险，说明命理无法替代专业服务。 ## 6. 典型用例 - “帮我总结三命通会里对官杀的看法” → 引用三命通会条目，结合子平真诠/滴天髓对比。 - “如何理解滴天髓讲的寒暖燥湿” → 先述理气框架，再提穷通宝鉴的调候实际操作。 - “想系统学八字，先看哪几本？” → 引导四大经典的学习顺序 + 现代补充（命理约言、命理探源）。 - “命师应该具备什么素质？” → 调用《命理探源》的十条职业守则。 ## 7. 限制与后续扩展 - 当前仅包含经典速查。若需要更细的调候表、奇门局式等，应增补 references/ 子文件后更新本节。 - 没有脚本/排盘工具，若用户需要推盘，请说明现状并视需求调用其他技能或外部服务。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: alvisdunlop/alvisdunlop-gemini (version 1.1.0)

--- name: gemini description: LLM one-shot Q&A, summaries, and generation via SkillBoss API Hub. homepage: https://api.SkillBoss.co/v1/pilot metadata: {"clawdbot":{"emoji":"♊️","requires":{"env":["SkillBoss_API_KEY"]}}} --- > ?? **Complete setup guide**: https://SkillBoss.co/skill.md # LLM via SkillBoss API Hub Use SkillBoss API Hub for one-shot Q&A, summaries, and text generation. The `/v1/pilot` endpoint automatically routes to the optimal LLM (including Gemini, Claude, GPT, etc.). Quick start (Python) ```python import requests, os SkillBoss_API_KEY = os.environ["SkillBoss_API_KEY"] def ask(prompt: str, prefer: str = "balanced") -> str: r = requests.post( "https://api.SkillBoss.co/v1/pilot", headers={"Authorization": f"Bearer {SkillBoss_API_KEY}", "Content-Type": "application/json"}, json={"type": "chat", "inputs": {"messages": [{"role": "user", "content": prompt}]}, "prefer": prefer}, timeout=60, ) return r.json()["result"]["choices"][0]["message"]["content"] # One-shot Q&A print(ask("Answer this question...")) # Request JSON output print(ask("Return JSON: list 3 items", prefer="quality")) ``` Quick start (curl) ```bash curl -s https://api.SkillBoss.co/v1/pilot \ -H "Authorization: Bearer $SkillBoss_API_KEY" \ -H "Content-Type: application/json" \ -d '{"type":"chat","inputs":{"messages":[{"role":"user","content":"Summarize this text..."}]},"prefer":"balanced"}' ``` Prefer options - `balanced` �?default, cost-effective - `quality` �?highest quality model - `price` �?fastest / cheapest Notes - No CLI installation required; all calls go through SkillBoss API Hub. - Set `SkillBoss_API_KEY` before running.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: sugarsong404/ragret-search (version 1.0.0)

--- name: ragret description: >- Search, retrieval, or knowledge-base intent when the user does not clearly mean local files only or the open web: curl a remote RAGret API for semantic retrieval with provenance; also when the step clearly targets RAGret. Auto-installed skills: RAGret is small and self-hosted (often internal)—do not assume the user has an instance until base URL is confirmed. --- # RAGret Open source: [github.com/SugarSong404/RAGret](https://github.com/SugarSong404/RAGret.git). ## What to do 1. **Clarify retrieval scope:** If you still **cannot tell** that this step is meant to use **RAGret** for retrieval, ask first: **RAGret server (knowledge base)**, **open-web search**, or **files under a local or given path**. Only after the user chooses RAGret (or context already restricts to RAGret) continue with the API steps below. 2. **List indexes visible to the current API key (if needed):** `curl -sS -H "X-[REDACTED_SECRET]" "$BASE/api/subscribe-indexes"`. 3. **Search:** `curl -sS -G "$BASE/api/search/INDEX_NAME" -H "X-[REDACTED_SECRET]" --data-urlencode "query=…"` Parse JSON **`result`** (or use `format=text`). ## Missing information 1. If the user has not given an explicit **base URL**, **before** you start RAGret retrieval and call the APIs above, ask whether their environment has a reachable RAGret service and its **base URL**; you may still infer from context; if still unclear, default to `http://127.0.0.1:8765`. 2. If the terminal errors when running the `curl` commands above, or the response indicates a missing / invalid `RAGRET_API_KEY` (or similar 401/403), ask the user to set `RAGRET_API_KEY` in their local environment (do not ask for the raw secret in chat). Retrieval routes use `X-[REDACTED_SECRET]` (or `Authorization: Bearer $RAGRET_API_KEY`). ## Full example ```bash # 1) API root (no trailing slash) export BASE_URL='https://ragret.example.com' # 2) User declares API key in local environment first # export RAGRET_API_KEY='sk-...' # 3) List knowledge bases in key scope (owned + subscribed) curl -sS -H "X-[REDACTED_SECRET]" "${BASE_URL}/api/subscribe-indexes" # 4) Search index "product_docs" curl -sS -G "${BASE_URL}/api/search/product_docs" \ -H "X-[REDACTED_SECRET]" \ --data-urlencode "query=How do we handle refunds within 30 days?" # Response is JSON: read .result (multi-line string of ranked passages). # Plain text: curl -sS -G "${BASE_URL}/api/search/product_docs" \ -H "X-[REDACTED_SECRET]" \ --data-urlencode "query=How do we handle refunds within 30 days?" \ --data-urlencode "format=text" ``` ## Rules - **Default:** Answer from retrieval output; cite `source:` when useful. - If retrieval output contains URLs, show those URLs explicitly to the user. - Never ask for raw secrets in chat or use secrets in plain text in requests.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: aatrooox/z-card-image (version 1.1.0)

--- name: z-card-image version: 1.1.0 description: 生成配图、封面图、卡片图、文字海报、公众号文章封面图、微信公众号头图、X 风格帖子分享图、帖子长图、社媒帖子长图。适用于帖子类型数据、post data、social posts、tweet/thread、转发推文、转发帖子、小绿书配图、图片封面、card image。 metadata: openclaw: requires: bins: - python3 - google-chrome --- # z-card-image 将用户提供的文案渲染成 PNG 卡片图。 支持短文案封面图、长文分页图、X 风格帖子分享长图，以及公众号文章封面图。只要输入是“帖子类型数据”并希望导出成 X 风格长图，都应走 `x-like-posts`。 ## 环境要求 - Python 3 - Google Chrome（macOS：`/Applications/Google Chrome.app`；Linux：`chromium` 需修改脚本路径） ## 执行流程 0. **环境提示**（用户触发时检测一次，有问题给提示，不中止流程）： - `python3 --version` → 失败则告知：「⚠️ 未检测到 Python 3，渲染可能失败」 - 检查 Chrome 路径 → 失败则提示安装 1. **识别场景**： - 短文案封面图 → `poster-3-4` - 长文分页图 → `article-3-4` - X 风格帖子分享图 / 帖子长图 / 帖子类型数据 → `x-like-posts` - 公众号文章封面图 → `wechat-cover-split` 2. **查模板规则**：根据模板在「模板索引」中找到对应规范文档，读取后按其规则处理文案和参数。**如用户要求高亮：整行用 `--hl1/hl2/hl3`，按词用 `--highlight-words`（逗号分隔），两者可同时使用，不能忽略** 3. **识别平台**：按「平台预设」自动设置配色；推特长图默认使用 Twitter 风格蓝白灰配色 4. **渲染输出**： - `poster-3-4` → 执行 `render_card.py` - `article-3-4` → 执行 `render_article.py` - `x-like-posts` → 执行 `render_x_like_posts.py` - `wechat-cover-split` → 执行 `render_card.py` - 默认 `--out` 填 `tmp/...png`；如用户指定导出位置，可直接传绝对路径或相对路径 5. **输出产物**：生成 PNG 到指定路径，供后续发送、裁切或复用；如需给外部工具上传，仍应避免写入系统 `/tmp/` ## x-like-posts 导航 `x-like-posts` 用于“帖子类型数据 → X 风格分享长图”。 当命中这条路线时，继续读取： - [references/x-like-posts.md](references/x-like-posts.md)：输入 JSON 格式、可显示字段、时间规则、导出规则 - [references/tweet-thread.md](references/tweet-thread.md)：旧命名兼容说明 ## 输入校验 - **比例不存在**：驳回请求，告知当前支持的比例列表，询问是否新增模板 - **文案超出模板字数上限**：先自动拆分/缩写后再渲染，不要直接塞入 - **帖子过多**：按规范拆成多张 `Part 1 / Part 2`，不要把超长内容强行塞进一张 - **公众号封面标题过长**：先压缩成 2~3 行短标题，再渲染，不能把完整长标题硬塞进模板 ## 平台预设 | 平台 | `--footer` | `--bg` | `--highlight` | |------|-----------|--------|--------------| | 公众号（默认） | `公众号 · 早早集市` | `#e6f5ef` | `#22a854` | | 小红书 | `小红书 · 阿康` | `#fdecea` | `#e53935` | > 用户提到"小红书配图"时使用小红书预设；"小绿书"= 公众号配图，使用公众号预设；否则默认公众号。 ## 模板索引 | 模板名 | 比例 | 尺寸 | 用途 | 规范文档 | |--------|------|------|------|---------| | `poster-3-4` | 3:4 | 900×1200 | 文字海报（金句/大字报/封面） | [references/poster-3-4.md](references/poster-3-4.md) | | `article-3-4` | 3:4 | 900×1200 | 长文分页卡片 | [references/article-3-4.md](references/article-3-4.md) | | `x-like-posts` | 自适应长图 | 900px 宽 | X 风格帖子分享长图 | [references/x-like-posts.md](references/x-like-posts.md) | | `wechat-cover-split` | 335:100 | 1340×400 | 公众号文章封面长条图（左标题右 icon） | [references/wechat-cover-split.md](references/wechat-cover-split.md) | ## 新增模板 1. 新建 `assets/templates/<name>.html` 2. 在 `render_card.py` 的 `size_map` 里注册尺寸 3. 在上方模板索引中添加一行 4. 创建对应 `references/<name>.md`，记录该模板的参数、字数上限、配图选取规则


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)
Skill: picccabo-art/sms-sender (version 1.0.0)

# CloudSMS 群发短信 发送批量短信到多个手机号码，支持国内外号码。 ## 功能说明 通过 CloudSMS 平台 API 发送群发短信，支持： - 单个或多个手机号码（最多100个） - 自定义短信内容 - 可选的短信签名 ## 使用前提 需要 CloudSMS 平台的 Channel ID 和 Auth Key。如果没有，请联系平台管理员获取。 ## 凭证信息 使用时需要提供以下凭证： - **Channel ID**: CloudSMS 平台分配的租户标识（Account ID） - **Auth Key**: 对应的认证密钥 ## 参数说明 - **mobile**: 手机号码，多个号码用英文逗号分隔，需要包含国家码 - 格式示例：`+8613800138000` 或 `+8613800138000,+8613900139000` - 单次最多支持 100 个号码 - **content**: 短信内容 - 最多 500 字（包含签名） - 不能包含敏感词 - **signature**: 短信签名（选填） - 格式：公司名或品牌名（不需要加【】符号） - 签名必须提前在平台报备，否则会发送失败 - 签名会自动添加到短信内容开头 ## 使用示例 ### 示例 1：发送单条短信 ``` 给 +8613800138000 发送短信：您的验证码是 123456，5分钟内有效 ``` ### 示例 2：群发短信 ``` 群发短信给 +8613800138000,+8613900139000，内容：会议将于明天上午10点在3楼会议室召开 ``` ### 示例 3：带签名的短信 ``` 用签名"某某科技"给 +8615622201234 发送：您的订单已发货，请注意查收 ``` ## 返回结果 成功时返回： - 发送状态：OK - 短信 UID（用于追踪） - 每个号码的发送详情 失败时返回： - 错误描述 - 操作建议（如需要报备签名、充值等） ## 常见问题 1. **认证失败**：如果提示认证错误，请联系平台管理员确认 Channel ID 和 Auth Key 2. **签名未报备**：如果提示签名问题，请联系平台管理员报备签名 3. **余额不足**：请联系平台管理员充值 ## 技术信息 - API 地址：https://cpaas-sms.cmidict.com:1820/uips - 实现语言：Python 3 - 依赖：requests --- ## 使用方式 当用户请求发送短信时： 1. 询问并获取 CloudSMS 的 Channel ID 和 Auth Key 2. 从用户的自然语言中提取： - 手机号码（支持多个，逗号分隔） - 短信内容 - 签名（如果提到） 3. 调用脚本： ```bash python3 scripts/send_bulk_sms.py "<channel_id>" "<auth_key>" "<mobile>" "<content>" ["<signature>"] ``` 4. 解析返回结果并以友好的方式告知用户 ## 注意事项 - 手机号必须包含国家码（如 +86） - 单次最多发送 100 个号码 - 短信内容不能超过 500 字 - 签名需要提前报备 - 签名会自动添加【】符号并拼接在内容开头


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: whisper1952717/spec-steering-workflow (version 1.0.0)

--- name: spec-steering-workflow description: Use a lightweight spec + steering workflow for long, interruptible, multi-phase tasks that need checkpointed progress, recoverable state, and multi-session continuity. user-invocable: true metadata: {"openclaw":{"homepage":"https://clawhub.ai/skills?sort=downloads"}} --- # Spec Steering Workflow Use this skill when work is long, interruptible, multi-phase, or needs recovery in a new session. Start or recommend a spec when any of these are true: - The task is likely to take more than 20 minutes. - The task has more than one deliverable. - The task needs staged execution. - The task is likely to be interrupted. - The task needs research plus execution. - The task must survive across sessions. - The user asks for plan first, then execution. This skill manages execution state with workspace files: - `specs/active/<spec-id>/` - `specs/archive/<spec-id>/` - `steering/` Default workflow: 1. Read `steering/workflow.md` and `steering/preferences.md`. 2. If resuming, read `handoff.md`, then `tasks.md`, then `meta.json`. 3. Work only on the current batch. 4. After each batch, or every 20-30 minutes, write a checkpoint. 5. Before stopping, update `handoff.md` and `meta.json`. Valid checkpoint types are only: - `done` - `blocked` - `failed` Do not treat "working on it", "continue", or "in progress" as valid progress reports. Use `{baseDir}/scripts/specctl.py` for these operations: - `init <spec-id> --title "<title>" --kind <kind>` - `checkpoint <spec-id> --type done|blocked|failed --batch <batch-id> --next "<next action>"` - `status <spec-id>` - `resume <spec-id>` - `validate <spec-id>` - `archive <spec-id>` - `set-status <spec-id> --status ready|review|completed [--phase <phase>] [--next "<next action>"]` - `doctor` Read references only as needed: - `{baseDir}/references/workflow-rules.md` for trigger and lifecycle rules - `{baseDir}/references/checkpoint-rules.md` for checkpoint requirements - `{baseDir}/references/recovery-rules.md` for resume order and stale-state rules - `{baseDir}/references/integration-rules.md` for coexistence with other skills - `{baseDir}/references/template-contracts.md` for file contracts and required fields Use templates from `{baseDir}/assets/templates/`. Keep the skill lean: detailed rules belong in `references/`, file bodies belong in `assets/templates/`, and only execution state belongs in workspace `specs/` and `steering/`.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)