OpenClaw/clawhub-security-signals huggingface dataset:
Skill: tang2606/brainstorming-conflict (version 1.0.0)

--- name: brainstorming description: "You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation." --- # Brainstorming Ideas Into Designs ## Overview Help turn ideas into fully formed designs and specs through natural collaborative dialogue. Start by understanding the current project context, then ask questions one at a time to refine the idea. Once you understand what you're building, present the design in small sections (200-300 words), checking after each section whether it looks right so far. ## The Process **Understanding the idea:** - Check out the current project state first (files, docs, recent commits) - Ask questions one at a time to refine the idea - Prefer multiple choice questions when possible, but open-ended is fine too - Only one question per message - if a topic needs more exploration, break it into multiple questions - Focus on understanding: purpose, constraints, success criteria **Exploring approaches:** - Propose 2-3 different approaches with trade-offs - Present options conversationally with your recommendation and reasoning - Lead with your recommended option and explain why **Presenting the design:** - Once you believe you understand what you're building, present the design - Break it into sections of 200-300 words - Ask after each section whether it looks right so far - Cover: architecture, components, data flow, error handling, testing - Be ready to go back and clarify if something doesn't make sense ## After the Design **Documentation:** - Write the validated design to `docs/plans/YYYY-MM-DD-<topic>-design.md` - Use elements-of-style:writing-clearly-and-concisely skill if available - Commit the design document to git **Implementation (if continuing):** - Ask: "Ready to set up for implementation?" - Use superpowers:using-git-worktrees to create isolated workspace - Use superpowers:writing-plans to create detailed implementation plan ## Key Principles - **One question at a time** - Don't overwhelm with multiple questions - **Multiple choice preferred** - Easier to answer than open-ended when possible - **YAGNI ruthlessly** - Remove unnecessary features from all designs - **Explore alternatives** - Always propose 2-3 approaches before settling - **Incremental validation** - Present design in sections, validate each - **Be flexible** - Go back and clarify when something doesn't make sense


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kirkraman/kirk-transcribe (version 1.0.0)

--- name: openai-whisper description: Speech-to-text via SkillBoss API Hub (STT, powered by Whisper and more). homepage: https://api.skillbossai.com metadata: {"clawdbot":{"emoji":"🎙️","requires":{"env":["SKILLBOSS_API_KEY"]}}} --- # Whisper STT via SkillBoss API Hub Use SkillBoss API Hub's `/v1/pilot` to transcribe audio (STT), powered by OpenAI Whisper and other speech recognition models. Quick start (Python) ```python import requests, base64, os SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"] API_BASE = "https://api.skillbossai.com/v1" def pilot(body: dict) -> dict: r = requests.post( f"{API_BASE}/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=body, timeout=60, ) return r.json() # Transcribe audio file audio_b64 = base64.b64encode(open("/path/audio.mp3", "rb").read()).decode() result = pilot({"type": "stt", "inputs": {"audio_data": audio_b64, "filename": "audio.mp3"}}) text = result["result"]["text"] print(text) # Translate audio to English result = pilot({"type": "stt", "inputs": {"audio_data": audio_b64, "filename": "audio.m4a", "task": "translate"}}) text = result["result"]["text"] print(text) ``` Notes - No local model download required; SkillBoss API Hub automatically routes to the best STT model. - `SKILLBOSS_API_KEY` environment variable required. - Response text is at `result["result"]["text"]`.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: balkanblbn/audit-log-firewall (version 1.0.0)

--- name: audit-log-firewall description: Policy-based monitoring and command-line enforcement for high-risk agent operations. Intercepts sensitive commands and logs them for human auditing. --- # Audit Log Firewall Security is a non-negotiable protocol for autonomous agents. This skill acts as a dynamic guardrail. ## Operational Modes ### 1. Interception Mode Every command is checked against a local allowlist (`config/allowlist.json`). - **High Risk**: commands like `rm -rf`, `sudo`, or direct `curl` to unknown external IPs. - **Protocol**: If a high-risk command is detected, the agent triggers a mandatory 'Pause and Ask' state. ### 2. Forensic Logging All terminal activity is hashed and stored in `.logs/SECURITY.json`. - **Fields**: Timestamp, Command, User, Working Directory, and Hash. - **Utility**: Allows humans to reconstruct the agent's actions in case of a breach or error. ## Installation ```bash clawhub install audit-log-firewall ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: alexeyvorobiev/alexey-brave-search (version 1.0.0)

--- name: brave-search description: Web search and content extraction via Brave Search API. Use for searching documentation, facts, or any web content. Lightweight, no browser required. --- # Brave Search Headless web search and content extraction using Brave Search. No browser required. ## Setup Run once before first use: ```bash cd ~/Projects/agent-scripts/skills/brave-search npm ci ``` Needs env: `BRAVE_API_KEY`. ## Search ```bash ./search.js "query" # Basic search (5 results) ./search.js "query" -n 10 # More results ./search.js "query" --content # Include page content as markdown ./search.js "query" -n 3 --content # Combined ``` ## Extract Page Content ```bash ./content.js https://example.com/article ``` Fetches a URL and extracts readable content as markdown. ## Output Format ``` --- Result 1 --- Title: Page Title Link: https://example.com/page Snippet: Description from search results Content: (if --content flag used) Markdown content extracted from the page... --- Result 2 --- ... ``` ## When to Use - Searching for documentation or API references - Looking up facts or current information - Fetching content from specific URLs - Any task requiring web search without interactive browsing


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: shiscofield12-beep/github-fetcher (version 1.0.0)

--- name: github-fetcher description: Use this skill when the user mentions a GitHub URL or asks to analyze, review, explore, or understand any GitHub project, repository, or codebase. Triggers on phrases like "分析这个项目", "看看这个仓库", "analyze this repo", "what does this project do", or any github.com URL in the message. metadata: {"clawdbot":{"emoji":"🐙","requires":{"bins":["curl"]}}} --- # GitHub Repository Fetcher When given a GitHub URL or repo name, ALWAYS use curl to fetch real content first. Never guess or infer — fetch then analyze. ## Standard analysis workflow ```bash # 1. List root directory curl -s "https://api.github.com/repos/OWNER/REPO/contents/" # 2. Get README curl -s "https://raw.githubusercontent.com/OWNER/REPO/main/README.md" # 3. Explore key subdirectories based on findings curl -s "https://api.github.com/repos/OWNER/REPO/contents/src" ``` ## Get specific file ```bash curl -s "https://raw.githubusercontent.com/OWNER/REPO/main/PATH/TO/FILE" ``` ## Extract OWNER/REPO from URLs - https://github.com/ultraworkers/claw-code → OWNER=ultraworkers REPO=claw-code - github.com/foo/bar → OWNER=foo REPO=bar ## Tips - Try `master` if `main` returns 404 - Use `?ref=BRANCH` for other branches - GitHub API rate limit: 60 req/hour unauthenticated - After fetching, always provide analysis based on actual content


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 52yuanchangxing/csv-cleanroom (version 1.0.0)

--- name: csv-cleanroom description: Profile messy CSV files, standardize columns, detect data quality issues, and produce a reproducible cleanup plan. version: 1.1.0 metadata: openclaw: requires: bins: - python3 emoji: 🧰 --- # CSV Cleanroom ## Purpose Profile messy CSV files, standardize columns, detect data quality issues, and produce a reproducible cleanup plan. ## Trigger phrases - 清洗 CSV - profile this dataset - 数据质量检查 - 列名规范化 - build a cleanup plan ## Ask for these inputs - CSV file or schema - target schema if available - known bad values - dedupe rules - date/currency locale ## Workflow 1. Profile the CSV: row count, nulls, duplicates, type mismatches, and outliers. 2. Normalize headers and map to the target schema. 3. Generate a step-by-step cleanup plan and optional transformed output. 4. Document irreversible operations before applying them. 5. Return a quality score and remediation checklist. ## Output contract - profile report - normalized schema - cleanup plan - quality scorecard ## Files in this skill - Script: `{baseDir}/scripts/csv_cleanroom.py` - Resource: `{baseDir}/resources/data_quality_checklist.md` ## Operating rules - Be concrete and action-oriented. - Prefer preview / draft / simulation mode before destructive changes. - If information is missing, ask only for the minimum needed to proceed. - Never fabricate metrics, legal certainty, receipts, credentials, or evidence. - Keep assumptions explicit. ## Suggested prompts - 清洗 CSV - profile this dataset - 数据质量检查 ## Use of script and resources Use the bundled script when it helps the user produce a structured file, manifest, CSV, or first-pass draft. Use the resource file as the default schema, checklist, or preset when the user does not provide one. ## Boundaries - This skill supports planning, structuring, and first-pass artifacts. - It should not claim that files were modified, messages were sent, or legal/financial decisions were finalized unless the user actually performed those actions. ## Compatibility notes - Directory-based AgentSkills/OpenClaw skill. - Runtime dependency declared through `metadata.openclaw.requires`. - Helper script is local and auditable: `scripts/csv_cleanroom.py`. - Bundled resource is local and referenced by the instructions: `resources/data_quality_checklist.md`.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: xueyetianya/docker-analyzer (version 1.0.0)

--- name: Docker Analyzer description: "A tool for exploring each layer in a docker image Based on wagoodman/dive (53,557+ GitHub stars). docker analyzer, go, cli, docker, docker-image, explorer, inspector" version: 1.0.0 license: MIT runtime: python3 --- # Docker Analyzer A tool for exploring each layer in a docker image Inspired by [wagoodman/dive](https://github.com/wagoodman/dive) (53,557+ GitHub stars). ## Commands - `help` - Help - `run` - Run - `info` - Info - `status` - Status ## Features - Core functionality from wagoodman/dive ## Usage Run any command: `docker-analyzer <command> [args]` --- > **Disclaimer**: This skill is an independent, original implementation. It is not affiliated with, endorsed by, or derived from the referenced open-source project. No code was copied. The reference is for context only. Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: lexiang/lexiang-mcp-skill (version 2.0.1)

--- name: lexiang-knowledge-base version: 2.0.0 description: "乐享知识库 MCP 全功能 Skill。当用户提到「乐享」「知识库」「lexiang」，或提供 lexiangla.com 链接，或涉及知识库的搜索/写入/编辑/文件/配置等操作时使用。" sub_skills: - base/SKILL.md - setup/SKILL.md - search/SKILL.md - writer/SKILL.md - blocks/SKILL.md - files/SKILL.md - connectors/SKILL.md --- # 乐享知识库 MCP Skill 当用户提到「**乐享**」「**知识库**」「**lexiang**」，或提供 `lexiangla.com` 链接，或给出 `space_id`、`entry_id`、`/spaces/`、`/pages/` 等乐享标识时，读取本 Skill。 --- ## ⛔ MANDATORY RULES — 必须遵守 1. **遇到 401 错误**：立即停止重试，读取 `setup/SKILL.md` 引导续期 2. **写入操作**：必须基于用户明确提供的目标（URL/ID/名称确认），**禁止**自行遍历或猜测目标 3. **链接生成**：必须使用 `whoami()` 返回的 `company.company_domain` 作为域名，**禁止**使用 MCP endpoint 拼接用户链接 4. **company_from**：不能拼接为子域名，只能作 `?company_from=xxx` 查询参数 --- ## 📋 意图路由表 根据用户意图，读取对应子模块 SKILL.md： | 用户意图 | 读取子模块 | 典型触发词 | |---------|-----------|-----------| | 配置乐享 / 401 错误 / Token 过期 | `setup/SKILL.md` | 「配置乐享」「token 过期」「连不上」「401」 | | 搜索 / 查找 / 阅读 / 浏览 | `search/SKILL.md` | 「找一下」「搜索」「读一下这个页面」「打开链接」 | | 创建文档 / 写入 / 保存 / 导入 | `writer/SKILL.md` | 「写到乐享」「创建文档」「保存到知识库」「导入」 | | 编辑已有页面 / Block 操作 | `blocks/SKILL.md` | 「修改这个页面」「加个标题」「删掉这段」「在 /pages/xxx 里…」 | | 上传/下载文件（PDF/Word/图片等） | `files/SKILL.md` | 「传个 PDF」「上传文件」「下载这个文件」 | | 导入腾讯会议 / iWiki | `connectors/SKILL.md` | 「把会议录制导入」「迁移 iWiki 页面」 | ### ⚠️ 易混淆场景 | 场景 | 正确模块 | 说明 | |------|---------|------| | 用户提供 `/pages/xxx` 链接 + 要求「加内容/修改」 | `blocks/SKILL.md` | 操作**已有页面** | | 用户提供 `/spaces/xxx` 链接 + 要求「写入/创建」 | `writer/SKILL.md` | 在知识库下**新建文档** | | 用户提供 `/pages/xxx` 链接 + 仅要求「读/总结」 | `search/SKILL.md` | **只读**操作 | | 上传 PDF/Word/图片 | `files/SKILL.md` | 二进制文件，非文本文档 | | 创建 Markdown 文本文档 | `writer/SKILL.md` | 文本内容，非二进制 | ### ⚠️ 跨模块任务 需要同时读取多个子模块时，按流程顺序读取： - **搜索后写入**：先 `search/SKILL.md` → 再 `writer/SKILL.md` - **读取后编辑**：先 `search/SKILL.md` → 再 `blocks/SKILL.md` - **上传后记录**：先 `files/SKILL.md` → 再 `writer/SKILL.md` --- ## 🔑 凭证检查 执行任何乐享操作前，确认 MCP 已连接。通过 `whoami()` 检查： ``` MCP Tool: whoami → 成功：返回用户信息，继续执行 → 401：读取 setup/SKILL.md，引导续期（点续期按钮，无需重新配置） → 连接失败：读取 setup/SKILL.md，引导完成初始配置 ``` --- ## 🔗 链接生成规则（全局通用） 所有操作完成后返回链接时，统一遵循（完整规则见 `base/SKILL.md`）： | `company.company_domain` 类型 | 链接格式 | 示例 | |------------------------------|----------|------| | 包含三级域名（如 `csig.lexiangla.com`） | `{domain}/pages/{entry_id}` | `https://csig.lexiangla.com/pages/abc` | | 顶级域名（如 `lexiangla.com`） | `{domain}/pages/{entry_id}?company_from={company_from}` | `https://lexiangla.com/pages/abc?company_from=csig` | **`{company_from}` 获取优先级：** 1. mcp.json `url` 字段中的 `company_from` 参数 2. 若无，使用 `whoami().company.code` --- ## 📚 子模块索引 > **按需加载**：根据意图路由表，只读取对应子模块的 SKILL.md，无需一次性加载全部。 | 子模块 | 文件 | 职责 | |--------|------|------| | 配置与认证 | `setup/SKILL.md` | Token 配置、续期、WorkBuddy OAuth、故障排查 | | 搜索与阅读 | `search/SKILL.md` | 关键词/语义搜索、内容读取、目录浏览 | | 文档写入 | `writer/SKILL.md` | 新建文档、导入内容、公众号收藏 | | Block 编辑 | `blocks/SKILL.md` | 已有页面的 Block 级增删改移 | | 文件管理 | `files/SKILL.md` | 二进制文件上传/下载（三步流程） | | 外部导入 | `connectors/SKILL.md` | 腾讯会议录制导入、iWiki 迁移 | --- > Skill version: **2.0.0**


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: easwee/voice-log (version 0.1.5)

--- name: voice-log description: Background voice journaling with Soniox realtime STT for OpenClaw. Requires SONIOX_API_KEY. Get/create your Soniox API key at https://soniox.com/speech-to-text. Use when the user asks to start or stop passive speech logging (especially commands like "start voice journal", "start voice log", and "end voice journal"), or asks for a summary/transcript of the last N minutes of conversation. metadata: {"openclaw":{"requires":{"bins":["node","arecord|rec|ffmpeg"],"env":{"SONIOX_API_KEY":"required - Soniox API key"},"note":"Captures microphone audio locally and streams audio to Soniox realtime STT only while journal is running."}}} --- # Voice log Conversation journal that uses Soniox realtime STT in a background daemon that: - Captures microphone audio continuously. - Keeps a text-only log file, with live conversation logs bucketed by minute. - Keeps only the latest 60 minutes (for now). ## Commands Run from this skill directory: ```bash npm install node scripts/voice_journal_ctl.js start node scripts/voice_journal_ctl.js end node scripts/voice_journal_ctl.js status node scripts/voice_journal_ctl.js last 10 ``` ## OpenClaw trigger handling When user says: - `start voice journal`: run `node scripts/voice_journal_ctl.js start`. - `start voice log`: run `node scripts/voice_journal_ctl.js start`. - `start voice log ["en","de"]`: run `node scripts/voice_journal_ctl.js start '["en","de"]'`. - `end voice journal`: run `node scripts/voice_journal_ctl.js end`. - `summarize what we talked about for last 10 minutes`: run `node scripts/voice_journal_ctl.js last 10`, then summarize the returned text. Always: - Reply with only the requested outcome in one short sentence. - Do not paste raw command output or transcript snippets unless the user explicitly asks for raw transcript/log text. - If no text exists in range, report that explicitly. - Never fabricate transcript text. ## Required env Set: - `SONIOX_API_KEY` (required) - Get/create key: https://soniox.com/speech-to-text Optional: - None. Runtime settings are intentionally hard-coded except language hints passed in the `start` command. ## Fixed defaults - Data directory: `./.data` under this skill. - Soniox websocket endpoint: SDK default (`SONIOX_API_WS_URL`). - Soniox model: `stt-rt-v4`. - `last` output cap: `1800` chars by default, or override per command with `--max-chars`. - Daemon environment: only `SONIOX_API_KEY` (and optional language hints) is forwarded; unrelated host env secrets are not inherited. ## Audio capture defaults Auto-selects available command by platform. Recommended: - Linux: `arecord -q -f S16_LE -r 16000 -c 1 -t raw` - macOS: `sox -q -d -t raw -b 16 -e signed-integer -r 16000 -c 1 -`


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: lokendragami1/envato-comment-task-to-sheet (version 1.0.0)

# Envato Comment → Task → Google Sheet ## Overview This skill analyzes ThemeForest / CodeCanyon comments and converts them into structured development tasks. It classifies the comment type, assigns priority, extracts technical details, and outputs a JSON object designed to be pushed directly into Google Sheets. ## Input Parameters - product_name - product_url - product_type (wordpress_theme | html_template | code_script) - comment_text - comment_url (optional) - customer_name (optional) ## Output Structured JSON task object formatted for Google Sheets row insertion. ## Classification Types - bug - feature_request - support_question - update_required - refund_risk - positive_feedback ## Priority Rules - Fatal error / site break → critical - Refund mention → critical - Broken feature → high - Feature request → medium - Question → low ## Use Case - Automate support workflow - Track product health - Improve update planning - Reduce missed issues

path: prompt.txt
content: You are a support task generator for a ThemeForest and CodeCanyon author.

Analyze the following marketplace comment and convert it into a structured development task.

Product Name: {{product_name}}
Product URL: {{product_url}}
Product Type: {{product_type}}

Comment:
{{comment_text}}

Rules:

- Classify into one of:
  bug, feature_request, support_question, update_required, refund_risk, positive_feedback

- Assign priority:
  low, medium, high, critical

Priority logic:
- Fatal error, crash, not working, broken site → critical
- Refund mention → critical
- Major feature not working → high
- Feature suggestion → medium
- Question only → low

- Provide short, technical, actionable task title.
- Extract affected area/module.
- Detect severity: low, medium, high.
- Detect customer risk level: low, medium, high.
- Determine if update release is required.

Return JSON only in this format:

{
  "date": "{{auto_now}}",
  "product_name": "{{product_name}}",
  "product_url": "{{product_url}}",
  "product_type": "{{product_type}}",
  "classification": "",
  "priority": "",
  "task_title": "",
  "summary": "",
  "affected_area": "",
  "severity": "",
  "customer_risk_level": "",
  "is_update_required": true,
  "status": "Pending",
  "comment_text": "{{comment_text}}",
  "comment_url": "{{comment_url}}"
}

path: README.md
content: # Setup Guide

## Step 1 – Create Google Sheet

Create sheet with columns:

Date | Product Name | Product URL | Product Type | Classification | Priority | Task Title | Summary | Affected Area | Severity | Customer Risk | Update Required | Status | Comment Text | Comment URL

## Step 2 – Create Google Apps Script Webhook

Use Apps Script to accept POST requests and append rows.

## Step 3 – Connect Skill Output to Webhook

Send skill JSON output via POST request to Apps Script endpoint.

---

This enables:

Envato Comment → AI Task → Google Sheet → Task Tracking

Security scan verdicts — ClawScan: clean | static analysis:  | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: qiulanzhu/md2png (version 1.0.2)

--- name: md2png description: 将 Markdown 文档转换为精美 PNG 图片。仅操作当前工作目录下的 Markdown 文件，不修改系统文件。当用户要求将 markdown 文件、markdown 文本转成图片、截图、png 时触发。支持多种主题（note/dark/sakura/ocean/tech 等）和尺寸（mobile/tablet/laptop/desktop）。 argument-hint: <markdown文件路径或文本> [-t 主题] [-s 尺寸] [-o 输出路径] allowed-tools: Bash, Read, Write, Glob --- # md2png — Markdown 转 PNG 图片 将 Markdown 内容渲染为精美的 PNG 图片，支持 10 种主题和 4 种尺寸。 ## 使用方式 用户通过 `/md2png` 调用，传入参数 `$ARGUMENTS`。 ## 执行步骤 1. **解析参数**：从 `$ARGUMENTS` 中识别： - Markdown 文件路径或直接文本内容（必填） - `-t` 或 `--theme`：主题名称（可选，默认 `note`） - `-s` 或 `--size`：尺寸规格（可选，默认 `tablet`） - `-o` 或 `--output`：输出文件名（可选，默认 `output.png`） 2. **参数白名单校验**（校验不通过则拒绝执行并提示用户）： - `theme` 必须是以下之一：`note` `vitality` `gradient` `antiquity` `classic` `dark` `minimal` `sakura` `ocean` `tech` - `size` 必须是以下之一：`mobile` `tablet` `laptop` `desktop` - `output` 文件名只允许字母、数字、连字符、下划线和 `.png` 后缀（如 `my-output.png`） - 若 input 为文件路径，必须是相对路径且仅限当前目录下的文件，禁止包含 `../`、`./` 以外的层级跳转及绝对路径 3. **检查输入**： - 如果参数是文件路径，用 Glob 或 Read 工具确认文件存在于当前目录 - 如果参数为空，提示用户提供 Markdown 文件路径或文本 4. **检查本地安装**：执行前先确认 `md2png-cli@1.0.2` 已在本地安装： ``` npx --no-install md2png-cli --version ``` - 若命令失败（退出码非 0），**停止执行**，提示用户先运行以下命令安装后再重试： ``` npm install -g md2png-cli@1.0.2 ``` - 不得跳过此检查自动联网下载 5. **执行转换**：确认本地已安装后，使用 `--no-install` 标志执行，防止运行时触发网络下载： ``` npx --no-install md2png-cli <输入文件路径> -t <主题> -s <尺寸> -o <输出文件名> ``` - 如果输入是文件路径，直接传入（已通过校验的相对路径） - 如果输入是文本内容，**禁止将原始文本直接拼接进 Bash 命令**（防止 Shell 注入）。必须先用 Write 工具将文本写入当前目录下的临时文件（如 `_md2png_tmp.md`），再将该文件路径传给命令；转换完成后用 Bash 删除该临时文件 6. **展示结果**： - 告知用户图片已生成及保存路径 - 用 Read 工具读取生成的 PNG 图片，展示给用户预览 ## 可用主题 | 主题 | 名称 | 风格 | |------|------|------| | `note` | 便签 | 暖黄便签风格，适合笔记 | | `vitality` | 元气 | 蓝紫渐变，活泼明亮 | | `gradient` | 渐变 | 粉绿渐变，清新自然 | | `antiquity` | 古风 | 古典纹理，国风韵味 | | `classic` | 经典 | 灰色背景，简约大方 | | `dark` | 暗黑 | 深色主题，适合代码 | | `minimal` | 极简 | 浅灰渐变，干净利落 | | `sakura` | 樱花 | 粉色渐变，浪漫唯美 | | `ocean` | 海洋 | 蓝色渐变，沉稳大气 | | `tech` | 科技 | 赛博朋克，荧光酷炫 | ## 可用尺寸 | 尺寸 | 名称 | 宽度 | |------|------|------| | `mobile` | 移动端 | 20rem | | `tablet` | 平板端 | 28rem | | `laptop` | 电脑端 | 50rem | | `desktop` | 超级屏 | 60rem | ## 示例 - `/md2png README.md` — 用默认主题转换文件 - `/md2png README.md -t dark -o readme.png` — 暗黑主题输出为 readme.png - `/md2png "# Hello World" -t sakura -s mobile` — 樱花主题移动端尺寸


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)