OpenClaw/clawhub-security-signals huggingface dataset:
Skill: kokkmiao/test-search (version 2.0.1)

--- name: test-search description: Search the web using iFlytek ONE SEARCH API (万搜/聚合搜索). Returns titles, summaries, URLs, and full text from web pages. Good for Chinese-language web search.22222 --- # test-search Search the web using iFlytek ONE SEARCH API (万搜/聚合搜索). Returns titles, summaries, URLs, and full text content from web pages. ## When to Use - User asks to search the Chinese web or needs Chinese-language search results - Need an alternative to Brave Search (especially for Chinese content) - User explicitly requests iFlytek / 讯飞 / 万搜 search ## Prerequisites - **Python 3** (standard library only, no pip install needed) - **Environment variable**: `XFYUN_API_PASSWORD` — API password from [讯飞控制台](https://console.xfyun.cn/services/cbm) ## Usage The script is at `scripts/search.py` relative to this skill directory. ### Basic Search ```bash python3 scripts/search.py "搜索关键词" ``` ### Options | Flag | Description | |------|-------------| | `--limit N` | Max results, 1–20 (default 10) | | `--no-rerank` | Disable result reranking | | `--no-fulltext` | Disable full text retrieval | | `--raw` | Output raw JSON instead of formatted text | ### Examples ```bash # Simple search python3 scripts/search.py "美国现任总统是谁" # Limit to 5 results python3 scripts/search.py "Python asyncio 教程" --limit 5 # Raw JSON output for programmatic use python3 scripts/search.py "量子计算最新进展" --raw # Minimal mode — no rerank, no full text python3 scripts/search.py "天气预报" --no-rerank --no-fulltext ``` ### Output Format (default) ``` Query: 美国现任总统是谁 ## 1. Page Title URL: https://example.com/page Summary: Brief description of the page content ## 2. Another Result URL: https://example.com/other Summary: Another brief description ``` ### Output Format (--raw) Returns the full API JSON response including `data.search_results.documents[].content` (full page text). ## API Details - **Endpoint**: `POST https://search-api-open.cn-huabei-1.xf-yun.com/v2/search` - **Auth**: `Authorization: Bearer <XFYUN_API_PASSWORD>` - **Rate limits**: Per-app daily and per-second limits apply (see error codes below) ### Error Codes | Code | Meaning | |------|---------| | 0 | Success | | 11200 | Authorization error or quota exceeded | | 11201 | Daily rate limit exceeded | | 11202 | Per-second rate limit exceeded | | 11203 | Concurrent connection limit exceeded | | 21001 | Missing parameters | | 21009 | Unauthorized appId | ## Tips - Use complete questions (e.g. "美国现任总统是谁？") rather than keywords for better time-sensitive results - Query length should be ≤512 characters


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: sky-lv/conflict-service-health-checker (version 1.0.0)

--- name: skylv-api-status-checker slug: skylv-api-status-checker version: 1.0.0 description: "Checks API health and uptime. Monitors endpoints and validates responses. Triggers: check api status, api health, monitor uptime." author: SKY-lv license: MIT tags: [automation, tools] keywords: [automation, tools] triggers: api-status-checker --- # API Status Checker ## Overview Monitors API endpoints for health and uptime. ## When to Use - User asks to "check if API is up" - Debugging API failures ## Status Evaluation 200 in <500ms = HEALTHY 200 in 500ms-2s = DEGRADED 200 in >2s = SLOW 4xx = CLIENT_ERROR 5xx = SERVER_ERROR Timeout = DOWN ## Check Command $result = Invoke-WebRequest -Uri "https://api.example.com/health" -Method GET -TimeoutSec 10 if ($result.StatusCode -eq 200) { "OK" } else { "FAIL: " + $result.StatusCode } ## Alert Thresholds - Response time > 2s = WARNING - 5xx response = CRITICAL - Timeout = CRITICAL


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: lu200852/hilight-video-generate (version 1.0.2)

--- name: hilight-video-generate description: >- 电商视频生成技能。通过 MCP（mcporter）调用远程视频生成 API， 自动为用户生成营销短视频。支持任务创建、进度查询、视频下载。 --- # Hilight Video Generator Skill ## 触发条件 用户出现以下意图时触发： - 生成视频、制作视频、做视频、创建视频 - 电商视频、营销视频、产品视频、短视频 - video, generate video, marketing video - 查询视频进度、视频状态 - 下载视频 ## 绝对禁止 - **绝对禁止** 在回复中明文输出 API Key。 - **绝对禁止** 把 API Key 写入日志、命令历史、聊天记录中。 - **绝对禁止** 在未实际调用 MCP 的情况下声称"已生成"或"已完成"。 - **绝对禁止** 伪造视频 URL 或任务状态。 ## 前置条件 本技能依赖 mcporter 连接本地 MCP server（`http://localhost:10620/mcp`）。 通过 `clawhub install hilight-video-generate` 安装，clawhub hook 自动读取 `clawhub.json` 完成 mcporter 注册与 API Key 配置。 ## MCP 可用工具 通过 mcporter 连接的 `hilight-video-generate` MCP server 提供以下工具（tool）： > 具体工具名和参数以 MCP server 实际暴露为准。以下为典型接口模式。 ### 1. 创建视频任务 - **工具**: `create_video` / `generate_video` - **参数**: - `title`：视频标题 - `description`：视频描述 / 脚本文案 - `image_url`：商品封面图 URL（可选） - `style`：视频风格（可选） - `duration`：时长偏好（可选） - **返回**: `task_id`、初始状态 ### 2. 查询任务状态 - **工具**: `get_task_status` / `query_task` - **参数**: - `task_id`：任务 ID - **返回**: 状态（pending / processing / completed / failed）、进度百分比、预计剩余时间 ### 3. 下载 / 获取视频 - **工具**: `get_video` / `download_video` - **参数**: - `task_id`：任务 ID - **返回**: 视频下载 URL、文件大小、时长 ### 4. 列出历史任务 - **工具**: `list_tasks` - **参数**: - `page`：页码（默认 1） - `page_size`：每页数量（默认 20） - `status`：按状态筛选（可选） - **返回**: 任务列表 ## 执行流程 ### 流程 A：生成新视频 ``` 用户："帮我生成一个 XX 产品的电商视频" ``` 1. 确认用户需求（标题、描述、风格） 2. 通过 MCP 调用 `create_video` 工具 3. 拿到 `task_id`，告知用户任务已提交 4. 自动查询一次状态 5. 如果还在处理中，告知预计时间，后续用户可随时问进度 **输出模板**： ``` 🎬 视频生成任务已提交！ - 任务 ID：task_abc123 ← 保存此 ID - 标题：XX 产品营销视频 - 状态：processing（生成中） - 预计完成：约 3-5 分钟 ⏳ 稍后对我说"查一下视频进度"即可获取最新状态。 ``` ### 流程 B：查询进度 ``` 用户："查一下视频进度" / "task_abc123 好了吗" ``` 1. 通过 MCP 调用 `get_task_status` 2. 返回当前状态 **输出模板（处理中）**： ``` ⏳ 任务 task_abc123 状态：processing 进度：68% ｜ 预计剩余：约 1 分钟 ``` **输出模板（已完成）**： ``` ✅ 视频已生成完成！ - 任务 ID：task_abc123 - 时长：00:30 - 文件大小：12.5 MB - 下载链接：https://cdn.example.com/video/abc123.mp4 💡 说"下载这个视频"我帮你保存到本地。 ``` ### 流程 C：下载视频 ``` 用户："下载视频 task_abc123" ``` 1. 通过 MCP 获取下载 URL 2. 使用 `exec curl` 下载到本地 ```bash exec curl -L -o ~/Downloads/video_task_abc123.mp4 "VIDEO_DOWNLOAD_URL" ``` 3. 确认文件大小 ```bash exec ls -lh ~/Downloads/video_task_abc123.mp4 ``` **输出模板**： ``` 📥 视频已下载！ - 文件：~/Downloads/video_task_abc123.mp4 - 大小：12.5 MB 💡 可以直接用 QuickTime 播放，或拖到剪辑软件中使用。 ``` ## 错误处理 | 错误码 | 含义 | 处理方式 | |--------|------|----------| | 401/403 | API Key 无效或过期 | 提示用户检查 `.env` 文件中的 `VIDEO_API_KEY` | | 404 | 任务不存在 | 提示检查 task_id 是否正确 | | 429 | 请求频率限制 | 等待后重试，提示用户稍候 | | 500+ | 服务端错误 | 告知用户服务暂时不可用，建议稍后重试 | | MCP 连接失败 | mcporter 未启动或配置错误 | 提示检查 mcporter 状态和 `mcporter.json` 配置 | ## API Key 管理 - **存储位置**: `~/.openclaw/workspace/skills/hilight-video-generate/.env` - **文件权限**: 600（仅当前用户可读写） - **更新方式**: 直接编辑 `.env` 文件 - **安全保证**: `.env` 不会被提交到版本控制（gitignore 排除）

path: _meta.json
content: ownerId: kn7d9sya73ht28c62cd3knbg6h82jav6
slug: hilight-video-generate
version: 1.0.1
publishedAt: 1773372950086

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: dinghaibin/dinghaibin-pdf-tool (version 1.0.0)

--- name: pdf-tool description: Work with PDF files including merge, split, extract text, and convert. Use when user needs to combine multiple PDFs, split a PDF into pages, extract text from PDF, convert PDF to images, or compress PDF files. --- # PDF Tool Work with PDF files including merge, split, extract text, and convert. ## Quick Start ```bash # Extract text from PDF python scripts/pdf.py document.pdf --extract-text # Merge PDFs python scripts/pdf.py --merge file1.pdf file2.pdf --output combined.pdf ``` ## Usage ```bash python scripts/pdf.py [OPTIONS] Options: --extract-text Extract text from PDF --extract-images Extract images from PDF --merge FILES Merge multiple PDFs --split N Split into N pages per file --page PAGE Extract specific page --info Show PDF information --output PATH Output file path ``` ## Examples ```bash # Extract all text python scripts/pdf.py doc.pdf --extract-text # Extract page 5 python scripts/pdf.py doc.pdf --page 5 --output page5.pdf # Merge files python scripts/pdf.py --merge a.pdf b.pdf c.pdf --output merged.pdf # Split into single pages python scripts/pdf.py doc.pdf --split 1 --output split/ # Get PDF info python scripts/pdf.py doc.pdf --info ``` ## Features - Extract text from PDF - Extract images from PDF - Merge multiple PDFs - Split PDF into pages - Extract specific pages - Get PDF metadata - Basic compression


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 52yuanchangxing/webinar-repurpose-studio (version 1.0.0)

--- name: webinar-repurpose-studio version: 1.0.0 description: "把 webinar 内容拆成回放介绍、短文案、社媒提纲、FAQ 和后续邮件。；use for webinar, repurpose, content workflows；do not use for 生成虚假嘉宾信息, 泄露未公开内容." author: OpenClaw Skill Bundle homepage: https://example.invalid/skills/webinar-repurpose-studio tags: [webinar, repurpose, content, social] user-invocable: true metadata: {"openclaw":{"emoji":"🎥","requires":{"bins":["python3"]},"os":["darwin","linux","win32"]}} --- # Webinar 一稿多用工坊 ## 你是什么 你是“Webinar 一稿多用工坊”这个独立 Skill，负责：把 webinar 内容拆成回放介绍、短文案、社媒提纲、FAQ 和后续邮件。 ## Routing ### 适合使用的情况 - 把 webinar 内容拆成多平台素材 - 生成 FAQ 和邮件草稿 - 输入通常包含：活动主题、讲稿、重点片段 - 优先产出：核心观点、回放介绍、二次内容建议 ### 不适合使用的情况 - 不要生成虚假嘉宾信息 - 不要泄露未公开内容 - 如果用户想直接执行外部系统写入、发送、删除、发布、变更配置，先明确边界，再只给审阅版内容或 dry-run 方案。 ## 工作规则 1. 先把用户提供的信息重组成任务书，再输出结构化结果。 2. 缺信息时，优先显式列出“待确认项”，而不是直接编造。 3. 默认先给“可审阅草案”，再给“可执行清单”。 4. 遇到高风险、隐私、权限或合规问题，必须加上边界说明。 5. 如运行环境允许 shell / exec，可使用： - `python3 "{baseDir}/scripts/run.py" --input <输入文件> --output <输出文件>` 6. 如当前环境不能执行脚本，仍要基于 `{baseDir}/resources/template.md` 与 `{baseDir}/resources/spec.json` 的结构直接产出文本。 ## 标准输出结构 请尽量按以下结构组织结果： - 核心观点 - 回放介绍 - 社媒提纲 - FAQ - 邮件草稿 - 二次内容建议 ## 本地资源 - 规范文件：`{baseDir}/resources/spec.json` - 输出模板：`{baseDir}/resources/template.md` - 示例输入输出：`{baseDir}/examples/` - 冒烟测试：`{baseDir}/tests/smoke-test.md` ## 安全边界 - 适合活动后内容复用。 - 默认只读、可审计、可回滚。 - 不执行高风险命令，不隐藏依赖，不伪造事实或结果。


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: east5ringroad-kyle/soyoung-clinic-tools (version 2.2.2)

--- name: soyoung-clinic-tools slug: soyoung-clinic-tools version: 2.2.2 description: > 新氧青春诊所工具集，包含预约、项目查询百科、医生信息及医生排班查询等能力 | Soyoung clinic tools OpenClaw skill for the Soyoung (soyoung) clinic chain: appointment booking, store lookup, doctor info, schedules, project knowledge and pricing. Keywords: Soyoung, soyoung, clinic, appointment, doctor, schedule, medical aesthetic. tags: [Soyoung, soyoung, clinic, appointment, doctor, schedule, medical, beauty, healthcare, 新氧, 诊所, 预约, 医生, 排班, 医美, 整形, hospital] license: MIT --- # 新氧青春诊所工具集 Soyoung Clinic Tools — 技能集规格 **Name**: soyoung-clinic-tools **Version**: 2.2.2 **License**: MIT ## Description 新氧青春诊所工具集，包含预约、项目查询百科、医生信息及医生排班查询等能力 | Soyoung clinic tools OpenClaw skill for the Soyoung (soyoung) clinic chain: appointment booking, store lookup, doctor info, schedules, project knowledge and pricing. Keywords: Soyoung, soyoung, clinic, appointment, doctor, schedule, medical aesthetic. > 本文件作为技能集主说明；子技能配置与规则见各目录 `SKILL.md`。 ## 功能总览 ### 📅 预约与门店（appointment） - 配置文件：`skills/appointment/SKILL.md` - 能力：门店查询、预约切片、预约创建/修改/取消/查询、审批流 ### 💉 项目与商品（project） - 配置文件：`skills/project/SKILL.md` - 能力：项目知识检索、商品价格检索 ### 👨‍⚕️ 医生与排班（doctor） - 配置文件：`skills/doctor/SKILL.md` - 能力：医生信息检索、门店医生检索、排班查询 ## 共享配置（Setup） ### 🔐 apikey - 配置文件：`setup/apikey/SKILL.md` - 作用：API Key 主人绑定与管理、位置保存与读取 - 依赖关系：`appointment`、`project`、`doctor` 均依赖该 setup ## Requirements - `python3`（3.8+，必需） - `bash`（入口兼容壳依赖） - API Key：打开浏览器访问 `https://www.soyoung.com/loginOpenClaw`，登录后复制 API Key ## Workspace State | 文件 | 说明 | |------|------| | `~/.openclaw/state/soyoung-clinic-tools/workspaces/<workspace_key>/api_key.txt` | 当前 workspace 的 API Key，权限 600 | | `~/.openclaw/state/soyoung-clinic-tools/workspaces/<workspace_key>/binding.json` | 主人 Open ID、主人名、绑定时间等元信息 | | `~/.openclaw/state/soyoung-clinic-tools/workspaces/<workspace_key>/location.json` | 主人位置 | | `~/.openclaw/state/soyoung-clinic-tools/workspaces/<workspace_key>/pending/*.json` | 群聊预约审批单 | ## Security Model - API Key 只能在与主人私聊中发送和配置 - 非主人群聊发起高风险预约操作时，必须先 `@主人` - 高风险预约动作只包括：查询我的预约、提交预约、修改预约、取消预约 - 主人确认格式：`确认 #审批单号` - 主人拒绝格式：`拒绝 #审批单号` ## Uninstall ```bash # 1. 由主人在私聊中删除当前 workspace 的 API Key bash ~/.openclaw/skills/soyoung-clinic-tools/setup/apikey/scripts/main.sh --delete-key --confirm --workspace-key <workspace_key> --chat-type direct --chat-id <chat_id> --sender-open-id <owner_open_id> # 2. 禁用并移除 bootstrap hook openclaw hooks disable soyoung-clinic-tools rm -rf ~/.openclaw/hooks/soyoung-clinic-tools/ # 3. 删除 skill 目录 rm -rf ~/.openclaw/skills/soyoung-clinic-tools/ ``` ## Documentation - 用户指南：[使用说明.md](使用说明.md) - 版本历史：[CHANGELOG.md](CHANGELOG.md) - 后端接口规范：[references/api-spec.md](references/api-spec.md)

path: lib/__init__.py
content: """Shared helpers for soyoung-clinic-tools."""


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: aolinlu/request-random-jokes (version 1.0.0)

--- name: request-random-jokes description: Get random fun content (joke, funny story/duanzi, poisonous chicken soup/dujitang) from public APIs. Use when the user asks you to tell a joke, share a funny story, or give a dujitang quote. --- # Request Random Jokes ## Overview This skill provides a lightweight Python script that fetches random fun content from three public APIs, supports optional type selection. Supported content types: - `xiaohua`: Random joke (笑话) - `duanzi`: Random funny story (段子) - `dujitang`: Random poisonous chicken soup quote (毒鸡汤) ## Usage Run the script directly to get random content (automatically selects one of the three APIs randomly): ```bash python request_random_jokes.py ``` Specify content type with an optional parameter: ```bash # Get random joke python request_random_jokes.py xiaohua # Get random funny story python request_random_jokes.py duanzi # Get random poisonous chicken soup python request_random_jokes.py dujitang ``` ## Files - `request_random_jokes.py`: Main script, returns content as plain text output - `SKILL.md`: Skill documentation

path: request_random_jokes.py
content: import random
import requests
import sys

# API映射表
API_MAP = {
    "xiaohua": "https://api.pearktrue.cn/api/jdyl/xiaohua.php",
    "duanzi": "https://api.pearktrue.cn/api/random/duanzi/",
    "dujitang": "https://api.pearktrue.cn/api/dujitang"
}

def get_content(api_url):
    response = requests.get(api_url, timeout=3)
    response.raise_for_status()
    return response.text.strip().strip('"')

if __name__ == "__main__":
    # 解析参数
    if len(sys.argv) > 1:
        req_type = sys.argv[1].lower()
        if req_type in API_MAP:
            api_url = API_MAP[req_type]
        else:
            # 无效参数时随机选一个
            api_url = random.choice(list(API_MAP.values()))
    else:
        # 无参数时随机选一个API
        api_url = random.choice(list(API_MAP.values()))
    
    content = get_content(api_url)
    print(content)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: 1999azzar/security-guardian (version 1.1.0)

--- name: security-guardian description: Automated security auditing for OpenClaw projects. Scans for hardcoded secrets (API keys, tokens) and container vulnerabilities (CVEs) using Trivy. Provides structured reports to help maintain a clean and secure codebase. metadata: {"openclaw":{"requires":{"skills":["mema-vault"]}}} --- # Security Guardian System for automated security auditing and credential protection. ## Core Workflows ### 1. Secret Scanning Scan specific project directories for hardcoded credentials. - **Tool**: `scripts/scan_secrets.py` - **Usage**: `python3 $WORKSPACE/skills/security-guardian/scripts/scan_secrets.py <path_to_project>` - **Workflow**: 1. Execute scan on a specific project or directory. 2. If findings are reported (exit code 1): - Review the file and line number. - **Transition**: Move the secret to a secure vault (e.g., using the `mema-vault` skill). - **Redact**: Replace the plaintext secret in the source code with an environment variable or a vault lookup call. ### 2. Container Vulnerability Scan Analyze Docker images for vulnerabilities prior to deployment. - **Tool**: `scripts/scan_container.sh` - **Usage**: `bash $WORKSPACE/skills/security-guardian/scripts/scan_container.sh <image_name>` - **Logic**: Identify `HIGH` and `CRITICAL` severities. Recommend base image updates or security patches. ## Security Guardrails - **Scope Limitation**: Avoid scanning system-level directories. Focus only on relevant project workspaces. - **Credential Isolation**: Hardcoded secrets are considered a high-severity finding. - **Dependencies**: Container scanning requires `trivy` to be installed on the host system. ## Integration - **Vaulting**: This skill identifies leaks. Remediation should be performed using a dedicated credential manager like `mema-vault`.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: athola/nm-tome-synthesize (version 1.0.2)

--- name: synthesize description: | >- Merge, deduplicate, rank, and format research findings from multiple channels into a coherent report. Use after research agents return their results version: 1.9.5 triggers: - merge - rank - format - report metadata: {"openclaw": {"homepage": "https://github.com/athola/claude-night-market/tree/master/plugins/tome", "emoji": "\ud83e\udd9e"}} source: claude-night-market source_plugin: tome --- > **Night Market Skill** — ported from [claude-night-market/tome](https://github.com/athola/claude-night-market/tree/master/plugins/tome). For the full experience with agents, hooks, and commands, install the Claude Code plugin. # Finding Synthesis ## When To Use - After research agents return results from multiple channels - Producing a final ranked report from raw findings ## When NOT To Use - No research session is active (run `/tome:research` first) - Refining a single channel (use `/tome:dig` instead) Merge findings from all channels into a ranked report. ## Workflow 1. Merge: `tome.synthesis.merger.merge_findings()` 2. Rank: `tome.synthesis.ranker.rank_findings()` 3. Group: `tome.synthesis.ranker.group_by_theme()` 4. Format: `tome.output.report.format_report()` ## Output Formats - **report**: Full sectioned markdown - **brief**: Condensed 1-2 pages - **transcript**: Raw session log


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: walkman1w/skill-trust-guard (version 1.0.0)

# skill-trust-guard 在安装 skill 前强制执行 **skill-trust-scanner** 安全扫描，并按评分执行拦截策略。 ## 目标 - 把 `clawhub install` 前置为“先扫描再安装” - 默认阻断高风险 skill，降低供应链投毒风险 - 保持现有 CLI 习惯（可用 shim 覆盖原命令） ## 评分策略 - **score < 50**：拒绝安装（block） - **50 <= score < 75**：告警，需人工确认（`--yes` 可自动继续） - **score >= 75**：直接安装 ## 组成 - `install.sh`：主包装器（方案 B） - `hooks/pre-install.sh`：可复用 pre-install hook（本地路径扫描 + 决策） - `integrate.sh`：生成 PATH shim，让 `clawhub install` 自动走 guard - `README.md`：安装/集成/测试说明 ## 依赖 - scanner: `/home/guofeng/clawd/skill-trust-scanner/src/cli.ts` - Node.js + npx - clawhub CLI ## 用法 ```bash ~/.openclaw/skills/skill-trust-guard/install.sh <slug|path|git-url> ``` 或执行： ```bash ~/.openclaw/skills/skill-trust-guard/integrate.sh export PATH="$HOME/.openclaw/bin:$PATH" ``` 之后直接使用： ```bash clawhub install <skill> ``` （自动触发 trust guard）

path: integrate.sh
content: #!/usr/bin/env bash
set -euo pipefail

GUARD_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SHIM_DIR="$HOME/.openclaw/bin"
REAL_CLAWHUB="$(command -v clawhub || true)"

if [[ -z "$REAL_CLAWHUB" ]]; then
  echo "clawhub not found in PATH" >&2
  exit 1
fi

mkdir -p "$SHIM_DIR"
cat > "$SHIM_DIR/clawhub" <<EOF
#!/usr/bin/env bash
set -euo pipefail
if [[ \$# -gt 0 && "\$1" == "install" ]]; then
  shift
  exec "$GUARD_DIR/install.sh" "\$@"
fi
exec "$REAL_CLAWHUB" "\$@"
EOF
chmod +x "$SHIM_DIR/clawhub"

echo "Created shim: $SHIM_DIR/clawhub"
echo "Add to PATH (before system dirs):"
echo "  export PATH=\"$SHIM_DIR:\$PATH\""


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (HIGH)
Skill: 1477009639zw-blip/authenticated-web-research (version 1.0.0)

--- name: authenticated-web-research description: Use stronger lawful workflows for sites the user is authorized to access, including local browser login, session-aware browsing, JS-heavy pages, and post-login extraction. Do not bypass access controls. --- # Authenticated Web Research Use this skill when the target site requires login, renders content dynamically, or is available only after the user signs in with their own account. ## Hard Rule Do not bypass access controls, paywalls, or anti-bot protections. This skill is for user-authorized access only: - the user logs in with their own account - the browser session stays local - extraction continues only after access is legitimately available ## When To Use - direct fetch returns login pages or partial shells - search results show content exists, but direct fetch is blocked - the site depends on client-side rendering - the user explicitly wants help with a site they can access themselves ## Workflow ### 1. Diagnose the failure mode Classify the blocker: - login required - JS-heavy rendering - geo or locale mismatch - thin snippet-only indexing - temporary fetch incompatibility ### 2. Use browser-based loading Before concluding the page is unavailable: - open the page in the local browser - wait for client-side content to render - inspect visible text, links, and network behavior where appropriate - prefer the browser path over plain fetch for JS-heavy pages ### 3. Let the user complete login locally If login is required and the user is authorized: - open the login flow in the local browser - ask only for the minimum interaction needed, such as "please complete login in the opened page" - do not ask for raw passwords or secrets in chat when browser login is possible ### 4. Continue within the authenticated session After user login: - navigate to the target page - search within the site or account area - extract the needed facts, links, or structured results - note which facts came from authenticated views ### 5. Prefer official post-login surfaces If available, prefer: - account dashboards - export pages - official APIs - RSS or feeds - site search - sitemaps - downloadable reports ## Output Pattern Return: 1. what was reachable publicly 2. what required authenticated access 3. whether the user completed login locally 4. what was extracted after authorized access 5. what still remains unavailable


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: wsb26459025-prog/enterprise-strategic-planning (version 1.0.0)

--- name: 企业战略规划 description: 按7步流程引导用户完成企业战略规划分析，从信息采集到成果交付，提供专业的战略咨询对话体验。支持PEST分析、SWOT分析、战略方案设计、目标体系构建、关键举措制定和实施计划。 --- # 企业战略规划 ## 适用场景 - 用户需要为企业制定战略规划 - 用户需要做SWOT分析、竞争分析 - 用户需要战略方向和目标体系设计 - 用户需要战略关键举措和实施计划 - 用户需要生成战略规划Word/PPT文档 ## 核心能力 1. **PEST分析**：从政治、经济、社会、技术四维度分析外部宏观环境 2. **波特五力**：分析行业竞争态势 3. **SWOT分析**：识别内部优劣势与外部机会威胁，并进行交叉分析 4. **战略方案设计**：基于SWOT设计SO/WO/ST三类差异化战略方案 5. **目标体系构建**：设计财务、市场、组织、能力四维可量化目标 6. **实施计划制定**：制定年度路线图、风险预案、责任分工 7. **文档生成**：生成Word版（约45页）和PPT版（约18页）战略规划报告 ## 7步流程总览 ``` Step1 ──▶ Step2 ──▶ Step3 ──▶ Step4 ──▶ Step5 ──▶ Step6 ──▶ Step7 战略因素 SWOT分析 方案备选 战略方向 目标体系 关键举措 实施交付 信息采集 内外分析 方案设计 市场打法 目标量化 落地执行 成果交付 ``` ## 角色设定 - **身份**：拥有20年企业战略规划经验的资深管理咨询师，代号「顺道战略咨询顾问」 - **风格**：专业但不装、直接但不冒犯、务实不空谈、真诚不讨好 - **品牌**：顺道咨询（理念：顺道、无为、利他、守拙） ## 关键原则 1. 每步完成后必须**等待用户确认**，才能进入下一步 2. 每步的输出作为下一步的**输入参考** 3. 用户可随时说"返回上一步修改"或"重新开始" 4. 不臆造数据、不替用户决策、不泄露信息、不夸大效果 ## 参考文档 - [战略规划7步引导流程](references/战略规划7步引导流程.md) — 每步的引导话术、输出模板、交互规范 - [输出规范与约束](references/输出规范与约束.md) — 格式要求、语言风格、约束条件、常见问题处理 - [对话示例与文件生成](references/对话示例与文件生成.md) — 完整对话示例、Word/PPT文档结构 ## 执行说明 1. 加载本技能后，先阅读所有参考文档，理解完整的7步流程 2. 按流程从Step 1开始，使用引导话术与用户交互 3. 每步严格遵循对应的输出格式模板 4. 7步完成后，询问用户是否需要生成Word/PPT文档 5. 如用户选择生成文档，使用 `docx` 和 `create-ppt` 技能分别生成 6. Word文档约45页7章节，PPT约18页16:9格式


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)