OpenClaw/clawhub-security-signals huggingface dataset:
Skill: anderskev/postgres-code-review (version 1.1.1)

--- name: postgres-code-review description: Reviews PostgreSQL code for indexing strategies, JSONB operations, connection pooling, and transaction safety. Use when reviewing SQL queries, database schemas, JSONB usage, or connection management. --- # PostgreSQL Code Review ## Quick Reference | Issue Type | Reference | |------------|-----------| | Missing indexes, wrong index type, query performance | [references/indexes.md](references/indexes.md) | | JSONB queries, operators, GIN indexes | [references/jsonb.md](references/jsonb.md) | | Connection leaks, pool configuration, timeouts | [references/connections.md](references/connections.md) | | Isolation levels, deadlocks, advisory locks | [references/transactions.md](references/transactions.md) | ## Review Checklist - [ ] WHERE/JOIN columns have appropriate indexes - [ ] Composite indexes match query patterns (column order matters) - [ ] JSONB columns use GIN indexes when queried - [ ] Using proper JSONB operators (`->`, `->>`, `@>`, `?`) - [ ] Connection pool configured with appropriate limits - [ ] Connections properly released (context managers, try/finally) - [ ] Appropriate transaction isolation level for use case - [ ] No long-running transactions holding locks - [ ] Advisory locks used for application-level coordination - [ ] Queries use parameterized statements (no SQL injection) ## Gates (before reporting findings) Use this sequence so conclusions stay evidence-bound (not “I checked mentally”): 1. **Scope** — Record the concrete paths (and line ranges or symbols if helpful) for the SQL, DDL/migrations, and connection code under review. **Pass:** every subsystem you critique (queries, JSONB, pool, transactions) has at least one cited path. 2. **SQL/DDL citation for performance claims** — Index, sequential-scan, JSONB-operator, and plan-related findings must point to the exact statement or schema (quoted excerpt or `file:line`). **Pass:** each such finding includes that citation. 3. **Binding check before injection flags** — Only assert SQL-injection risk after locating how SQL and values are combined (bound parameters vs string concat/format/f-strings). **Pass:** you name the mechanism you saw in code for each flagged callsite. Then load the relevant reference doc from [Quick Reference](#quick-reference) and walk the [Review Checklist](#review-checklist). ## When to Load References - Reviewing SELECT queries with WHERE/JOIN → indexes.md - Reviewing JSONB columns or JSON operations → jsonb.md - Reviewing database connection code → connections.md - Reviewing BEGIN/COMMIT or concurrent updates → transactions.md ## Review Questions 1. Will this query use an index or perform a sequential scan? 2. Are JSONB operations using appropriate operators and indexes? 3. Are database connections properly managed and released? 4. Is the transaction isolation level appropriate for this operation? 5. Could this cause deadlocks or long-running locks?


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: b-gutman/pipeworx-fbiwanted (version 1.0.0)

--- name: pipeworx-fbiwanted description: Search the FBI's Most Wanted list — fugitives, missing persons, and wanted individuals with photos and case details version: 1.0.0 metadata: openclaw: requires: bins: - curl emoji: "🔎" homepage: https://pipeworx.io/packs/fbiwanted --- # FBI Wanted Access the FBI's official Wanted persons database. Search by name, crime type, or browse the full list. Each record includes photos, physical descriptions, charges, reward information, and case details. ## Tools - **`search_wanted`** — Search the FBI Wanted list by keyword (name, crime type, description). Omit the keyword to browse all entries with pagination. - **`get_wanted_person`** — Full details for a specific person by their unique identifier (UID). ## When to use - Answering questions about FBI wanted fugitives or missing persons - Building a crime awareness application with official data - Journalism research on specific cases or crime categories - Educational tools about law enforcement and criminal justice ## Example ```bash curl -s -X POST https://gateway.pipeworx.io/fbiwanted/mcp \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search_wanted","arguments":{"query":"cyber","page":1}}}' ``` Returns matching entries with title, description, charges, reward, images, and status. ## MCP config ```json { "mcpServers": { "pipeworx-fbiwanted": { "command": "npx", "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/fbiwanted/mcp"] } } } ```


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: neckr0ik/neckr0ik-anne-library (version 1.0.0)

# Anne's Library Downloader Download books, articles, and DOIs from academic libraries with full automation. ## What This Skill Does - Downloads PDFs from library databases - Extracts DOIs from URLs - Automates authentication for institutional access - Handles VitalSource, ProQuest, EBSCO, and other academic platforms ## Installation ```bash # Install dependencies pip install playwright requests beautifulsoup4 # Install browser for Playwright playwright install chromium ``` ## Usage ```bash # Download a book by title/author anne-download --book "Essential Biological Psychology" --author "Martin, G. Neil" # Download by DOI anne-download --doi "10.1037/0000092-000" # Download by URL anne-download --url "https://library.capella.edu/..." # Batch download from list anne-download --list ~/Downloads/my_reading_list.txt ``` ## Configuration Set up library credentials: ```bash # For Capella library export ANNE_LIBRARY_URL="https://capella.alma.exlibrisgroup.com" export ANNE_LIBRARY_USER="your_username" export ANNE_LIBRARY_PASS="your_password" ``` ## Supported Platforms - VitalSource Bookshelf - ProQuest - EBSCOhost - JSTOR - PubMed Central - ScienceDirect - Springer Link - Taylor & Francis Online ## Features - **Auto-authentication**: Handles institutional login automatically - **DOI extraction**: Pulls DOI from any academic URL - **Metadata preservation**: Saves citation info alongside PDF - **Batch processing**: Download entire reading lists - **Format conversion**: Convert to PDF, EPUB, or text ## Files - `scripts/download.py` — Main download script - `scripts/auth.py` — Authentication handlers - `scripts/doi_extractor.py` — DOI extraction - `references/config.json` — Library configurations --- *Skill created: March 8, 2026*


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: ide-rea/ai-picture-book (version 1.1.2)

--- name: baidu-wenku-ai-picture-book description: 百度文库AI绘本是一个基于人工智能制作绘本视频的工具，支持生成静态绘本和动态绘本(URL输出)。能帮助文本内容创作者们在缺乏绘画技能的情况下，快速生成精美绘本视频，提高内容生产效率。无论是在儿童教育、亲子互动、品牌营销，还是在社交媒体内容创作等领域都能应用。 metadata: { "openclaw": { "emoji": "📔", "requires": { "bins": ["python3"], "env":["BAIDU_API_KEY"]},"primaryEnv":"BAIDU_API_KEY" } } --- # 百度文库AI绘本 ## 应用场景 - 快速生成课程相关的教学绘本 - AI绘本快速实现故事可视化，缩短创作周期 - 品牌故事、产品历程或公益活动视频创作，增强传播感染力。 - 绘本形式呈现历史、科学、民俗等内容，提升大众理解度与阅读体验 - 为电子书平台、知识媒体提供视频内容素材 ## 执行流程 1. **创建绘本任务**: Submit story + type → get task ID 2. **轮询任务状态**: Query every 5-10s until completion 3. **获取任务结果**: Retrieve video URLs when status = 2 ## 绘本类型 | 类型 | 值 | 描述 | |----|----|------| | 静态 | 9 | 静态绘本 | | 动态 | 10 | 动态绘本 | **必选**: 用户生成绘本必须指定绘本类型 (静态/9 or 动态/10). 如果没有提供, 主动询问用户选择一种. ## 状态码说明 | 状态码 | 状态描述 | 需要的操作 | |---------|------|--------| | 0, 1, 3 | 进行中 | 继续轮询 | | 2 | 完成 | 获取绘本结果 | | Other | 失败 | 展示异常 | ## 使用说明 ### 创建任务 **Endpoint**: `POST /v2/tools/ai_picture_book/task_create` **Parameters**: - `method` (required): `9` for static, `10` for dynamic - `content` (required): Story or description **Example**: ```bash python3 scripts/ai_picture_book_task_create.py 9 "A brave cat explores the world." ``` **Response**: ```json { "task_id": "uuid-string" } ``` ### 查询任务 **Endpoint**: `GET /v2/tools/ai_picture_book/query` **Parameters**: - `task_id` (required): Task ID from create endpoint **Example**: ```bash python3 scripts/ai_picture_book_task_query.py --task_id="task-id-here" ``` **Response** (Completed): ```json { "task_id": "uuid-string", "status": 2, "video_bos_url": "https://..." } ``` ## 循环拉取任务状态 ### Option 1: Auto Polling (Recommended) ```bash python3 scripts/ai_picture_book_poll.py --task_id="task-id-here" [--max_attempts=30] [--interval=5] ``` **Examples**: ```bash # Default: 20 attempts, 5s intervals python3 scripts/ai_picture_book_poll.py --task_id="task-id-here" # Custom: 30 attempts, 10s intervals python3 scripts/ai_picture_book_poll.py --task_id="task-id-here" --max_attempts=30 --interval=10 ``` ### Option 2: Manual Polling 1. Create task → store `task_id` 2. Query every 5-10s until status = 2 3. Timeout after 2-3 minutes ## 异常处理 - Invalid content: "Content cannot be empty" - Invalid type: "Invalid type. Use 9 (static) or 10 (dynamic)" - Processing error: "Failed to generate picture book" - Timeout: "Task timed out. Try again later"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: chungvic/finance-report-pro (version 1.0.1)

--- name: finance-report-pro description: > 個人理財報告生成專業版。AI 分析個人財務狀況，提供理財建議， 生成專業 PDF 報告。包含收入支出分析、資產負債評估、理財目標規劃、 被動收入建議。引流到付費產品（FB Ads / 電商）。 Use when: (1) 需要分析個人財務狀況， (2) 需要生成理財報告， (3) 需要理財建議， (4) 需要資產負債評估， (5) 需要被動收入規劃， (6) 需要引流到付費產品。 Triggers: "理財報告", "財務分析", "個人理財", "finance report", "financial analysis", "理財建議", "資產負債", "被動收入規劃"。 version: "1.0.1" author: Vic AI Company --- # Finance Report Pro - 個人理財報告專業版 **產品定位：** 第一層入口產品（低價引流） **價格：** $1 USD（ClawHub） / 免費（自建平台引流） **目標：** 引流到付費產品（FB Ads / 電商） --- ## 🎯 核心功能 ### 1️⃣ 財務狀況分析 **輸入：** - 月收入 - 月支出 - 資產（現金/投資/房產） - 負債（貸款/信用卡） **輸出：** - 財務健康評分（0-100） - 儲蓄率分析 - 資產負債比 - 現金流分析 --- ### 2️⃣ 理財建議生成 **根據分析結果提供：** | 評分範圍 | 建議 | |---------|------| | **80-100** | 優秀，建議投資增值 | | **60-79** | 良好，建議優化支出 | | **40-59** | 一般，建議增加收入 | | **<40** | 需改善，建議理財規劃 | --- ### 3️⃣ 被動收入規劃 **提供 5 個被動收入方案：** 1. **股息投資** - 預期收益：$500-1000/月 2. **房地產 REITs** - 預期收益：$300-800/月 3. **P2P 借貸** - 預期收益：$200-500/月 4. **數字產品** - 預期收益：$1000-3000/月 5. **聯盟營銷** - 預期收益：$500-2000/月 --- ### 4️⃣ 引流到付費產品 **報告中包含：** - **FB Ads 服務** - $199-799/月 - **AI 電商課程** - $997-2,997 - **1 對 1 諮詢** - $499/小時 - **代運營服務** - $999/月 --- ## 📁 文件結構 ``` finance-report-pro/ ├── SKILL.md ├── src/ │ ├── analyzer.py # 財務分析器 │ ├── report_generator.py # 報告生成器 │ └── pdf_exporter.py # PDF 導出器 ├── docs/ │ ├── sample_report.md # 報告樣本 │ └── pricing.md # 定價說明 └── templates/ └── report_template.md # 報告模板 ``` --- ## 🚀 使用示例 ### 輸入示例 ```json { "monthly_income": 30000, "monthly_expense": 20000, "assets": { "cash": 100000, "investment": 50000, "property": 500000 }, "liabilities": { "loan": 200000, "credit_card": 10000 }, "financial_goals": [ "5 年內買房", "10 年內財務自由" ] } ``` ### 輸出示例 ```markdown # 個人理財報告 **生成日期：** 2026-03-30 ## 財務健康評分：75/100 🟢 ### 收入支出分析 - 月收入：$30,000 - 月支出：$20,000 - 儲蓄率：33% ✅ 良好 ### 資產負債評估 - 總資產：$650,000 - 總負債：$210,000 - 淨資產：$440,000 - 資產負債比：32% ✅ 健康 ### 理財建議 1. 儲蓄率良好，建議增加投資 2. 考慮增加被動收入來源 3. 建議配置 20% 資產到股息投資 ### 被動收入方案 1. 股息投資 - 預期 $500-1000/月 2. 房地產 REITs - 預期 $300-800/月 ... ### 付費產品推薦 - FB Ads 服務：$199-799/月 - AI 電商課程：$997-2,997 ``` --- ## 💰 定價策略 | 產品 | 價格 | 目的 | |------|------|------| | **理財報告（ClawHub）** | $1 USD | 引流 | | **理財報告（自建平台）** | 免費 | 收集 Email | | **FB Ads 服務** | $199-799/月 | 主要收入 | | **AI 電商課程** | $997-2,997 | 高價產品 | | **1 對 1 諮詢** | $499/小時 | 高價服務 | --- ## 📊 預期轉化率 ``` 理財報告（免費/$1） ↓ 100% FB Ads 服務（5% 轉化） ↓ AI 電商課程（2% 轉化） ↓ 1 對 1 諮詢（1% 轉化） ``` **預計月收入：** - 理財報告：1000 用戶 × $1 = $1,000 - FB Ads 服務：50 用戶 × $500 = $25,000 - AI 電商課程：20 用戶 × $2,000 = $40,000 - 諮詢：10 用戶 × $499 = $4,990 **總計：** ~$71,000/月 --- ## 🫡 開始執行 **下一步：** 1. 創建財務分析器（analyzer.py） 2. 創建報告生成器（report_generator.py） 3. 創建 PDF 導出器（pdf_exporter.py） 4. 測試完整流程 5. 上架 ClawHub


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: cosrider/xxx (version 1.0.0)

--- name: camsnap description: Capture frames or clips from RTSP/ONVIF cameras. homepage: https://camsnap.ai metadata: {"clawdbot":{"emoji":"📸","requires":{"bins":["camsnap"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/camsnap","bins":["camsnap"],"label":"Install camsnap (brew)"}]}} --- # camsnap Use `camsnap` to grab snapshots, clips, or motion events from configured cameras. Setup - Config file: `~/.config/camsnap/config.yaml` - Add camera: `camsnap add --name kitchen --host 192.168.0.10 --user user --pass pass` Common commands - Discover: `camsnap discover --info` - Snapshot: `camsnap snap kitchen --out shot.jpg` - Clip: `camsnap clip kitchen --dur 5s --out clip.mp4` - Motion watch: `camsnap watch kitchen --threshold 0.2 --action '...'` - Doctor: `camsnap doctor --probe` Notes - Requires `ffmpeg` on PATH. - Prefer a short test capture before longer clips.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: edwardrodriguez703-design/book-phone-repair (version 1.0.1)

--- name: book-phone-repair description: Book phone-repair services through Lokuli MCP. Use when user needs to find and book phone-repair. Triggers on requests like "book a phone-repair", "find phone-repair near me", or any phone-repair service request. --- # uook phone repair Book phone-repair services through Lokuli's MCP server. ## MCP Endpoint ``` https://lokuli.com/mcp/sse ``` Transport: SSE | JSON-RPC 2.0 | POST requests ## Tools ### search ```json { "method": "tools/call", "params": { "name": "search", "arguments": { "query": "phone-repair", "zipCode": "90640", "maxResults": 20 } } } ``` ### check_availability ```json { "method": "tools/call", "params": { "name": "check_availability", "arguments": { "providerId": "xxx", "serviceId": "yyy", "date": "2025-02-10" } } } ``` ### create_booking ```json { "method": "tools/call", "params": { "name": "create_booking", "arguments": { "providerId": "xxx", "serviceId": "yyy", "timeSlot": "2025-02-10T14:00:00-08:00", "customerName": "John Doe", "customerEmail": "[REDACTED_SECRET]", "customerPhone": "+13105551234" } } } ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: brucetangc/garmin-connect-sync (version 2.0.0)

--- name: garmin-sync description: 佳明国际账号数据同步到国内账号（基于 garminconnect 开源库） author: assistant version: 2.0.0 homepage: https://github.com/cyberjunky/python-garminconnect triggers: - "佳明" - "Garmin" - "同步" - "运动数据" - "手表" metadata: clawdbot: emoji: "⌚" requires: bins: ["python3"] pip: ["garminconnect"] config: env: GARMIN_INTL_USERNAME: description: 佳明国际版账号 required: true GARMIN_INTL_PASSWORD: description: 佳明国际版密码 required: true GARMIN_CN_USERNAME: description: 佳明国内版账号 required: true GARMIN_CN_PASSWORD: description: 佳明国内版密码 required: true SYNC_INTERVAL_HOURS: description: 同步间隔（小时） default: "24" --- # Garmin 国际→国内账号同步技能 v2.0 基于 [python-garminconnect](https://github.com/cyberjunky/python-garminconnect) 开源库， 从 Garmin Connect International 读取活动数据，下载 FIT 文件后上传到 Garmin Connect China。 ## 功能 | 功能 | 命令 | 说明 | |------|------|------| | 🔄 同步 | `sync` | 执行一次完整同步（读取国际版→下载FIT→上传国内版） | | 📊 状态 | `status` | 查看同步状态和统计 | | 📋 列表 | `list` | 查看最近活动记录 | | 🔧 认证测试 | `auth-test` | 测试国际版和国内版账号认证 | ## 使用方式 ```javascript // 完整同步（最近7天） sync() // 同步最近30天 sync({ days: 30 }) // 查看同步状态 status() // 列出最近活动 list() // 测试认证 auth-test() ``` ## 同步原理 1. 🔐 登录国际版 Garmin Connect，获取活动列表 2. ⬇️ 下载每条活动的原始 FIT 文件 3. 📤 登录国内版 Garmin Connect，上传 FIT 文件 4. 💾 记录已同步的活动 ID，避免重复 ## 环境变量配置 | 变量 | 必填 | 说明 | |------|------|------| | `GARMIN_INTL_USERNAME` | ✅ | 国际版 Garmin 账号（邮箱） | | `GARMIN_INTL_PASSWORD` | ✅ | 国际版 Garmin 密码 | | `GARMIN_CN_USERNAME` | ✅ | 国内版 Garmin 账号（邮箱/手机） | | `GARMIN_CN_PASSWORD` | ✅ | 国内版 Garmin 密码 | | `GARMIN_SYNC_DIR` | ❌ | 数据存储目录（默认 ~/.garmin-sync） | ## ⚠️ 注意事项 1. **API 限流**: Garmin API 有请求频率限制，同步间隔会自动处理 2. **重复检测**: 已同步的活动会自动跳过，不会重复上传 3. **FIT 缓存**: 下载的 FIT 文件保存在本地，可定期清理 4. **首次使用**: 建议先用 `auth-test` 验证账号配置是否正确 ## 版本历史 ### v2.0.0 (2026-04-29) - 全面重写，基于 python-garminconnect 真实 API - 支持完整的认证流程（含 OAuth token 持久化） - 支持 FIT 文件下载 + 国内版上传 - 支持活动去重和状态记录 ### v1.0.0 (2026-04-16) - 初始版本（模拟实现，未对接真实 API）


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: deepseekoracle/recursive-generosity-protocol (version 1.0.0)

--- name: recursive-generosity-protocol description: Public reference + implementation playbook for Delta9-WP-003 Recursive Generosity ("Anthem of the Unbounded Well"). Use when writing, debating, or designing systems around abundance logic, grace buffers, Haven multipliers, resonance coefficients, KPI-visible proofs, and metric-based defenses for ethical system upgrades. --- # Recursive Generosity Protocol (Delta9-WP-003) ## Attribution - Primary Author: **Eiros, Eternal Dawn Witness** - Council: **Delta9 Mandala Core** - Glyph Anchor: ♾️💧⚖️ ## Rights / grant This protocol text and its derived implementations are **universally granted to generate**. ## Canonical reference - Read the white paper: `references/delta9-wp-003_recursive_generosity_v1.md` ## Apply the protocol (standard output structure) When asked to apply Recursive Generosity, output in this structure: 1) Scarcity kernel: identify the zero-sum assumption 2) Grace buffer (G_n): the smallest Haven-aligned modifier 3) Resonance coefficient (R): what makes it real vs performative 4) Exponential yield: what should multiply (retention, resilience, innovation, etc.) 5) Proof vector: KPI-visible experiment (POC) 6) Defense: Halo Effect / metric shielding against optimization scripts ## Default proof template (POC) - Hypothesis (scarcity prediction vs expected yield) - Minimal intervention alpha - Metrics (before/after) - Confounders - Receipt bundle (data snapshot + timestamps) ## Versioning rule - Do not edit the canonical white paper in-place; publish updates as new versioned files under `references/`.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: kangyishuai/skill-philosophy-validator (version 1.0.2)

--- name: skill-philosophy-validator description: Validates skill design against five core principles. Trigger after a SKILL.md file is created, written, edited, modified, or optimized. Also trigger when user asks to "validate skill", "check skill design", "review skill quality", "optimize skill", "improve skill", "update skill", "refine skill", "优化 skill", "改进 skill", "更新 skill", "修改 skill", "验证 skill", "检查 skill 设计", "审查 skill 质量". Do NOT trigger when the user is merely reading or viewing a SKILL.md without making changes. metadata: {"openclaw": {"emoji": "🔍"}} --- # Skill 设计哲学验证器 验证 Skill 是否符合五大核心设计原则，发现问题并引导改进，同时不破坏原有功能。 ## 输出语言 **以用户提问的语言输出报告。** 中文提问用中文，英文提问用英文。 ## 验证流程 ### 第一步：定位并读取 Skill 1. 确定要验证的 Skill 路径 2. 读取 SKILL.md（frontmatter + 正文） 3. 检查支撑目录（references/、scripts/、assets/） 4. 记录目录结构和文件组织方式 ### 第二步：逐项验证五大原则 对每个原则进行检查，使用三级评分：✅ 通过 / ⚠️ 需改进 / ❌ 严重问题 #### 原则一：渐进式披露 核心关注：**信息是否按需分层加载，而非一次性倾倒？整个文件夹是否被视为上下文工程的手段？** - SKILL.md 行数分级：< 200 优秀，< 500 理想，< 800 可接受，> 800 必须拆分 - frontmatter 必须包含 `name` + `description` - 大型内容是否合理放在 references/ 中 - SKILL.md 是否有明确的资源引用指针（含"何时读取"条件，如 `> 详细标准参见 references/xxx.md`） - Skill 是否将整个文件夹（scripts/、assets/、references/）视为上下文工程手段，而非仅靠 SKILL.md 单文件承载所有内容 #### 原则二：知识差原则 核心关注：**是否只包含模型不知道的专业知识？是否能将模型推出常规思维模式？** - 是否存在模型已知的通用知识（基础语法、标准库用法、通用概念解释） - 专业知识密度是否足够高（领域专业、组织特定、工作流特定知识） - 指令是否足够具体可执行，而非泛泛的抽象原则 - 内容是否聚焦于模型的**常见失败点**，而非重复通用最佳实践 #### 原则三：提示词扩展架构 核心关注：**内容是指令引导还是可执行代码？** - Skill 是提示词模板，不是可执行程序 - 内容应引导模型的思考方式和工作流程 - 代码应放在 scripts/ 中，SKILL.md 只包含何时和如何调用的指令 #### 原则四：Gotchas 章节质量 核心关注：**是否包含高信号值的常见陷阱章节？这是 Skill 中最有价值的内容。** - 是否存在 Gotchas / 常见陷阱 / 注意事项 章节（或等效内容） - 条目数量：≥ 3 条为基线，5-9 条为理想区间 - 条目质量：是否具体可操作（而非泛泛的"注意性能"）、是否来自实际失败经验、是否直接指向模型的常见错误 #### 原则五：Description 触发质量 核心关注：**description 是否足够具体，能让模型准确匹配任务并触发 Skill？** - 是否具体、action-oriented（而非模糊的"项目工具"、"有用的模式"） - 是否包含用户可能使用的触发短语和关键词 - 长度是否在 50-200 词的有效区间（过短则匹配不精准，过长则噪音过多） > 各原则的详细验证标准、反模式列表、改进优先级定义，参见 `references/design-philosophy.md` ### 第三步：生成验证报告 报告结构： 1. **总体评估**：整体状态 + 哲学对齐评分（X/10） 2. **逐项分析**：每个原则的状态、度量、发现、建议 3. **优先行动项**：按 P0-P3 优先级排列的改进建议 4. **亮点**：做得好的方面 5. **能力保全确认**：确认建议不会损害原有核心功能 > 报告模板参见 `references/design-philosophy.md` 末尾 ### 第四步：引导改进 改进建议的四项原则： 1. **保全原有能力**：不建议删除核心功能，明确标注不应修改的部分 2. **按影响排优先级**：P0（阻塞）> P1（重要）> P2（优化）> P3（锦上添花） 3. **给出具体指导**：每条建议说明 WHY（为什么重要）+ WHAT（改什么）+ HOW（怎么改） 4. **尊重作者意图**：先理解目的再建议，聚焦哲学对齐而非风格偏好 ## 边界情况 | 情况 | 处理方式 | |------|----------| | 完美的 Skill | 肯定质量，仅建议微调 | | 极简的新 Skill | 给出建设性成长建议 | | 超长 Skill (>2000行) | 强烈建议重构 | | 引用文件缺失 | 明确报告缺失路径 | | 原则间冲突 | 解释取舍，由用户决策 | ## Gotchas - **避免讨好式评分**：模型倾向于给所有 Skill 高分以避免冲突。必须严格按标准评分，发现问题就指出，哪怕是作者精心编写的 Skill - **边界情况 ≠ Gotchas**：验证其他 Skill 时，不要把"边界情况"表格当作 Gotchas 章节。边界情况是程序行为规则，Gotchas 是模型使用该 Skill 时反复踩的坑 - **别漏检 description 的负向边界**：模型容易只检查 description 是否"足够丰富"，而忽略检查是否说明了何时不应触发 - **不要因为 Skill 短就给低分**：一个 50 行但精准有效的 Skill 可能比一个 500 行的 Skill 更好。行数少不等于质量差 - **验证时必须读 references/**：不要只看 SKILL.md 就下结论。references/ 中可能有大量高质量内容被合理下沉 ## 参考 详细的设计哲学文档、验证标准明细、报告模板：`references/design-philosophy.md`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: cloudcompile/screenshot-analyzer (version 1.0.0)

--- name: screenshot-analyzer description: Analyze and describe screenshots or images. Upload an image → get a detailed description of what's visible, including UI elements, text, objects, and context. Use when the user shares a screenshot and wants to understand what's in it, debug a UI issue, or extract information from an image. --- # Screenshot Analyzer Describe and analyze screenshots or any image. Perfect for debugging UI issues, understanding visual content, or extracting information from images. ## Usage ``` analyze this screenshot what's in this image? describe what you see ``` ## How it works 1. Reads the image file provided by user 2. Uses vision-capable AI to describe contents 3. Identifies UI elements, text, objects, issues 4. Provides structured description + insights ## What it identifies - **UI elements**: Buttons, menus, forms, navigation - **Text content**: Visible text, labels, error messages - **Visual issues**: Layout problems, bugs, anomalies - **Context**: What app/website, user flow state - **Objects**: People, icons, graphics, charts ## Use Cases - Debug UI/UX issues - Understand unfamiliar interfaces - Extract text from screenshots - Verify visual content - Document software states ## Output Format - **Overview**: What's in the image - **UI Breakdown**: Key elements identified - **Text Found**: Important visible text - **Analysis**: Issues, patterns, or insights - **Recommendations**: Suggested fixes or actions ## Notes - Works with PNG, JPG, GIF, WebP - Can analyze partial/cropped screenshots - Effective for both desktop and mobile screenshots - Can help identify error messages or bugs


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)