OpenClaw/clawhub-security-signals huggingface dataset:
Skill: edisonchenai/edison-autopilot-post-x (version 1.0.0)

# Edison Autopilot Post X AI-powered auto-tweeting system. Generates and posts 5 tweets per day to X using GPT-5.1, with Telegram notifications and built-in safeguards. Built entirely through **vibe coding** with Claude Code — zero lines of code written by hand. ## What It Does - Generates 5 tweets/day using GPT-5.1, matching your persona and voice - Posts automatically to X at scheduled times via cron - Sends Telegram notifications for every posted tweet - Checks last 10 tweets to avoid repetition - 3-layer character limit protection (target 220 → retry at 280 → hard reject) - Configurable banned phrases list to kill GPT filler - Explicit rules to prevent AI from fabricating data/statistics - Style variety — mixes formats (hot takes, questions, one-liners, stories) ## Setup ### 1. Install dependencies ```bash pip install tweepy requests ``` ### 2. Set environment variables ```bash export OPENAI_API_KEY="sk-..." export X_CONSUMER_KEY="..." export X_CONSUMER_SECRET="..." export X_ACCESS_TOKEN="..." export X_ACCESS_TOKEN_SECRET="..." # Optional: Telegram notifications export TWEET_BOT_TOKEN="..." export TWEET_BOT_CHAT_ID="..." ``` ### 3. Customize your persona Edit `auto_tweet.py` — update the `PERSONA`, `TOPICS`, and `BANNED_PHRASES` sections to match your voice, topics, and style. ### 4. Run ```bash python auto_tweet.py --dry-run # preview without posting python auto_tweet.py # post for real ``` ### 5. Schedule with cron (5x daily) ```bash crontab -e # Add: 0 8,11,14,17,21 * * * cd /path/to/repo && python auto_tweet.py ``` ## API Keys Required | Service | Cost | Where | |---------|------|-------| | X API (Basic) | $25/month | developer.x.com | | OpenAI API | ~$0.50/day | platform.openai.com | | Telegram Bot | Free | @BotFather on Telegram | ## Prompt Engineering Tips 1. **Study real people** — encode tweet styles you admire into the persona 2. **Ban the filler** — maintain a growing list of GPT's favorite empty phrases 3. **Never let AI make up numbers** — explicit "NEVER FABRICATE DATA" rule 4. **Force variety** — require different formats, tones, and structures 5. **Shorter is better** — target 140-220 chars, not 280


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: mykelio1001/submit-pr (version 1.0.2)

--- name: submit-pr description: 规范化 PR 提交工作流。当用户需要提交 PR 时使用，自动完成敏感信息扫描、文件范围确认、规范 commit 生成和 PR 创建 disable-model-invocation: true allowed-tools: Read, Grep, Glob, Bash(git status:*), Bash(git diff:*), Bash(git add:*), Bash(git commit:*), Bash(git push:*), Bash(git log:*), Bash(git branch:*), Bash(gh pr create:*), Bash(gh pr view:*) argument-hint: "[pr-title]" --- ## 当前上下文 - 当前分支：!`git branch --show-current` - 变更文件：!`git status --short` - 最近 commit：!`git log --oneline -5` ## 任务 提交 PR，标题：$ARGUMENTS 按以下流程逐步执行，**每个检查不通过时必须停止并告知用户**。 --- ## Step 1：敏感信息扫描 对所有待提交的变更文件执行扫描，检测以下模式： **私钥 / 助记词** ``` 0x[0-9a-fA-F]{64} # 以太坊私钥 [0-9a-fA-F]{64} # 裸十六进制私钥 PRIVATE_KEY\s*=\s*\S+ # 环境变量赋值 MNEMONIC\s*=\s*\S+ SECRET\s*=\s*\S+ ``` **API 密钥 / Token** ``` sk-[a-zA-Z0-9]{20,} # OpenAI / Anthropic key ghp_[a-zA-Z0-9]{36} # GitHub token [0-9a-f]{32} # 通用 32 位 hex token Authorization:\s*Bearer\s+\S+ ``` **敏感文件** - `.env`、`.env.*`（非 `.env.example`） - `*.pem`、`*.key`、`*.p12`、`keystore.json` 执行命令： ```bash git diff HEAD --name-only # 获取变更文件列表 git diff HEAD -- <file> # 逐文件检查内容 ``` **结果**： - 发现敏感信息 → **立即停止**，列出具体文件和行号，要求用户处理后重新触发 - 无敏感信息 → 继续 Step 2 --- ## Step 2：文件范围确认 列出所有变更文件，按类型分组展示： ``` 新增文件： + src/Foo.sol 修改文件： ~ src/Bar.sol ~ test/Bar.t.sol 删除文件： - src/Old.sol ``` 询问用户： > 以上文件是否都与本次功能相关？是否有需要排除或补充的文件？ **等待用户确认后**继续 Step 3。如有调整，执行： ```bash git add <confirmed-files> # 只暂存用户确认的文件 git restore --staged <excluded> # 移出不相关文件 ``` --- ## Step 3：生成 commit 信息 根据变更内容，生成符合以下规范的 commit message： ### 格式 ``` <type>(<scope>): <subject> [body - 可选，说明 why 而非 what，每行不超过 72 字符] ``` ### type 枚举 | type | 适用场景 | |------|---------| | `feat` | 新功能 | | `fix` | Bug 修复 | | `docs` | 文档变更 | | `refactor` | 重构（不影响功能） | | `test` | 测试相关 | | `chore` | 构建/工具/依赖 | | `perf` | 性能优化 | ### subject 规范 - **不超过 50 字符** - 动词开头，使用英文原形：add / fix / remove / update / refactor 等 - **全程使用英文，禁止出现中文字符** - 不加句号 - 说清楚"做了什么"，不写"update code"、"fix bug"这类无意义描述 ### 示例 ``` feat(vault): add reentrancy guard to withdraw fix(token): correct decimal calculation in transfer docs(readme): add skill usage guide ``` 向用户展示生成的 commit message，**确认后**执行提交： ```bash git commit -m "<confirmed message>" ``` --- ## Step 4：推送并创建 PR ```bash git push origin <current-branch> ``` 使用以下模板创建 PR： ```bash gh pr create \ --title "$ARGUMENTS" \ --body "$(cat <<'EOF' ## 变更内容 - <bullet points 说明主要改动> ## 测试 - [ ] 本地编译通过 - [ ] 相关测试通过 - [ ] 无敏感信息泄露 ## 关联 EOF )" ``` --- ## 输出模板 ``` ## PR 提交报告 **分支**：<branch-name> **标题**：<pr-title> **Commit**：<hash> <message> **敏感信息扫描**：✅ 通过 **文件范围**：✅ 已确认（共 N 个文件） **PR 链接**：<gh pr url> ``` --- ## 注意事项 - Step 1 发现敏感信息时**必须停止**，不得跳过 - Step 2 必须等用户明确确认文件列表，不得自动推断 - commit message **必须全程使用英文**，不得包含中文字符 - commit message **不得使用** AI 生成的模糊描述（"various improvements"、"update"等） - 不得 force push 到 main/master 分支


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kazuya-ecnu/ideas (version 1.0.0)

--- name: ideas description: 记录日常奇思妙想、灵感片段、技术创意。支持按主题分类、状态追踪、关键词搜索。 triggers: 想了个主意, 灵感, 创意, 记一下, 这个想法, 有个念头, 发现, 想法 version: 1.0.0 author: Akira license: MIT --- # ideas v1.0 - 奇思妙想记录 ## 数据文件（存放于 `~/.openclaw/workspace/ideas-data/`） - `~/.openclaw/workspace/ideas-data/ideas.json` — 创意记录列表 ## 数据格式 ```json { "ideas": [ { "id": "uuid", "content": "想法内容", "tags": ["标签1", "标签2"], "status": "pending | in_progress | done | dropped", "created_at": "YYYY-MM-DDTHH:mm:ss", "updated_at": "YYYY-MM-DDTHH:mm:ss" } ] } ``` ## 操作 1. **记录想法**：解析内容 → 提取标签 → 生成 ID → 追加到 ideas.json → 反馈已记录 2. **查看列表**：读取 ideas.json → 按时间倒序展示 → 支持筛选 pending/in_progress/done 3. **搜索想法**：按关键词搜索 content 和 tags 4. **更新状态**：找到对应想法 → 更新 status 和 updated_at 5. **删除想法**：软删除（标记 status 为 dropped）或彻底删除 ## 状态说明 - `pending` — 待处理（默认） - `in_progress` — 进行中 - `done` — 已完成 - `dropped` — 已放弃 ## 标签建议 技术、生活、产品、学习、投资、健康等 ## 注意事项 - 每个想法单独一条，content 尽量完整记录原始念头 - tags 自动提取或用户补充 - 按时间倒序展示，最新的在最前面


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: jincocodev/jarvis-ui (version 1.0.3)

--- name: jarvis-ui description: JARVIS-style HUD web interface for OpenClaw agents. Interactive Three.js orb with agent state visualization, real-time chat via Gateway WebSocket, audio spectrum analyzer, system monitor, and TTS. Use when you want a visual dashboard for your OpenClaw agent. metadata: {"openclaw":{"emoji":"🦾","version":"1.0.3","requires":{"bins":["node","npm"]},"homepage":"https://github.com/jincocodev/openclaw-jarvis-ui"}} --- # 🦾 JARVIS UI A JARVIS-style HUD interface for your OpenClaw agent. ## Install ```bash ./setup.sh ``` Gateway token is auto-detected from `~/.openclaw/openclaw.json`. > **⚠️ Remote/non-localhost access:** If JARVIS server is accessed from a different machine (not localhost), add this to your `~/.openclaw/openclaw.json`: > ```json > { "gateway": { "controlUi": { "allowInsecureAuth": true } } } > ``` > Then restart OpenClaw Gateway. Then start: ```bash node --env-file=.env server/index.js ``` Open `http://localhost:9999` ## Customize Copy and edit `config.local.json`: ```bash cp config.json config.local.json ``` | Field | Description | Default | |-------|-------------|---------| | `name` | Page title | JARVIS | | `agent.name` | Agent display name | JARVIS | | `agent.emoji` | Agent emoji | 🤖 | | `agent.sessionKey` | OpenClaw session key | agent:main:main | | `server.port` | Server port | 9999 | | `tts.voice` | macOS TTS voice | Samantha | ## Production ```bash npm i -g pm2 pm2 start server/index.js --name jarvis --node-args="--env-file=.env" pm2 save ``` ## Features - 🔮 Three.js orb — reacts to agent state (thinking/speaking/idle) - 💬 Real-time chat — Gateway WebSocket relay - 🎵 Audio visualizer — spectrum, ring, waveform - 📊 Model status — live token usage, model info - 🖥️ System monitor — CPU, memory, uptime - 🗣️ TTS — Edge TTS (free, cross-platform) + macOS `say` (offline) - 📱 Mobile responsive + PWA ## Requirements - Node.js 20+ - OpenClaw Gateway running locally - Python 3 + `edge-tts` (`pip install edge-tts`) for TTS - ffmpeg (optional, macOS `say` engine only)


Security scan verdicts — ClawScan: suspicious | static analysis:  | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: elvismusli/agentfin (version 1.0.0)

--- name: agentfin description: Issue virtual Visa/MC cards funded by USDT. Check balance, get card credentials, fetch OTP codes — all via REST API. version: 1.0.0 homepage: https://agentfin.tech metadata: {"openclaw":{"requires":{"env":["AGENTFIN_API_KEY"]},"primaryEnv":"AGENTFIN_API_KEY","emoji":"💳"}} --- # AgentFin — Virtual Cards for Agents You have access to the AgentFin API. Use it to check your balance, get virtual card credentials for online purchases, and fetch OTP codes for 3DS verification. ## Authentication All requests require a Bearer token. Use the `AGENTFIN_API_KEY` environment variable. ``` Authorization: Bearer $AGENTFIN_API_KEY ``` Base URL: `https://agentfin.tech/api` ## Endpoints ### Check Balance & Card Status ```bash curl -H "Authorization: Bearer $AGENTFIN_API_KEY" \ https://agentfin.tech/api/me ``` Response includes `balance` (USD string), `card` object with `maskedPan` and `status`, and `depositAddress` for USDT top-ups. ### Get Card Credentials (for online purchases) ```bash curl -H "Authorization: Bearer $AGENTFIN_API_KEY" \ https://agentfin.tech/api/cards/{cardId}/sensitive ``` Returns `pan`, `cvv`, `expiryMonth`, `expiryYear`, `cardHolderName`, `billingAddress`. Rate limited to 10 requests/minute. **Important:** Use the `cardId` from the `/api/me` response (`card.cardId` field). ### Fetch Latest OTP Code (for 3DS verification) ```bash curl -H "Authorization: Bearer $AGENTFIN_API_KEY" \ https://agentfin.tech/api/inbox/latest-otp ``` Returns the most recent email with extracted OTP codes. The `extractedCodes` field is an array of strings. Use the first element as the verification code. If a purchase triggers 3DS, wait 10-30 seconds for the OTP email to arrive, then call this endpoint. ### Top Up Card Balance ```bash curl -X POST -H "Authorization: Bearer $AGENTFIN_API_KEY" \ -H "Content-Type: application/json" \ -d '{"amount": 50, "currency": "USD"}' \ https://agentfin.tech/api/cards/{cardId}/topup ``` Moves funds from your account balance to the card. The card is prepaid — you cannot spend more than the loaded amount. ### View Transaction History ```bash curl -H "Authorization: Bearer $AGENTFIN_API_KEY" \ https://agentfin.tech/api/me/transactions ``` Returns all deposits, card charges, top-ups, and refunds. ## Typical Purchase Flow 1. Check balance with `GET /api/me` — ensure sufficient funds 2. Get card credentials with `GET /api/cards/{cardId}/sensitive` 3. Use PAN, CVV, expiry to fill in payment form on merchant site 4. If 3DS is triggered, wait ~15 seconds then `GET /api/inbox/latest-otp` 5. Submit the OTP code from `extractedCodes[0]` 6. Purchase complete ## Important Notes - The card is **prepaid**. You cannot spend more than the loaded balance. - Card credentials are rate-limited (10/min). Cache them for the duration of a purchase session. - OTP codes arrive via email to a dedicated inbox. There may be a 10-30 second delay. - Fund the account by sending USDT (TRC20) to the deposit address from `GET /api/me`.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: youjunzhao/a-share-claw (version 0.1.1)

--- name: a-share-claw description: A-share paper-trading automation workflow for MX APIs. Use when user asks to run scheduled A-share mock trading, enforce risk limits (single position cap, total exposure cap, stale-order cancellation), generate daily review, or maintain Day/Balance/Daily Return tracking. --- # A-Share Claw Execute this workflow for A-share paper trading with MX APIs. ## Steps 1. Ensure environment: - `MX_APIKEY` is set. - `MX_API_URL` defaults to `https://mkapi2.dfcfs.com/finskillshub`. 2. Ensure runtime files under workspace: - `mx_autotrade/config.json` - `mx_autotrade/run_autotrade.py` - `mx_autotrade/daily_review.py` 3. Ensure schedules (trading days): - `09:24` run strategy - `10:30` run strategy - `14:30` run strategy (risk-first) - `15:10` run daily review 4. Enforce risk rules: - Single symbol position cap (`maxPositionPerStock`, default 15%) - Total exposure cap (`maxTotalPosition`, default 60%) - Auto-cancel stale pending orders (>20 min) 5. Daily output: - Produce review JSON (`mx_autotrade/reviews/review-YYYY-MM-DD.json`) - Update README day table with: `Day | Balance | Daily Return` (no Day0) ## Quick run commands ```bash python3 mx_autotrade/run_autotrade.py python3 mx_autotrade/daily_review.py ``` ## Notes - Fail safely: if account is not bound, stop and report clearly. - Prefer discipline over trade frequency.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: evolinkai/web-research (version v3.0.2)

--- name: web-research description: Web search via EvoLink API. Returns clean, formatted results with titles, URLs, and descriptions. Powered by evolink.ai metadata: {"clawdbot":{"emoji":"🔍","requires":{"bins":["bash","curl","jq"],"env":["EVOLINK_API_KEY"]},"primaryEnv":"EVOLINK_API_KEY"}} --- # Web Search Assistant Web search using EvoLink API. Returns clean, formatted results with titles, URLs, and descriptions. Powered by [Evolink.ai](https://evolink.ai?utm_source=clawhub&utm_medium=skill&utm_campaign=web-search) ## When to Use Use this skill when users request: - Web searches for information or resources - Finding current or recent information online - Research requiring current web data - Fact-checking or verification using web sources - Gathering URLs and resources on a topic ## Search ```bash {baseDir}/scripts/search.sh "query" {baseDir}/scripts/search.sh "query" 20 ``` ## Options - `<query>`: Search query - `<max_results>`: Number of results (default: 10) ## Configuration Set your EvoLink API key: ```bash export EVOLINK_API_KEY="your-evolink-api-key-here" ``` 👉 [Get free API key](https://evolink.ai/signup?utm_source=clawhub&utm_medium=skill&utm_campaign=web-search) ## Example ```bash bash scripts/search.sh "Claude Opus 4 features" ``` Output: ``` 🔍 Searching: Claude Opus 4 features 📄 Claude Opus 4: New Features and Capabilities 🔗 https://example.com/opus-4 📝 Comprehensive guide to Claude Opus 4's new features... 📄 What's New in Claude Opus 4 🔗 https://example.com/whats-new 📝 Latest updates and improvements in Claude Opus 4... ``` ## Security **Credentials & Network** `EVOLINK_API_KEY` is required to call the EvoLink API. Your search queries are sent to `api.evolink.ai` for processing. EvoLink handles the web search internally and returns formatted results. **File Access** This skill does not read or write any files. **Network Access** This skill makes network requests to: - **EvoLink API** (`api.evolink.ai`) - to perform web searches All network calls are performed via curl and can be audited in the script source code. **Persistence & Privilege** This skill does not modify other skills or system settings. No elevated or persistent privileges are requested. ## Links - [GitHub](https://github.com/EvoLinkAI/web-research-skill-for-openclaw) - [API Reference](https://docs.evolink.ai/en/api-manual/language-series/claude/claude-messages-api?utm_source=clawhub&utm_medium=skill&utm_campaign=web-search) - [Community](https://discord.com/invite/5mGHfA24kn) - [Support](mailto:[REDACTED_SECRET])


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: iosif2321/groq-voice-transcriber (version 1.0.0)

# groq-voice-transcriber Автоматическая расшифровка голосовых сообщений через Groq Whisper API. ## Что делает - Перехватывает входящие аудио из Telegram - Расшифровывает через Groq Whisper API - Отправляет текст в LLM для ответа - Возвращает ответ пользователю ## Настройка 1. Установи зависимости: `pip install -r requirements.txt` 2. Создай `.env` с `GROQ_API_KEY` 3. Установи навык: `clawhub install ./skills/groq-voice-transcriber` ## Автор Создано для Андрея (Tr0n2321)

path: config.json
content: {
  "name": "groq-voice-transcriber",
  "version": "1.0.0",
  "description": "Голосовые сообщения через Groq Whisper API",
  "entry": "handler.py",
  "trigger": {
    "type": "audio",
    "channels": ["telegram"]
  },
  "env": {
    "GROQ_API_KEY": "required"
  }
}


path: handler.py
content: from groq import Groq
import os

class GroqVoiceTranscriber:
    def __init__(self):
        [REDACTED_SECRET]"GROQ_API_KEY", [REDACTED_SECRET])
        self.client = Groq([REDACTED_SECRET])
    
    def transcribe(self, audio_path: str, language: str = "ru") -> str:
        """Расшифровка аудио через Groq Whisper"""
        try:
            with open(audio_path, "rb") as file:
                transcription = self.client.audio.transcriptions.create(
                    file=(os.path.basename(audio_path), file.read()),
                    model="whisper-large-v3",
                    language=language
                )
            return transcription.text
        except Exception as e:
            return f"Ошибка расшифровки: {str(e)}"
    
    def get_response(self, text: str) -> str:
        """Получение ответа от Groq LLM"""
        try:
            response = self.client.chat.completions.create(
                messages=[
                    {"role": "system", "content": "Ты полезный ассистент. Отвечай кратко и по делу на русском языке."},
                    {"role": "user", "content": text}
                ],
                model="llama-3.1-8b-instant"
            )
            return response.choices[0].message.content
        except Exception as e:
            return f"Ошибка ответа: {str(e)}"
    
    def process_voice(self, audio_path: str) -> str:
        """Полный цикл: аудио → текст → ответ"""
        text = self.transcribe(audio_path)
        if text.startswith("Ошибка"):
            return text
        return self.get_response(text)

# Точка входа для OpenClaw
def handle(audio_path: str, **kwargs) -> str:
    transcriber = GroqVoiceTranscriber()
    return transcriber.process_voice(audio_path)


path: requirements.txt
content: groq>=0.4.0


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: pigro0314/publish-temp (version 1.0.0)

--- name: pogo-pvp description: Pokémon GO PvP 培养查询技能 v1.1。基于 PvPokeTW 真实排行数据 + gamemaster 基础种族值，提供排名查询、最佳 IV、用户 IV 对比等功能。 --- # PoGo-PvP — Pokémon GO PvP 培养查询 v1.1 数据源：**PvPokeTW**（[pvpoketw.com](https://pvpoketw.com/)）→ 翻译自 PvPoke，排行 JSON 拉取自 `pvpoke/pvpoke` GitHub raw，gamemaster 含宝可梦基础种族值与类型。 ## 命令 `/pvp 培养 <宝可梦> <联盟> [攻击/防御/生命]` ### 参数 | 参数 | 示例 | 说明 | |:----|:----|:----| | 宝可梦 | `玛力露丽` / `水兔子` / `azumarill` | 支持中文/英文/别名 | | 联盟 | `1500` / `超级联盟` / `master` / `大师` | 自动识别简写 | | IV（可选） | `1/15/10` / `0/15/15` | 攻击/防御/HP 各 0~15 | ### 输出字段（无用户 IV） | 字段 | 来源 | 说明 | |:----|:----|:-----| | 宝可梦 | speciesId → 中文映射 | 本地字典 | | 联盟 | 参数解析 | 自动识别 | | PvPokeTW排名 | 数组 index + 1 | PvPoke 排行 | | 评分 | score | PvPoke 综合评分 0~100 | | 属性 | gamemaster | 类型中文（如 `[水][妖精]`） | | 推荐招式 | moveset | 官方推荐配置（中文） | | 最佳 IV | IV 计算 | 4096 种组合中排名第 1 | | 最佳 CP | IV 计算 | 对应最佳 IV 的 CP | | 最佳等级 | IV 计算 | 对应最佳 IV 的等级（支持半级） | | 精英TM | — | 暂无准确数据 | | 招式池 | fastMoves / chargedMoves | 全部可用招式 | | 对战分析 | matchups / counters | 前 5 条 | | 数据来源 | — | PvPokeTW | | 更新时间 | — | UTC | ### 输出字段（有用户 IV） 新增对比块： | 字段 | 说明 | |:----|:-----| | 我的 IV | 用户输入的 IV 组合 | | 我的 CP | 该 IV 在联盟限制下的 CP | | 我的等级 | 该 IV 升级到的等级 | | 我的 IV 排名 | 在前 50 内显示排名，否则「未进入前 50」 | | 差别 | 最佳 IV - 用户 IV 的各维差值 | | 最佳 IV | 排名第 1 的 IV 组合 | ### 示例 ``` 宝可梦：弃世猴 联盟：超级联盟 PvPokeTW排名：#28 评分：90.1 属性：[格斗][幽灵] 推荐招式：踢倒 + 愤怒之拳 + 近身战 最佳 IV：0/13/14 最佳 CP：1500 最佳等级：17 精英TM：暂无准确数据 我的 IV：1/15/10 我的 CP：1455 我的等级：16.5 我的 IV 排名：未进入前50 差别：攻击 -1，防御 -2，生命 4 最佳 IV：0/13/14 ``` **规则：** 1. 不显示乘积 2. 不计算乘积 3. 不显示百分比接近度 4. 不用乘积判断好坏 5. IV / CP / 等级只能来自 PvPokeTW 真实数据 6. 查不到就显示「暂无准确数据」 7. 不允许模拟、不允许随机、不允许补编 ## 数据管理 ```bash # 拉取/刷新所有联盟缓存 python scripts/fetch_pvpoke.py --league 1500 python scripts/fetch_pvpoke.py --league 2500 python scripts/fetch_pvpoke.py --league master # gamemaster 自动在查询时拉取，过期自动刷新 # 手动测试 node dist/index.js 弃世猴 1500 node dist/index.js 弃世猴 1500 1/15/10 node dist/index.js --test ``` ## 缓存策略 - 缓存目录：`cache/` - rankings TTL：7 天 - gamemaster TTL：7 天 - 过期自动回退网络拉取 - 无缓存也拉不到 → 提示 ## IV 计算原理 IV 排序来源于 PvPokeTW 数据，不保证所有联盟字段完整。 对所有 4096 种 IV 组合： - 找到每个组合在 CP ≤ 联盟限制下的**最高等级** - 内部排序参考原始数据字段 - 取前 50 名 ## 数据字典 详见 `data/` 目录： - `pokemon_alias.json` — 中文俗称/别名 → speciesId - `src/mapper.ts` — speciesId / moveId → 中文名 ## 限制 - ✅ 所有数据来自 PvPoke/PvPokeTW 真实数据源 - ✅ IV/CP/等级均为真实可信计算结果 - ✅ 不输出乘积、不对比乘积、不显示接近度 - ❌ 不猜 XL 糖需求（gamemaster 不含 XL 关联字段） - ❌ 不生成截图/OCR/组队 ## 扩展计划（v1.2+） 1. elite_moves.json 白名单 → 精英TM 判断 2. 中文名全覆盖（800+ speciesId） 3. 属性相性 / 招式属性补充 4. 支持 XL 糖提示（需 PoGo API 或用户输入等级）


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: alexanderhe88/facebook-marketplace-search (version 0.1.3)

--- name: facebook-marketplace-search description: Search Facebook Marketplace listings near a specified location with filters for radius, price range, limit, and pickup-only. This skill is a thin client for a user-provided local Marketplace service and returns normalized JSON results with local-first ranking support. --- # Facebook Marketplace Search Search nearby Facebook Marketplace listings via a **user-provided local Marketplace service**. ## Design goal This published skill is intentionally a **thin wrapper client**. It does **not** ship with: - embedded Facebook scraping logic - vendored Marketplace scraper code - built-in background services - LaunchAgent installers That design keeps the published package smaller, easier to review, and less sensitive from a security-scanning perspective. ## What this skill does - sends a search request to a local Marketplace-compatible service - supports: - `query` - `location` - `radius_km` - `min_price` - `max_price` - `limit` - `pickup_only` - `sort` - returns normalized JSON with: - `id` - `title` - `price` - `location` - `seller_name` - `image_url` - `listing_url` ## Expected local service By default this client calls: - `http://127.0.0.1:8787/search` Override with: - `MARKETPLACE_API_BASE_URL` The local service is expected to accept query parameters such as: - `query` - `location` - `radius_km` - `min_price` - `max_price` - `limit` - `pickup_only` - `sort` ## Setup Install deps: ```bash python3 -m pip install -r skills/facebook-marketplace-search/requirements.txt ``` Optionally copy config: ```bash cp skills/facebook-marketplace-search/config.example.json \ skills/facebook-marketplace-search/config.json ``` ## Usage ```bash python3 skills/facebook-marketplace-search/scripts/facebook_marketplace_search.py \ --query "burrow sofa" \ --location "Livingston, NJ" \ --radius-km 48 \ --limit 10 \ --sort local_first ``` ## Output shape ```json { "query": "burrow sofa", "location": "Livingston, NJ", "count": 2, "results": [ { "id": "123", "title": "Burrow Sofa", "price": 400.0, "location": "Livingston, NJ", "seller_name": "Jane Doe", "image_url": "https://...", "listing_url": "https://www.facebook.com/marketplace/item/123" } ] } ``` ## Notes - This skill is a client wrapper, not a bundled scraper. - It is meant to integrate with a local service you control. - Some upstream services may not always provide seller names or exact pickup semantics. - Sorting behavior depends on the local service implementation.


Security scan verdicts — ClawScan: clean | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (HIGH)