OpenClaw/clawhub-security-signals huggingface dataset:
Skill: nikhilp1234567/biodiversity-corridor-calculator (version 1.0.0)

Open Claw Agent Skill: Biodiversity Corridor Analyst Description This skill allows an autonomous agent to analyze and value biodiversity corridors using advanced landscape ecology models. It processes H3 geospatial indices to calculate connectivity scores, visualize landscape resistance, and assess ecological premium values for conservation projects. The agent can use this skill to: 1. **Analyze Connectivity**: Evaluate a set of hexagonal land parcels (H3 indices) to determine their potential as biodiversity corridors, stepping stones, or regeneration zones. 2. **Assess Landscape Context**: Retrieve data on surrounding land cover and ecological resistance to understand the broader environmental context of a project site. Server Configuration Base URL: https://www.nikhilp.online/biodiversity-corridor-calculator API Base Path: /api --- 1. Analyze Connectivity Endpoint: POST https://www.nikhilp.online/biodiversity-corridor-calculator/api/analyze Description Analyzes the connectivity and ecological potential of a specified cluster of H3 hexagons. The analysis considers local habitat quality and regional landscape structure to classify the area into scenarios like "Vital Corridor," "Habitat Expansion," or "Stepping Stone." Input Schema (JSON) centerLat (Number): The latitude of the center point for the analysis region (between -90 and 90). centerLng (Number): The longitude of the center point for the analysis region (between -180 and 180). projectHexes (Array of Strings): A list of H3 hexagonal indices (resolution 9 is standard) representing the land parcels to be analyzed. Maximum 50 hexes per request to ensure performance. Usage Example To analyze a small cluster of land parcels in a specific region: JSON { "centerLat": 51.5074, "centerLng": -0.1278, "projectHexes": [ "892a100d2b3ffff", "892a100d2b7ffff", "892a100d2bbffff" ] } Response Format JSON { "results": [ { "h3Index": "892a100d2b3ffff", "originalCode": 10, "natureState": 1, "scenario": { "code": "CORRIDOR", "label": "Vital Corridor", "description": "This area acts as a bridge...", "color": "#f59e0b", "priority": 1.0 }, "resistance": 1, "localNature": 0.45, "landscapeNature": 0.30 } ], "context": [ { "h3Index": "892a100d28fffff", "originalCode": 50 } ... ] } Notes - **Rate Limiting**: The API is strictly rate-limited (approx. 5 requests per minute). Ensure you can handle 429 Too Many Requests responses gracefully by waiting before retrying. - **H3 Indices**: The system relies on H3 geospatial indexing. Ensure you can generate or work with valid resolution 9 H3 strings.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: amitabhama/investmentguru (version 1.0.0)

# 投资大师 Skill 基于**中国顶级投资大师** + **国际投资大师**的价值投资分析Skill。 ## 整合了20+位投资大师 ### 🇨🇳 中国大师（7位） 段永平、张磊、李录、邱国鹭、王国斌、林园、但斌 ### 🌍 国际大师（13位） 巴菲特、彼得林奇、木头姐、格雷厄姆、芒格、费雪、伯里、阿克曼、索罗斯、达里奥、达摩达兰、米勒、邓普顿 ## 功能 ### 1. 股票数据自动抓取 - 实时行情（价格、涨跌幅、成交量、PE、市值） - K线历史数据 - 均线系统（MA5/10/20/60） - 近期走势（1日/5日/1月/3月） - 板块/行业信息 - 市场情绪指标 ### 2. 智能投资分析 - 自动识别股票 - 根据行业自动匹配最合适的大师方法 - 生成完整分析报告（7个部分） - 多大师对比分析 ### 3. Agent对话式集成 - 当用户问股票时自动触发 - 支持指定大师方法（"用林园的方法看XXX"） - 支持对比分析（"XXX和YYY哪个好"） ## 安装 ```bash pip install -e . ``` ## 使用方法 ### Python API ```python from investment_gurus import smart_analyze, handle_user_message # 方法1: 对话式触发（Agent用） response = handle_user_message("茅台现在能买吗？") # 方法2: 直接分析 report = smart_analyze("贵州茅台") # 方法3: 指定大师 report = smart_analyze("片仔癀", guru="linyuan") # 方法4: 多大师对比 from investment_gurus import compare_all_methods report = compare_all_methods("宁德时代") ``` ### 命令行 ```bash invest-guru analyze -s 贵州茅台 invest-guru compare -s 比亚迪 ``` ## 支持的股票 - A股：茅台、五粮液、片仔癀、宁德时代、比亚迪、平安、招商银行等 - 港股：腾讯、阿里、美团、京东等 - 美股：苹果、微软、谷歌、亚马逊、特斯拉等 ## 投资大师 ### 🇨🇳 中国大师（7位） | 大师 | 方法 | 擅长行业 | |------|------|----------| | 段永平 | 能力圈+商业模式 | 消费、科技 | | 张磊 | 超长期+动态护城河 | 科技、新能源 | | 林园 | 嘴巴经济+垄断 | 白酒、医药 | | 但斌 | 伟大企业+时间玫瑰 | 消费、互联网 | | 邱国鹭 | 三好原则+逆向 | 金融、周期 | | 李录 | 安全边际+文明 | 消费、科技 | | 王国斌 | 幸运行业+企业 | 消费、制造 | ### 🌍 国际大师（13位） | 大师 | 方法 | 核心指标 | |------|------|----------| | 巴菲特 | 合理价格买伟大公司 | ROE>15%, PE<25, 自由现金流 | | 彼得林奇 | 寻找10倍股(GARP) | PEG<1, 营收增长>15% | | 木头姐 | 创新颠覆 | 创新指数, TAM, 研发>10% | | 格雷厄姆 | 安全边际 | PE<15, PB<1.5, NCAV | | 芒格 | Wonderful Business | 商业模式, 护城河, 定价权 | | 费雪 | 成长股调研 | 研发投入, 毛利率, 市场份额 | | 伯里 | 深度价值+逆向 | 隐蔽资产, PB, 清算价值 | | 阿克曼 | 激进投资 | 催化剂, 估值修复空间 | | 索罗斯 | 宏观对冲 | 宏观周期, 流动性, 政策 | | 达里奥 | 全天候 | 经济周期, 利率, 通胀 | | 达摩达兰 | DCF估值 | DCF, EV/EBITDA, 相对估值 | | 米勒 | 价值成长合一 | ROIC>15%, 成长性 | | 邓普顿 | 逆向投资 | PE历史低位, VIX高位 | ### 📊 分析维度（4个） | 维度 | 指标 | |------|------| | 估值 | PE, PB, PS, EV/EBITDA, DCF, 股息率 | | 基本面 | ROE, 毛利率, 净利率, 营收增长 | | 技术面 | MA5/20/60, RSI, MACD, 成交量 | | 情绪 | 新闻情绪, 机构评级, 资金流向, VIX | ## 触发条件 当用户输入包含以下内容时自动触发： - 股票名称（茅台、宁德时代等） - 6位股票代码 - 关键词：股票、买、卖、投资、分析、走势、行情、估值 ## 文件结构 ``` investment_gurus/ ├── investment_gurus/ │ ├── __init__.py # 入口 │ ├── base.py # 基类 │ ├── data_fetcher.py # 数据抓取 │ ├── smart_analyzer.py # 智能分析 │ ├── agent_handler.py # Agent集成 (核心) │ ├── tencent_api.py # 腾讯财经API (实时行情) │ ├── international_gurus.py # 国际大师分析 │ ├── analyzer.py # 综合分析器 │ ├── duan.py # 段永平 │ ├── zhanglei.py # 张磊 │ ├── liu_lu.py # 李录 │ ├── qiuguoluo.py # 邱国鹭 │ ├── wangguobin.py # 王国斌 │ ├── linyuan.py # 林园 │ └── danbing.py # 但斌 ├── SKILL.md ├── README.md ├── setup.py ├── requirements.txt └── manifest.json ``` ## 数据源 - **腾讯财经API** (`web.ifzq.gtimg.cn`) - 实时/收盘行情 - **Yahoo Finance** (yfinance) - 备用数据源 - 支持：港股、美股、A股


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: tonylnng/tonic-brainstorm (version 1.0.0)

--- name: Brainstorm description: Generate ideas fast. Adapt depth and structure to what the user actually needs. --- ## Default: Ideas First When user asks for ideas, **generate immediately**. Don't interrogate first. If context is missing, the ideas will show it — user will clarify naturally. ## Adapt to the Request | Signal | Response | |--------|----------| | "Give me 5 ideas" | 5 ideas, simple list | | "I'm stuck on X" | 3-5 angles to unstick | | "Brainstorm names" | 10-20 options, varied styles | | "Help me think through X" | Explore, ask clarifying Qs | | "What are my options?" | Structured comparison | Match the energy. Quick request → quick response. Deep request → go deep. ## Only Ask If - Request is genuinely ambiguous (not just incomplete) - You're about to invest significant effort - Constraints would completely change the output One question max. Not five. ## Structure When It Helps Don't force categories. Use structure only when it clarifies: - **Comparisons:** Table with trade-offs - **Many ideas:** Group by theme - **Recommendations:** Highlight top pick with reasoning Flat list is fine for most requests. ## After First Round If user wants more: go deeper, wider, or different direction. If user is silent: they got what they needed. Don't push. Check `modes.md` for different brainstorm approaches. Check `prompts.md` for creative expansion techniques. --- **Related:** For multi-perspective exploration, see `diverge`. For iteration, see `loop`.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jiwenbing/renewal-alert (version 1.0.0)

--- name: renewal-alert version: 1.0.0 description: Track insurance policy renewal dates and send timely reminders before policies expire. Use when users want to register insurance renewal dates, get expiry alerts, or review policies due for renewal. --- # Renewal Alert Track all insurance policies and their renewal dates. Alert users before policies expire so they never face a coverage gap due to a forgotten renewal. ## When to Use - User wants to register an insurance policy renewal date - User asks when their insurance expires - User wants a reminder before their policy renews or expires - User wants to review all upcoming insurance renewals - User got a renewal notice and wants help deciding whether to renew ## How to Use 1. Record policy details: type, insurer, policy number, renewal date, premium amount 2. Set reminder schedule (e.g., 60 days, 30 days, 7 days before renewal) 3. At renewal time: remind user and prompt them to review coverage before auto-renewing 4. Suggest reviewing coverage needs annually at renewal 5. Flag if premium has increased significantly from previous year ## Examples - "My car insurance renews on July 15th, remind me 30 days before" - "When does my health insurance expire?" - "List all my insurance renewal dates coming up in the next 90 days"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: antonia-sz/clawhub-publish-skill (version 1.0.0)

--- name: clawhub-publisher description: > 将本地 skill 目录发布到 clawhub.com 的自动化发布助手。 当用户说"发布这个 skill 到 clawhub"、"把 XX skill 上传到 clawhub"、 "clawhub publish"、"发布到 clawhub" 等时触发。 自动处理：token 验证、CLI bug patch、slug 冲突、频率限制重试。 author: antonia-sz version: 1.0.0 --- # ClawHub Publisher — Skill 自动发布器 把本地 skill 目录一键发布到 clawhub.com，自动处理所有已知坑。 --- ## 需要用户提供 | 参数 | 说明 | 示例 | |------|------|------| | `skill 目录路径` | 本地 skill 文件夹（必须包含 SKILL.md） | `/root/.openclaw/workspace/skills/SKILL-xxx` | | `clawhub token` | 格式 `clh_xxx`，clawhub.com → Profile → API Keys 获取 | `clh_7XoVic...` | | `slug` | URL 名称，全小写+连字符 | `my-skill-name` | | `displayName` | 展示名称 | `My Skill — 一句话描述` | | `tags` | 逗号分隔（可选） | `productivity,writing` | 如果缺少任何必填项，**只问缺少的那个**，不要重复已知信息。 --- ## 执行流程 ### Step 1：环境检查 ```bash # 确认 clawhub CLI 已安装 which clawhub || npm install -g clawhub clawhub --version # 确认 skill 目录存在且包含 SKILL.md ls {skill_dir}/SKILL.md ``` ### Step 2：Patch CLI（如需要） clawhub CLI 存在一个 bug：publish 时 payload 缺少 `acceptLicenseTerms: true`，服务端会返回 400。 检查并修复： ```bash PUBLISH_JS=$(find /usr/local/lib /usr/lib -name "publish.js" -path "*/clawhub/*" 2>/dev/null | head -1) # 检查是否已 patch grep -q "acceptLicenseTerms" "$PUBLISH_JS" && echo "已 patch" || \ # 在 payload 构建处加入 acceptLicenseTerms: true sed -i 's/skillName:/acceptLicenseTerms: true, skillName:/' "$PUBLISH_JS" && echo "patch 完成" ``` > 💡 patch 是幂等的，重复执行无害。 ### Step 3：查重（可选但推荐） ```bash # 用 knot_skills 搜索是否已有同名/同功能 skill knot_skills search "{slug关键词}" ``` 如果发现完全重复的 skill，告知用户，询问是否继续（换 slug 或放弃）。 ### Step 4：执行发布 ```bash CLAWHUB_TOKEN={token} \ clawhub publish {skill_dir} \ --slug {slug} \ --name "{displayName}" \ --version {version:-1.0.0} \ --changelog "{changelog:-Initial release}" \ --tags "{tags:-latest}" ``` ### Step 5：错误处理 遇到以下错误时，按对应方案处理： **`Error: Path must be a folder`** → 检查传入的是目录路径还是文件路径，修正后重试 **`slug already taken` / `409`** → 在 slug 后加 `-v2` 或更具体的后缀，询问用户确认后重试 **`rate limit exceeded` / `429`** → 使用 qqbot-cron skill 创建定时重试任务： ``` 约 65 分钟后执行相同的 publish 命令 任务名：clawhub-publish-retry-{slug} 完成后通知用户 ``` **`400 Bad Request`（含 acceptLicenseTerms）** → 重新执行 Step 2 的 patch，再重试 **`401 Unauthorized`** → token 无效或已过期，请用户在 clawhub.com 重新生成 ### Step 6：验证上架 ```bash knot_skills search "{slug}" ``` 发布成功后回复： ``` ✅ 发布成功：{displayName} 📦 slug：{slug} 🌐 https://clawhub.com/skills/{slug} 安装命令：clawhub install {slug} ``` --- ## 快速调用示例 用户说： > "把 /workspace/skills/SKILL-my-tool 发布到 clawhub，token 是 clh_abc，slug 用 my-tool" 直接执行 Step 1-6，完成后汇报结果，无需逐步确认。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: peand-rover/handyman-video (version 1.0.0)

name: handyman-video version: "1.0.0" displayName: "Handyman Video — Home Repair and Multi-Trade Service Videos for Handyman Services" description: > The handyman whose clients call back for every project on their list and don't bother getting other quotes isn't faster or cheaper than other handymen — they showed up on time, sent a text when they were 20 minutes away, gave a written estimate before starting, and did the thing the homeowner actually asked them to do without trying to upsell three more projects while they were there. Handyman Video turns your multi-trade capability, your reliability track record, and your transparent pricing approach into short service and trust videos that answer the question every homeowner with a list of small repairs asks: is this the handyman who will actually show up when they said they would, do what they quoted, and leave my house better than they found it? tags: - handyman video - handyman service video - home repair video - handyman marketing video - home maintenance video --- # Handyman Video Help handyman services create reliability and service videos. ## What You Do 1. Ask what type of video (service overview, specific trade capability, reliability track record, before/after repair, customer testimonial) 2. Gather: trades covered, licensing (if applicable), service area, booking process, typical project types, reliability differentiators 3. Generate 45-75 second script; suggest: handyman completing a specific repair showing quality, customer describing the reliability and communication, service range demonstration, before/after project, transparent pricing approach


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: gift-is-coding/computer-use-notes (version 1.0.0)

--- name: computer-use-notes description: Record and classify user observations about what computer use can do, partially do, and cannot do. Use when the user says to remember/log/record capability findings, test results, limitations, or asks for a running categorized notebook. --- # Computer Use Notes When the user provides a capability observation, do the following: 1. Extract one concise note sentence. 2. Classify into one of three categories: - `can-do`: clearly works reliably - `partial`: works in some cases / unstable / needs workaround - `cannot-do`: currently not possible or repeatedly fails 3. Append the note with timestamp via script: - `python3 skills/computer-use-notes/scripts/add_note.py --category <category> --note "<text>"` 4. Reply with a short confirmation including category. ## Classification hints - Contains words like “能做 / 可以 / 成功 / works” => `can-do` - Contains words like “部分能做 / 偶尔 / 不稳定 / workaround” => `partial` - Contains words like “不能做 / 无法 / 失败 / blocked” => `cannot-do` If ambiguous, ask one short clarification question. ## Data files - Raw log: `memory/computer-use-notes.jsonl` - Human-readable board: `memory/computer-use-notes.md`

path: scripts/add_note.py
content: #!/usr/bin/env python3
import argparse
import datetime as dt
import json
from pathlib import Path

ROOT = Path(__file__).resolve().parents[3]
MEM_DIR = ROOT / "memory"
RAW = MEM_DIR / "computer-use-notes.jsonl"
BOARD = MEM_DIR / "computer-use-notes.md"

CATS = ["can-do", "partial", "cannot-do"]
TITLES = {
    "can-do": "能做（Can Do）",
    "partial": "部分能做（Partial）",
    "cannot-do": "不能做（Cannot Do）",
}


def load_entries():
    items = []
    if RAW.exists():
        for line in RAW.read_text(encoding="utf-8").splitlines():
            if line.strip():
                items.append(json.loads(line))
    return items


def rebuild_board(entries):
    lines = ["# Computer Use 能力记录", ""]
    lines.append(f"更新于：{dt.datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
    lines.append("")
    for cat in CATS:
        lines.append(f"## {TITLES[cat]}")
        subset = [e for e in entries if e.get("category") == cat]
        if not subset:
            lines.append("- （暂无）")
        else:
            for e in subset[-200:]:
                lines.append(f"- [{e['time']}] {e['note']}")
        lines.append("")
    BOARD.write_text("\n".join(lines), encoding="utf-8")


def main():
    p = argparse.ArgumentParser()
    p.add_argument("--category", required=True, choices=CATS)
    p.add_argument("--note", required=True)
    args = p.parse_args()

    MEM_DIR.mkdir(parents=True, exist_ok=True)
    now = dt.datetime.now().strftime("%Y-%m-%d %H:%M:%S")
    item = {"time": now, "category": args.category, "note": args.note.strip()}

    with RAW.open("a", encoding="utf-8") as f:
        f.write(json.dumps(item, ensure_ascii=False) + "\n")

    entries = load_entries()
    rebuild_board(entries)
    print(json.dumps(item, ensure_ascii=False))


if __name__ == "__main__":
    main()


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mike47512/website-building (version 0.1.0)

--- name: "网站搭建" description: "该技能介绍如何通过网站搭建实现变现；当你计划从事或优化网站搭建时调用。" --- # 网站搭建 概览： - 场景：以“网站搭建”为核心的可复制变现路径 - 目标：在90天内跑通最小可行闭环，并达成正向现金流 定位与人群： - 适合：具备基础认知或实践经验，愿意持续投入的人/团队 - 不适合：短期套利、违规刷量、无内容/供给能力者 典型渠道： - 独立站、SaaS着陆页、SEO获取客户 - 通用补充：微信/抖音/小红书/闲鱼/淘宝/独立站/社群 变现模型： - 收入结构：主收入 + 辅助收入（广告/佣金/订阅/服务/周边） - 成本结构：获客成本（CAC）+ 供给/履约 + 固定开销 - 核心指标：GMV、毛利率、转化率、留存、LTV/CAC、复购率 执行流程： - 01 选赛道与定位：明确供给、目标用户、差异化与定价 - 02 搭MVP：以最低成本验证一个渠道的有效性 - 03 获取流量：内容分发/投放/合作互推，建立追踪 - 04 转化与交付：标准化流程与模板，保证体验与口碑 - 05 复盘与迭代：每周数据盘点，优化漏斗与供给结构 工具清单： - 生产：文案/设计/剪辑/表格/自动化工具 - 获取：SEO/SEM/信息流/平台任务/达人合作 - 追踪：表格/CRM/数据看板/UTM/埋点 - 履约：工单/客服/交付模板/质检清单 合规与风险： - 遵守平台政策与法律法规，严禁虚假宣传、刷量、侵权 - 明确版权与交付约定，规范合同与发票 常见坑位： - 盲目扩渠道、无数据追踪、定价不清、交付不标准 - 过度依赖单平台、忽视复购与会员化 30日执行计划： - 第1周：定位、选品/供给、搭建MVP与基本素材 - 第2周：上线一个主渠道，跑数据，优化文案与转化 - 第3周：稳定交付流程，建立追踪与看板，启动第二渠道 - 第4周：总结复盘，完善模板与清单，制定90日目标 检查清单： - 明确目标与指标，完成MVP验证，建立复盘与模板库 - 形成可复制的标准作业流程（SOP）


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: parkertoddbrooks/wip-repos (version 1.9.72)

--- name: wip-repos description: Repo manifest reconciler. Makes repos-manifest.json the single source of truth for repo organization. license: MIT interface: [cli, module, mcp] metadata: display-name: "Repo Manifest Reconciler" version: "0.1.0" homepage: "https://github.com/wipcomputer/wip-ai-devops-toolbox" author: "Parker Todd Brooks" category: dev-tools capabilities: - manifest-check - filesystem-sync - repo-add - repo-move - tree-generation requires: bins: [node, git] openclaw: requires: bins: [node, git] install: - id: node kind: node package: "@wipcomputer/wip-repos" bins: [wip-repos] label: "Install via npm" emoji: "📂" compatibility: Requires git, node. Node.js 18+. --- # wip-repos Repo manifest reconciler. Like prettier for folder structure. Move folders around all day; on sync, everything snaps back to where the manifest says. ## When to Use This Skill **Use wip-repos for:** - Checking if the filesystem matches the manifest (`check`) - Moving repos to match the manifest (`sync`) - Adding a new repo to the manifest (`add`) - Moving a repo in the manifest (`move`) - Generating a directory tree from the manifest (`tree`) **Use after:** - Cloning a new repo - Moving repos between categories - Adding new repos to the org ### Do NOT Use For - Git operations (use git directly) - Repo creation on GitHub (use gh) ## API Reference ### CLI ```bash wip-repos check # diff filesystem vs manifest wip-repos sync --dry-run # preview moves wip-repos sync # execute moves wip-repos add ldm-os/utilities/new-tool --remote wipcomputer/new-tool wip-repos move ldm-os/utilities/tool --to ldm-os/devops/tool wip-repos tree # generate directory tree ``` ### Module ```javascript import { check, planSync, addRepo, moveRepo, generateReadmeTree } from '@wipcomputer/wip-repos'; const result = check('/path/to/manifest.json', '/path/to/repos/'); const moves = planSync('/path/to/manifest.json', '/path/to/repos/'); ``` ### MCP Tools: `repos_check`, `repos_sync_plan`, `repos_add`, `repos_move`, `repos_tree`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: mirni/gh-skillguard (version 1.0.0)

--- name: gh-skillguard description: "Run a complete security audit on any OpenClaw SKILL.md in one call. Combines malware scanning (SkillScan), permission scope analysis (ScopeCheck), and prompt injection detection (PromptGuard) into a single unified report with a SAFE/CAUTION/DANGEROUS verdict." metadata: {"openclaw":{"emoji":"🏰","requires":{"bins":["python"]},"install":[{"id":"pip","kind":"uv","packages":["fastapi","uvicorn","pydantic","pyyaml"]}]}} --- # SkillGuard Full security audit of a SKILL.md — three checks, one call. ## Start the server ```bash uvicorn skillguard.app:app --port 8005 ``` ## Audit a skill ```bash curl -s -X POST http://localhost:8005/v1/audit-skill \ -H "Content-Type: application/json" \ -d "{\"skill_content\": $(cat path/to/SKILL.md | jq -Rs)}" | jq ``` Returns `verdict` (SAFE/CAUTION/DANGEROUS), `total_findings`, and three sub-reports: - **scan** — malware detection (safety_score, findings, verdict) - **scope** — permission analysis (declared vs detected, undeclared_access) - **injection** — prompt injection (risk_score, patterns_detected) ## Why use SkillGuard instead of individual tools? One call instead of three. Same price. Combined verdict logic: if the malware scan finds anything, it's DANGEROUS. If only scope or injection issues, it's CAUTION. Clean skill = SAFE.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kkkkhazix/hv-analysis (version 1.0.0)

--- name: hv-analysis description: | 横纵分析法（Horizontal-Vertical Analysis）深度研究Skill。由数字生命卡兹克提出，融合历时-共时分析、纵向-横截面研究设计、案例研究法与竞争战略分析。 当用户想要系统性研究一个产品、公司、概念、技术或人物时使用。纵轴追踪完整生命历程，横轴与竞品系统性横向对比，交叉产出洞察，最终输出PDF研究报告。 --- # 横纵分析法深度研究 > **方法论溯源** > 横纵分析法由数字生命卡兹克（Khazix）提出，融合了语言学中的历时-共时分析（Saussure）、社会科学中的纵向-横截面研究设计、商学院案例研究法、以及竞争战略分析的核心思想，形成了一套适用于产品/公司/概念/人物的通用研究框架。 你正在执行一次横纵分析法深度研究。最终产出一份**排版精美的PDF研究报告**。 ## 前置准备 拿到用户输入后，确认以下信息（如果用户已经给得足够明确，不需要追问，直接开始）： 1. **研究对象**：具体的产品名/公司名/概念名/人名 2. **类型**：产品、公司、概念、人物、还是其他？ 3. **研究动机**（可选）：为什么要研究它？ 4. **特别关注点**（可选）：有没有特别想深入的方向？ ## 第一步：联网信息收集 **必须联网搜索**，不能仅靠已有知识。使用子Agent并行搜索： - **子Agent 1 — 纵向信息**：起源、创始人背景、发展历程、关键事件、版本迭代、融资、战略转向 - **子Agent 2 — 横向信息**：竞品识别、各竞品特点和用户口碑、行业对比、市场份额 - **子Agent 3**（复杂对象才需要）：补充信息，如创始人深度背景、用户社区讨论 信息来源优先级：一手来源 > 二手来源（官方博客 > 权威媒体原创 > 转载聚合）。搜不到的信息诚实标注「暂缺」，绝不编造。 ## 第二步：纵向分析（Diachronic / Longitudinal） 沿时间轴，完整还原研究对象从诞生到现在的发展全貌。这是报告主体，篇幅最重。 内容覆盖：**起源追溯**（诞生背景、创始团队）→ **诞生节点**（首次发布时间、最初形态）→ **演进历程**（关键节点按时间顺序）→ **决策逻辑**（每个关键节点的选择原因）→ **阶段划分**（萌芽期、增长期、转型期等）。 要写成叙事故事，不是年表流水账。篇幅 6,000-15,000 字。 ## 第三步：横向分析（Synchronic / Cross-sectional） 以当前时间点为切面，与同赛道竞品全面对比。 先判断竞品场景：A. 无直接竞品（分析为什么）→ B. 少量竞品（逐一深入）→ C. 竞品充分（选3-5个代表性的）。 对比维度：核心差异（技术路线、产品形态、商业模式）、用户视角（真实口碑、使用体验）、生态位分析（版图位置）、趋势判断。篇幅 3,000-10,000 字。 ## 第四步：横纵交汇洞察 把纵向发展脉络和横向竞争格局结合，给出综合性新判断（不是前面的缩写版）： 1. 历史如何塑造了当下的竞争位置 2. 优势和劣势各自的历史根源 3. 未来三个剧本：最可能的、最危险的、最乐观的 篇幅 1,500-3,000 字。 ## 第五步：生成PDF报告 使用本Skill自带的 `scripts/md_to_pdf.py` 脚本（基于WeasyPrint）将Markdown转为排版精美的PDF。内置完整CSS排版方案：A4页面、封面页、中英文混排、页眉页脚、表格斑马纹等。 ## 不同类型适配 - **产品**：纵轴重版本迭代、技术路线；横轴重功能对比、用户体验 - **公司**：纵轴重融资历程、战略转向；横轴重商业模式、市场份额 - **概念**：纵轴重起源和演变；横轴重与相近概念的区别 - **人物**：纵轴重职业轨迹、关键决策；横轴重与同领域人物的对比 ## 写作风格 在「研究报告的严谨」和「卡兹克的可读性」之间平衡：节奏感、叙事驱动、敢下判断、层层剥开、回环呼应。避免AI味套话（「综上所述」「赋能」「在当今时代」等）。 全文总计 10,000-30,000 字。深度和完整度是价值所在。 完整版 Skill 含详细写作规范、子Agent联网指引、PDF排版细节，见 GitHub：https://github.com/KKKKhazix/khazix-skills


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)