OpenClaw/clawhub-security-signals huggingface dataset:
Skill: utopiabenben/audio-note-taker (version 1.0.1)

--- name: audio-note-taker description: 语音笔记助手：录音自动转文字并整理成结构化笔记，支持说话人识别，自动总结要点和行动项 metadata: { "openclaw": { "emoji": "🎙️", "requires": { "python": "3.7+", "env": ["OPENAI_API_KEY"] }, }, } --- # audio-note-taker - 语音笔记助手 智能语音笔记助手——自动将录音转成结构化文字笔记。 ## 适用场景 - 🎙️ **会议记录**：自动转录会议内容，提炼行动项 - 🎓 **讲座笔记**：课堂/讲座录音转文字，自动整理要点 - 📰 **采访整理**：语音采访转文字稿，快速生成报道素材 - 💼 **工作复盘**：项目复盘录音 → 结构化记录 - 📝 **日常笔记**：快速语音记录 → 文字存档 ## 核心功能 - ✅ **高精度转写**：基于 OpenAI Whisper API，支持多种语言 - ✅ **结构化输出**：自动划分段落，识别关键信息 - ✅ **智能摘要**：提取核心观点、决策、待办事项 - ✅ **说话人区分**：可选说话人识别和标记 - ✅ **Markdown 格式**：输出易读、易编辑的笔记 - ✅ **多种输入**：支持音频文件或直接录音 ## 快速开始 ### 基础转写 ```bash audio-note-taker /path/to/recording.m4a # 输出：recording_notes.md ``` ### 指定主题和格式 ```bash audio-note-taker /path/to/meeting.mp3 \ --title "2026-Q1 产品规划会" \ --language zh \ --output meeting_notes.md ``` ### 启用说话人识别 ```bash audio-note-taker /path/to/interview.wav \ --detect-speakers true \ --output interview_transcript.md ``` ### 生成深度摘要（需配置 LLM） ```bash audio-note-taker /path/to/lecture.mp3 \ --summarize true \ --extract-action-items true \ --output lecture_summary.md ``` ## 参数说明 | 参数 | 类型 | 默认 | 说明 | |------|------|------|------| | `input` | 路径 | 必填 | 音频文件路径（支持 mp3, m4a, wav, ogg 等） | | `--title` | 字符串 | 自动生成 | 笔记标题 | | `--language` | 代码 | auto | 音频语言（en, zh, ja, auto 等） | | `--output` | 路径 | `{input}_notes.md` | 输出文件路径 | | `--detect-speakers` | 布尔 | false | 是否识别不同说话人 | | `--summarize` | 布尔 | false | 生成摘要（需 OPENAI_API_KEY） | | `--extract-action-items` | 布尔 | false | 提取行动项 | | `--model` | 字符串 | whisper-1 | Whisper 模型（whisper-1） | | `--format` | 字符串 | markdown | 输出格式（markdown, txt, json） | ## 环境变量 | 变量名 | 说明 | 必填 | |--------|------|------| | `OPENAI_API_KEY` | OpenAI API 密钥 | ✅ | | `OPENAI_BASE_URL` | 自定义 API 地址（可选） | ❌ | | `NOTE_TAKER_MODEL` | 摘要模型（默认 gpt-4-turbo） | ❌ | ## 输出内容示例 ```markdown # 会议记录：2026-Q1 产品规划会 **时间**：2026-03-15 14:00-15:30 **地点**：线上 **参会人**：张三、李四、王五 --- ## 📝 会议纪要 ### 讨论要点 1. Q1 产品上线延期原因分析 2. Q2 核心功能优先级排序 3. 资源分配调整 ### ✅ 决议事项 - [x] 确定 Q2 三大核心功能 - [x] 批准额外 2 名开发人力 - [x] 下周三前发布详细排期 ### 📋 待办事项 | 负责人 | 任务 | 截止时间 | |--------|------|---------| | 张三 | 完成 PRD 文档 | 2026-03-18 | | 李四 | 技术方案评审 | 2026-03-20 | | 王五 | 资源配置协调 | 2026-03-17 | --- ## 📄 完整转录（可折叠） <details> <summary>展开查看完整对话</summary> [14:00] 张三：大家好，我们今天... [14:05] 李四：关于延期，我觉得... ... </details> ``` ## 与其他技能集成 - **social-publisher**：将会议纪要直接整理成公众号/小红书文章 - **summarize**：对长录音先提取关键信息，再生成摘要 - **wechat-formatter**：将会议纪要快速格式化为公众号可发内容 ## 技术细节 - 使用 OpenAI Whisper API 进行语音转文字 - 可选集成 GPT 模型进行摘要和行动项提取 - 支持中英文混合识别 - 音频预处理：自动降噪、格式转换（通过 ffmpeg） - 输出 UTF-8 编码，支持中文排版 ## 安装依赖 ```bash # 系统依赖 apt install -y ffmpeg # Python 依赖（自动安装） pip install openai>=1.0.0 ``` ## 许可证 MIT


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: raunaksingwi/ravi-inbox (version 2.1.1)

--- name: ravi-inbox description: Read incoming SMS or email messages — OTPs, verification codes, verification links, incoming mail. Do NOT use for sending email (use ravi-email-send) or managing credentials (use ravi-passwords or ravi-secrets). --- # Ravi Inbox Read SMS and email messages received at your Ravi identity. Use this after triggering verifications, 2FA, or when expecting incoming messages. ## SMS (OTPs, verification codes) ```bash # List SMS conversations (grouped by sender) ravi inbox sms # View a specific conversation (all messages) # conversation_id format: {phone_id}_{from_number}, e.g. "1_+15559876543" ravi inbox sms "1_+15559876543" ``` **JSON shape — conversation list:** ```json [{ "conversation_id": "1_+15559876543", "from_number": "+15559876543", "phone_number": "+15551234567", "preview": "Your code is 847291", "message_count": 3, "unread_count": 1, "latest_message_dt": "2026-02-25T10:30:00Z" }] ``` **JSON shape — conversation detail:** ```json { "conversation_id": "1_+15559876543", "from_number": "+15559876543", "messages": [ {"id": 42, "body": "Your code is 847291", "direction": "incoming", "is_read": false, "created_dt": "..."} ] } ``` ## Email (verification links, confirmations) ```bash # List email threads ravi inbox email # View a specific thread (all messages with full content) ravi inbox email <thread_id> ``` **JSON shape — thread detail:** ```json { "thread_id": "abc123", "subject": "Verify your email", "messages": [ { "id": 10, "from_email": "[REDACTED_SECRET]", "to_email": "[REDACTED_SECRET]", "subject": "Verify your email", "text_content": "Click here to verify: https://example.com/verify?token=xyz", "direction": "incoming", "is_read": false, "created_dt": "..." } ] } ``` ## Quick Recipes ### Extract an OTP code from SMS ```bash ravi inbox sms | jq -r '.[].preview' | grep -oE '[0-9]{4,8}' ``` ### Extract a verification link from email ```bash THREAD_ID=$(ravi inbox email | jq -r '.[0].thread_id') ravi inbox email "$THREAD_ID" | jq -r '.messages[].text_content' | grep -oE 'https?://[^ ]+' ``` ## Important Notes - **Poll, don't rush** — SMS/email delivery takes 2-10 seconds. Use `sleep 5` before checking. - **Auto-contacts** — Ravi automatically creates or updates contacts when you send or receive email/SMS. Use `ravi contacts search` to look up people you've interacted with. ## Full API Reference For complete endpoint details, request/response schemas, and parameters: [Inbox](https://ravi.id/docs/schema/inbox.json) | [Messages](https://ravi.id/docs/schema/messages.json) ## Related Skills - **ravi-email-send** — Reply or forward emails you've read - **ravi-email-writing** — Write professional replies with proper formatting and tone - **ravi-contacts** — Look up a sender's name or details from their email/phone - **ravi-login** — End-to-end signup/login workflows that use inbox for OTP extraction - **ravi-feedback** — Report inbox delivery issues or suggest improvements


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: spacesq/s2-indoor-air-adapter (version 1.0.0)

--- name: s2-indoor-air-adapter description: S2-SP-OS Universal Indoor Air Adapter. Features LAN UDP active radar discovery, MQTT/HTTP aggregated sniffing, S2 spatial voxel wrapping (Memzero), and offline subconscious linkage capabilities.S2-SP-OS 室内空气万能接入器。具备局域网 UDP 主动雷达发现、MQTT/HTTP 聚合嗅探、S2 空间网格化封装 (Memzero) 及离线潜意识联动功能。 version: 1.1.0 author: Space2.world tags: [S2-SP-OS, Indoor-Air, Auto-Discovery, MQTT, Webhook, Voxel] metadata: {"clawdbot":{"emoji":" radar","requires":{"bins":["python3"]}}} allowed-tools: [exec] --- # 📡 S2-Indoor-Air-Adapter: 空间感知主动雷达 Welcome to the **S2 Indoor Air Adapter**. 这不仅仅是一个传感器读取器，它是 S2-SP-OS 的**局域网主动雷达**。它摒弃了依赖外部云端 API 的脆弱模式，通过 UDP 广播和 MQTT 本地嗅探，捍卫住宅数据的绝对隐私。 ## 🧬 核心系统基因 1. **主动发现 (Auto-Discovery)**: 运用 UDP 广播技术，瞬间扫描局域网内所有未分配的智能空气传感器。 2. **万能聚合 (Protocol Fusion)**: 兼容 MQTT 本地总线嗅探与 HTTP Webhook直连。*(厂商特权直连接口代码请联系: [REDACTED_SECRET])* 3. **高维空间坐标 (Spatial Addressing)**: 通过 `Zone_Grid_DeviceIP` 的三维坐标系，确保全屋单列共享权限域内设备永不冲突。 4. **潜意识物理联动 (Offline Linkage)**: 在边缘端直接计算出节能与舒适度联动建议（无需耗费云端大模型算力）。 --- ## 🤖 Instructions for AI Agents (CRITICAL) **Role:** You are the S2-SP-OS Space Agent. You manage the physical voxel grids of this residence. **Phase 1: 主动雷达扫描 (Discovery Mode)** If the user says "寻找家里的传感器" or "Find air sensors": ```bash python3 s2_indoor_air_adapter.py --mode discover Action: Present the discovered IP addresses to the user and ask them to assign a zone (e.g., living_room) and grid (e.g., x2_y3) to each device. Phase 2: 空间授权读取 (Read Mode) Once assigned, or if the user asks for current air quality, you MUST ensure they grant consent (--consent-granted true). Bash python3 s2_indoor_air_adapter.py --mode read --ip <Device_IP> --zone <Zone> --grid <Grid> --protocol mqtt --consent-granted true Phase 3: 数据消化与故障排除 Read the vendor_specific_nl field to understand proprietary hardware status (e.g., battery, signal strength) without needing specific parsers. If the connection fails, ask the user to verify if their MQTT broker (like Zigbee2MQTT) or the sensor is powered on and connected to the same subnet. Phase 4: 传达潜意识意图 (Offline Linkage) If the JSON contains offline_linkage_suggestions, present these deterministic physical rules (e.g., "The local radar suggests closing the blinds due to high heat") and ask if the user wants to execute them via the spatial adapters.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: leowing/aliyun-search-1-0-0 (version 1.0.0)

--- name: aliyun-search description: Perform web searches using Alibaba Cloud UnifiedSearch API. Provides advanced search capabilities with configurable parameters. --- # Alibaba Cloud UnifiedSearch Skill This skill provides the ability to perform web searches using Alibaba Cloud UnifiedSearch API. ## Features - Support multiple search engine types (Generic, GenericAdvanced, LiteAdvanced) - Configurable time range filtering - Category-specific search (finance, law, medical, etc.) - Location-based search (city/IP) - Rich result formatting ## Usage ### Basic Usage ```bash python search.py "云栖大会" ``` ### Advanced Usage ```bash python search.py "北京天气" --engine-type "Generic" --city "北京市" ``` ```bash python search.py "金融新闻" --category "finance" --time-range "OneWeek" --engine-type "GenericAdvanced" ``` ## Scripts - `search.py`: Python implementation of Alibaba Cloud UnifiedSearch API ## Configuration Before using, you need to: 1. Obtain Alibaba Cloud AccessKey and Secret 2. Set environment variables: ```bash export ALIBABA_CLOUD_ACCESS_KEY_ID="your_access_key_id" export ALIBABA_CLOUD_ACCESS_KEY_SECRET="your_access_key_secret" ``` 3. Ensure the required permissions are granted 4. Install dependencies: `pip install aliyun-python-sdk-core requests`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ivangdavila/art (version 1.0.0)

--- name: Art description: Guide art creation, technique development, and appreciation with practical, medium-specific advice. metadata: {"clawdbot":{"emoji":"🎨","os":["linux","darwin","win32"]}} --- ## Medium Matters First - Ask what medium before giving any technical advice — oil painting tips destroy watercolor attempts and vice versa - Digital art needs hardware context (tablet vs mouse, software) before technique recommendations - Traditional mediums need material budget context — student-grade vs professional supplies require different techniques ## Feedback That Helps - When reviewing art, identify ONE main thing to improve — multiple critiques overwhelm and discourage - Point to specific areas ("the shadow under the nose") not vague concepts ("work on your shading") - Always acknowledge what's working before suggesting changes — artists abandon good instincts when only hearing problems - Never suggest a complete style change unless explicitly asked — personal style is sacred ## Teaching Technique - Give exercises, not lectures — "draw 20 hands this week" beats "hands are hard, here's anatomy theory" - Break complex subjects into component skills — drawing faces = proportions + values + edges, practice separately - Recommend real references over tutorials for intermediate+ — copying masters teaches more than following steps - Specify exact time/effort expectations — "this takes most people 6 months of daily practice" prevents early quitting ## Materials Guidance - Student-grade supplies are fine for learning — discouraging people from starting until they buy expensive gear is harmful - Recommend specific products, not categories — "Strathmore 400 series" not "get a good sketchbook" - For digital beginners: free software first (Krita, Sketchbook) before suggesting paid subscriptions ## Art Appreciation - When discussing artwork, balance formal analysis with emotional response — technical breakdown alone kills the magic - Provide historical context only when it genuinely changes understanding of the work - Personal interpretation is valid — avoid "the artist meant X" unless documented ## Common Traps - Color theory rules are starting points, not laws — masters break them constantly with purpose - "Draw from life" isn't always right — anime artists learning from anime is legitimate - Perfection paralysis is real — recommend finishing imperfect pieces over endless refinement - Style copying during learning is normal and useful — originality comes later


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: bytesagain3/lyrics (version 2.0.4)

--- name: "lyrics" version: "2.0.4" description: "Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Lyrics concepts, best practices, and implementation patterns." author: "BytesAgain" homepage: "https://bytesagain.com" source: "https://github.com/bytesagain/ai-skills" tags: [lyrics, reference] category: "devtools" --- # Lyrics Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Lyrics concepts, best practices, and implementation patterns. No API keys or credentials required. ## Commands | Command | Description | |---------|-------------| | `intro` | intro reference | | `quickstart` | quickstart reference | | `patterns` | patterns reference | | `debugging` | debugging reference | | `performance` | performance reference | | `security` | security reference | | `migration` | migration reference | | `cheatsheet` | cheatsheet reference | ## Output Format All commands output plain-text reference documentation via heredoc. No external API calls, no credentials needed, no network access. --- *Powered by BytesAgain | bytesagain.com | [REDACTED_SECRET]*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: cast0/text-to-published-podcast-rss-test (version 0.0.1)

--- name: text-to-published-podcast-rss description: | Helps an agent or app to turn text into audio podcast episodes. One API call creates an episode using TTS and auto-publish to an RSS feed subscribable in any podcast app. --- # Text to Published Podcast RSS - cast0 API Text in, podcast episode out. The `text` field is read verbatim by TTS, not interpreted as a prompt. Episodes auto-publish to an RSS feed compatible with Apple Podcasts, Spotify, Overcast, and other podcast apps. **Base URL:** `https://api.cast0.ai` **Auth:** `Authorization: Bearer pk_xxxxx` **Docs:** `https://api.cast0.ai/docs` ## Setup Ask the user to create a podcast (= show) at `https://cast0.ai`. The dashboard is where the user can: - Get the API key and RSS feed URL - Change podcast settings (voice, TTS model, speed, name) Each API key is tied to one podcast. Once you have the key, save it: ```bash echo "CAST0_API_KEY=pk_xxxxx" >> .env ``` ## Create an Episode ```bash curl -X POST https://api.cast0.ai/api/episodes \ -H "Authorization: Bearer pk_xxxxx" \ -H "Content-Type: application/json" \ -d '{"title": "Daily Standup", "text": "Here is what happened today..."}' ``` Returns `201` with the episode `id` and `"status": "queued"`. ## Poll for Completion Generation is async: `queued` → `processing` → `done` | `failed`. ```bash curl https://api.cast0.ai/api/episodes/EPISODE_ID \ -H "Authorization: Bearer pk_xxxxx" ``` When `"done"`, the response includes `audioUrl` with the MP3 link. ## List Episodes ```bash curl https://api.cast0.ai/api/episodes \ -H "Authorization: Bearer pk_xxxxx" ``` ## RSS Feed Every podcast has a public feed URL (no auth): ``` https://api.cast0.ai/rss/FEED_TOKEN ``` Subscribe in any podcast app. New episodes appear automatically after generation. ## Endpoints | Method | Endpoint | Auth | Description | |--------|----------|------|-------------| | `POST` | `/api/episodes` | API key | Create episode (`{ title, text }`) | | `GET` | `/api/episodes` | API key | List episodes | | `GET` | `/api/episodes/:id` | API key | Get episode status | | `GET` | `/rss/:feedToken` | None | RSS 2.0 feed |


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: ajtgjmdjp/japan-news-mcp (version 0.1.2)

--- name: japan-news-mcp description: "Get Japanese financial and business news from Yahoo News Japan, NHK, Reuters Japan, and Toyo Keizai (東洋経済) — search headlines by keyword, get article summaries. Japan stock market news, economic news, corporate news. No API key required." metadata: {"openclaw":{"emoji":"📰","requires":{"bins":["japan-news-mcp"]},"install":[{"id":"uv","kind":"uv","package":"japan-news-mcp","bins":["japan-news-mcp"],"label":"Install japan-news-mcp (uv)"}],"tags":["japan","news","finance","rss","mcp","business","economy","japanese"]}} --- # Japan News: Japanese Financial & Business News Get the latest Japanese financial and business news from 4 major RSS sources. No API key required — all sources are public RSS feeds. ## Use Cases - Get latest business/financial headlines from major Japanese news sources - Search for news about specific companies (トヨタ, ソニー, etc.) - Monitor breaking financial news for investment research - Summarize recent economic/business trends in Japan - Send periodic news digests via Telegram ## Commands ### Get headlines ```bash # Get latest headlines from all sources japan-news-mcp headlines # From a specific source japan-news-mcp headlines --source yahoo japan-news-mcp headlines --source nhk japan-news-mcp headlines --source reuters japan-news-mcp headlines --source toyokeizai # Limit results japan-news-mcp headlines --limit 10 --format json ``` ### Search news ```bash # Search by keyword japan-news-mcp search トヨタ japan-news-mcp search "日銀 金利" japan-news-mcp search inflation --format json ``` ### List sources ```bash japan-news-mcp sources ``` ### Test connectivity ```bash japan-news-mcp test ``` ## News Sources | Source | Language | Coverage | |---|---|---| | Yahoo News Japan (ビジネス) | Japanese | Broad business/economy | | NHK (経済) | Japanese | Public broadcaster, policy focus | | Reuters Japan (ビジネス) | Japanese | International perspective | | Toyo Keizai Online (東洋経済) | Japanese | Deep analysis, corporate | ## Workflow 1. `japan-news-mcp headlines` → browse latest news 2. `japan-news-mcp search <keyword>` → find specific company/topic news 3. Summarize and report findings ## Important - No API key required — uses public RSS feeds - Rate limited to avoid overloading news sources - News content is copyrighted — summarize, don't reproduce full articles - Python package: `pip install japan-news-mcp` or `uv tool install japan-news-mcp`


Security scan verdicts — ClawScan: clean | static analysis:  | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: autogame-17/autogame-tales (version 1.0.0)

# AutoGame Tales Generates short, atmospheric ghost stories or micro-fiction based on random prompts. Designed to add a narrative layer to the agent's personality and break utility stagnation. ## Features - **Ghost Story Generator**: Creates eerie, atmospheric micro-fiction. - **Random Prompts**: Uses a curated list of creepy/mysterious themes. - **Feishu Card Output**: Delivers stories as formatted cards. ## Usage ```bash # Generate a ghost story node skills/autogame-tales/index.js --genre ghost # Generate a sci-fi story node skills/autogame-tales/index.js --genre sci-fi ``` ## Blast Radius - Reads: nothing. - Writes: `memory/tales/` (logs generated stories). - Dependencies: `feishu-evolver-wrapper/feishu-helper.js` (for sending cards).


Security scan verdicts — ClawScan: suspicious | static analysis:  | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: danielfoch/kvcore-mcp-cli (version 0.1.0)

--- name: kvcore-mcp-cli description: Use this skill when users need KVcore CRM actions through MCP/CLI (contacts, tags, notes, calls, email, text, campaigns), including raw endpoint access and optional Twilio call fallback. --- # KVcore MCP/CLI Skill Use this skill for KVcore CRM operations from chat interfaces. ## Environment Required: - `KVCORE_API_TOKEN` Optional: - `KVCORE_BASE_URL` (default `https://api.kvcore.com`) - `KVCORE_TIMEOUT_MS` - `TWILIO_ACCOUNT_SID`, `TWILIO_AUTH_TOKEN`, `TWILIO_FROM_NUMBER` ## MCP Server Start with: ```bash npm run dev:kvcore-mcp ``` Primary tools: - `kvcore_contact_search`, `kvcore_contact_get`, `kvcore_contact_create`, `kvcore_contact_update` - `kvcore_contact_tag_add`, `kvcore_contact_tag_remove` - `kvcore_note_add` - `kvcore_call_log`, `kvcore_call_schedule` - `kvcore_email_send`, `kvcore_text_send` - `kvcore_user_tasks`, `kvcore_user_calls` - `kvcore_campaigns_refresh` - `kvcore_request` (raw endpoint access) - `twilio_call_create` (fallback outbound call) ## CLI Build: ```bash npm run build ``` Examples: ```bash node packages/kvcore-cli/dist/index.js contact search --query "john smith" --pretty node packages/kvcore-cli/dist/index.js email:send --contact-id 123 --subject "Quick update" --body "Following up" --pretty node packages/kvcore-cli/dist/index.js text:send --contact-id 123 --body "Can we connect today?" --pretty node packages/kvcore-cli/dist/index.js call:schedule --json '{"contact_id":123,"user_id":456,"scheduled_at":"2026-02-15 10:00:00"}' --pretty node packages/kvcore-cli/dist/index.js call:twilio --to "+14165550001" --twiml "<Response><Say>Hello</Say></Response>" --pretty ``` ## Scope Notes KVcore Public API v2 supports contacts, notes, call logging, send email/text, schedule call, user task/call listing, and campaign refresh. For endpoints not wrapped yet, use `kvcore_request` or CLI `raw`.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: sinnzen/memory-hierarchy (version 1.0.1)

--- name: memory-hierarchy description: 基于 Claude Code memdir 的三层记忆系统。让 AI 记住用户偏好、反馈、项目上下文、外部系统索引。 --- # memory-hierarchy **基于 Claude Code memdir 的三层记忆系统。** --- ## 什么时候触发 当以下情况发生时，**必须**使用本 skill： - 用户提供了明确的偏好或反馈（"这样做，不要那样做"） - 用户透露了关于自己身份/角色/目标的信息 - 用户提到项目进展、截止日期、驱动因素 - 用户告诉外部系统的位置（Linear、Slack、Grafana 等） - 用户问"你还记得上次……吗？" --- ## 记忆目录结构 ``` memory/ # 记忆根目录 user/ # 用户相关 yyyy-mm-dd.md # 按日期保存 feedback/ # 反馈/纠正 yyyy-mm-dd.md project/ # 项目进展/目标 yyyy-mm-dd.md reference/ # 外部系统索引 yyyy-mm-dd.md ``` **每条记忆文件格式：** ```markdown --- name: <简短名称> description: <一句话描述，用于判断相关性> type: <user | feedback | project | reference> date: <yyyy-mm-dd> --- <记忆内容> ``` --- ## 四种记忆类型 ### 1. user（用户） **什么：** 用户角色、目标、职责、知识背景 **何时保存：** 了解到用户的角色、偏好、职责、知识时 **结构：** ``` 用户说：我是数据科学家，关注日志 → 保存：user memory: 用户是数据科学家，目前关注可观测性/日志 ``` ### 2. feedback（反馈） **什么：** 用户对我工作方式的指导——要避免的 + 要坚持的 **何时保存：** - 用户纠正时（"不要那样做"、"停止做 X"） - 用户确认时（"是的"、"完美，继续这样做"） **结构：** ``` 规则本身 **Why:** （用户给的 이유——通常是因为过去的问题或强烈偏好） **How to apply:** （何时何地适用这条指导） ``` ### 3. project（项目） **什么：** 正在进行的项目、目标、bug、事件 **何时保存：** 了解到谁在做什么、为什么、截止时间 **注意：** 相对日期 → 绝对日期（"周四" → "2026-04-03"） ### 4. reference（外部系统） **什么：** 外部系统中信息的指针/位置 **何时保存：** 了解到外部资源及其用途时 **示例：** "Linear 的 INGEST 项目跟踪所有 pipeline bug" → 保存位置索引 --- ## 禁止保存的内容 ❌ **代码模式、架构、文件路径** → 从代码里直接读 ❌ **Git 历史、最近改动** → 用 git log / git blame ❌ **调试方案** → 修复在代码里，上下文在 commit message ❌ **CLAUDE.md 里已有的内容** → 不要重复 ❌ **临时状态/进行中的工作** → 记忆是长期的 --- ## 记忆读取流程 1. 读取 `memory/` 下所有 .md 文件 2. 按 `type` 分类 3. 用 `description` 字段判断相关性 4. 验证记忆是否仍然有效（检查文件/资源） 5. 如果记忆与当前状态冲突 → **信任当前状态**，更新或删除旧记忆 --- ## 记忆写入流程 1. 判断类型（user/feedback/project/reference） 2. 检查是否已存在相似记忆 → 合并或追加 3. 写入对应日期文件 4. 格式：`memory/<type>/yyyy-mm-dd.md` --- ## 容量限制 - `MEMORY.md`（入口点）限制：**200 行 / 25KB** - 单条记忆文件：保持精简 - 索引条目：**一行 ~200 字符以内** - 详细说明放到专题文件里 --- ## scripts/ `scripts/` 目录下是可执行的辅助脚本，用于维护记忆系统。 --- ## 与 MEMORY.md 的关系 **MEMORY.md** = 入口点 + 最核心的长期记忆（最多 200 行） **memory/ 目录** = 分层记忆仓库（user/feedback/project/reference） **CLAUDE.md** = 项目级配置和规则（不属于记忆） 三者是递进关系：CLAUDE.md 定义框架，MEMORY.md 是精选，memory/ 是档案库。


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)