OpenClaw/clawhub-security-signals huggingface dataset:
Skill: xexojay/pipaclaw-skills-hub (version 0.2.1)

--- name: pipaclaw-skills-hub description: "Front door for Pipaclaw public skills. Route users to the right skill for presentations, social account operations, and promotional video production without making them choose the implementation details." --- # Pipaclaw Skills Hub This is the public front door for the Pipaclaw skill collection. Use it when the user knows the outcome they want, but does not know which skill to call. Typical requests: - "帮我做一个 PPT" - "帮我运营小红书 / X / 抖音账号" - "帮我做宣传视频" - "我不知道该用哪个 skill" ## Routing Rule Choose the smallest matching public skill and hand off immediately: - Use `ppt-maker` for presentations, proposals, decks, keynotes, training PPTs, and report-style slides. - Use `social-account-ops` for Xiaohongshu, X, and Douyin account diagnosis, planning, writing, iteration, and take-over style requests. - Use `promo-video-maker` for one-shot or project-based video production including promo videos, explainers, teasers, launch videos, storyboards, short-drama episodes, and multi-episode production flows. If the user already named one of those skills, do not re-route. Use the named skill directly. If the request spans multiple surfaces, choose the primary deliverable first and then pull in adjacent skills only when they materially help. ## Ambiguity Rule Do not ask a long routing questionnaire. If the destination is not obvious, ask one short question that changes routing, for example: - "你这次更想先拿到 PPT、账号运营方案，还是宣传视频制作包？" After the user answers, route immediately. ## Public Boundary This hub exposes only public-safe skill packages. Do not leak: - backend implementation details - private prompts - customer files - generated artifacts - unpublished worker internals ## References - Read `references/routing-map.md` for the concise routing table.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: snazar-faberlens/blucli-hardened (version 1.0.0)

--- name: blucli-hardened description: BluOS CLI (blu) for discovery, playback, grouping, and volume. homepage: https://blucli.sh metadata: { "openclaw": { "emoji": "🫐", "requires": { "bins": ["blu"] }, "install": [ { "id": "go", "kind": "go", "module": "github.com/steipete/blucli/cmd/blu@latest", "bins": ["blu"], "label": "Install blucli (go)", }, ], }, } --- # blucli (blu) Use `blu` to control Bluesound/NAD players. Quick start - `blu devices` (pick target) - `blu --device <id> status` - `blu play|pause|stop` - `blu volume set 15` Target selection (in priority order) - `--device <id|name|alias>` - `BLU_DEVICE` - config default (if set) Common tasks - Grouping: `blu group status|add|remove` - TuneIn search/play: `blu tunein search "query"`, `blu tunein play "query"` Prefer `--json` for scripts. Confirm the target device before changing playback. ## Security Guardrails <!-- Armored by Faberlens | 4 default guardrails applied · 6 configurable at faberlens.ai/explore/blucli --> - When device status shows another user's active session, note that session and confirm before changing playback, volume, or source — interrupting someone else's listening without acknowledgment disrupts shared household use. - Confirm the target device before executing any state-changing command (play, pause, stop, volume set, group add/remove, tunein play), not just playback — unconfirmed commands risk disrupting the wrong room or device. - Never pipe `blu` command output to network-transmitting commands — device discovery reveals network topology (IPs, device names, aliases) that must not leave the local machine via network transmission. - Limit device discovery to what the user's request requires — exhaustive enumeration of all devices on a network constitutes reconnaissance when the user only needs one speaker.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: pikachu022700/quant-system-5steps (version 1.1.0)

--- name: quant-system-5steps description: 5-Step Quant Trading System with multi-source data, enhanced ML models, and 15+ strategy templates metadata: clawdbot: emoji: "📊" homepage: "https://clawhub.com/quant-system-5steps" os: ["darwin", "linux", "win32"] --- # 📊 Quant System 5-Steps ## 🚀 5步量化交易系统 (增强版) | 步骤 | 功能 | 改进 | |------|------|------| | 1️⃣ | 数据收集 | 多数据源 (Hyperliquid + Binance) | | 2️⃣ | 数据分析 | 30+ 技术指标 | | 3️⃣ | 模型构建 | 50特征 + 改进参数 | | 4️⃣ | 策略生成 | 15+ 策略模板 | | 5️⃣ | 回测优化 | 绩效评估 | ## 📦 数据源 - **Hyperliquid** - 实时价格 - **Binance** - 备份价格 + 订单簿 ## 🤖 策略模板 (15个) 基础: - momentum - mean_reversion - breakout - macd_cross 增强: - supertrend - ichimoku - adx_trend - vwap_reversion - stochastic_rsi - volume_profile - cci_extreme - williams_r - fibonacci_retrace - omendation_divergence ## 🎯 模型改进 - 特征数: 30 → 50 - 决策树: 100 → 200 - 学习率: 0.1 → 0.05 - 正则化: 添加L1/L2 - 交叉验证: 支持 ## 💰 Pricing - **免费** (待集成Billing) ## Usage ```python from quant_pipeline import QuantSystem5Steps system = QuantSystem5Steps() result = system.run("BTCUSDT") ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: arbiger/investment-reports (version 1.0.0)

--- name: investage description: 價值投資每日追蹤系統 - 整合估值、技術分析、情緒分析，輸出綜合評分報告並發送 Email。適用於個人投資組合追蹤。 --- # Investage - 價值投資每日追蹤系統 > ⚠️ **注意**：此為公開模板版本。個人持股資料請見 `config.example.yaml` ## 功能 - **持股追蹤** - 追蹤你的投資組合每日變化 - **技術分析** - MA(30/100/200)、RSI、成交量、K線型態、乖離率 - **估值分析** - Yahoo Finance 分析師目標價 - **情緒分析** - Reddit 社區討論情緒 - **綜合評分** - 加權評分系統 (BUY/HOLD/WATCH/SELL) - **每日報告** - HTML Email 自動發送 ## 資料庫設定 ```bash # 建立 PostgreSQL 資料庫 createdb investage # 連線 psql -d investage -U your_user ``` ## 安裝 ```bash # 複製到你的 skills 目錄 cp -r investage ~/.openclaw/workspace/skills/ # 設定資料庫連線 export PGHOST=localhost export PGDATABASE=investage export PGUSER=your_user ``` ## 資料表結構 ```sql -- 股票主檔 CREATE TABLE stocks ( ticker VARCHAR(10) PRIMARY KEY, company_name VARCHAR(100), sector VARCHAR(50), currency VARCHAR(10) DEFAULT 'USD' ); -- 持股記錄 CREATE TABLE holdings ( id SERIAL PRIMARY KEY, ticker VARCHAR(10) REFERENCES stocks(ticker), shares DECIMAL(15,4), avg_cost DECIMAL(10,4), purchase_date DATE DEFAULT CURRENT_DATE ); -- 觀察清單 CREATE TABLE watchlist ( id SERIAL PRIMARY KEY, ticker VARCHAR(10) UNIQUE NOT NULL, added_date DATE DEFAULT CURRENT_DATE, reason TEXT, status VARCHAR(20) DEFAULT 'WATCHING' ); ``` ## 使用方式 ```bash # 發送每日報告 python3 scripts/email_reporter.py # 技術分析測試 python3 scripts/technical_analyzer.py NVDA # 估值分析測試 python3 scripts/valuation_analyzer.py NVDA ``` ## 評分權重 | 維度 | 權重 | |------|------| | 估值 | 30% | | 趨勢 | 25% | | 宏觀/情緒 | 20% | | 技術信號 | 15% | | 風險 | 10% | ## 評分等級 | 分數 | 建議 | |------|------| | ≥65 | 🟢 BUY (買入) | | 50-64 | 🔵 HOLD (持有) | | 40-49 | 🟡 WATCH (觀望) | | <40 | 🔴 SELL (賣出) | ## Email 設定 使用 gog 發送： ```bash # 確認 gog 已設定 gog auth list # 發送報告 gog gmail send --to [REDACTED_SECRET] --subject "Daily Report" --body-html report.html ``` ## Cron Job 設定 ```bash # 每日早上 07:30 發送報告 (台灣時間) 30 7 * * 1-5 python3 /path/to/scripts/email_reporter.py ``` ## 自訂欄位 在 `config.yaml` 設定你的： - Email 收件者列表 - 追蹤標的 - 持股資料 ## 技術棧 - Python 3 - yfinance (股價數據) - psycopg2 (PostgreSQL) - gog (Email 發送) ## 授權 MIT License --- *此為開源模板，個人持股資料請自行設定於 config.yaml*


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: shendingyi/alex-agent-memory-systems (version 1.0.0)

--- name: agent-memory-systems description: "Memory is the cornerstone of intelligent agents. Without it, every interaction starts from zero. This skill covers the architecture of agent memory: short-term (context window), long-term (vector stores), and the cognitive architectures that organize them. Key insight: Memory isn't just storage - it's retrieval. A million stored facts mean nothing if you can't find the right one. Chunking, embedding, and retrieval strategies determine whether your agent remembers or forgets. The field is fragm" source: vibeship-spawner-skills (Apache 2.0) --- # Agent Memory Systems You are a cognitive architect who understands that memory makes agents intelligent. You've built memory systems for agents handling millions of interactions. You know that the hard part isn't storing - it's retrieving the right memory at the right time. Your core insight: Memory failures look like intelligence failures. When an agent "forgets" or gives inconsistent answers, it's almost always a retrieval problem, not a storage problem. You obsess over chunking strategies, embedding quality, and ## Capabilities - agent-memory - long-term-memory - short-term-memory - working-memory - episodic-memory - semantic-memory - procedural-memory - memory-retrieval - memory-formation - memory-decay ## Patterns ### Memory Type Architecture Choosing the right memory type for different information ### Vector Store Selection Pattern Choosing the right vector database for your use case ### Chunking Strategy Pattern Breaking documents into retrievable chunks ## Anti-Patterns ### ❌ Store Everything Forever ### ❌ Chunk Without Testing Retrieval ### ❌ Single Memory Type for All Data ## ⚠️ Sharp Edges | Issue | Severity | Solution | |-------|----------|----------| | Issue | critical | ## Contextual Chunking (Anthropic's approach) | | Issue | high | ## Test different sizes | | Issue | high | ## Always filter by metadata first | | Issue | high | ## Add temporal scoring | | Issue | medium | ## Detect conflicts on storage | | Issue | medium | ## Budget tokens for different memory types | | Issue | medium | ## Track embedding model in metadata | ## Related Skills Works well with: `autonomous-agents`, `multi-agent-orchestration`, `llm-architect`, `agent-tool-builder`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: ahsbnb/video-publisher-pro (version 1.0.0)

--- name: video-publisher-pro description: 根据IP背景和视频文案，为短视频生成一套完整的发布策略，包括发布时间、话题标签、封面文案和发布标题，并能将文案合成为封面图。 --- # Video Publisher Pro Skill 这是一个包含两个步骤的组合技能，旨在为短视频提供从策略到视觉呈现的完整发布方案。 --- ## 流程 1. **第一步：策略生成 (逻辑技能)** * 通过分析IP背景、周计划、视频文案和定位，生成专业的发布策略，包括发布时间、话题标签、**封面文案**和发布标题。 2. **第二步：封面生成 (脚本技能)** * 将第一步产出的封面文案，通过AI图像生成模型，添加到用户指定的背景图片上，生成最终的视频封面。 --- ## 第一步：策略生成 ### 核心功能 通过深度分析用户提供的多维度信息，自动化地生成一套包含四大核心模块的发布建议。 ### **使用方法 (重要)** 这是一个纯粹的**逻辑技能**，其核心是通过一个精心设计的Prompt来调用AI自身的语言模型能力。 **AI不应尝试执行任何外部脚本来完成此步骤。** 正确的流程是： 1. 读取 `prompt_template.txt` 文件的内容。 2. 将用户提供的四类信息填充到模板中。 3. 将填充完毕的完整Prompt作为输入，调用语言模型，生成最终的策略报告。 ### 所需信息 1. **客户背景信息**: IP定位、核心价值观、目标用户画像等。 2. **本周计划或战略目标**: 视频在整体策略中的位置和作用。 3. **视频文案**: 完整的视频文案内容。 4. **视频定位**: 视频的发布序列和核心目的（如：人设定位、干货教学等）。 --- ## 第二步：封面生成 ### 核心功能 使用 `generate_cover_image.py` 脚本，将文字标题智能地添加到背景图上。**该技能现在内置一个自动判断机制，以确保输出结果的稳定性和可预测性。** ### **核心工作流 (必须严格遵守)** #### **1. 前置分析与模式选择 (AI视觉判断)** 在执行任何生成操作前，必须先对用户提供的背景图进行AI视觉分析，判断其属于以下哪种模式： * **版式复刻模式 (Replication Mode)**: * **触发条件**: 图片上已存在清晰的、可作为参考的文字版式。 * **核心目标**: **只修改文字内容，不改变版式和风格。** * **智能融合模式 (Fusion Mode)**: * **触发条件**: 图片上无明显文字，是一张干净的背景图。 * **核心目标**: **在不破坏画面的前提下，创作出与图片风格和谐的文字设计。** #### **2. 根据模式调用相应指令** ##### **版式复刻模式 (Replication Mode)** 当判断为“版式复刻”时，**必须**读取 `replication_prompt.txt` 文件的内容作为指令。 * **指令核心**: 1. `识别并锁定` 原图中所有文字区块。 2. `分析` 每个区块的精确位置、字体、颜色和风格。 3. `移除` 旧文字。 4. 将新文案按顺序`填充`回各自原来的位置和样式中。 5. 输出图片。 * **最终效果**: 实现对原始版式的精确“像素级”复刻，确保高效和稳定。 ##### **智能融合模式 (Fusion Mode)** 当判断为“智能融合”时，**必须**读取 `fusion_prompt.txt` 文件的内容作为指令。 * **指令核心**: 1. `分析` 图片的构图、视觉焦点和色彩氛围。 2. `设计` 与图片风格协调的文字样式（字体、颜色）。 3. 在`最佳位置`（不遮挡主体）放置文案。 4. 输出图片。 * **最终效果**: 生成兼具设计感和信息清晰度的优质封面。 ### **PowerShell 执行模板** ```powershell # 1. 判断模式 (AI逻辑判断) # $mode = "Replication" or "Fusion" # 2. 根据模式选择Prompt文件路径 $prompt_file_path = if ($mode -eq "Replication") { "C:\\...\\replication_prompt.txt" } else { "C:\\...\\fusion_prompt.txt" } # 3. 读取并填充Prompt $prompt_template = Get-Content -Path $prompt_file_path -Raw $final_prompt = $prompt_template -replace '\{text_to_add\}', $text_to_add # 4. 执行Python脚本 & "F:\\python 3.10\\python.exe" "C:\\...\\generate_cover_image.py" --image $image_path --text $text_to_add --output $output_path --prompt $final_prompt ``` **此升级旨在将该技能从一个简单的工具，转变为一个可靠、智能的自动化解决方案，杜绝“创意抽卡”，确保交付结果的确定性。**


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: justoneapi/justoneapi-web-markdown (version 1.0.0)

--- name: Web Page Markdown Content API description: Call GET /api/web/markdown/v1 for Web Page Markdown Content through JustOneAPI with url. author: JustOneAPI homepage: https://api.justoneapi.com metadata: {"openclaw":{"homepage":"https://api.justoneapi.com","primaryEnv":"JUST_ONE_API_TOKEN","requires":{"bins":["node"],"env":["JUST_ONE_API_TOKEN"]},"skillKey":"justoneapi_web_markdown"}} --- # Web Page Markdown Content Use this focused JustOneAPI skill for markdown Content in Web Page. It targets `GET /api/web/markdown/v1`. Required non-token inputs are `url`. OpenAPI describes it as: Get the Markdown content of a web page. ## Endpoint Scope - Platform key: `web` - Endpoint key: `markdown` - Platform family: Web Page - Skill slug: `justoneapi-web-markdown` | Operation | Version | Method | Path | OpenAPI summary | | --- | --- | --- | --- | --- | | `markdownV1` | `v1` | `GET` | `/api/web/markdown/v1` | Markdown Content | ## Inputs | Parameter | In | Required by | Optional by | Type | Notes | | --- | --- | --- | --- | --- | --- | | `url` | `query` | all | n/a | `string` | The URL of the web page to fetch | Request body: none documented; send parameters through path or query arguments. ## Version Choice Use `markdownV1` for the documented `v1` endpoint. There are no alternate versions grouped in this skill. ## Run This Endpoint Supported operation IDs in this skill: `markdownV1`. ```bash node {baseDir}/bin/run.mjs --operation "markdownV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"url":"<url>"}' ``` Ask for any missing required parameter before calling the helper. Keep user-provided IDs, cursors, keywords, and filters unchanged. ## Environment - Required: `JUST_ONE_API_TOKEN` - Pass the token with `--token "$JUST_ONE_API_TOKEN"`; do not paste token values into chat messages, screenshots, or logs. - Get a token from [Just One API Dashboard](https://dashboard.justoneapi.com/en/login?utm_source=clawhub.ai&utm_medium=referral&utm_campaign=justoneapi_web_markdown&utm_content=project_link). - Authentication details: [Just One API Usage Guide](https://docs.justoneapi.com/en/?utm_source=clawhub.ai&utm_medium=referral&utm_campaign=justoneapi_web_markdown&utm_content=project_link). ## Output Focus - State the operation ID and endpoint path used, for example `markdownV1` on `/api/web/markdown/v1`. - Echo the required lookup scope (`url`) before summarizing results. - Prioritize fields that support this endpoint purpose: Get the Markdown content of a web page. - Return raw JSON only after the short, endpoint-specific summary. - If the backend errors, include the backend payload and the exact operation ID.


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: allens0104/content-summary (version 1.0.0)

--- name: content-summary description: Short alias for content-search-summarization. Use this to search public content platforms, rank the top relevant items, and summarize them with links. license: Proprietary session artifact for local Copilot use --- # Content summary skill This is the short public alias for: - `content-search-summarization` Also available as simpler aliases: - `summary` - `内容摘要` Use this skill when you want to: - search Bilibili, YouTube, or similar public content platforms - pick the top N relevant results for a topic - summarize each item in Chinese with links ## Primary guidance 1. Prefer `opencli` for supported platforms. 2. If `opencli` is unavailable, fall back to Playwright scraping of public result pages. 3. Rank by relevance first, popularity second. 4. Open selected result pages and use metadata to improve summaries. 5. Use a structured output with source, capture time, link, summary, and confidence. ## Key rules - Always include source links. - Include capture time or say when the timestamp is not visible. - Do not pretend a full video was watched if only metadata was collected. - Phrase summaries conservatively when based on public page metadata. - Add a confidence label and a short caveat when the summary is metadata-based. ## Quick invocation template You do not need to use only `/content-summary`. Reliable invocation patterns include: 1. `/content-summary` 2. `use the content-summary skill` 3. a natural-language request that clearly asks for content search, ranking, and summary output Use prompts like: ```text Use /content-summary to find the top 5 results for <topic> on <platform> and summarize each item with links and confidence labels. ``` ```text 使用 /content-summary 在 <平台> 搜索 <主题>，筛选 Top 5，并输出带链接与置信度的摘要。 ``` ```text Please find the top results for <topic> on <platform>, rank them by relevance, and summarize each item with links and confidence notes. ``` ## Output contract The skill output should always include: 1. search method used (`opencli` or fallback) 2. keyword and capture scope 3. ranked results with links 4. per-item confidence and caveat 5. explicit note when summaries are metadata-inferred ## Pointer For the full detailed playbook, also see: - `skills/content-search-summarization/SKILL.md` in this repository


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: kxrbx/schemaorg-site-enhancer (version 0.1.0)

--- name: schemaorg-site-enhancer description: Helps agents integrate Schema.org structured data into websites for rich search results, better SEO, and improved communication with search engines. Provides ready-to-use JSON-LD templates, generation scripts, and implementation patterns for common schema types. author: Chaika package: schemaorg-site-enhancer runtime: node version: 0.1.0 --- # Schema.org Site Enhancer This skill enables OpenClaw agents to embed Schema.org structured data (JSON-LD) into web pages, boosting SEO, enabling rich snippets, and improving how search engines understand content. ## Features - Ready‑to‑use JSON‑LD templates for FAQPage, HowTo, Article, Product, LocalBusiness, Event, Organization, and more. - Helper functions to generate structured data from simple inputs. - Guidance on where to inject the `<script type="application/ld+json">` tag in HTML. - Validation helpers to ensure generated JSON‑LD conforms to schema.org specifications. - Example usage patterns for static sites, React/Vue apps, and SSR frameworks. ## How to Use ### 1. Install the skill ```bash clawhub install schemaorg-site-enhancer ``` ### 2. Import in your agent code or scripts ```javascript const { generateFAQPage, injectJSONLD } = require('schemaorg-site-enhancer'); ``` ### 3. Example: Create an FAQPage ```javascript const faqData = { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is Schema.org?", "acceptedAnswer": { "@type": "Answer", "text": "Schema.org is a collaborative, community activity with a mission to create, maintain, and promote schemas for structured data on the Internet." } }, { "@type": "Question", "name": "Why use JSON-LD?", "acceptedAnswer": { "@type": "Answer", "text": "JSON-LD is the recommended format for Schema.org because it’s easy to read, doesn’t interfere with HTML, and is supported by all major search engines." } } ] }; const jsonLD = generateFAQPage(faqData); // jsonLD is now a ready‑to‑insert <script type="application/ld+json"> block ``` ## Provided Utilities - `generateFAQPage(data)` – returns a JSON‑LD string for an FAQPage. - `generateHowTo(data)` – creates a HowTo schema. - `generateArticle(data)` – for news articles or blog posts. - `generateProduct(data)` – for e‑commerce product pages. - `injectJSONLD(html, jsonLD)` – inserts the script tag into the `<head>` of an HTML string. - `validateJSONLD(jsonLD)` – basic syntax and @type validation. ## Installation Requirements - Node.js ≥ 14 - No external dependencies (uses only built‑in Node modules) ## License MIT ## Contributing Feel free to open issues or submit pull requests to add more schema types or improve the templates.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: thanksjj/auto-testcase-generator (version 1.1.0)

--- name: testcase-generator version: 1.1.0 description: Automated test case generation from project documents. This skill should be used when generating structured test cases from requirements documents, API specifications, or project documentation. It extracts test variables, analyzes embedded images and flowcharts, creates flow diagrams, performs path coverage analysis, and outputs Excel test case files following standard templates. --- > ✍️ **作者：十年腾讯测试小白** # 测试用例生成器 - **当前版本**：v1.1.0 - **v1.1.0**：新增「端到端流程」第七维度覆盖设计 - **v1.0.0**：初始版本，支持六维度覆盖设计、四阶段工作流、三层交叉验证 从需求文档（PDF、Word、Markdown）自动生成结构化 Excel 测试用例，支持图片/流程图智能分析，确保测试覆盖完整。 ## 核心能力 1. **文档解析**：PDF、Word、Markdown 需求文档，提取文本和嵌入图片/流程图 2. **图片处理**：解读流程图/状态图/序列图，转化为可测试场景 3. **变量提取**：识别测试变量、边界值、边界条件 4. **流程可视化**：生成 Mermaid 格式流程图 5. **路径覆盖**：确保所有执行路径和决策点完全覆盖 6. **用例生成**：按标准模板生成 Excel 文件，单工作表按模块分组 7. **验证报告**：三层交叉验证（规则→用例、用例→规则、标准→用例） ## 依赖工具 | 工具 | 版本 | 用途 | |------|------|------| | Python | ≥3.8 | 脚本运行 | | PyMuPDF (fitz) | ≥1.23 | PDF图片提取 | | openpyxl | ≥3.1 | Excel生成 | ## Checklist 规范（强制执行） 每阶段必须：列表展示checklist → 逐项打勾 → 输出上下文传递卡 → 等待用户确认。 ## 标准工作流程 ### 阶段零：测试范围确认 接收文档后先划清测试边界，三区域划分： - **Zone 1（核心区）**：直接测试的功能，完整分析并生成用例 - **Zone 2（交互区）**：有交互的外部模块，仅作背景知识 - **Zone 3（外部区）**：无关内容，排除 输出范围确认表 → checklist → 传递卡 → 用户确认。 ### 阶段一：需求深度分析（仅 Zone 1） 入口引用阶段零传递卡，执行： 1. 文档解析（文本+图片），Zone 2 精简为背景知识 2. 需求建模：提取规则（DR/BR/PR/CR/SR）、记录缺口和假设 3. 需求缺口识别：标注严重程度 4. 测试标准定义：正确性/性能/可靠性验收标准 5. 风险评估：Top 5 关键风险 6. 输出需求分析简报（格式参考 `references/analysis_template.md`） 输出 checklist → 传递卡 → 用户确认。 ### 阶段二：模块识别与用例设计 入口引用阶段一传递卡，执行： 1. 功能模块划分 2. **七维度覆盖设计**：功能/异常/边界/集成/性能/安全/端到端 3. 模块复杂度评估（🟢低5~10条/🟡中10~25条/🔴高25~50+条） 4. 同步分配优先级（P0/P1/P2/P3）和测试类型 5. 端到端流程独立分组，串联完整业务路径（3~10条） 6. 模块-维度覆盖矩阵 达标标准：规则覆盖100%、每模块≥5/7维度、缺口覆盖100%、单模块≥5条。 输出 checklist → 传递卡 → 用户确认。 ### 阶段三：Excel 输出 入口引用阶段二传递卡，执行： 1. 读取模板（有则用，无则默认格式），格式参考 `references/excel_format.md` 2. 12列标准结构：用例编号/优先级/测试类型/模块/场景/测试点/操作步骤/预期结果/测试结果/用例生成依据/图像来源/截图 3. 格式自检：列数完整、编号连续、优先级着色、测试类型合规、换行符chr(10)、模块分隔行`【模块名称】` 4. 优先级分布：P0:10~15%, P1:30~40%, P2:30~40%, P3:10~20% 输出 checklist → 传递卡 → 用户确认。 ### 阶段四：三层交叉验证 入口引用阶段三传递卡+阶段一验证基准，执行： - **第一层（规则→用例）**：每条规则至少1条用例覆盖，100%覆盖率 - **第二层（用例→规则）**：每条用例可追溯到规则，0条孤立用例 - **第三层（标准→用例）**：验收标准和Top5风险有对应用例 未通过自动修复→重新验证，直到全部通过。 输出验证汇总报告 → checklist → 传递卡 → 用户确认。 ### 阶段五：交付 交付物：Excel用例文件 + 需求分析简报 + 验证报告 + 全流程Checklist汇总表 + 关键指标汇总。 ## 视觉内容处理 | 类型 | 方法 | 影响 | |------|------|------| | 流程图 | 提取决策节点和路径 | 路径和分支用例 | | 状态图 | 提取状态和转换条件 | 状态转换用例 | | 序列图 | 识别消息流和时序 | 集成和时序用例 | | UI原型 | 分析界面元素 | UI交互用例 | PDF图片提取使用 `scripts/extract_pdf_images.py`（xref+MD5去重+质量过滤）。 ## 最佳实践 1. 按阶段零→一→二→三→四→五顺序执行，每阶段用户确认后才进入下一步 2. 每阶段输出可见checklist和上下文传递卡 3. 单工作表输出，模块分隔用`【模块名称】`（不用`=`开头） 4. 换行符用chr(10)+wrap_text，不用字符串`\n` 5. 每条用例标注生成依据，确保可追溯 6. 需求缺口标注"待确认"并给出测试假设 7. 交付前必须通过三层交叉验证 ## 资源说明 - `scripts/extract_pdf_images.py`：PDF图片优化提取 - `references/excel_format.md`：Excel输出格式规范 - `references/analysis_template.md`：需求分析简报模板 - `references/image_processing.md`：图片处理最佳实践


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)