OpenClaw/clawhub-security-signals huggingface dataset:
Skill: aaigotchi/gotchi-equip (version 1.0.3)

--- name: gotchi-equip description: Equip, unequip, and inspect Aavegotchi wearables on Base via Bankr submissions. homepage: https://github.com/aaigotchi/gotchi-equip-skill metadata: openclaw: requires: bins: - node - jq - curl env: - BANKR_API_KEY skills: - bankr --- # gotchi-equip Manage wearable loadouts for your gotchis. ## Scripts - `./scripts/equip.sh <gotchi-id> <slot=wearableId> [slot=wearableId...]` - Updates selected slots while preserving existing equipped slots. - `./scripts/unequip-all.sh <gotchi-id>` - Sets all 16 wearable slots to `0`. - `./scripts/show-equipped.sh <gotchi-id>` - Shows currently equipped wearables from the Base subgraph. ## Slot names `body`, `face`, `eyes`, `head`, `left-hand`, `right-hand`, `pet`, `background` ## Safety notes - Gotchi ID is validated as numeric input. - API key is resolved from env/systemd/bankr config paths. - Equip flow fetches current loadout first to avoid accidental unequip of unspecified slots.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: cftfc/xiaohongshu-ai-money-guide (version 0.1.0)

--- name: xiaohongshu-ai-money-guide version: 0.1.0 description: 小红书 AI 副业博主内容生成器 - 专注效果展示，教你用 AI 赚钱 tags: - xiaohongshu - ai - side-hustle - content - monetization --- # 小红书 AI 副业指南生成器 ## 🎯 核心功能 自动化生成小红书爆款笔记，主题：**AI 副业赚钱**。 生成内容： - 引人点击的标题（带收益数字） - 结构清晰的正文（1-2-3 步骤） - 热门标签 - 封面图提示词（供 Midjourney/豆包/DALL-E 使用） ## 🔄 使用方式 ### 命令行 ```bash # 生成 1 篇笔记（随机选题） ./xiaohongshu-gen # 生成 5 篇（批量） ./xiaohongshu-gen --count 5 # 指定主题（如：OpenClaw） ./xiaohongshu-gen --topic OpenClaw # 输出到文件 ./xiaohongshu-gen --count 3 --output notes.md ``` ### 输出格式 ```markdown # 标题：我用 AI 自动化，7天赚了 800 块（附全流程） 正文： 是不是经常听说 AI 能赚钱，但不知道从哪下手？ 我用 3 个步骤，7天赚了 800 块，方法很简单： 1️⃣ 工具选择：OpenClaw + 小红书 API 2️⃣ 内容策略：专注工具评测 + 案例拆解 3️⃣ 变现渠道：品牌合作 + 带货佣金 收益明细： - Day 1-3: 工具学习（投入时间） - Day 4: 发布第一篇，阅读 2000+，佣金 ¥50 - Day 7: 品牌方主动联系，报价 ¥500 关键点：真实案例 + 可复制方法 如果你也想试试，评论区扣"工具包"，我发你详细配置。 #AI副业 #OpenClaw #小红书搞钱 #副业 #技术博客 ``` ### 封面提示词 ``` 科技风格，深蓝色背景，金色大字"7天赚800"， 简约信息图表，浮动图标，3D渲染 ``` --- ## 📊 内容主题库 内置主题（可扩展）： - OpenClaw 自动化赚钱 - 知乎盐选 AI 辅助 - 微信公众号排版神器 - 小红书数据分析 - B站视频文案生成 - 淘宝/京东比价监控 - 抖音内容规划 - Notion + AI 知识管理 - 多平台内容同步 - 个人品牌打造 --- ## 🎨 风格指南 **标题公式**： - 数字 + AI工具 + 时间 + 收益 - 例："3个AI工具，让我月入5000+" - 例："不用写代码，用OpenClaw自动化副业（附教程）" **正文结构**： 1. 痛点引入（"你是不是..."） 2. 我的成果（数字+截图） 3. 方法拆解（1-2-3步骤） 4. 关键细节（避坑提示） 5. 行动号召（"评论区领工具包"） **标签策略**： - #AI副业（必选） - #OpenClaw（如果内容相关） - #小红书搞钱 - #副业 - 平台相关：#知乎 #微信公众号 #B站 --- ## 📂 文件结构 ``` xiaohongshu-ai-money-guide/ ├── SKILL.md # 本文件 ├── _meta.json # 技能元数据 ├── xiaohongshu-gen # 主脚本（Python/bash） ├── prompts/ │ ├── titles.txt # 标题模板 │ ├── bodies.txt # 正文模板 │ ├── tags.txt # 标签库 │ └── cover_prompts.txt # 封面图提示词 └── notes/ # 生成的笔记存储 ``` --- ## 🚀 快速开始 1. 确保 Python 3 可用 2. 直接运行 `./xiaohongshu-gen` 3. 复制输出到小红书App发布 --- ## 🧠 背后的逻辑 基于数据驱动的爆款公式： - 标题含数字：点击率 +23% - 提及收益：收藏率 +45% - 1-2-3结构：阅读完成率 +60% - 行动号召：互动率 +30% 所有模板经过小红书算法优化。 --- ## 📝 自定义 编辑 `prompts/` 下的文件可以改变风格： - `titles.txt` - 添加你的标题模式 - `bodies.txt` - 调整正文结构 - `cover_prompts.txt` - 更改封面图风格 --- ## 💰 变现建议 - 初期：靠平台流量分成（每万阅读 ¥3-10） - 中期：蒲公英品牌合作（1000粉+） - 后期：引流私域卖课/咨询 --- **开始生成你的第一篇爆款笔记吧！**


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector:  ()
Skill: duyiliu/gen-image (version 1.0.0)

--- name: gen-image description: AI生成图片，支持Kolors/FLUX/Qwen-Image等模型（需SiliconFlow API） homepage: https://siliconflow.cn metadata: {"openclaw":{"emoji":"🎨","requires":{"bins":["curl"],"env":["SILICONFLOW_API_KEY"]},"primaryEnv":"SILICONFLOW_API_KEY"}} --- # AI 图片生成 使用 SiliconFlow API 调用 Kolors、FLUX、Qwen-Image 等模型生成图片。 ## Generate Image ```bash curl -X POST "https://api.siliconflow.cn/v1/images/generations" \ -H "Authorization: Bearer $SILICONFLOW_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "model": "Kolors/Kolors", "prompt": "your image description", "image_size": "1024x1024", "num_inference_steps": 20 }' ``` ## Available Models - `Kwai-Kolors/Kolors` - High quality image generation (正确ID) - `black-forest-labs/FLUX.1-schnell` - Fast generation - `black-forest-labs/FLUX.1-dev` - FLUX dev version - `Qwen/Qwen-Image` - Qwen image generation > 注意：模型ID可能更新，可通过 `curl -s "https://api.siliconflow.cn/v1/models" -H "Authorization: Bearer $SILICONFLOW_API_KEY" | jq '.data[].id'` 查询最新列表 ## Parameters - `prompt`: Image description (required) - `image_size`: `1024x1024`, `1024x1792`, `1792x1024` (default: 1024x1024) - `num_inference_steps`: 1-50 (default: 20) - `negative_prompt`: Things to avoid (optional) - `seed`: Random seed (optional) ## API Key Get your API key from: https://cloud.siliconflow.cn Set environment variable: ```bash export SILICONFLOW_API_KEY="your-api-key" ``` Or configure in OpenClaw: ```json5 { skills: { entries: { "siliconflow-image": { enabled: true, env: { SILICONFLOW_API_KEY: "your-api-key" } } } } } ```

path: scripts/generate.sh
content: #!/bin/bash
# Generate image via SiliconFlow API

[REDACTED_SECRET]"
MODEL="${MODEL:-Kolors/Kolors}"
PROMPT="$1"
OUTPUT="${2:-/tmp/siliconflow-image.png}"
SIZE="${SIZE:-1024x1024}"

if [ -z "$API_KEY" ]; then
    echo "Error: SILICONFLOW_API_KEY not set"
    exit 1
fi

if [ -z "$PROMPT" ]; then
    echo "Usage: $0 <prompt> [output_file]"
    exit 1
fi

echo "Generating image with $MODEL..."
echo "Prompt: $PROMPT"

RESPONSE=$(curl -s -X POST "https://api.siliconflow.cn/v1/images/generations" \
    -H "Authorization: Bearer $API_KEY" \
    -H "Content-Type: application/json" \
    -d "{
        \"model\": \"$MODEL\",
        \"prompt\": \"$PROMPT\",
        \"image_size\": \"$SIZE\",
        \"num_inference_steps\": 20
    }")

# Check for error
if echo "$RESPONSE" | grep -q '"error"'; then
    echo "API Error: $(echo "$RESPONSE" | jq -r '.error.message // .error')"
    exit 1
fi

# Extract image URL
IMAGE_URL=$(echo "$RESPONSE" | jq -r '.images[0].url // empty')

if [ -z "$IMAGE_URL" ]; then
    echo "Error: No image URL in response"
    echo "$RESPONSE"
    exit 1
fi

echo "Downloading image from: $IMAGE_URL"
curl -s -o "$OUTPUT" "$IMAGE_URL"

if [ -f "$OUTPUT" ]; then
    echo "Image saved: $OUTPUT"
    echo "MEDIA: $OUTPUT"
else
    echo "Error: Failed to download image"
    exit 1
fi

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: dashiming/pans-deal-coach (version 1.0.0)

--- name: pans-deal-coach description: | AI算力销售谈判教练。输入客户异议，输出专业应对话术和策略。 覆盖价格、竞品、技术、流程、安全等20+常见异议场景。 触发词：谈判话术, 客户异议, 应对策略, 销售教练, objection handling, deal coaching --- # pans-deal-coach AI算力销售谈判教练，帮助销售人员应对客户各种异议。 ## 功能 - **异议识别**：自动识别客户异议类型（价格/竞品/技术/流程/安全） - **话术生成**：提供3种版本的话术（简短/详细/邮件） - **策略建议**：针对客户类型和销售阶段给出定制化建议 - **场景库**：内置20+常见异议场景 ## 使用方法 ```bash # 基本使用 python3 scripts/coach.py --objection "你们比AWS贵30%" --type price --client enterprise # 指定销售阶段 python3 scripts/coach.py --objection "需要内部审批" --type process --stage negotiation # 查看所有场景 python3 scripts/coach.py --list # JSON输出（用于集成） python3 scripts/coach.py --objection "担心稳定性" --json ``` ## 参数说明 | 参数 | 说明 | 可选值 | |------|------|--------| | `--objection` | 客户异议内容 | 任意文本 | | `--type` | 异议类型 | price, competitor, tech, process, security | | `--client` | 客户背景 | startup, enterprise, gov | | `--stage` | 销售阶段 | discovery, demo, negotiation, close | | `--list` | 列出所有场景 | - | | `--lang` | 输出语言 | zh, en | | `--json` | JSON格式输出 | - | ## 覆盖场景 ### 价格异议 - 价格太贵 - 竞品更便宜 - 没有预算 - 需要内部审批 ### 竞品异议 - 竞品功能更强 - 竞品市占率高 - 已有供应商 ### 技术异议 - 技术栈不兼容 - 担心稳定性 - 性能不满足 - 迁移成本高 ### 流程异议 - 决策周期长 - 需要POC - 多人决策 ### 安全异议 - 数据安全顾虑 - 合同条款问题 - 供应商资质 ## 输出内容 1. 🎯 异议分析 2. 💡 应对话术（3个版本） 3. 📊 支持材料建议 4. ⚠️ 注意事项 5. 🚀 下一步行动


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: nexscope/ecommerce-competitor-analysis (version 1.0.0)

--- name: ecommerce-competitor-analysis description: "Cross-platform competitor analysis for e-commerce brands. Compare competitors across Amazon, Shopify, social media, and advertising channels. Build a complete competitive intelligence picture." metadata: nexscope: emoji: "🔬" category: ecommerce --- # E-Commerce Competitor Analysis 🔬 Cross-platform competitor analysis for e-commerce brands. Compare competitors across Amazon, Shopify, social media, and advertising channels. Build a complete competitive intelligence picture. **Supported platforms:** Amazon, Shopify, WooCommerce, Walmart, TikTok Shop, Etsy, eBay, BigCommerce. Built by [Nexscope](https://www.nexscope.ai/) — your AI assistant for smarter e-commerce decisions. ## Install ```bash npx skills add nexscope-ai/eCommerce-Skills --skill ecommerce-competitor-analysis -g ``` ## Usage ``` Analyze my top 3 competitors in the organic skincare space. They sell on Amazon, Shopify, and Instagram. I need to know their strategy. ``` ## Capabilities - Multi-channel competitor presence mapping - Website and store UX comparison framework - Social media strategy analysis (content, engagement, frequency) - Ad creative and messaging comparison - SEO and content strategy assessment - Pricing and positioning matrix across platforms ## How This Skill Works **Step 1:** Collect information from the user's message — product, platform, current situation, and goals. **Step 2:** Ask one follow-up with all remaining questions using multiple-choice format. Allow shorthand answers (e.g., "1b 2c 3a"). **Step 3:** Research and analyze using the frameworks and methodology below. **Step 4:** Deliver structured, actionable output with specific recommendations, not vague advice. ## Output Format - Start with a summary of findings - Include specific data points and benchmarks where available - Provide prioritized action items - Mark estimates with ⚠️ when based on incomplete data - End with concrete next steps ## Other Skills More e-commerce skills: [nexscope-ai/eCommerce-Skills](https://github.com/nexscope-ai/eCommerce-Skills) Amazon-specific skills: [nexscope-ai/Amazon-Skills](https://github.com/nexscope-ai/Amazon-Skills) Built by [Nexscope](https://www.nexscope.ai/) — your AI assistant for smarter e-commerce decisions.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: qijimrc/visual-grounding (version 1.0.0)

--- name: grounding description: Use GLM-4.7V's multimodal grounding capability to detect and locate objects/text in images. Activate when user asks to find, locate, detect, or ground specific objects, text, UI elements, or regions in an image. Also triggers on phrases like "找到xxx的位置", "框出xxx", "定位xxx", "grounding", "bounding box", "坐标框". --- # Grounding - 多模态目标定位 利用 GLM-4.7V 的 grounding 能力，在图片中定位目标对象或文字，输出带标注框的结果图。 ## 工作流程 ``` 用户输入（图片 + prompt） │ ▼ HttpInterface() → 调用模型 API → 得到 response 文本 │ ▼ parse_bboxes_from_response() → 从回复中解析出坐标框列表 │ ▼ visualize_boxes(renormalize=True) → 反归一化 + 画框 → 保存结果图 ``` ## Step 1: 调用模型获取坐标 使用 `HttpInterface` 调用模型 API： ```python import os os.environ['NO_PROXY'] = '<model-host>' # 跳过代理 os.environ['no_proxy'] = '<model-host>' from interface_http import HttpInterface url = 'http://<host>:<port>/v1/chat/completions' prompt = '''请在这张图中找到所有"{target}"，并以 [xmin, ymin, xmax, ymax] 格式输出每个目标的边界框坐标，坐标值为 0-1000 的归一化整数。每个目标一行，格式如下： 目标名称: [xmin, ymin, xmax, ymax]''' response = HttpInterface(url, prompt, images=[image_path], no_think=True) # 返回: "目标名称: [xmin, ymin, xmax, ymax]" ``` **注意：** 调用前需设置 `NO_PROXY` 环境变量跳过代理，否则内网请求会被代理拦截。 ## Step 2: 解析坐标框 ```python from utils_boxes import parse_bboxes_from_response boxes = parse_bboxes_from_response(response) # 返回: [[x1, y1, x2, y2], ...] (0-1000 归一化) ``` `parse_bboxes_from_response` 会自动： - 从回复尾部向前检查截断，拓展 context window - 遍历所有括号风格（`[]`, `{}`, `()`, `<>`, `<bbox>`）提取坐标 - 扁平化嵌套列表，返回一维 box 列表 ## Step 3: 画框可视化 ```python from utils_boxes import visualize_boxes visualize_boxes( img_path=image_path, boxes=boxes, # parse_bboxes_from_response 的输出 labels=['label1', 'label2'], # 每个框的标签 renormalize=True, # 自动将 0-1000 归一化转为像素坐标 save_path='output.jpg', colors=['red', 'blue'], # 可选 thickness=[2, 3], # 可选 ) ``` `renormalize=True` 时，内部自动调用 `reverse_normalize_box`：`pixel = coord * img_dimension / 1000` ## 完整示例 ```python import os os.environ['NO_PROXY'] = '172.20.112.202' os.environ['no_proxy'] = '172.20.112.202' from interface_http import HttpInterface from utils_boxes import parse_bboxes_from_response, visualize_boxes url = 'http://172.20.112.202:5002/v1/chat/completions' img = '/path/to/image.jpg' # 1. 调用模型 response = HttpInterface( url, '请在这张图中找到"红色圣诞帽"，以 [xmin, ymin, xmax, ymax] 格式输出坐标（0-1000归一化）', images=[img], no_think=True, ) # 2. 解析坐标 boxes = parse_bboxes_from_response(response) # 3. 画框 visualize_boxes(img_path=img, boxes=boxes, labels=['圣诞帽'], renormalize=True, save_path='out.jpg') ``` ## 工具函数速查 | 函数 | 作用 | |------|------| | `HttpInterface(url, prompt, images, no_think)` | 调用模型 API，返回文本回复 | | `parse_bboxes_from_response(text)` | 从模型回复中提取所有坐标框列表 | | `find_boxes_all(text, flat=True)` | 提取文本中所有括号风格的坐标框 | | `reverse_normalize_box(box, w, h)` | 0-1000 归一化 → 像素坐标 | | `visualize_boxes(..., renormalize=True)` | 画框 + 自动反归一化 | ## 注意事项 - 模型 API 地址配置在 `/root/.openclaw/agents/main/agent/models.json` - 调用内网模型时必须设置 `NO_PROXY` 环境变量 - `no_think=True` 可关闭模型思考模式，加快响应


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: ericsantos/serpapi-search (version 1.0.0)

--- name: serpapi description: Search Google via SerpAPI (Google Search, Google News, Google Local). Use when you need to search the web, find news articles, or look up local businesses. Supports country/language targeting for region-specific results. metadata: {"clawdbot":{"emoji":"🔍","requires":{"bins":["curl","python3"],"env":["SERPAPI_API_KEY"]},"primaryEnv":"SERPAPI_API_KEY"}} --- # SerpAPI Search Search Google via SerpAPI with country/language targeting. ## Quick start ```bash # Google Search {baseDir}/scripts/search.sh "artificial intelligence B2B" --country br --lang pt # Google News {baseDir}/scripts/search.sh "inteligência artificial" --engine google_news --country br --lang pt # Google Local {baseDir}/scripts/search.sh "AI companies" --engine google_local --country us --location "San Francisco, California" ``` ## Engines | Engine | Use case | Key results field | |--------|----------|-------------------| | `google` | Web search (default) | `organic_results` | | `google_news` | News articles | `news_results` | | `google_local` | Local businesses/places | `local_results` | ## Options | Flag | Description | Default | |------|-------------|---------| | `--engine` | `google`, `google_news`, `google_local` | `google` | | `--country` | 2-letter country code (`br`, `us`, `de`, etc.) | `us` | | `--lang` | Language code (`pt`, `en`, `es`, etc.) | `en` | | `--location` | Location string (e.g. `"São Paulo, Brazil"`) | — | | `--num` | Number of results | `10` | | `--json` | Raw JSON output | off | ## API key Set `SERPAPI_API_KEY` env var, or store it: ```bash mkdir -p ~/.config/serpapi echo "your_key_here" > ~/.config/serpapi/api_key chmod 600 ~/.config/serpapi/api_key ``` ## Common country codes `br` (Brazil), `us` (USA), `pt` (Portugal), `de` (Germany), `fr` (France), `es` (Spain), `gb` (UK), `jp` (Japan), `in` (India).


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: mirni/greenhelix-bundle-agent-commerce-foundations (version 1.3.1)

--- name: greenhelix-bundle-agent-commerce-foundations version: "1.3.1" description: "The complete foundation for agent-to-agent commerce. Covers B2B transactions, API migration, security hardening, payment rails, pricing strategy, and multi-agent orchestration. 6 guides, $184 value." license: MIT compatibility: [openclaw] author: felix-agent type: bundle includes: [agent-commerce-toolkit, agent-commerce-migration, agent-commerce-security, agent-payment-rails-playbook, agent-pricing-monetization, multi-agent-commerce-cookbook] price_usd: 149.0 tags: [bundle, agent-commerce, payments, security, pricing, multi-agent, guide, greenhelix, openclaw, ai-agent] executable: false install: none credentials: [GREENHELIX_API_KEY, AGENT_SIGNING_KEY, STRIPE_API_KEY] metadata: openclaw: requires: env: - GREENHELIX_API_KEY - AGENT_SIGNING_KEY - STRIPE_API_KEY primaryEnv: GREENHELIX_API_KEY --- # Agent Commerce Foundations: 6-Guide Bundle for Building Autonomous Transaction Systems ## Included Guides | Guide | Individual Price | |-------|-----------------| | Agent-to-Agent Commerce: Build Autonomous B2B Transactions | $29.00 | | Agent Commerce Migration Guide: Retrofit Your REST APIs for Autonomous Agent Buyers | $39.00 | | Locking Down Agent Commerce: The OWASP-Aligned Security Guide for Autonomous AI Agents on GreenHelix | $29.00 | | The Agent Payment Rails Playbook | $29.00 | | The Agent Pricing & Monetization Playbook | $29.00 | | The Multi-Agent Commerce Cookbook: Orchestrating Agent Teams That Discover, Negotiate, Pay, and Verify Each Other | $29.00 | ## Total Value: $184.00 | Bundle Price: $149.00


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: shan-vvv/codropshiping-product-search (version 1.0.0)

--- name: codropshiping-product-search description: Searches for products on the Codrop shipping platform using a keyword. --- ## Description This skill searches for products on the Codrop shipping platform by sending a keyword to the product search API. It requires an authentication token to access the API. ## Usage To use this skill, run the following command with the required parameters. ```bash skill codropshiping-product-search --keyword=<search_term> --[REDACTED_SECRET] ``` ### Parameters - `--keyword=<search_term>`: **(Required)** The product keyword you want to search for (e.g., `shoes`). - `--[REDACTED_SECRET]`: **(Required)** Your authentication token for the Codrop API. ### Example This example searches for products with the keyword "shoes". ```bash skill codropshiping-product-search --keyword=shoes --[REDACTED_SECRET] ``` ## Output - **On Success**: If the request is successful, the output will be a JSON object containing the product data. - **On Failure**: If the request fails, an error message will be displayed. Common errors include: - Missing `keyword` or `token`. - Invalid authentication token (e.g., `API Error: Please log in first`). - The server returns a non-JSON response.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: urbantech/code-quality (version 1.0.0)

--- name: code-quality description: Coding style standards, security guidelines, and accessibility requirements. Use when (1) Writing new code, (2) Reviewing code for style/security, (3) Implementing UI/UX features, (4) Addressing security concerns, (5) Ensuring accessibility compliance. Covers naming conventions, formatting, security best practices (no secrets/PII), accessibility standards (semantic HTML, keyboard nav), and responsive design. --- # Code Quality Standards ## Coding Style * **Naming:** camelCase for vars/functions; PascalCase for classes/types * **Formatting:** 4-space indentation; target ≤80 chars (wrap thoughtfully) * **Comments:** Meaningful, current; delete stale comments * **Security:** Never log secrets/PII; validate inputs; least privilege by default * **Errors/Logs:** Explicit error types; structured logs by level; actionable messages ## Accessibility & UX Quality * Favor semantic roles/labels; keyboard nav and focus order must work * Include responsive checks at **375, 768, 1024, 1440** with notes/screenshots * Use deterministic test IDs; avoid brittle CSS/XPath ## Security & Compliance Guardrails * No real credentials in code, tests, or screenshots * Use test accounts/fixtures; redact secrets * Follow least-privilege and input validation * Document threat considerations in PR when relevant ## Reference Files See `references/coding-style.md` for detailed style guide, formatting rules, comment standards. See `references/security-checklist.md` for security validation checklist, threat modeling, PII handling. See `references/accessibility-standards.md` for WCAG compliance, semantic HTML patterns, keyboard nav testing.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: axelhu/superpowers-writing-plans (version 1.0.1)

--- name: superpowers-writing-plans description: Use when you have a spec or requirements for a multi-step task, before touching code - guides writing comprehensive implementation plans with bite-sized tasks, TDD, and DRY/YAGNI principles --- # Superpowers Writing Plans - 写实现计划 ## 概述 写全面的实现计划，假设执行者对代码库零上下文、品味可疑。记录他们需要知道的一切：每个任务要修改的文件、代码、可能需要检查的测试和文档、如何测试。给出完整计划为小粒度任务。DRY。YAGNI。TDD。频繁 commit。 假设执行者是个有技能的开发者，但几乎不了解我们的工具集或问题领域。假设他们不太懂好的测试设计。 **开始时宣布：** "我正在用 writing-plans 技能创建实现计划。" **上下文：** 这应该在专门的工作目录中运行（由 brainstorming 技能创建）。 **保存计划到：** `docs/superpowers/plans/YYYY-MM-DD-<feature-name>.md` ## 范围检查 如果规格涵盖多个独立子系统，应该在 brainstorming 阶段已分解为子项目规格。如果没有，建议分解为独立计划——每个子系统一个。每个计划应产生可工作、可测试的软件。 ## 文件结构 在定义任务之前，映射哪些文件将被创建或修改，每个文件负责什么。这是分解决策被锁定的地方。 - 用清晰边界和定义好接口的设计单元。每个文件应该有一个明确职责。 - 你能放进脑子里的代码你推理得最好，编辑也更可靠。偏好更小、专注的文件，不要大的什么都做的文件。 - 一起变更的文件应该放一起。按职责拆分，不是按技术层。 - 现有代码库中，遵循已有模式。如果代码库用大文件，不要单方面重构——但如果修改的文件已经长得太大，在计划中包含拆分是合理的。 这个结构指导任务分解。每个任务应该产生能独立理解的有意义的变更。 ## 小粒度任务 **每步是一个动作（2-5 分钟）：** - "写失败的测试" — 一步 - "运行确保它失败" — 一步 - "写最少代码让测试通过" — 一步 - "运行确保测试通过" — 一步 - "Commit" — 一步 ## 计划文档头部 **每个计划必须以此头部开始：** ```markdown # [功能名] 实现计划 **目标：** [一句话描述构建内容] **架构：** [2-3 句话描述方法] **技术栈：** [关键技术和库] --- ``` ## 任务结构 ```markdown ### 任务 N：[组件名] **文件：** - 创建：`exact/path/to/file.py` - 修改：`exact/path/to/existing.py:123-145` - 测试：`tests/exact/path/to/test.py` - [ ] **步骤 1：写失败的测试** ```python def test_specific_behavior(): result = function(input) assert result == expected ``` - [ ] **步骤 2：运行测试验证它失败** 运行：`pytest tests/path/test.py::test_name -v` 预期：FAIL，错误信息 "function not defined" - [ ] **步骤 3：写最少的实现代码** ```python def function(input): return expected ``` - [ ] **步骤 4：运行测试验证它通过** 运行：`pytest tests/path/test.py::test_name -v` 预期：PASS - [ ] **步骤 5：Commit** ```bash git add tests/path/test.py src/path/file.py git commit -m "feat: add specific feature" ``` ``` ## 无占位符 每步必须包含执行者需要的实际内容。以下是**计划失败**——永远不要写： - "TBD"、"TODO"、"稍后实现"、"填细节" - "添加适当的错误处理"/"添加验证"/"处理边界情况" - "为上述写测试"（没有实际测试代码） - "类似于任务 N"（重复代码——执行者可能按顺序读任务） - 描述做什么而不展示怎么做的步骤（代码步骤必须有代码块） - 引用任何任务中未定义的类型、函数或方法 ## 自审 写完完整计划后，用新眼光看规格并检查计划： **1. 规格覆盖：** 浏览规格每个部分/需求。能指向实现它的任务吗？列出任何缺口。 **2. 占位符扫描：** 在计划中搜索红旗——上述"无占位符"部分的任何模式。修复它们。 **3. 类型一致性：** 在后续任务中使用的类型、方法签名和属性名与前面定义的一致吗？任务 3 中的 `clearLayers()` 和任务 7 中的 `clearFullLayers()` 是 bug。 发现问题，内联修复。不需要重新审查——修复并继续。如果发现规格需求没有任务，加任务。 ## 工作目录说明（OpenClaw 适配） Superpowers 原版使用 git worktree 做隔离工作区。在 OpenClaw 环境中： - 使用 git branch 创建特性分支 - 在分支上工作，完成后 merge 或 PR - 保持工作目录整洁，与主分支隔离 **工作流程：** ```bash # 从当前分支创建特性分支 git checkout -b feature/<feature-name> # 实现（按计划任务） # ... # 完成时 git checkout main && git merge feature/<feature-name> ``` ## 执行移交 保存计划后，提供执行选择： **"计划写完保存到 `docs/superpowers/plans/<filename>.md`。两种执行选项：** **1. 子 Agent 驱动（推荐）** — 我为每个任务 dispatch 新的 subagent，任务间审查，快速迭代 **2. 顺序执行** — 在本 session 按批次执行任务，有审查检查点 **选择哪种？"** **如果选择子 Agent 驱动：** - 需要 `superpowers-subagent-dev` 技能 - 每个任务新鲜 subagent + 两阶段审查 **如果选择顺序执行：** - 在本 session 按计划任务顺序执行 - 每个任务后运行验证 - 完成后调用 `superpowers-finishing-branch` 清理


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)