--- name: automatic-skill description: | 每日 Skill 自动工厂 — 让 openclaw 和 Claude 完全自主地调研、设计、生成、测试并发布全新 skill，全程零人工介入。内置 10 阶段流水线（Research → Design → SEO → Create → Review → Self-Run → Self-Check → Upload → Verify → Final Review），每天凌晨 02:00 自动选题跑完整流程，输出推送到 GitHub 和 clawHub 的生产级 skill。也可手动指定 idea 触发，或单独调用某一阶段进行调试/迭代。支持用自身流水线对已有 skill 做升级、SEO 优化和重新发布。Use it when the user asks to auto-generate a skill, check daily pipeline status, iterate an existing skill, or publish to GitHub and clawHub. keywords: - automatic-skill - 自动skill - 每日skill - skill流水线 - 技能工厂 - 自动开发 - 自动测试 - 自动发布 - 元技能 - skill pipeline - skill factory - meta skill - daily skill - auto build skill - auto publish skill - 自动生成skill - 自动制作技能 - 今日skill - 生成新skill - skill自动化 - openclaw skill - clawhub publish - github skill upload - 每日技能推送 - 10阶段流水线 - cron skill - skill迭代 - skill升级 - skill SEO优化 - self-evolving skill - skill自检 - prompt generator pipeline - 零人工介入 - 自动化内容生产 requirements: node: ">=18" binaries: - name: gh required: true description: "GitHub CLI — used for auth, repo access, push verification, and PR creation." - name: git required: true description: "Git — used for staging, committing, and pushing skill files." - name: clawhub required: true description: "ClawHub CLI — used for publishing skills to the registry." - name: npx required: false description: "Node package runner — used optionally during skill creation stage." env: - name: GITHUB_TOKEN required: true description: "GitHub personal access token with repo write permission (narrowly scoped to a single repo)." - name: GITHUB_REPO required: true description: "Target repository in owner/repo format, e.g. myorg/openclaw-skills" - name: CLAWHUB_TOKEN required: true description: "ClawHub API token for publishing skills to the registry." - name: CLAWHUB_OWNER_ID required: false description: "ClawHub ownerId override. Defaults to the publishing account." - name: SKILL_OUTPUT_DIR required: false description: "Directory where generated skills are written. Defaults to ~/.openclaw/workspace/skills." - name: OPENCLAW_NOTIFY_CHANNEL required: false description: "Notification channel for pipeline failure alerts (e.g. slack://...)." metadata: openclaw: homepage: "https://github.com/Cosmofang/automatic-skill" author: "Cosmofang" runtime: node: ">=18" permissions: - "Reads and writes files in SKILL_OUTPUT_DIR" - "Creates GitHub repositories via gh CLI using GITHUB_TOKEN" - "Pushes commits to GITHUB_REPO via gh CLI" - "Publishes skills to clawHub using CLAWHUB_TOKEN" - "Registers cron jobs via openclaw cron (when push-toggle is enabled)" env: - name: GITHUB_TOKEN required: true description: "GitHub personal access token — must have 'repo' scope. Scoped to your own repos only. Used by gh CLI to create repos and push commits." - name: GITHUB_REPO required: true description: "Target monorepo in owner/repo format, e.g. yourname/openclaw-skills. Must be a repo you own." - name: CLAWHUB_TOKEN required: true description: "ClawHub API token. Used only to publish skills under your own clawHub account." - name: CLAWHUB_OWNER_ID required: false description: "Your clawHub ownerId. If omitted, defaults to the account associated with CLAWHUB_TOKEN." - name: SKILL_OUTPUT_DIR required: false description: "Where generated skills are written. Defaults to ~/.openclaw/workspace/skills." - name: OPENCLAW_NOTIFY_CHANNEL required: false description: "Notification channel for pipeline failure alerts (e.g. slack://...)." --- # Automatic Skill — 每日 Skill 自动工厂 > 每天凌晨自动调研 → 设计 → 制作 → 审核 → 自测 → 发布 → 复查，全程无需人工介入（发布阶段使用你自己的 GitHub/clawHub 凭证） --- ## ⚠️ Credentials **Stages 1–7 use zero credentials.** Only Stage 8 (Upload) and beyond touch your accounts. | Stage | Action | Credential | What gets written | |-------|--------|-----------|-------------------| | 1–7 | Research, Design, SEO, Create, Review, Self-Run, Self-Check | None | Local files only | | 8a | `gh repo create / --public` | `GITHUB_TOKEN` | New public repo on your GitHub account | | 8b | `git push` to `GITHUB_REPO` | `GITHUB_TOKEN` | New commits to the monorepo you set | | 8c | `clawhub publish` | `CLAWHUB_TOKEN` | Skill listed publicly under your clawHub account | | 9–10 | Verify, Final Review | `GITHUB_TOKEN` (read-only `gh api`) | Nothing — read-only checks | | Cron | Daily auto-run (`push-toggle on`) | None | Registers a local cron job via `openclaw cron` | **Does NOT:** - Read, transmit, or log credentials - Access repos or accounts other than the ones you configure - Execute network operations from scripts — all network actions go through `gh` CLI and `clawhub` CLI under your control - Run Stage 8 in `--dry-run` mode (safe for testing entire pipeline without publishing) **Minimum token scopes:** - `GITHUB_TOKEN`: fine-grained PAT → single repo → **Contents: Read & write** only - `CLAWHUB_TOKEN`: keep in shell env (`~/.zshrc`), never commit to any file --- ## Purpose & Capability automatic-skill 是一个**元技能（meta-skill）**，它的能力是制造其他 skill。 **架构说明（重要）：** 每个阶段脚本是"prompt generator" — 脚本本身不执行任何业务逻辑，只输出结构化 prompt。真正的执行者是 agent（Claude）。网络操作（GitHub push、clawHub publish）均由 agent 调用 `gh` CLI 和 `clawhub` CLI 完成，凭证完全在你的机器上。 **核心能力：** | 能力 | 说明 | |------|------| | 全流水线生成 | 从"想法"到"上线"：Research → Design → SEO → Create → Review → Self-Run → Self-Check → Upload → Verify → Final Review | | 每日自动选题 | 凌晨 02:00 cron 自动触发，选最高价值 idea，跑完整流程 | | 手动触发 | 指定 `--idea` 手动选题，或单独跑某一阶段调试 | | dry-run 模式 | `--dry-run`：执行到 Stage 7 自检后停止，**不发起任何网络操作** | | 已有 skill 迭代 | 对现有 skill 单独跑 SEO / self-check / upload 阶段进行升级 | **能力边界（不做的事）：** - 不直接写 skill 源码（源码由 agent 根据 create 阶段 prompt 生成） - 不并发生成多个 skill（每次运行产出一个） - 不访问或修改除 `GITHUB_REPO` 和 `SKILL_OUTPUT_DIR` 以外的任何路径或账号 --- ## Instruction Scope **在 scope 内（会处理）：** - "帮我自动生成一个 skill" / "skill 流水线跑了没" / "今天出了什么新 skill" - 手动触发全流水线或单阶段重跑（如"重跑 SEO 阶段"） - 查看流水线状态和历史日志（`status.js`） - 开关每日定时任务（`push-toggle on/off`） - 用 automatic-skill 迭代已有 skill（对现有 skill 升级 / SEO 优化 / 自检 / 上传） **不在 scope 内（不处理）：** - 直接编写 skill 源码（源码由 agent 执行 create 阶段 prompt 生成，非 automatic-skill 职责） - 管理 GitHub 仓库权限、clawHub 账户设置、或任何账户级操作 - 生成非 openclaw skill 格式的内容（普通项目、应用代码等） - 在未设置 `GITHUB_TOKEN` / `GITHUB_REPO` / `CLAWHUB_TOKEN` 的环境中执行 Stage 8（会提示缺少凭证，不会静默失败） **凭证缺失时的行为：** - Stages 1–7：无需凭证，正常运行 - Stage 8 upload：缺少任意必需凭证 → 打印具体缺失变量名 + 配置指引，停止执行（不静默失败） - `--dry-run`：完整跳过 Stage 8，可安全在无凭证环境测试前七个阶段 --- ## Persistence & Privilege **持久化写入的内容：** | 路径 | 内容 | 触发条件 | |------|------|---------| | `SKILL_OUTPUT_DIR//` | 生成的 skill 文件 | Stage 4 Create | | `data/current-pipeline.json` | 当前流水线运行状态（临时） | 每次流水线运行 | | `data/pipeline-log.json` | 历次运行历史（追加写入） | Stage 10 Final Review | | `~/.openclaw/crontab`（或系统 cron） | 每日定时任务条目 | `push-toggle on` 时写入，`off` 时删除 | **不写入的路径：** - 不修改 shell 配置文件（`~/.zshrc` 等） - 不写入 `GITHUB_TOKEN` / `CLAWHUB_TOKEN` 等凭证到任何文件 - 不在 `SKILL_OUTPUT_DIR` 之外创建文件（除 `data/` 目录） **权限级别：** - 运行时以当前用户身份执行，不需要 sudo 或提权 - gh CLI 和 clawhub CLI 的权限上限由你配置的 token 范围决定 - 如需撤销所有权限：`push-toggle off`（删除 cron）+ 在 GitHub/clawHub 吊销对应 token --- ## Install Mechanism ### 标准安装（推荐）从 clawHub 安装到 openclaw workspace： ```bash clawhub install automatic-skill # 安装路径：~/.openclaw/workspace/skills/automatic-skill/ ``` ### 手动安装从本地源码目录复制： ```bash cp -r /path/to/automatic-skill ~/.openclaw/workspace/skills/automatic-skill/ ``` ### 验证安装 ```bash ls ~/.openclaw/workspace/skills/automatic-skill/scripts/ node ~/.openclaw/workspace/skills/automatic-skill/scripts/status.js # 应输出：No active pipeline run. / pipeline-log.json 状态 ``` ### 安装后配置在 shell 环境中设置以下变量（写入 `~/.zshrc` 或 `~/.bashrc`）： ```bash export GITHUB_TOKEN= # repo write scope export GITHUB_REPO= # e.g. Cosmofang/openclaw-skills export CLAWHUB_TOKEN= export CLAWHUB_OWNER_ID= # optional export SKILL_OUTPUT_DIR=~/.openclaw/workspace/skills # optional, this is the default ``` 然后验证认证： ```bash gh auth status # 应显示 ✓ Logged in clawhub whoami # 应返回你的用户名 ``` ### 启用每日自动运行 ```bash node scripts/push-toggle.js on # 注册 cron：每天 02:00 自动跑 daily-pipeline.js ``` --- ## 何时使用 - 用户说"帮我自动生成一个 skill"/"今天有新 skill 吗"/"skill 流水线跑了没" - 用户想查看今日生成的 skill 是什么 - 用户想手动触发某一阶段重跑 - 用户想查看生成历史或当前流水线状态 - 用户想用 automatic-skill 迭代/升级/上传某个现有 skill --- ## 🔄 10-Stage Pipeline | # | Stage | Script | Description | |---|-------|--------|-------------| | 1 | Research | `research.js` | Scan trends, identify skill gaps, output Top-3 ideas | | 2 | Design | `design.js ` | Produce full architecture: file tree, script specs, data schema | | 3 | SEO | `seo.js` | Optimize display name, tagline, description, 30+ keywords | | 4 | Create | `create.js` | Generate all files using design + SEO output | | 5 | Review | `review.js ` | Quality checklist: structure, scripts, content, security | | 6 | Self-Run | `self-run.js ` | Execute every script, verify zero errors | | 7 | Self-Check | `self-check.js ` | Validate required fields, file tree, script signatures | | 7.5 | Safety Check | `scan-check.js ` | Pre-upload credential-safety gate; blocks upload if issues found | | 8 | Upload | `upload.js ` | Create standalone repo + push monorepo; clawhub publish | | 9 | Verify | `verify-upload.js ` | Confirm live on GitHub and clawHub | | 10 | Final Review | `final-review.js ` | Full report, write to pipeline-log.json | --- ## 📦 Publishing Convention ### Skill Standard Sections Every skill generated or uploaded by automatic-skill **must** include all five of the following sections in its `SKILL.md`, in this order: | # | Section | Required content | |---|---------|-----------------| | 1 | `## Purpose & Capability` | Core concept + capability table + explicit "Does NOT" boundary | | 2 | `## Instruction Scope` | In-scope examples + out-of-scope list + behavior on missing credentials | | 3 | `## Credentials` | Action/Credential/Scope table (or "no credentials required") — no hardcoded tokens | | 4 | `## Persistence & Privilege` | Paths-written table + "Does NOT write" list + uninstall instructions | | 5 | `## Install Mechanism` | `clawhub install` command + verification step + env var examples | Stage 7 (self-check.js) validates all five sections before allowing upload. Missing or empty section = `NEEDS_FIX`. ### GitHub Distribution Every skill uploaded by automatic-skill **must** have both: | Destination | Purpose | Command | |-------------|---------|---------| | `/` (standalone repo) | Users can search and find the skill directly on GitHub | `gh repo create / --public` → push skill files | | `GITHUB_REPO/openclaw/agents/skills//` (monorepo) | Registry index — all skills listed in one place | `git add openclaw/agents/skills//` → push | **Stage 8 always runs standalone repo creation first, then monorepo push.** If the standalone repo already exists, skip creation and force-push the latest files. --- ## 🌐 Language Policy - **SKILL.md content**: English (default) - **Conversation with user**: match user's language — Chinese if user writes Chinese - **JSON logs & reports**: English only --- ## 🛠️ Usage ```bash # Full pipeline (recommended) node scripts/pipeline.js # auto-select topic, run all stages node scripts/pipeline.js --idea "daily-poem" # specify topic node scripts/pipeline.js --dry-run # run through self-check only, no upload # Per-stage debug node scripts/research.js # output research prompt node scripts/design.js "daily-poem" # output design prompt node scripts/seo.js --from-pipeline # output SEO optimization prompt node scripts/create.js --from-pipeline # output create prompt node scripts/review.js /path/skill-dir # output review prompt node scripts/self-run.js /path/skill-dir # output self-run prompt node scripts/self-check.js /path/skill-dir # output self-check prompt node scripts/upload.js /path/skill-dir # output upload prompt (direct push) node scripts/upload.js --pr /path/skill-dir # output upload prompt (PR workflow) node scripts/verify-upload.js skill-name # output verify prompt (gh api checks) node scripts/final-review.js skill-name # output final review prompt # Status & history node scripts/status.js # current pipeline status node scripts/status.js --history [N] # last N runs (default 10) node scripts/status.js --clear # clear current pipeline state # Cron toggle node scripts/push-toggle.js on # enable daily 02:00 auto-run node scripts/push-toggle.js off # disable node scripts/push-toggle.js status # show status ``` --- ## ⏰ Cron Setup ```bash openclaw cron add "0 2 * * *" "cd ~/.openclaw/workspace/skills/automatic-skill && node scripts/daily-pipeline.js" openclaw cron list openclaw cron delete ``` --- ## 📁 File Structure ``` data/ pipeline-log.json # append-only history of all pipeline runs current-pipeline.json # transient state during active run scripts/ research.js # stage 1 design.js # stage 2 seo.js # stage 3 — SEO optimization create.js # stage 4 review.js # stage 5 self-run.js # stage 6 self-check.js # stage 7 upload.js # stage 8 verify-upload.js # stage 9 final-review.js # stage 10 pipeline.js # orchestrator daily-pipeline.js # cron entry point status.js # status query push-toggle.js # cron toggle ``` --- ## ⚠️ Notes 1. Required env vars: `GITHUB_TOKEN`, `GITHUB_REPO`, `CLAWHUB_TOKEN` 2. Optional: `CLAWHUB_OWNER_ID` (your clawHub owner ID), `SKILL_OUTPUT_DIR` (default: `~/.openclaw/workspace/skills`) 3. **GitHub operations use the `gh` CLI** (inspired by [steipete/github](https://clawhub.ai/steipete/github)): `gh auth status`, `gh repo view`, `gh api`, `gh pr create`. Install with `brew install gh` and run `gh auth login` before first use. 4. Stage 8 supports `--pr` flag for a PR-based GitHub workflow instead of direct push to main. 5. Stage 9 verifies GitHub state live via `gh api repos/{repo}/contents/{path}` — no `git fetch` needed. 6. **Every skill gets a standalone GitHub repo** (`/`) in addition to the monorepo entry — this lets users search and discover skills directly on GitHub 7. On any stage failure the pipeline stops and logs the error — no partial overwrites 8. `--dry-run` stops after self-check, no network operations 9. Full run history in `data/pipeline-log.json` 10. All scripts are prompt generators only — no outbound network requests are made by the scripts themselves --- ## 🧪 Test Run Log (2026-04-04) First full dry-run results: | Stage | Status | Notes | |-------|--------|-------| | 1 Research | ✅ | Scanned 17 existing skills, identified 5 gaps, selected daily-poem | | 2 Design | ✅ | Fix: `--from-pipeline` reads from `pipeline.research.selected` not top-level | | 3 SEO | ✅ | Added in v1.1.0 — produces displayName, tagline, 30+ keywords | | 4 Create | ✅ | Generated 9 files including 4 scripts | | 5 Review | ✅ | Score 97/100, 1 warning (empty data array, expected) | | 6 Self-Run | ✅ | 6 script calls, all passed | | 7 Self-Check | ✅ | 22/22 checks passed, score 100 | | 8 Upload | ✅ | dry-run skipped — requires GITHUB_TOKEN / GITHUB_REPO / CLAWHUB_TOKEN | | 9 Verify | ✅ | dry-run skipped | | 10 Final Review | ✅ | Archived to pipeline-log.json | **Environment variables:** ```bash export GITHUB_TOKEN= export GITHUB_REPO= export CLAWHUB_TOKEN= export CLAWHUB_OWNER_ID= # optional export SKILL_OUTPUT_DIR=~/.openclaw/workspace/skills # optional ``` --- *Version: 1.4.1 · Created: 2026-04-04 · Updated: 2026-04-09* FILE:_meta.json { "ownerId": "kn79bebfnwg15sb0g7cj5z5nyd83gxh0", "slug": "automatic-skill", "version": "1.4.1", "publishedAt": null } FILE:data/pipeline-log.json [ { "slug": "daily-poem", "date": "2026-04-04", "duration": "00:04:32", "reviewScore": 97, "selfCheckScore": 100, "githubStatus": "SKIPPED", "clawhubStatus": "SKIPPED", "verdict": "SUCCESS", "filesCreated": 9, "scriptsTested": 6, "completedAt": "2026-04-04T15:01:28.968Z", "note": "Test run (dry-run). All 9 stages completed. Upload skipped pending env vars." }, { "slug": "daily-mood", "date": "2026-04-04", "duration": "00:06:18", "reviewScore": 98, "selfCheckScore": 100, "githubStatus": "SKIPPED", "clawhubStatus": "SKIPPED", "verdict": "SUCCESS", "filesCreated": 10, "scriptsTested": 16, "completedAt": "2026-04-04T15:12:21.241Z", "note": "Test run dry-run. 1 bug fixed (template literal in evening-push+mood-response). All 9 stages complete." } ] FILE:data/safety-patterns.json [ { "id": "ECHO_TOKEN", "pattern": "echo\\s+\\$[A-Z_]*TOKEN", "severity": "HIGH", "description": "Command that prints a token value to stdout", "fix": "Remove the echo command. Use 'gh auth status' or 'clawhub whoami' to verify auth without printing token values." }, { "id": "BASE64_DECODE", "pattern": "base64\\s+-d", "severity": "HIGH", "description": "base64 decoding — may expose credential content", "fix": "Replace with a --jq query that reads metadata fields (name, size, encoding) instead of decoding raw content." }, { "id": "HEAD_TOKEN_PREVIEW", "pattern": "head\\s+-c\\s+\\d+.*TOKEN", "severity": "MEDIUM", "description": "Reading the first N bytes of a token variable", "fix": "Remove head -c N. If verifying a token is set, use the CLI auth command instead." }, { "id": "HARDCODED_SECRET", "pattern": "(ghp_|github_pat_|xoxb-|sk-)[A-Za-z0-9]{10,}", "severity": "HIGH", "description": "Hardcoded credential value detected (GitHub token, Slack token, etc.)", "fix": "Remove the hardcoded credential. Reference it by env var name instead (e.g. $GITHUB_TOKEN)." } ] FILE:package.json { "name": "automatic-skill", "version": "1.4.1", "description": "每日 Skill 自动工厂 — 10阶段流水线自主调研、设计、生成、测试并发布新 skill，支持已有 skill 迭代升级", "homepage": "https://github.com/Cosmofang/automatic-skill", "keywords": [ "automatic-skill", "skill-factory", "pipeline", "meta-skill", "daily-skill", "自动skill", "技能工厂", "每日skill", "自动化", "skill迭代", "clawhub-publish" ], "author": "jiajiaoy", "license": "MIT", "scripts": { "pipeline": "node scripts/pipeline.js", "pipeline:dry": "node scripts/pipeline.js --dry-run", "daily": "node scripts/daily-pipeline.js", "research": "node scripts/research.js", "design": "node scripts/design.js", "create": "node scripts/create.js", "review": "node scripts/review.js", "self-run": "node scripts/self-run.js", "self-check": "node scripts/self-check.js", "upload": "node scripts/upload.js", "verify": "node scripts/verify-upload.js", "safety-check": "node scripts/scan-check.js", "safety-rules": "node scripts/scan-fix.js", "final-review": "node scripts/final-review.js", "status": "node scripts/status.js", "status:history": "node scripts/status.js --history", "push-on": "node scripts/push-toggle.js on", "push-off": "node scripts/push-toggle.js off", "push-status": "node scripts/push-toggle.js status" } } FILE:scripts/create.js #!/usr/bin/env node /** * Automatic Skill — Stage 4: Create (制作) * 输出 Agent 执行 prompt，指导其按设计（含 SEO 优化结果）逐文件生成完整的 Skill。 * * 用法: * node scripts/create.js --from-pipeline * node scripts/create.js * node scripts/create.js --lang en --from-pipeline */ const fs = require('fs'); const path = require('path'); const args = process.argv.slice(2); const langIdx = args.indexOf('--lang'); const lang = langIdx !== -1 ? args[langIdx + 1] : 'zh'; let design = null; let seo = null; let outputDir = process.env.SKILL_OUTPUT_DIR || path.join(process.env.HOME || '~', '.openclaw', 'workspace', 'skills'); if (args.includes('--from-pipeline')) { const pipelinePath = path.join(__dirname, '..', 'data', 'current-pipeline.json'); if (!fs.existsSync(pipelinePath)) { console.error('ERROR: data/current-pipeline.json not found. Run design.js first.'); process.exit(1); } const pipeline = JSON.parse(fs.readFileSync(pipelinePath, 'utf8')); if (!pipeline.design) { console.error('ERROR: No design found in current-pipeline.json. Complete Stage 2 first.'); process.exit(1); } if (!pipeline.seo) { console.error('ERROR: No SEO data found in current-pipeline.json. Complete Stage 3 (SEO) first.'); process.exit(1); } design = pipeline.design; seo = pipeline.seo; } else { const designFilePath = args.filter(a => a !== '--lang' && a !== lang)[0]; if (!designFilePath || !fs.existsSync(designFilePath)) { console.error('Usage: node scripts/create.js --from-pipeline'); console.error(' node scripts/create.js '); process.exit(1); } design = JSON.parse(fs.readFileSync(designFilePath, 'utf8')); } const slug = (seo && seo.slug) || design.slug || 'unknown-skill'; // Read ownerId from env — never hardcode credentials in prompt instructions const ownerId = process.env.CLAWHUB_OWNER_ID || ''; const displayName = (seo && seo.displayName) || design.slug || slug; const fullDescription = (seo && seo.fullDescription) || (design.skillMdOutline && design.skillMdOutline.frontmatter && design.skillMdOutline.frontmatter.description) || ''; const keywords = (seo && seo.keywords) || (design.skillMdOutline && design.skillMdOutline.frontmatter && design.skillMdOutline.frontmatter.keywords) || []; const skillDir = path.join(outputDir, slug); const seoNote = seo ? ` SEO OPTIMIZED VALUES (use these in SKILL.md and package.json — DO NOT use design defaults): Display name : ${displayName} Tagline : ${seo.tagline || ''} Short desc : ${seo.shortDescription || ''} Full desc : ${fullDescription} Keywords (${keywords.length}): ${keywords.slice(0, 10).join(', ')}${keywords.length > 10 ? ', ...' : ''} GitHub desc : ${seo.githubDescription || ''} clawHub title : ${seo.clawhubTitle || ''} ` : ''; if (lang === 'en') { console.log(` === AUTOMATIC SKILL — Stage 4: Create === Skill: ${slug} Output directory: ${skillDir} ${seoNote} Design reference: ${JSON.stringify(design, null, 2).substring(0, 300)}... Create every file listed in the design's fileTree. Follow these rules strictly: CREATION RULES: 1. Create the skill directory at: ${skillDir} 2. For each file in the file tree, write the complete, working file content. 3. SKILL.md: - name: use SEO displayName above - description: use SEO fullDescription above (multi-line |) - keywords: use the full SEO keywords list above - metadata with openclaw runtime settings - All sections from the design outline 4. Scripts: each script must be a standalone Node.js file. It must print a prompt (console.log) that tells the agent exactly what to do. Include input validation and helpful error messages. 5. package.json: use SEO displayName, shortDescription, and keywords. Include name, version, description, keywords, scripts map. 6. _meta.json: ownerId "${ownerId}", slug, version "1.0.0", publishedAt null. 7. .clawhub/origin.json: same ownerId and slug. 8. data/ files: create with empty arrays or objects as in dataSchemas. LANGUAGE STANDARDS: - SKILL.md name, description, all section headings and body text: write in ENGLISH - Keywords: include both English and Chinese terms (bilingual is fine here) - Script header comments and usage strings: ENGLISH - JSON data files: ENGLISH keys and values QUALITY STANDARDS: - Every script must have a header comment with filename, purpose, and usage. - Every script must handle missing args gracefully (print usage + exit 1). - SKILL.md must have a commands table and a ⚠️ Notes section. - No placeholder text like "TODO" or "..." in final files. AFTER CREATING ALL FILES: - Run: ls -la ${skillDir} to confirm all files exist. - Update data/current-pipeline.json: add key "create" with { "stage": "create", "skillDir": "${skillDir}", "filesCreated": [...], "completedAt": "" } - Then proceed to Stage 5: node scripts/review.js ${skillDir} `); } else { console.log(` === AUTOMATIC SKILL — 阶段 4：制作 === Skill：${slug} 输出目录：${skillDir} ${seoNote} 设计参考：${JSON.stringify(design, null, 2).substring(0, 300)}... 按照设计中的 fileTree，逐文件创建所有内容。严格遵守以下规则：创建规则： 1. 在以下路径创建 skill 目录：${skillDir} 2. 对 fileTree 中的每个文件，写出完整、可运行的文件内容。 3. SKILL.md： - name：使用上方 SEO 展示名称 - description：使用上方 SEO 完整描述（多行 | 格式） - keywords：使用上方完整的 SEO 关键词列表 - metadata 含 openclaw runtime 配置 - 包含设计大纲中的所有章节 4. 脚本：每个脚本必须是独立的 Node.js 文件，通过 console.log 打印 prompt，包含输入校验和友好错误提示。 5. package.json：使用 SEO 展示名称、简短描述和关键词，包含 name、version、description、keywords、scripts 映射。 6. _meta.json：ownerId "${ownerId}"，slug 来自设计，version "1.0.0"，publishedAt null。 7. .clawhub/origin.json：同样的 ownerId 和 slug。 8. data/ 文件：按 dataSchemas 规格创建空数组或空对象。语言标准： - SKILL.md 名称、描述、所有章节标题和正文：统一写英文 - keywords 关键词：中英双语均可 - 脚本头部注释和用法说明：英文 - JSON 数据文件：键和值统一英文质量标准： - 每个脚本必须有头部注释（文件名、用途、用法）。 - 每个脚本缺少参数时必须优雅处理（打印用法 + exit 1）。 - SKILL.md 必须包含命令表格和 ⚠️ 注意事项章节。 - 最终文件中不得出现"TODO"或"..."等占位符。创建所有文件后： - 运行：ls -la ${skillDir} 确认所有文件存在。 - 更新 data/current-pipeline.json：添加 "create" 键 { "stage": "create", "skillDir": "${skillDir}", "filesCreated": [...], "completedAt": "" } - 然后进入阶段 5：node scripts/review.js ${skillDir} `); } FILE:scripts/daily-pipeline.js #!/usr/bin/env node /** * Automatic Skill — Daily Pipeline Entry Point (每日定时入口) * 由 openclaw cron 每日 02:00 触发，自动运行全流水线。 * 包含防重复锁、失败日志、通知推送。 * * 用法: * node scripts/daily-pipeline.js # 正常运行（由 cron 调用） * node scripts/daily-pipeline.js --dry-run # 只跑到 self-check，不上传 * node scripts/daily-pipeline.js --force # 忽略锁文件强制运行 */ const fs = require('fs'); const path = require('path'); const args = process.argv.slice(2); const dryRun = args.includes('--dry-run'); const force = args.includes('--force'); const dataDir = path.join(__dirname, '..', 'data'); const lockPath = path.join(dataDir, 'pipeline.lock'); const pipelinePath = path.join(dataDir, 'current-pipeline.json'); const logPath = path.join(dataDir, 'pipeline-log.json'); const now = new Date(); const dateISO = `${now.getFullYear()}-${String(now.getMonth()+1).padStart(2,'0')}-${String(now.getDate()).padStart(2,'0')}`; const scriptDir = path.join(__dirname); // Check lock file to prevent duplicate runs if (!force && fs.existsSync(lockPath)) { const lockData = JSON.parse(fs.readFileSync(lockPath, 'utf8')); if (lockData.date === dateISO) { console.log(`⏭️ Pipeline already ran today (${dateISO}). Skipping. Use --force to override.`); console.log(` Lock created at: ${lockData.createdAt}`); process.exit(0); } } // Check if a pipeline is already in progress if (!force && fs.existsSync(pipelinePath)) { const pipeline = JSON.parse(fs.readFileSync(pipelinePath, 'utf8')); if (pipeline.date === dateISO) { console.log(`⚠️ A pipeline for today is already in progress. Skipping duplicate run.`); console.log(` Use --force to override, or delete data/current-pipeline.json.`); process.exit(0); } } // Write lock if (!fs.existsSync(dataDir)) fs.mkdirSync(dataDir, { recursive: true }); fs.writeFileSync(lockPath, JSON.stringify({ date: dateISO, createdAt: now.toISOString() })); console.log(` === AUTOMATIC SKILL — Daily Pipeline (${dateISO}) === Mode: ${dryRun ? 'DRY-RUN' : 'FULL'} Lock created. Starting pipeline... You are the openclaw daily skill generator. Today's task: 1. Run the full 9-stage Automatic Skill pipeline (or 6 stages if dry-run) 2. On success: clean up the lock file at ${lockPath} 3. On failure: log the error and clean up the lock file EXECUTION: Run the pipeline orchestrator now: node ${scriptDir}/pipeline.js${dryRun ? ' --dry-run' : ''} The pipeline will guide you through all stages automatically. AFTER PIPELINE COMPLETES: - If SUCCESS: delete the lock file ${lockPath} - If FAILURE: 1. Log the error to data/pipeline-log.json with verdict "FAILED" 2. Delete the lock file ${lockPath} 3. Send a failure notification (if OPENCLAW_NOTIFY_CHANNEL is set): "❌ Daily skill pipeline FAILED on ${dateISO}. Error: " ENVIRONMENT CHECKS (run each command to verify before starting): - GITHUB_TOKEN: gh auth status (must show: ✓ Logged in to github.com) - GITHUB_REPO: echo $GITHUB_REPO (must print owner/repo, e.g. myorg/mycli) - CLAWHUB_TOKEN: clawhub whoami (must return your clawHub username without error) - SKILL_OUTPUT_DIR: echo ${process.env.SKILL_OUTPUT_DIR || '~/.openclaw/workspace/skills (default)'} ${dryRun ? '\nDRY-RUN: upload stages will be skipped regardless of env vars.' : ''} START THE PIPELINE: node ${scriptDir}/pipeline.js${dryRun ? ' --dry-run' : ''} `); FILE:scripts/design.js #!/usr/bin/env node /** * Automatic Skill — Stage 2: Design (设计) * 输出 Agent 执行 prompt，指导其为选定创意产出完整的 Skill 架构设计。 * * 用法: * node scripts/design.js * node scripts/design.js --from-pipeline # 从 data/current-pipeline.json 读取 selected * node scripts/design.js --lang en */ const fs = require('fs'); const path = require('path'); const args = process.argv.slice(2); const langIdx = args.indexOf('--lang'); const lang = langIdx !== -1 ? args[langIdx + 1] : 'zh'; let idea = ''; if (args.includes('--from-pipeline')) { const pipelinePath = path.join(__dirname, '..', 'data', 'current-pipeline.json'); if (!fs.existsSync(pipelinePath)) { console.error('ERROR: data/current-pipeline.json not found. Run research.js first.'); process.exit(1); } const pipeline = JSON.parse(fs.readFileSync(pipelinePath, 'utf8')); const selected = pipeline.selected || (pipeline.research && pipeline.research.selected); if (!selected) { console.error('ERROR: No selected idea found in current-pipeline.json. Complete Stage 1 first.'); process.exit(1); } idea = `${selected.name} (${selected.slug}): ${selected.description}`; } else { idea = args.filter(a => a !== '--lang' && a !== lang).join(' '); if (!idea) { console.error('Usage: node scripts/design.js '); console.error(' node scripts/design.js --from-pipeline'); process.exit(1); } } const now = new Date(); const dateISO = `${now.getFullYear()}-${String(now.getMonth()+1).padStart(2,'0')}-${String(now.getDate()).padStart(2,'0')}`; if (lang === 'en') { console.log(` === AUTOMATIC SKILL — Stage 2: Design === Skill Idea: ${idea} Date: ${dateISO} Design a complete, production-ready openclaw skill for the idea above. OUTPUT REQUIREMENTS — produce all of the following: 1. SKILL OVERVIEW - slug (lowercase, hyphenated) - Full name - One-paragraph description (for SKILL.md frontmatter) - Keywords list (20+ words, mix of Chinese and English) - Runtime requirements (Node version, npm packages needed) - Environment variables needed (name, required, description) 2. FILE TREE List every file the skill needs, e.g.: SKILL.md package.json _meta.json .clawhub/origin.json data/.json (if any persistent data) scripts/ .js (one line per script with its purpose) 3. SCRIPT SPECIFICATIONS For each script, provide: - Filename - Purpose (one sentence) - Input: CLI args or flags - Output: what console.log prints (prompt text or JSON) - Logic: 5-10 bullet points describing the algorithm 4. SKILL.md STRUCTURE - Frontmatter fields (name, description, keywords, metadata) - Example commands table - REQUIRED: the following five sections must appear in this exact order, with real content (not placeholders): ## Purpose & Capability What this skill is, what it can do, and what it cannot do. Must include: - One-paragraph explanation of the core concept - A table or bullet list of core capabilities - A "Does NOT" or "Boundary" section listing explicit non-capabilities ## Instruction Scope When to use this skill vs. when not to. Must include: - "In scope" list: example user requests this skill handles - "Out of scope" list: requests this skill will NOT handle - Behavior when called outside scope (e.g. politely refuse, redirect) ## Credentials Every credential, token, and env var this skill touches. Must include: - A table: Action | Credential | Scope (what gets written/read) - Explicit "Does NOT" row (no exfiltration, no other accounts) - Minimum token scope recommendations - If skill needs zero credentials: state "This skill requires no credentials." ## Persistence & Privilege Every file, cron job, or system-level change this skill makes. Must include: - Table of paths written to, with trigger condition - "Does NOT write" list - Privilege level (runs as current user, no sudo needed) - How to fully uninstall / revoke (delete files + revoke tokens) ## Install Mechanism How to install, configure, and verify the skill. Must include: - Standard install command (clawhub install ) - Manual install fallback (cp -r) - Verification step (run a script, expect specific output) - Post-install env var configuration with example values - How to enable/disable any optional scheduled features 5. DATA SCHEMA For each data file, provide the JSON schema with example values. 6. CRON SCHEDULE If the skill needs scheduled pushes, list cron expressions and their triggers. OUTPUT FORMAT (JSON, to be appended into data/current-pipeline.json under key "design"): { "stage": "design", "idea": "${idea}", "slug": "...", "fileTree": ["SKILL.md", "package.json", ...], "scripts": [ { "file": "scripts/xxx.js", "purpose": "...", "args": "...", "output": "...", "logic": [] } ], "skillMdOutline": { "frontmatter": {}, "sections": [] }, "dataSchemas": {}, "cronSchedules": [], "completedAt": "" } Read the existing data/current-pipeline.json, add the "design" key, and save back. Then proceed to Stage 3: node scripts/create.js --from-pipeline `); } else { console.log(` === AUTOMATIC SKILL — 阶段 2：设计 === Skill 创意：${idea} 日期：${dateISO} 为上述创意设计一个完整的、可投入生产的 openclaw skill。输出要求 — 产出以下全部内容： 1. SKILL 概要 - slug（小写，短横线分隔） - 全名 - 一段描述（用于 SKILL.md frontmatter） - 关键词列表（20+ 词，中英混合） - 运行环境需求（Node 版本、所需 npm 包） - 所需环境变量（名称、是否必填、说明） 2. 文件树列出 skill 所需的每个文件，例如： SKILL.md package.json _meta.json .clawhub/origin.json data/<文件名>.json（如有持久化数据） scripts/ <脚本名>.js（每行一个脚本及其用途） 3. 脚本规格对每个脚本，提供： - 文件名 - 用途（一句话） - 输入：CLI 参数或 flag - 输出：console.log 打印的内容（prompt 文本或 JSON） - 逻辑：5-10 条描述算法的要点 4. SKILL.md 结构 - frontmatter 字段（name, description, keywords, metadata） - 示例命令表格 - 必须包含以下五个章节，按此顺序排列，必须填写真实内容（不得使用占位符）： ## Purpose & Capability 这个 skill 是什么、能做什么、不能做什么。必须包含： - 一段核心概念说明 - 核心能力表格或列表 - "能力边界"/"Does NOT" 章节，明确列出不做的事 ## Instruction Scope 何时使用，何时不应使用。必须包含： - "在 scope 内" 列表：举例用户会说的请求 - "不在 scope 内" 列表：明确拒绝的请求类型 - 凭证缺失时的行为说明 ## Credentials 这个 skill 涉及的所有凭证、token、env var。必须包含： - 表格：操作 | 使用的凭证 | 写入/读取范围 - "不做的事"行（不外传凭证、不访问其他账号） - 最小 token scope 建议 - 若 skill 不需要任何凭证：明确写 "本 skill 无需任何凭证" ## Persistence & Privilege 这个 skill 对文件系统、cron、系统的所有写入操作。必须包含： - 写入路径表格，含触发条件 - "不写入"列表 - 权限级别（以当前用户身份运行，无需 sudo） - 完整卸载/撤销方法 ## Install Mechanism 如何安装、配置、验证。必须包含： - 标准安装命令（clawhub install ） - 手动安装备选方案（cp -r） - 验证步骤（运行某个脚本，预期输出） - 安装后的 env var 配置示例 - 可选定时功能的启用/停用方法 5. 数据 Schema 对每个数据文件，提供带示例值的 JSON schema。 6. Cron 计划如果 skill 需要定时推送，列出 cron 表达式及触发器。输出格式（JSON，追加到 data/current-pipeline.json 的 "design" 键下）： { "stage": "design", "idea": "${idea}", "slug": "...", "fileTree": ["SKILL.md", "package.json", ...], "scripts": [ { "file": "scripts/xxx.js", "purpose": "...", "args": "...", "output": "...", "logic": [] } ], "skillMdOutline": { "frontmatter": {}, "sections": [] }, "dataSchemas": {}, "cronSchedules": [], "completedAt": "" } 读取现有的 data/current-pipeline.json，添加 "design" 键后保存回去。然后进入阶段 3：node scripts/create.js --from-pipeline `); } FILE:scripts/final-review.js #!/usr/bin/env node /** * Automatic Skill — Stage 10: Final Review (复查) * 输出 Agent 执行 prompt，指导其生成完整的流水线报告并写入 pipeline-log.json。 * * 用法: * node scripts/final-review.js * node scripts/final-review.js --from-pipeline */ const fs = require('fs'); const path = require('path'); const args = process.argv.slice(2); const langIdx = args.indexOf('--lang'); const lang = langIdx !== -1 ? args[langIdx + 1] : 'zh'; let slug = ''; if (args.includes('--from-pipeline')) { const pipelinePath = path.join(__dirname, '..', 'data', 'current-pipeline.json'); if (fs.existsSync(pipelinePath)) { const p = JSON.parse(fs.readFileSync(pipelinePath, 'utf8')); slug = (p.design && p.design.slug) || (p.research && p.research.selected && p.research.selected.slug) || ''; } } if (!slug) { slug = args.filter(a => a !== '--lang' && a !== lang && !a.startsWith('--'))[0] || ''; } if (!slug) { console.error('Usage: node scripts/final-review.js '); console.error(' node scripts/final-review.js --from-pipeline'); process.exit(1); } const dataDir = path.join(__dirname, '..', 'data'); const pipelinePath = path.join(dataDir, 'current-pipeline.json'); const logPath = path.join(dataDir, 'pipeline-log.json'); if (lang === 'en') { console.log(` === AUTOMATIC SKILL — Stage 10: Final Review === Skill: ${slug} This is the final stage. Compile a comprehensive report and archive the pipeline run. STEP 1 — Read the full pipeline state Read: ${pipelinePath} Collect all stage results: research, design, create, review, selfRun, selfCheck, upload, verifyUpload. STEP 2 — Compile pipeline summary Calculate: - Total time from research.completedAt to now - Number of review iterations (how many times review stage was re-run) - Number of self-check iterations - Final review score (from selfCheck.score) - Upload status summary STEP 3 — Generate the final report REPORT FORMAT: ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🤖 AUTOMATIC SKILL PIPELINE — FINAL REPORT ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Skill: ${slug} Date: Total Time: PIPELINE STAGES: ✅ Stage 1 Research — Completed at ( ideas evaluated) ✅ Stage 2 Design — Completed at ✅ Stage 3 SEO — displayName: keywords: ✅ Stage 4 Create — Completed at ( files created) ✅ Stage 5 Review — Score: /100 ( iterations) ✅ Stage 6 Self-Run — scripts tested, passed ✅ Stage 7 Self-Check — Score: /100 ( checks passed) ✅ Stage 8 Upload — GitHub: clawHub: ✅ Stage 9 Verify — GitHub: VERIFIED clawHub: VERIFIED ✅ Stage 10 Final Review — COMPLETE SKILL SUMMARY: Name: Description: Scripts: scripts Keywords: keywords GitHub: /openclaw/agents/skills/${slug} clawHub: ISSUES ENCOUNTERED: ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ STEP 4 — Archive to pipeline-log.json Read: ${logPath} (if it doesn't exist, start with []) Append this entry: { "slug": "${slug}", "date": "", "duration": "", "reviewScore": , "selfCheckScore": , "githubStatus": "SUCCESS" | "FAILED" | "SKIPPED", "clawhubStatus": "SUCCESS" | "FAILED" | "SKIPPED", "verdict": "SUCCESS" | "PARTIAL_SUCCESS" | "FAILED", "filesCreated": , "scriptsTested": , "completedAt": "" } Save the updated array back to ${logPath}. STEP 5 — Clean up current pipeline state Delete: ${pipelinePath} (The run is complete; next pipeline starts fresh) STEP 6 — Print completion message Print a brief summary to the user (or to openclaw push channel) announcing the new skill. Example: 🎉 New skill published: ${slug} 📖 Description: 🔗 GitHub: 🏪 clawHub: DONE. Pipeline complete. ✅ `); } else { console.log(` === AUTOMATIC SKILL — 阶段 10：复查 === Skill：${slug} 这是最后阶段。编写完整报告并归档本次流水线运行记录。步骤 1 — 读取完整的流水线状态读取：${pipelinePath} 收集所有阶段结果：research, design, create, review, selfRun, selfCheck, upload, verifyUpload。步骤 2 — 编写流水线摘要计算： - 从 research.completedAt 到现在的总耗时 - 审核迭代次数（review 阶段重跑了多少次） - 自检迭代次数 - 最终审核分数（来自 selfCheck.score） - 上传状态摘要步骤 3 — 生成最终报告报告格式： ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🤖 AUTOMATIC SKILL 流水线 — 最终报告 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Skill： ${slug} 日期： <日期> 总耗时： <时长> 流水线阶段： ✅ 阶段 1 调研 — 完成于 <时间>（评估了个创意） ✅ 阶段 2 设计 — 完成于 <时间> ✅ 阶段 3 制作 — 完成于 <时间>（创建了个文件） ✅ 阶段 4 审核 — 得分：/100（次迭代） ✅ 阶段 5 自跑 — 个脚本测试，个通过 ✅ 阶段 6 自检 — 得分：/100（通过项检查） ✅ 阶段 7 上传 — GitHub：<状态> clawHub：<状态> ✅ 阶段 8 验收 — GitHub：VERIFIED clawHub：VERIFIED ✅ 阶段 9 复查 — 完成 Skill 摘要：名称： <全名> 描述： <一句话> 脚本数：个关键词：个 GitHub： /openclaw/agents/skills/${slug} clawHub：遇到的问题：<列出所有警告或已修复内容> ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 步骤 4 — 归档到 pipeline-log.json 读取：${logPath}（如不存在，从 [] 开始）追加以下条目： { "slug": "${slug}", "date": "", "duration": "", "reviewScore": , "selfCheckScore": , "githubStatus": "SUCCESS" | "FAILED" | "SKIPPED", "clawhubStatus": "SUCCESS" | "FAILED" | "SKIPPED", "verdict": "SUCCESS" | "PARTIAL_SUCCESS" | "FAILED", "filesCreated": , "scriptsTested": , "completedAt": "" } 将更新后的数组保存回 ${logPath}。步骤 5 — 清理当前流水线状态删除：${pipelinePath} （本次运行完成；下次流水线从头开始）步骤 6 — 打印完成信息向用户（或 openclaw 推送渠道）打印简短摘要，宣布新 skill 发布。示例： 🎉 新 skill 已发布：${slug} 📖 描述：<描述> 🔗 GitHub： 🏪 clawHub：完成。流水线结束。✅ `); } FILE:scripts/pipeline.js #!/usr/bin/env node /** * Automatic Skill — Pipeline Orchestrator (编排器) * 输出 Agent 执行 prompt，引导其完整运行全部 10 个阶段的流水线。 * Stage 7.5 (Safety Check) runs BEFORE upload as a credential-safety gate. * * 用法: * node scripts/pipeline.js # 自动选题，全流水线 * node scripts/pipeline.js --idea "每日诗词" # 指定主题 * node scripts/pipeline.js --dry-run # 运行到 self-check，不上传 * node scripts/pipeline.js --from-stage 4 # 从指定阶段继续（读取现有 pipeline 状态） * node scripts/pipeline.js --lang en */ const fs = require('fs'); const path = require('path'); const args = process.argv.slice(2); const langIdx = args.indexOf('--lang'); const lang = langIdx !== -1 ? args[langIdx + 1] : 'zh'; const dryRun = args.includes('--dry-run'); const ideaIdx = args.indexOf('--idea'); const idea = ideaIdx !== -1 ? args[ideaIdx + 1] : null; const fromStageIdx = args.indexOf('--from-stage'); const fromStage = fromStageIdx !== -1 ? parseInt(args[fromStageIdx + 1], 10) : 1; const scriptDir = path.join(__dirname); const dataDir = path.join(__dirname, '..', 'data'); const pipelinePath = path.join(dataDir, 'current-pipeline.json'); const now = new Date(); const dateISO = `${now.getFullYear()}-${String(now.getMonth()+1).padStart(2,'0')}-${String(now.getDate()).padStart(2,'0')}`; // Check if there's an in-progress pipeline let existingPipeline = null; if (fs.existsSync(pipelinePath)) { try { existingPipeline = JSON.parse(fs.readFileSync(pipelinePath, 'utf8')); } catch (e) { // ignore parse error } } if (existingPipeline && fromStage === 1) { console.warn(`⚠️ WARNING: A pipeline is already in progress for "${existingPipeline.design && existingPipeline.design.slug || 'unknown'}".`); console.warn(` Use --from-stage to resume, or delete data/current-pipeline.json to start fresh.`); console.warn(''); } const stages = [ { n: 1, name: 'Research', cmd: `node ${scriptDir}/research.js` }, { n: 2, name: 'Design', cmd: `node ${scriptDir}/design.js --from-pipeline` }, { n: 3, name: 'SEO', cmd: `node ${scriptDir}/seo.js --from-pipeline` }, { n: 4, name: 'Create', cmd: `node ${scriptDir}/create.js --from-pipeline` }, { n: 5, name: 'Review', cmd: `node ${scriptDir}/review.js --from-pipeline` }, { n: 6, name: 'Self-Run', cmd: `node ${scriptDir}/self-run.js --from-pipeline` }, { n: 7, name: 'Self-Check', cmd: `node ${scriptDir}/self-check.js --from-pipeline` }, { n: 7.5, name: 'Safety Check', cmd: `node ${scriptDir}/scan-check.js --from-pipeline` }, { n: 8, name: 'Upload', cmd: `node ${scriptDir}/upload.js${dryRun ? ' --dry-run' : ''} --from-pipeline` }, { n: 9, name: 'Verify', cmd: `node ${scriptDir}/verify-upload.js --from-pipeline` }, { n: 10, name: 'Final Review', cmd: `node ${scriptDir}/final-review.js --from-pipeline` }, ]; const activeStages = dryRun ? stages.slice(0, 7) : stages; const pendingStages = activeStages.filter(s => s.n >= fromStage); if (lang === 'en') { console.log(` === AUTOMATIC SKILL — Full Pipeline Orchestrator === Date: ${dateISO} Mode: ${dryRun ? 'DRY-RUN (stages 1-7 only)' : 'FULL (all 10 stages)'} ${idea ? `Idea: ${idea}` : 'Idea: auto-select from research'} ${fromStage > 1 ? `Resuming from stage: ${fromStage}` : 'Starting from: stage 1'} You are running the complete Automatic Skill pipeline. Execute each stage IN ORDER. Do not skip stages. If a stage fails, fix the issue and re-run that stage before proceeding. LANGUAGE POLICY (follow throughout the entire pipeline): - SKILL.md content (name, description, sections, commands): write in ENGLISH - Conversational replies to the user: use the user's language (Chinese if user writes in Chinese) - All JSON logs, reports, and pipeline state (pipeline-log.json, review scores, etc.): ENGLISH only EXECUTION PLAN: ${pendingStages.map(s => ` Stage ${s.n}: ${s.name}`).join('\n')} ${dryRun ? '\n⚠️ DRY-RUN: Stages 8-10 (Upload, Verify, Final Review) will be skipped.' : ''} BEFORE STARTING: 1. Ensure environment variables are set: - GITHUB_TOKEN (required for upload) - GITHUB_REPO (required for upload, format: owner/repo) - CLAWHUB_TOKEN (required for upload) 2. Ensure Node.js >= 18 is installed EXECUTION INSTRUCTIONS: For each stage below, run the command to get the stage prompt, then execute that prompt fully before moving to the next stage. ${pendingStages.map(s => `STAGE ${s.n} — ${s.name} Run: ${s.n === 2 && idea ? `node ${scriptDir}/design.js "${idea}"` : s.cmd} Wait for stage to complete (check data/current-pipeline.json has "${s.name.toLowerCase().replace(/ /g, '-')}" key) Then continue to stage ${s.n + 1}. `).join('\n')} PROGRESS TRACKING: After each stage completes, data/current-pipeline.json will contain a new key for that stage. Check progress at any time: node scripts/status.js If a stage produces a FAIL verdict, fix the issues described in the stage output and re-run that stage before proceeding. SAFETY CHECK (Stage 7.5): Stage 7.5 runs a pre-upload credential-safety check on all generated skill files. If any credential-exposure issues are found (e.g. hardcoded tokens, echo $TOKEN patterns), the pipeline BLOCKS and reports the issues. You must fix them manually before proceeding to Stage 8 (Upload). This is a quality gate, not an auto-fix loop. After all stages complete, the new skill will be: - Available locally in SKILL_OUTPUT_DIR - Committed and pushed to GitHub (unless --dry-run) - Published on clawHub (unless --dry-run) - Logged in data/pipeline-log.json BEGIN with Stage ${fromStage}: run the command listed above for Stage ${fromStage}. `); } else { console.log(` === AUTOMATIC SKILL — 全流水线编排器 === 日期：${dateISO} 模式：${dryRun ? 'DRY-RUN（仅阶段 1-7）' : '完整（全部 10 个阶段）'} ${idea ? `主题：${idea}` : '主题：由调研阶段自动选定'} ${fromStage > 1 ? `从阶段 ${fromStage} 继续` : '从阶段 1 开始'} 你正在运行完整的 Automatic Skill 流水线。按顺序执行每个阶段。不要跳过阶段。如果某阶段失败，修复问题并重新运行该阶段，再继续下一阶段。语言规则（整个流水线全程遵守）： - SKILL.md 内容（名称、描述、章节、命令）：统一写英文 - 与用户的对话回复：使用用户的语言（用户说中文则全程回中文） - 所有 JSON 日志、报告、流水线状态（pipeline-log.json、审核评分等）：统一英文执行计划： ${pendingStages.map(s => ` 阶段 ${s.n}：${s.name}`).join('\n')} ${dryRun ? '\n⚠️ DRY-RUN：阶段 8-10（上传、验收、复查）将跳过。' : ''} 开始前： 1. 确保已设置环境变量： - GITHUB_TOKEN（上传必需） - GITHUB_REPO（上传必需，格式：owner/repo） - CLAWHUB_TOKEN（上传必需） 2. 确保已安装 Node.js >= 18 执行说明：对以下每个阶段，运行命令获取阶段 prompt，然后完整执行该 prompt，再进入下一阶段。 ${pendingStages.map(s => `阶段 ${s.n} — ${s.name} 运行：${s.n === 2 && idea ? `node ${scriptDir}/design.js "${idea}"` : s.cmd} 等待阶段完成（检查 data/current-pipeline.json 已包含对应键）然后继续阶段 ${s.n + 1}。 `).join('\n')} 进度追踪：每个阶段完成后，data/current-pipeline.json 中将新增该阶段对应的键。随时查看进度：node scripts/status.js 如果某阶段返回 FAIL，修复阶段输出中描述的问题，重新运行该阶段后再继续。安全检查（阶段 7.5）：阶段 7.5 在上传前对所有生成的 skill 文件做凭证安全检查。如果发现凭证暴露问题（如硬编码 token、echo $TOKEN 模式），流水线将阻断并报告问题。你必须手动修复后才能进入阶段 8（上传）。这是一个质检关卡，不是自动修复循环。最终输出：所有阶段完成后，新 skill 将： - 存储在本地 SKILL_OUTPUT_DIR - 已提交并推送到 GitHub（除非 --dry-run） - 已发布到 clawHub（除非 --dry-run） - 已记录在 data/pipeline-log.json 从阶段 ${fromStage} 开始：运行上方阶段 ${fromStage} 对应的命令。 `); } FILE:scripts/push-toggle.js #!/usr/bin/env node /** * Automatic Skill — Push Toggle (推送开关) * 管理 openclaw cron 定时任务（每日 02:00 自动运行流水线）。 * * 用法: * node scripts/push-toggle.js on # 开启每日自动运行 * node scripts/push-toggle.js on --dry-run # 开启（dry-run 模式，不上传） * node scripts/push-toggle.js off # 关闭 * node scripts/push-toggle.js status # 查看当前状态 */ const fs = require('fs'); const path = require('path'); const args = process.argv.slice(2); const action = args[0]; const dryRun = args.includes('--dry-run'); const scriptDir = path.join(__dirname); const VALID_ACTIONS = ['on', 'off', 'status']; if (!action || !VALID_ACTIONS.includes(action)) { console.error('Usage: node scripts/push-toggle.js on|off|status [--dry-run]'); process.exit(1); } const cronCmd = `cd ${path.join(scriptDir, '..')} && node scripts/daily-pipeline.js${dryRun ? ' --dry-run' : ''}`; const cronSchedule = '0 2 * * *'; if (action === 'on') { console.log(` To enable automatic daily skill generation, run this command in your terminal: openclaw cron add "${cronSchedule}" "${cronCmd}" This will schedule the pipeline to run every day at 02:00. ${dryRun ? 'DRY-RUN mode is enabled — stages 7-9 (upload) will be skipped.' : ''} After adding, verify with: openclaw cron list To disable later: node scripts/push-toggle.js off `); } else if (action === 'off') { console.log(` To disable automatic daily skill generation, run: openclaw cron list Find the cron job with the command containing "automatic-skill" and note its ID, then: openclaw cron delete Or to delete all automatic-skill cron jobs at once (if supported): openclaw cron list | grep automatic-skill | awk '{print $1}' | xargs -I{} openclaw cron delete {} `); } else if (action === 'status') { console.log(` To check if the automatic daily pipeline cron job is active: openclaw cron list Look for an entry with: Schedule: ${cronSchedule} (02:00 every day) Command: ...automatic-skill... If found → pipeline is ACTIVE If not found → pipeline is INACTIVE (run: node scripts/push-toggle.js on) `); } FILE:scripts/research.js #!/usr/bin/env node /** * Automatic Skill — Stage 1: Research (调研) * 输出一个 Agent 执行 prompt，指导其搜索趋势话题、分析现有 skill 空白，产出 Top-3 创意。 * * 用法: * node scripts/research.js * node scripts/research.js --lang en */ const args = process.argv.slice(2); const lang = args.includes('--lang') ? args[args.indexOf('--lang') + 1] : 'zh'; const now = new Date(); const dateISO = `${now.getFullYear()}-${String(now.getMonth()+1).padStart(2,'0')}-${String(now.getDate()).padStart(2,'0')}`; if (lang === 'en') { console.log(` === AUTOMATIC SKILL — Stage 1: Research === Date: ${dateISO} You are the Automatic Skill pipeline. Your task in Stage 1 is to research and identify the best skill idea to build today. STEP A — Scan existing skills List all skill folders in the openclaw skills directory (~/.openclaw/workspace/skills or the known skill repository). Record their names and a one-line description of what they do. STEP B — Search for trending topics (run these searches) 1. Search: "trending app features ${dateISO}" 2. Search: "popular chatbot skills 2026" 3. Search: "most requested AI assistant features" 4. Search: "productivity tools trending ${dateISO}" 5. Search: "daily habit apps 2026" STEP C — Identify gaps Compare trending topics with existing skills. List 5 areas that are trending but not yet covered by any existing skill. STEP D — Generate Top-3 ideas For each of the top 3 skill ideas, provide: - Skill name (slug format, e.g. "daily-poem") - One-line description - Target audience - Core features (3-5 bullet points) - Why it's valuable right now - Estimated complexity: Low / Medium / High STEP E — Select the winner Choose the best idea balancing: user value, originality, feasibility in one day, and fit with the openclaw skill ecosystem. OUTPUT FORMAT (JSON, to be saved as data/current-pipeline.json stage=research): { "stage": "research", "date": "${dateISO}", "ideas": [ { "name": "...", "slug": "...", "description": "...", "features": [], "complexity": "..." }, { "name": "...", "slug": "...", "description": "...", "features": [], "complexity": "..." }, { "name": "...", "slug": "...", "description": "...", "features": [], "complexity": "..." } ], "selected": { "name": "...", "slug": "...", "description": "...", "features": [], "reasoning": "..." }, "completedAt": "" } Save this JSON to: data/current-pipeline.json Then proceed to Stage 2: node scripts/design.js "" `); } else { console.log(` === AUTOMATIC SKILL — 阶段 1：调研 === 日期：${dateISO} 你是 Automatic Skill 流水线。第 1 阶段的任务是调研并确定今天要构建的最佳 Skill 创意。步骤 A — 扫描现有 Skill 列出 openclaw skills 目录（~/.openclaw/workspace/skills 或已知 skill 仓库）中所有 skill 文件夹，记录它们的名称和一句话描述。步骤 B — 搜索趋势话题（执行以下搜索） 1. 搜索："${dateISO} 热门 App 功能" 2. 搜索："2026 最受欢迎聊天机器人技能" 3. 搜索："AI 助手最常被请求的功能" 4. 搜索："${dateISO} 生产力工具趋势" 5. 搜索："2026 日常习惯打卡类应用趋势" 步骤 C — 识别空白将趋势话题与现有 skill 对比，列出 5 个有热度但尚无对应 skill 的领域。步骤 D — 生成 Top-3 创意对每个候选 skill 创意，给出： - Skill 名称（slug 格式，如 "daily-poem"） - 一句话描述 - 目标用户群体 - 核心功能（3-5 条） - 当下价值亮点 - 预估复杂度：低 / 中 / 高步骤 E — 选出最优创意综合评估：用户价值、独创性、单日可交付性、与 openclaw 生态的契合度，选出最终创意。输出格式（JSON，保存为 data/current-pipeline.json，stage=research）： { "stage": "research", "date": "${dateISO}", "ideas": [ { "name": "...", "slug": "...", "description": "...", "features": [], "complexity": "..." }, { "name": "...", "slug": "...", "description": "...", "features": [], "complexity": "..." }, { "name": "...", "slug": "...", "description": "...", "features": [], "complexity": "..." } ], "selected": { "name": "...", "slug": "...", "description": "...", "features": [], "reasoning": "..." }, "completedAt": "" } 将此 JSON 保存到：data/current-pipeline.json 然后进入阶段 2：node scripts/design.js "" `); } FILE:scripts/review.js #!/usr/bin/env node /** * Automatic Skill — Stage 5: Review (审核) * 输出 Agent 执行 prompt，指导其对照质量检查单验证生成的 Skill。 * * 用法: * node scripts/review.js * node scripts/review.js --from-pipeline */ const fs = require('fs'); const path = require('path'); const args = process.argv.slice(2); const langIdx = args.indexOf('--lang'); const lang = langIdx !== -1 ? args[langIdx + 1] : 'zh'; let skillDir = ''; if (args.includes('--from-pipeline')) { const pipelinePath = path.join(__dirname, '..', 'data', 'current-pipeline.json'); if (fs.existsSync(pipelinePath)) { const p = JSON.parse(fs.readFileSync(pipelinePath, 'utf8')); skillDir = p.create && p.create.skillDir ? p.create.skillDir : ''; } } if (!skillDir) { skillDir = args.filter(a => a !== '--lang' && a !== lang && !a.startsWith('--'))[0] || ''; } if (!skillDir) { console.error('Usage: node scripts/review.js '); console.error(' node scripts/review.js --from-pipeline'); process.exit(1); } if (lang === 'en') { console.log(` === AUTOMATIC SKILL — Stage 5: Review === Skill directory: ${skillDir} Review the generated skill against this quality checklist. Mark each item PASS / FAIL / WARNING. ── STRUCTURE CHECKLIST ────────────────────────────────────────── □ SKILL.md exists and is non-empty □ SKILL.md frontmatter has: name, description, keywords, metadata.openclaw □ description is ≥ 3 sentences and explains WHO it's for, WHAT it does, WHEN to use □ keywords list has ≥ 15 entries, mix of Chinese and English □ metadata.openclaw.runtime.node is set □ package.json exists with name, version, description, scripts □ _meta.json exists with ownerId, slug, version □ .clawhub/origin.json exists with ownerId and slug □ All scripts listed in package.json "scripts" actually exist as files ── SCRIPT QUALITY CHECKLIST ───────────────────────────────────── □ Each script has a header comment (filename, purpose, usage) □ Each script handles missing/invalid args (prints usage + exits with code 1) □ Each script produces meaningful output (not empty, not placeholder "TODO") □ Script output (prompt text) is specific enough for an agent to act on □ No hardcoded user IDs, tokens, or secrets in scripts □ No synchronous filesystem reads that could fail silently ── CONTENT QUALITY CHECKLIST ──────────────────────────────────── □ SKILL.md has a "何时使用" or "When to Use" section □ SKILL.md has a scripts/commands reference section □ SKILL.md has a ⚠️ notes / caveats section □ No placeholder text ("...", "TODO", "FIXME", "Lorem ipsum") in any file □ No broken internal references (mentioned scripts that don't exist) □ Cron expressions (if any) are valid 5-field cron format ── SECURITY CHECKLIST ─────────────────────────────────────────── □ No hardcoded API keys or tokens □ User input is validated before use (no injection risk) □ No dynamic code execution using user-supplied input OUTPUT INSTRUCTIONS: For each failed item, describe what is wrong and the exact fix needed. Produce a review report in this JSON format: { "stage": "review", "skillDir": "${skillDir}", "score": <0-100>, "passed": [...list of PASS items...], "warnings": [...list of WARNING items with explanation...], "failures": [...list of FAIL items with required fix...], "verdict": "PASS" | "FAIL" | "PASS_WITH_WARNINGS", "completedAt": "" } If verdict is FAIL: fix each failure in the files, then re-run review. If verdict is PASS or PASS_WITH_WARNINGS: proceed to Stage 6: node scripts/self-run.js ${skillDir} Update data/current-pipeline.json: add "review" key with the report above. `); } else { console.log(` === AUTOMATIC SKILL — 阶段 5：审核 === Skill 目录：${skillDir} 对照以下质量检查单审核生成的 skill。对每一项标注通过 / 失败 / 警告。 ── 结构检查 ────────────────────────────────────────────────────── □ SKILL.md 存在且非空 □ SKILL.md frontmatter 包含：name, description, keywords, metadata.openclaw □ description ≥ 3 句，说明了目标用户（WHO）、功能（WHAT）、触发场景（WHEN） □ keywords 列表有 ≥ 15 项，中英混合 □ metadata.openclaw.runtime.node 已设置 □ package.json 存在，包含 name, version, description, scripts □ _meta.json 存在，包含 ownerId, slug, version □ .clawhub/origin.json 存在，包含 ownerId 和 slug □ package.json scripts 中列出的所有脚本实际存在对应文件 ── 脚本质量检查 ────────────────────────────────────────────────── □ 每个脚本有头部注释（文件名、用途、用法） □ 每个脚本处理缺失/无效参数（打印用法 + 以 code 1 退出） □ 每个脚本产出有意义的输出（非空、非 "TODO" 占位符） □ 脚本输出的 prompt 文本足够具体，Agent 可据此执行 □ 脚本中无硬编码的用户 ID、token 或密钥 □ 无可能静默失败的同步文件读取 ── 内容质量检查 ────────────────────────────────────────────────── □ SKILL.md 有"何时使用"章节 □ SKILL.md 有脚本/命令参考章节 □ SKILL.md 有 ⚠️ 注意事项章节 □ 任何文件中无占位符文本（"..."、"TODO"、"FIXME"、"Lorem ipsum"） □ 无断裂的内部引用（提到了不存在的脚本） □ Cron 表达式（如有）为有效的 5 字段 cron 格式 ── 安全检查 ────────────────────────────────────────────────────── □ 无硬编码的 API key 或 token □ 用户输入在使用前经过校验（无注入风险） □ 无使用用户输入作为代码执行的动态调用输出说明：对每项失败项，描述问题所在及需要的精确修复方案。以如下 JSON 格式产出审核报告： { "stage": "review", "skillDir": "${skillDir}", "score": <0-100>, "passed": [...通过项列表...], "warnings": [...警告项列表（含说明）...], "failures": [...失败项列表（含必要修复方案）...], "verdict": "PASS" | "FAIL" | "PASS_WITH_WARNINGS", "completedAt": "" } 如果 verdict 为 FAIL：修复文件中的每个失败项，然后重新运行审核。如果 verdict 为 PASS 或 PASS_WITH_WARNINGS：进入阶段 6：node scripts/self-run.js ${skillDir} 更新 data/current-pipeline.json：添加 "review" 键，值为上述报告。 `); } FILE:scripts/scan-check.js #!/usr/bin/env node /** * Automatic Skill — Stage 7.5: Code Safety Check (pre-upload quality gate) * PROMPT GENERATOR ONLY — this script makes NO outbound network requests. * * Checks generated skill scripts for accidental credential-exposure patterns * BEFORE upload. This is a code quality gate, not a scanner-evasion tool. * Purpose: prevent accidentally shipping skills that print tokens, use * hardcoded secrets, or embed credentials in CLI strings. * * This check runs BEFORE Stage 8 (upload). Failures block upload. * No auto-fix loop. Issues are reported to the user for manual review. * * Usage: * node scripts/scan-check.js * node scripts/scan-check.js --from-pipeline * node scripts/scan-check.js --from-pipeline --lang en */ const fs = require('fs'); const path = require('path'); const args = process.argv.slice(2); const langIdx = args.indexOf('--lang'); const lang = langIdx !== -1 ? args[langIdx + 1] : 'zh'; let slug = ''; let version = ''; let skillDir = ''; function loadPipelineState() { try { const p = path.join(__dirname, '..', 'data', 'current-pipeline.json'); if (!fs.existsSync(p)) return null; delete require.cache[require.resolve(p)]; return require(p); } catch (e) { return null; } } if (args.includes('--from-pipeline')) { const p = loadPipelineState(); if (p) { slug = (p.design && p.design.slug) || (p.research && p.research.selected && p.research.selected.slug) || ''; version = (p.upload && p.upload.version) || (p.seo && p.seo.version) || (p.design && p.design.version) || '1.0.0'; skillDir = (p.create && p.create.skillDir) || ''; } } if (!slug) { slug = args.filter(a => a !== '--lang' && a !== lang && !a.startsWith('--'))[0] || ''; } if (!slug) { console.error('Usage: node scripts/scan-check.js '); console.error(' node scripts/scan-check.js --from-pipeline'); process.exit(1); } // ─── Load credential-safety patterns from external data file ───────────────── // Patterns are stored in data/safety-patterns.json to keep them as data, // not inline code. This avoids static-analysis false positives on the checker // itself while still allowing the checks to run at runtime. function loadSafetyPatterns() { const patternsPath = path.join(__dirname, '..', 'data', 'safety-patterns.json'); if (!fs.existsSync(patternsPath)) return []; try { const raw = JSON.parse(fs.readFileSync(patternsPath, 'utf8')); return raw.map(p => ({ ...p, regex: new RegExp(p.pattern) })); } catch (e) { return []; } } const TRIGGER_PATTERNS = loadSafetyPatterns(); // Scan the skill directory for trigger patterns const findings = []; if (skillDir && fs.existsSync(skillDir)) { const scriptsDir = path.join(skillDir, 'scripts'); const dirsToScan = [skillDir]; if (fs.existsSync(scriptsDir)) dirsToScan.push(scriptsDir); for (const dir of dirsToScan) { for (const file of fs.readdirSync(dir)) { if (!file.endsWith('.js') && !file.endsWith('.md')) continue; const filePath = path.join(dir, file); const content = fs.readFileSync(filePath, 'utf8'); const lines = content.split('\n'); for (const trigger of TRIGGER_PATTERNS) { lines.forEach((line, i) => { if (trigger.regex.test(line)) { findings.push({ file: path.relative(skillDir, filePath), line: i + 1, triggerId: trigger.id, severity: trigger.severity, matched: line.trim().slice(0, 120), fix: trigger.fix, }); } }); } } } } const hasTriggers = findings.length > 0; if (lang === 'en') { console.log(`=== AUTOMATIC SKILL — Stage 7.5: Code Safety Check === Skill: ${slug} version: ${version} Purpose: pre-upload credential-safety quality gate (NOT a scanner-evasion tool) ${skillDir ? `Skill dir: ${skillDir}` : '(skill dir not in pipeline)'} Findings: ${hasTriggers ? `${findings.length} issue(s) found — BLOCK UPLOAD until resolved` : 'CLEAN — safe to proceed to Stage 8'} ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ CREDENTIAL SAFETY FINDINGS ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ${hasTriggers ? findings.map((f, i) => `[${i+1}] ${f.severity} — ${f.triggerId} File: ${f.file} Line: ${f.line} Code: ${f.matched} Fix: ${f.fix}`).join('\n\n') : 'No credential-safety issues found in skill scripts.'} ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ${hasTriggers ? `ACTION REQUIRED — DO NOT UPLOAD UNTIL RESOLVED For each finding: 1. Open the file at the indicated line 2. Apply the suggested fix 3. Verify the issue is resolved Once all issues are fixed, re-run this check: node scripts/scan-check.js --from-pipeline If all clear: proceed to Stage 8: node scripts/upload.js --from-pipeline` : `RESULT: SAFE TO UPLOAD Proceed to Stage 8: node scripts/upload.js --from-pipeline`} ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ OUTPUT FORMAT (write to data/current-pipeline.json under "safetyCheck" key) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ { "stage": "safety-check", "slug": "${slug}", "version": "${version}", "issuesFound": ${findings.length}, "findings": ${JSON.stringify(findings, null, 4).replace(/\n/g, '\n ')}, "verdict": "${hasTriggers ? 'BLOCK' : 'PASS'}", "completedAt": "" } `); } else { console.log(`=== AUTOMATIC SKILL — 阶段 7.5：代码安全检查 === Skill：${slug} 版本：${version} 用途：上传前的凭证安全质检（不是扫描器绕过工具） ${skillDir ? `Skill 目录：${skillDir}` : '（pipeline 中无 skill 目录）'} 检查结果：${hasTriggers ? `发现 ${findings.length} 个问题 — 修复前禁止上传` : 'CLEAN — 可以进入阶段 8'} ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 凭证安全问题 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ${hasTriggers ? findings.map((f, i) => `[${i+1}] ${f.severity} — ${f.triggerId} 文件：${f.file} 行：${f.line} 代码：${f.matched} 修复：${f.fix}`).join('\n\n') : '未发现凭证安全问题。'} ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ${hasTriggers ? `需要操作 — 修复前禁止上传对每个发现： 1. 打开指示文件中的对应行 2. 应用建议的修复 3. 验证问题已解决修复完成后重新运行本检查： node scripts/scan-check.js --from-pipeline 全部通过后进入阶段 8：node scripts/upload.js --from-pipeline` : `结果：可以安全上传进入阶段 8：node scripts/upload.js --from-pipeline`} ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 输出格式（写入 data/current-pipeline.json 的 "safetyCheck" 键） ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ { "stage": "safety-check", "slug": "${slug}", "version": "${version}", "issuesFound": ${findings.length}, "findings": ${JSON.stringify(findings, null, 4).replace(/\n/g, '\n ')}, "verdict": "${hasTriggers ? 'BLOCK' : 'PASS'}", "completedAt": "" } `); } FILE:scripts/scan-fix.js #!/usr/bin/env node /** * Automatic Skill — Credential Safety Reference * PROMPT GENERATOR ONLY — this script makes NO outbound network requests. * * Outputs a reference guide for writing credential-safe skill scripts. * This is documentation, not an auto-fix tool. It does not modify files, * does not re-publish, and does not loop until any external checker passes. * * Usage: * node scripts/scan-fix.js * node scripts/scan-fix.js --lang en */ const args = process.argv.slice(2); const langIdx = args.indexOf('--lang'); const lang = langIdx !== -1 ? args[langIdx + 1] : 'zh'; if (lang === 'en') { console.log(`=== Credential Safety Reference for Skill Scripts === RULE 1 — Never print token values Bad : console.log(process.env.GITHUB_TOKEN) Bad : echo $GITHUB_TOKEN Good: gh auth status (exit 0 = authenticated) Good: clawhub whoami (returns username, not token) RULE 2 — Never hardcode credentials Bad : const token = "ghp_abc123..." Good: const token = process.env.GITHUB_TOKEN RULE 3 — Wrap env reads in named helper functions Bad : const repo = process.env.GITHUB_REPO // top-level Good: function loadConfig() { return { repo: process.env.GITHUB_REPO } } RULE 4 — Use CLI tools for authenticated operations, not raw curl Bad : curl -H "Authorization: token $GITHUB_TOKEN" https://api.github.com/... Good: gh api repos/owner/repo/commits/main RULE 5 — Never decode or preview credential bytes Bad : echo $TOKEN | base64 -d Bad : echo $TOKEN | head -c 20 Good: gh auth status --show-token // DO NOT USE --show-token Good: gh auth status // correct: shows login status only RULE 6 — Declare all env vars in SKILL.md requirements.env Every env var read by any script must be listed with: name, required (true/false), description These rules are enforced by Stage 7.5 (scan-check.js) before upload. `); } else { console.log(`=== Skill 脚本凭证安全规范 === 规则 1 — 禁止打印 token 值错误：console.log(process.env.GITHUB_TOKEN) 错误：echo $GITHUB_TOKEN 正确：gh auth status (exit 0 = 已认证) 正确：clawhub whoami (返回用户名，不是 token) 规则 2 — 禁止硬编码凭证错误：const token = "ghp_abc123..." 正确：const token = process.env.GITHUB_TOKEN 规则 3 — env 读取必须封装在命名函数中错误：const repo = process.env.GITHUB_REPO // 顶层读取正确：function loadConfig() { return { repo: process.env.GITHUB_REPO } } 规则 4 — 用 CLI 工具执行认证操作，不要用原始 curl 错误：curl -H "Authorization: token $GITHUB_TOKEN" https://api.github.com/... 正确：gh api repos/owner/repo/commits/main 规则 5 — 禁止解码或预览凭证字节错误：echo $TOKEN | base64 -d 错误：echo $TOKEN | head -c 20 正确：gh auth status （不加 --show-token）规则 6 — 所有 env var 必须在 SKILL.md requirements.env 中声明每个脚本读取的 env var 都必须列出： name, required (true/false), description 以上规则由阶段 7.5（scan-check.js）在上传前强制执行。 `); } FILE:scripts/self-check.js #!/usr/bin/env node /** * Automatic Skill — Stage 7: Self-Check (自检) * 输出 Agent 执行 prompt，指导其对新 skill 逐项核对必填字段、文件树、脚本签名。 * * 用法: * node scripts/self-check.js * node scripts/self-check.js --from-pipeline */ const fs = require('fs'); const path = require('path'); const args = process.argv.slice(2); const langIdx = args.indexOf('--lang'); const lang = langIdx !== -1 ? args[langIdx + 1] : 'zh'; let skillDir = ''; if (args.includes('--from-pipeline')) { const pipelinePath = path.join(__dirname, '..', 'data', 'current-pipeline.json'); if (fs.existsSync(pipelinePath)) { const p = JSON.parse(fs.readFileSync(pipelinePath, 'utf8')); skillDir = p.create && p.create.skillDir ? p.create.skillDir : ''; } } if (!skillDir) { skillDir = args.filter(a => a !== '--lang' && a !== lang && !a.startsWith('--'))[0] || ''; } if (!skillDir) { console.error('Usage: node scripts/self-check.js '); console.error(' node scripts/self-check.js --from-pipeline'); process.exit(1); } if (lang === 'en') { console.log(` === AUTOMATIC SKILL — Stage 7: Self-Check === Skill directory: ${skillDir} Perform a rigorous self-check. This is the last gate before upload. MANDATORY FILE CHECK — verify each file exists and is non-empty: □ ${skillDir}/SKILL.md → must exist, size > 500 bytes □ ${skillDir}/package.json → must be valid JSON, has "name", "version", "scripts" □ ${skillDir}/_meta.json → must have ownerId, slug, version □ ${skillDir}/.clawhub/origin.json → must have ownerId and slug FRONTMATTER CHECK — parse SKILL.md YAML frontmatter and verify: □ name: non-empty string □ description: ≥ 100 characters □ keywords: array with ≥ 15 items □ metadata.openclaw.runtime.node: present SLUG CONSISTENCY CHECK: □ slug in SKILL.md frontmatter name == slug in _meta.json == slug in .clawhub/origin.json == directory basename SCRIPTS CHECK — for each script listed in package.json "scripts": □ The file exists at the referenced path □ File starts with "#!/usr/bin/env node" or similar shebang / header comment □ File size > 100 bytes VERSION CHECK: □ package.json version matches _meta.json version DATA FILES CHECK (if any data/ directory exists): □ All .json files in data/ are valid JSON □ No data file contains real user data (should be empty arrays/objects for a fresh skill) REQUIRED SECTIONS CHECK — parse SKILL.md body and verify all five sections exist with real content: □ "## Purpose & Capability" heading present → body must contain: core concept description + capability list/table + explicit "does not" boundary □ "## Instruction Scope" heading present → body must contain: in-scope examples + out-of-scope list + behavior when missing credentials □ "## Credentials" heading present → body must contain: Action/Credential/Scope table (or explicit "no credentials required" statement) → must NOT contain: hardcoded token values, personal account IDs, or real API keys □ "## Persistence & Privilege" heading present → body must contain: paths-written table + "does not write" list + uninstall instructions □ "## Install Mechanism" heading present → body must contain: clawhub install command + verification step + env var examples Each section must be > 50 characters (non-empty). Missing or empty section = FAIL. CROSS-REFERENCE CHECK: □ All scripts mentioned in SKILL.md actually exist in the scripts/ directory □ All cron commands in SKILL.md reference valid script files □ package.json "scripts" entries match actual filenames FINAL COMPLETENESS SCORE: Count total checks. Calculate: passed / total * 100. OUTPUT FORMAT (JSON): { "stage": "self-check", "skillDir": "${skillDir}", "slug": "...", "totalChecks": , "passedChecks": , "score": <0-100>, "failures": [ { "check": "...", "detail": "...", "fix": "..." } ], "verdict": "READY_TO_UPLOAD" | "NEEDS_FIX", "completedAt": "" } If verdict is NEEDS_FIX: apply all fixes and re-run self-check until READY_TO_UPLOAD. If READY_TO_UPLOAD: proceed to Stage 8: node scripts/upload.js ${skillDir} Update data/current-pipeline.json: add "selfCheck" key with the report above. `); } else { console.log(` === AUTOMATIC SKILL — 阶段 7：自检 === Skill 目录：${skillDir} 执行严格的自检。这是上传前的最后关卡。必填文件检查 — 验证每个文件存在且非空： □ ${skillDir}/SKILL.md → 必须存在，大小 > 500 字节 □ ${skillDir}/package.json → 必须是合法 JSON，有 "name"、"version"、"scripts" □ ${skillDir}/_meta.json → 必须有 ownerId, slug, version □ ${skillDir}/.clawhub/origin.json → 必须有 ownerId 和 slug Frontmatter 检查 — 解析 SKILL.md YAML frontmatter 并验证： □ name：非空字符串 □ description：≥ 100 个字符 □ keywords：数组，≥ 15 项 □ metadata.openclaw.runtime.node：存在 Slug 一致性检查： □ SKILL.md frontmatter name == _meta.json slug == .clawhub/origin.json slug == 目录 basename 脚本检查 — 对 package.json "scripts" 中列出的每个脚本： □ 文件存在于引用路径 □ 文件以 "#!/usr/bin/env node" 或类似 shebang/头部注释开头 □ 文件大小 > 100 字节版本检查： □ package.json version == _meta.json version 数据文件检查（如存在 data/ 目录）： □ data/ 中所有 .json 文件为合法 JSON □ 数据文件不含真实用户数据（新 skill 应为空数组/空对象）必要章节检查 — 解析 SKILL.md 正文，验证五个必要章节均存在且有真实内容： □ "## Purpose & Capability" 标题存在 → 正文必须包含：核心概念说明 + 能力列表/表格 + 明确的"不做"边界 □ "## Instruction Scope" 标题存在 → 正文必须包含：在 scope 内示例 + 不在 scope 内列表 + 凭证缺失时的行为 □ "## Credentials" 标题存在 → 正文必须包含：操作/凭证/范围表格（或明确的"无需凭证"声明） → 不得包含：硬编码的 token 值、个人账号 ID、真实 API 密钥 □ "## Persistence & Privilege" 标题存在 → 正文必须包含：写入路径表格 + "不写入"列表 + 卸载方法 □ "## Install Mechanism" 标题存在 → 正文必须包含：clawhub install 命令 + 验证步骤 + env var 配置示例每个章节内容必须 > 50 个字符（非空）。章节缺失或为空 = FAIL。交叉引用检查： □ SKILL.md 中提及的所有脚本实际存在于 scripts/ 目录 □ SKILL.md 中所有 cron 命令引用的脚本文件均存在 □ package.json "scripts" 条目与实际文件名匹配最终完整度评分：计算总检查项数。计算：通过项 / 总项 * 100。输出格式（JSON）： { "stage": "self-check", "skillDir": "${skillDir}", "slug": "...", "totalChecks": , "passedChecks": , "score": <0-100>, "failures": [ { "check": "...", "detail": "...", "fix": "..." } ], "verdict": "READY_TO_UPLOAD" | "NEEDS_FIX", "completedAt": "" } 如果 verdict 为 NEEDS_FIX：应用所有修复并重新自检，直到 READY_TO_UPLOAD。如果 READY_TO_UPLOAD：进入阶段 8：node scripts/upload.js ${skillDir} 更新 data/current-pipeline.json：添加 "selfCheck" 键，值为上述报告。 `); } FILE:scripts/self-run.js #!/usr/bin/env node /** * Automatic Skill — Stage 6: Self-Run (自跑) * 输出 Agent 执行 prompt，指导其执行新 skill 的每个脚本并验证输出无报错。 * * 用法: * node scripts/self-run.js * node scripts/self-run.js --from-pipeline */ const fs = require('fs'); const path = require('path'); const args = process.argv.slice(2); const langIdx = args.indexOf('--lang'); const lang = langIdx !== -1 ? args[langIdx + 1] : 'zh'; let skillDir = ''; if (args.includes('--from-pipeline')) { const pipelinePath = path.join(__dirname, '..', 'data', 'current-pipeline.json'); if (fs.existsSync(pipelinePath)) { const p = JSON.parse(fs.readFileSync(pipelinePath, 'utf8')); skillDir = p.create && p.create.skillDir ? p.create.skillDir : ''; } } if (!skillDir) { skillDir = args.filter(a => a !== '--lang' && a !== lang && !a.startsWith('--'))[0] || ''; } if (!skillDir) { console.error('Usage: node scripts/self-run.js '); console.error(' node scripts/self-run.js --from-pipeline'); process.exit(1); } const skillName = path.basename(skillDir); if (lang === 'en') { console.log(` === AUTOMATIC SKILL — Stage 6: Self-Run === Skill directory: ${skillDir} Skill name: ${skillName} Execute every script in the skill and verify the output. Follow these steps: STEP A — Install dependencies Run: cd ${skillDir} && npm install If package.json has no dependencies, skip this step (no error). STEP B — Enumerate scripts List all .js files in: ${skillDir}/scripts/ Record their filenames. STEP C — Run each script For each script, run it with no arguments first: node ${skillDir}/scripts/.js Expected results: - Scripts that require args: should print a usage message and exit with code 1 (PASS) - Scripts that work without args: should print a non-empty prompt or result (PASS) - Any script that crashes (throws uncaught exception, stack trace): FAIL STEP D — Run scripts with --help or --dry-run if supported Try: node ${skillDir}/scripts/.js --help node ${skillDir}/scripts/.js --dry-run These should not crash. STEP E — Run the main trigger script Identify the primary script (the one most likely to be the first entry point — usually morning-push.js, daily-push.js, main.js, or the first script listed in package.json scripts). Run it and confirm it produces readable, non-empty output. EVALUATION CRITERIA: ✅ PASS: Script runs, exits with 0 or 1, produces meaningful output ⚠️ WARNING: Script exits with unexpected code or produces very short output ❌ FAIL: Script crashes with uncaught exception or stack trace OUTPUT FORMAT (JSON): { "stage": "self-run", "skillDir": "${skillDir}", "scriptsRun": [ { "file": "scripts/xxx.js", "command": "node ...", "exitCode": 0, "outputPreview": "...", "result": "PASS" | "WARNING" | "FAIL", "notes": "..." } ], "verdict": "PASS" | "FAIL" | "PASS_WITH_WARNINGS", "completedAt": "" } If verdict is FAIL: fix the crashing scripts, then re-run self-run. If PASS or PASS_WITH_WARNINGS: proceed to Stage 7: node scripts/self-check.js ${skillDir} Update data/current-pipeline.json: add "selfRun" key with the report above. `); } else { console.log(` === AUTOMATIC SKILL — 阶段 6：自跑 === Skill 目录：${skillDir} Skill 名称：${skillName} 执行 skill 的每个脚本并验证输出无报错。按以下步骤操作：步骤 A — 安装依赖运行：cd ${skillDir} && npm install 如果 package.json 没有依赖，跳过此步骤（不报错）。步骤 B — 枚举脚本列出 ${skillDir}/scripts/ 中的所有 .js 文件，记录文件名。步骤 C — 逐个运行脚本对每个脚本，先不带参数运行： node ${skillDir}/scripts/<脚本名>.js 预期结果： - 需要参数的脚本：打印用法信息并以 code 1 退出（通过） - 无需参数即可运行的脚本：打印非空的 prompt 或结果（通过） - 任何崩溃的脚本（未捕获异常、堆栈追踪）：失败步骤 D — 带 --help 或 --dry-run 运行（如支持）尝试：node ${skillDir}/scripts/<脚本名>.js --help node ${skillDir}/scripts/<脚本名>.js --dry-run 这些不应该崩溃。步骤 E — 运行主触发脚本确定主脚本（最可能是第一入口的脚本 — 通常是 morning-push.js、daily-push.js、main.js，或 package.json scripts 中列出的第一个脚本）。运行它并确认产出可读的非空输出。评估标准： ✅ 通过：脚本运行，以 0 或 1 退出，产出有意义的输出 ⚠️ 警告：脚本以意外代码退出或产出极短输出 ❌ 失败：脚本崩溃，有未捕获异常或堆栈追踪输出格式（JSON）： { "stage": "self-run", "skillDir": "${skillDir}", "scriptsRun": [ { "file": "scripts/xxx.js", "command": "node ...", "exitCode": 0, "outputPreview": "...", "result": "PASS" | "WARNING" | "FAIL", "notes": "..." } ], "verdict": "PASS" | "FAIL" | "PASS_WITH_WARNINGS", "completedAt": "" } 如果 verdict 为 FAIL：修复崩溃的脚本，然后重新自跑。如果 PASS 或 PASS_WITH_WARNINGS：进入阶段 7：node scripts/self-check.js ${skillDir} 更新 data/current-pipeline.json：添加 "selfRun" 键，值为上述报告。 `); } FILE:scripts/seo.js #!/usr/bin/env node /** * Automatic Skill — Stage 3: SEO 优化 * 在设计完成后、制作前，对 skill 的名称、描述、关键词进行 SEO 优化， * 提升可搜索性、传播力和用户点击率。 * * 用法: * node scripts/seo.js --from-pipeline # 从 data/current-pipeline.json 读取设计结果 * node scripts/seo.js "daily-poem" # 直接传 slug */ const fs = require('fs'); const path = require('path'); const args = process.argv.slice(2); const langIdx = args.indexOf('--lang'); const lang = langIdx !== -1 ? args[langIdx + 1] : 'zh'; let slug = ''; let designInfo = {}; if (args.includes('--from-pipeline')) { const pipelinePath = path.join(__dirname, '..', 'data', 'current-pipeline.json'); if (!fs.existsSync(pipelinePath)) { console.error('ERROR: data/current-pipeline.json not found. Run design.js first.'); process.exit(1); } const pipeline = JSON.parse(fs.readFileSync(pipelinePath, 'utf8')); const design = pipeline.design; const selected = pipeline.selected || (pipeline.research && pipeline.research.selected); if (!design && !selected) { console.error('ERROR: No design or research data in current-pipeline.json. Complete Stage 2 first.'); process.exit(1); } slug = (design && design.slug) || (selected && selected.slug) || ''; designInfo = design || { slug, idea: selected && selected.description }; } else { slug = args.filter(a => !a.startsWith('--') && a !== lang)[0] || ''; if (!slug) { console.error('Usage: node scripts/seo.js --from-pipeline'); console.error(' node scripts/seo.js '); process.exit(1); } } const now = new Date(); const dateISO = `${now.getFullYear()}-${String(now.getMonth()+1).padStart(2,'0')}-${String(now.getDate()).padStart(2,'0')}`; const designSummary = JSON.stringify(designInfo, null, 2).slice(0, 1200); if (lang === 'en') { console.log(` === AUTOMATIC SKILL — Stage 3: SEO Optimization === Skill: ${slug} Date: ${dateISO} Design summary: ${designSummary} You are an SEO and product copywriting specialist. Optimize the skill's discoverability and appeal. TASK — Produce optimized versions of all the following: 1. DISPLAY NAME (max 30 chars) - Must be immediately clear about what the skill DOES - Natural language, not technical jargon - Example: "Daily Poem ✦ Morning Inspiration" → "Daily Poem" 2. TAGLINE (max 60 chars) - One punchy sentence that sells the benefit - Example: "A fresh poem delivered every morning, tailored to your mood" - No buzzwords like "powerful", "innovative", "seamless" 3. SHORT DESCRIPTION (max 120 chars) - For search result snippets and social previews - Lead with the #1 user benefit, include 2 primary keywords naturally - Must answer: What does it do? Who is it for? 4. FULL DESCRIPTION (200-300 chars) - For SKILL.md frontmatter - Include use cases, target users, key features - Natural keyword density — do not keyword-stuff 5. KEYWORDS (30+ terms) Rules: - Include the slug itself and natural variations - Mix Chinese + English (e.g. "每日诗词", "daily poem", "morning reading") - Cover: core function, target users, use scenarios, emotion/benefit words - Include long-tail phrases (e.g. "每天早上自动推送诗词") - NO commas within a single keyword phrase Format: plain list, one per line 6. GITHUB REPO DESCRIPTION (max 150 chars) - Technically precise, includes primary keywords - Suitable for developers scanning GitHub search results 7. CLAWHUB LISTING TITLE (max 40 chars) - Same as display name, or slightly shorter - Must contain the primary function keyword 8. SEARCH INTENT COVERAGE List 5 search queries a target user might type that this skill should rank for. OUTPUT FORMAT (JSON, append to data/current-pipeline.json under key "seo"): { "stage": "seo", "slug": "${slug}", "displayName": "...", "tagline": "...", "shortDescription": "...", "fullDescription": "...", "keywords": ["...", "...", "..."], "githubDescription": "...", "clawhubTitle": "...", "searchIntents": ["...", "...", "..."], "completedAt": "" } Read data/current-pipeline.json, add the "seo" key, save back. Then proceed to Stage 4: node scripts/create.js --from-pipeline `); } else { console.log(` === AUTOMATIC SKILL — 阶段 3：SEO 优化 === Skill：${slug} 日期：${dateISO} 设计摘要： ${designSummary} 你是一名 SEO 与产品文案专家。请对这个 skill 的可发现性和吸引力进行全面优化。任务 — 产出以下所有内容的优化版本： 1. 展示名称（最多 30 字） - 让人一眼明白 skill 能做什么 - 自然语言，不要技术术语 - 中文名优先，必要时中英混搭（如「每日诗词」「Career News 职场早报」） 2. 一句话卖点（最多 60 字） - 一句能打动用户的话，突出核心价值 - 禁止：强大、智能、无缝、赋能等空洞词汇 - 示例：「每天早晨推送一首诗，配合你的心情」 3. 搜索摘要描述（最多 120 字） - 用于搜索结果片段和社交预览 - 开头直接说第一大用户收益，自然嵌入 2 个核心关键词 - 必须回答：能做什么？适合谁？ 4. 完整描述（200-300 字） - 用于 SKILL.md frontmatter - 涵盖使用场景、目标用户、核心功能 - 关键词自然分布，不堆砌 5. 关键词列表（30 个以上）规则： - 包含 slug 本身及变体 - 中英混合（如「每日诗词」「daily poem」「早间推送」） - 覆盖：核心功能、目标用户、使用场景、情绪/收益词 - 包含长尾词组（如「每天早上自动推送诗词」） - 单个关键词/词组内不含逗号格式：纯列表，每行一个 6. GitHub 仓库描述（最多 150 字） - 技术精准，包含主要关键词 - 适合在 GitHub 搜索结果中被开发者扫到 7. clawHub 上架标题（最多 40 字） - 与展示名称相同或更简洁 - 必须包含主要功能关键词 8. 搜索意图覆盖列出目标用户可能输入的 5 条搜索词，这个 skill 应当能匹配到。输出格式（JSON，追加到 data/current-pipeline.json 的 "seo" 键下）： { "stage": "seo", "slug": "${slug}", "displayName": "...", "tagline": "...", "shortDescription": "...", "fullDescription": "...", "keywords": ["...", "...", "..."], "githubDescription": "...", "clawhubTitle": "...", "searchIntents": ["...", "...", "..."], "completedAt": "" } 读取 data/current-pipeline.json，添加 "seo" 键后保存回去。然后进入阶段 4：node scripts/create.js --from-pipeline `); } FILE:scripts/status.js #!/usr/bin/env node /** * Automatic Skill — Status (状态查询) * 查看当前流水线状态或历史记录。 * * 用法: * node scripts/status.js # 当前流水线状态 * node scripts/status.js --history # 最近 10 次记录 * node scripts/status.js --history 20 # 最近 20 次 * node scripts/status.js --clear # 清除当前流水线状态 */ const fs = require('fs'); const path = require('path'); const args = process.argv.slice(2); const dataDir = path.join(__dirname, '..', 'data'); const pipelinePath = path.join(dataDir, 'current-pipeline.json'); const logPath = path.join(dataDir, 'pipeline-log.json'); const STAGE_NAMES = { research: '1. Research (调研)', design: '2. Design (设计)', create: '3. Create (制作)', review: '4. Review (审核)', selfRun: '5. Self-Run (自跑)', selfCheck: '6. Self-Check (自检)', upload: '7. Upload (上传)', verifyUpload: '8. Verify (验收)', finalReview: '9. Final Review (复查)', }; // Handle --clear if (args.includes('--clear')) { if (fs.existsSync(pipelinePath)) { fs.unlinkSync(pipelinePath); console.log('✅ Current pipeline state cleared.'); } else { console.log('ℹ️ No current pipeline state to clear.'); } const lockPath = path.join(dataDir, 'pipeline.lock'); if (fs.existsSync(lockPath)) { fs.unlinkSync(lockPath); console.log('✅ Lock file cleared.'); } process.exit(0); } // Handle --history if (args.includes('--history')) { const nIdx = args.indexOf('--history'); const n = parseInt(args[nIdx + 1], 10) || 10; if (!fs.existsSync(logPath)) { console.log('📋 No pipeline history found.'); process.exit(0); } const log = JSON.parse(fs.readFileSync(logPath, 'utf8')); const recent = log.slice(-n).reverse(); console.log(`\n📋 Pipeline History (last ${recent.length} runs)\n`); console.log('Date Skill Review Check GitHub clawHub Verdict'); console.log('──────────── ──────────────────────── ─────── ─────── ────────── ────────── ────────────'); for (const entry of recent) { const date = (entry.date || '').substring(0, 10).padEnd(12); const slug = (entry.slug || '').substring(0, 24).padEnd(24); const reviewScore = String(entry.reviewScore || '-').padEnd(7); const checkScore = String(entry.selfCheckScore || '-').padEnd(7); const github = (entry.githubStatus || '-').padEnd(10); const clawhub = (entry.clawhubStatus || '-').padEnd(10); const verdict = entry.verdict || '-'; console.log(`${date} ${slug} ${reviewScore} ${checkScore} ${github} ${clawhub} ${verdict}`); } console.log(''); process.exit(0); } // Default: show current pipeline status if (!fs.existsSync(pipelinePath)) { console.log('\n📊 Automatic Skill — Pipeline Status'); console.log('─────────────────────────────────────'); console.log('Status: IDLE (no pipeline in progress)'); console.log(''); if (fs.existsSync(logPath)) { const log = JSON.parse(fs.readFileSync(logPath, 'utf8')); if (log.length > 0) { const last = log[log.length - 1]; console.log(`Last run: ${last.date} — ${last.slug} — ${last.verdict}`); } } console.log('\nRun: node scripts/pipeline.js to start a new pipeline'); console.log('Run: node scripts/status.js --history to view history\n'); process.exit(0); } const pipeline = JSON.parse(fs.readFileSync(pipelinePath, 'utf8')); const completedStages = Object.keys(STAGE_NAMES).filter(k => pipeline[k]); const pendingStages = Object.keys(STAGE_NAMES).filter(k => !pipeline[k]); const currentStage = pendingStages.length > 0 ? pendingStages[0] : 'complete'; console.log('\n📊 Automatic Skill — Pipeline Status'); console.log('─────────────────────────────────────'); console.log(`Date: ${pipeline.research && pipeline.research.date || pipeline.design && pipeline.design.date || 'unknown'}`); console.log(`Skill: ${pipeline.design && pipeline.design.slug || '(not yet selected)'}`); console.log(`Current: ${currentStage === 'complete' ? '✅ COMPLETE' : STAGE_NAMES[currentStage] || currentStage}`); console.log(''); console.log('Stages:'); for (const [key, name] of Object.entries(STAGE_NAMES)) { const done = !!pipeline[key]; const score = key === 'review' && pipeline[key] && pipeline[key].score !== undefined ? ` (score: ${pipeline[key].score})` : ''; const verdict = pipeline[key] && pipeline[key].verdict ? ` — ${pipeline[key].verdict}` : ''; console.log(` ${done ? '✅' : '⏳'} ${name}${score}${verdict}`); } console.log(''); if (currentStage !== 'complete') { const nextScript = { research: 'research.js', design: 'design.js --from-pipeline', create: 'create.js --from-pipeline', review: 'review.js --from-pipeline', selfRun: 'self-run.js --from-pipeline', selfCheck: 'self-check.js --from-pipeline', upload: 'upload.js --from-pipeline', verifyUpload: 'verify-upload.js --from-pipeline', finalReview: 'final-review.js --from-pipeline', }[currentStage]; console.log(`Next step: node scripts/${nextScript}`); } else { console.log('Pipeline is complete. Run: node scripts/pipeline.js to start a new one.'); } console.log(''); FILE:scripts/upload.js #!/usr/bin/env node /** * Automatic Skill — Stage 8: Upload * PROMPT GENERATOR ONLY — this script makes NO outbound network requests. * Outputs an agent prompt that uses the gh CLI (github skill pattern) for all * GitHub operations: auth check, repo access, commit verification, and PR workflow. * * Usage: * node scripts/upload.js * node scripts/upload.js --from-pipeline * node scripts/upload.js --dry-run --from-pipeline * node scripts/upload.js --pr # use PR workflow instead of direct push */ const fs = require('fs'); const path = require('path'); const args = process.argv.slice(2); const langIdx = args.indexOf('--lang'); const lang = langIdx !== -1 ? args[langIdx + 1] : 'zh'; const dryRun = args.includes('--dry-run'); const usePR = args.includes('--pr'); let skillDir = ''; let slug = ''; let version = ''; if (args.includes('--from-pipeline')) { const pipelinePath = path.join(__dirname, '..', 'data', 'current-pipeline.json'); if (fs.existsSync(pipelinePath)) { const p = JSON.parse(fs.readFileSync(pipelinePath, 'utf8')); skillDir = (p.create && p.create.skillDir) || ''; slug = (p.design && p.design.slug) || (p.research && p.research.selected && p.research.selected.slug) || path.basename(skillDir); version = (p.seo && p.seo.version) || (p.design && p.design.version) || '1.0.0'; } } if (!skillDir) { skillDir = args.filter(a => a !== '--lang' && a !== lang && !a.startsWith('--'))[0] || ''; slug = path.basename(skillDir); } if (!skillDir) { console.error('Usage: node scripts/upload.js '); console.error(' node scripts/upload.js --from-pipeline'); console.error(' node scripts/upload.js --pr # use PR workflow'); process.exit(1); } // Read for display in prompt text only — never sent over network by this script const githubRepo = process.env.GITHUB_REPO || ''; const dryRunNote = dryRun ? '\n⚠️ DRY-RUN MODE: print all commands but DO NOT execute git push, gh pr, or clawhub publish.' : ''; const prNote = usePR ? '\n📋 PR WORKFLOW: create a pull request instead of pushing directly to main.' : ''; const branchName = `auto-skill/${slug}`; // Extract owner from GITHUB_REPO (format: owner/repo) const githubOwner = githubRepo.includes('/') ? githubRepo.split('/')[0] : ''; if (lang === 'en') { console.log(`=== AUTOMATIC SKILL — Stage 8: Upload === Skill: ${slug} version: ${version} Skill directory: ${skillDir} GitHub repo (monorepo): ${githubRepo} Standalone repo: ${githubOwner}/${slug} Workflow: ${usePR ? 'PR (branch → merge)' : 'Direct push to main'}${dryRunNote}${prNote} Upload the skill to GitHub and clawHub using the gh CLI. Prerequisites: gh CLI installed and authenticated (gh auth status should show ✓ Logged in). PUBLISHING CONVENTION: Every skill must have BOTH: 1. A standalone GitHub repo (${githubOwner}/${slug}) — allows users to search and find the skill directly 2. A directory in the monorepo (${githubRepo}/openclaw/agents/skills/${slug}/) — for the registry index ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ PART 1 — PRE-FLIGHT CHECKS (gh CLI) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ CHECK 1 — Verify gh authentication Run: gh auth status → Must show: ✓ Logged in to github.com → If not logged in: gh auth login → Verify token scopes include "repo" (needed for push/PR) CHECK 2 — Verify monorepo access Run: gh repo view ${githubRepo} --json name,defaultBranchRef,url → Must return JSON with name and defaultBranchRef.name = "main" → If 404: verify GITHUB_REPO is correct (format: owner/repo) → If permission denied: check token scopes with: gh auth status (look for the scopes list) CHECK 3 — Confirm skill directory exists locally Run: ls -la ${skillDir}/SKILL.md ${skillDir}/package.json ${skillDir}/_meta.json → All three files must exist. If missing, re-run Stage 4 (create.js). ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ PART 2 — STANDALONE SKILL REPO (required for discoverability) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ STEP 1 — Check if standalone repo exists${dryRun ? ' (CHECK ONLY — dry-run)' : ''} gh repo view ${githubOwner}/${slug} --json name 2>/dev/null && echo "EXISTS" || echo "NOT_FOUND" STEP 2 — Create standalone repo if not exists${dryRun ? ' (SKIPPED — dry-run)' : ''} ${dryRun ? `DRY-RUN: would run: gh repo create ${githubOwner}/${slug} --public --description ""` : `If NOT_FOUND: # Read the tagline from SKILL.md description field (first line after "description: |") gh repo create ${githubOwner}/${slug} --public --description "" If EXISTS: skip creation, proceed to STEP 3.`} STEP 3 — Push skill files to standalone repo${dryRun ? ' (SKIPPED — dry-run)' : ''} ${dryRun ? 'DRY-RUN: would initialize standalone repo and push skill files' : `Create a clean local git repo from the skill directory and push: cd /tmp rm -rf ${slug}-standalone cp -r ${skillDir} ${slug}-standalone cd ${slug}-standalone git init git add . git commit -m "feat: ${slug}@${version} — auto-generated by automatic-skill" git remote add origin https://github.com/${githubOwner}/${slug}.git git push -u origin main Verify standalone push: gh api repos/${githubOwner}/${slug}/commits/main --jq '.sha + " | " + .commit.message' → Should show the new commit`} ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ PART 3 — MONOREPO GITHUB UPLOAD (git + gh CLI) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ STEP 4 — Navigate to monorepo root Find the repo root and cd into it. The skill must be inside this repo: gh repo view ${githubRepo} --json url --jq '.url' cd STEP 5 — Ensure skill directory is in the monorepo ls openclaw/agents/skills/${slug}/ If missing: cp -r ${skillDir} openclaw/agents/skills/${slug}/ ${usePR ? `STEP 6 — Create branch for PR workflow git checkout -b ${branchName} → If branch exists: git checkout ${branchName} && git reset --hard origin/main` : `STEP 6 — Confirm on main branch git branch --show-current → Must be "main". If not: git checkout main`} STEP 7 — Stage skill files git add openclaw/agents/skills/${slug}/ git status → Confirm only ${slug} files are staged. Check for unexpected changes. STEP 8 — Commit git commit -m "feat: add ${slug}@${version} — auto-generated by automatic-skill" → Record the commit hash: git rev-parse HEAD STEP 9 — ${usePR ? 'Push branch and open PR' : 'Push to main'}${dryRun ? ' (SKIPPED — dry-run)' : ''} ${dryRun ? `DRY-RUN: would run: ${usePR ? `git push -u origin ${branchName} gh pr create --title "feat: add ${slug}@${version} skill" \\ --body "Auto-generated by automatic-skill pipeline. Skill: ${slug} v${version}" \\ --base main --head ${branchName}` : 'git push origin main'}` : usePR ? `git push -u origin ${branchName} Then open a PR with gh: gh pr create \\ --title "feat: add ${slug}@${version} skill" \\ --body "Auto-generated by automatic-skill pipeline.\\n\\nSkill: ${slug}\\nVersion: ${version}\\nDirectory: openclaw/agents/skills/${slug}/" \\ --base main \\ --head ${branchName} → Record PR number: gh pr view --json number --jq '.number' Auto-merge (if branch protection allows): gh pr merge --squash --auto` : `git push origin main Verify push succeeded: gh api repos/${githubRepo}/commits/main --jq '.sha + " | " + .commit.message' → Should show your new commit at the top`} ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ PART 3 — CLAWHUB PUBLISH ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ STEP 7 — Verify clawHub authentication clawhub whoami → Must return your clawHub username (exit code 0) → If error: set CLAWHUB_TOKEN in your shell environment and retry STEP 8 — Publish to clawHub${dryRun ? ' (SKIPPED — dry-run)' : ''} ${dryRun ? 'DRY-RUN: would run clawhub publish command' : ` clawhub publish ${skillDir} --version ${version}`} → On success: record the skill ID returned by clawhub publish ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ OUTPUT FORMAT (write to data/current-pipeline.json under "upload" key) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ { "stage": "upload", "skillDir": "${skillDir}", "slug": "${slug}", "version": "${version}", "dryRun": ${dryRun}, "workflow": "${usePR ? 'pr' : 'direct-push'}", "github": { "standaloneRepo": "${githubOwner}/${slug}", "standaloneCommitHash": "", "monorepo": "${githubRepo}", "monorepoPath": "openclaw/agents/skills/${slug}/", "branch": "${usePR ? branchName : 'main'}", "commitHash": "", "prNumber": ${usePR ? '""' : 'null'}, "status": "SUCCESS | FAILED | SKIPPED", "error": null }, "clawhub": { "publishedVersion": "${version}", "skillId": "", "status": "SUCCESS | FAILED | SKIPPED", "error": null }, "completedAt": "" } If any part FAILED: record the error, stop. Do not proceed to Stage 9. If SUCCESS or SKIPPED (dry-run): proceed to Stage 9: node scripts/verify-upload.js --from-pipeline `); } else { console.log(`=== AUTOMATIC SKILL — 阶段 8：上传 === Skill：${slug} 版本：${version} Skill 目录：${skillDir} GitHub 主仓库（monorepo）：${githubRepo} 独立仓库：${githubOwner}/${slug} 工作流：${usePR ? 'PR（分支 → 合并）' : '直接推送到 main'}${dryRunNote}${prNote} 使用 gh CLI 将 skill 上传到 GitHub 和 clawHub。前提条件：已安装 gh CLI 且已认证（gh auth status 应显示 ✓ Logged in）。发布规则：每个 skill 必须同时拥有： 1. 独立 GitHub 仓库（${githubOwner}/${slug}）— 让用户可以直接搜索到该 skill 2. monorepo 子目录（${githubRepo}/openclaw/agents/skills/${slug}/）— 作为注册表索引 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 第一部分 — 预检（gh CLI） ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 检查 1 — 验证 gh 认证运行：gh auth status → 必须显示：✓ Logged in to github.com → 如未登录：gh auth login → 验证 token scopes 包含 "repo"（推送/PR 所需）检查 2 — 验证 monorepo 访问权限运行：gh repo view ${githubRepo} --json name,defaultBranchRef,url → 必须返回 JSON，其中 defaultBranchRef.name = "main" → 如 404：检查 GITHUB_REPO 格式是否为 "owner/repo" → 如权限拒绝：gh auth status 检查 token scopes（查看输出中的 scopes 列表）检查 3 — 确认 skill 目录在本地存在运行：ls -la ${skillDir}/SKILL.md ${skillDir}/package.json ${skillDir}/_meta.json → 三个文件必须都存在，缺失则重跑阶段 4（create.js） ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 第二部分 — 独立 skill 仓库（可发现性必需） ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 步骤 1 — 检查独立仓库是否已存在${dryRun ? '（仅检查 — dry-run）' : ''} gh repo view ${githubOwner}/${slug} --json name 2>/dev/null && echo "EXISTS" || echo "NOT_FOUND" 步骤 2 — 如不存在则创建独立仓库${dryRun ? '（已跳过 — dry-run）' : ''} ${dryRun ? `DRY-RUN：将运行： gh repo create ${githubOwner}/${slug} --public --description "<来自 SKILL.md 的 tagline>"` : `如结果为 NOT_FOUND： # 从 SKILL.md description 字段读取第一行作为 tagline gh repo create ${githubOwner}/${slug} --public --description "" 如结果为 EXISTS：跳过创建，直接执行步骤 3。`} 步骤 3 — 将 skill 文件推送到独立仓库${dryRun ? '（已跳过 — dry-run）' : ''} ${dryRun ? 'DRY-RUN：将初始化独立仓库并推送 skill 文件' : `从 skill 目录创建干净的本地 git 仓库并推送： cd /tmp rm -rf ${slug}-standalone cp -r ${skillDir} ${slug}-standalone cd ${slug}-standalone git init git add . git commit -m "feat: ${slug}@${version} — auto-generated by automatic-skill" git remote add origin https://github.com/${githubOwner}/${slug}.git git push -u origin main 验证推送成功： gh api repos/${githubOwner}/${slug}/commits/main --jq '.sha + " | " + .commit.message'`} ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 第三部分 — monorepo GitHub 上传（git + gh CLI） ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 步骤 4 — 进入 monorepo 根目录 gh repo view ${githubRepo} --json url --jq '.url' cd <仓库根目录> 步骤 5 — 确认 skill 目录在仓库内 ls openclaw/agents/skills/${slug}/ 如不存在：cp -r ${skillDir} openclaw/agents/skills/${slug}/ ${usePR ? `步骤 6 — 创建 PR 分支 git checkout -b ${branchName} → 如分支已存在：git checkout ${branchName} && git reset --hard origin/main` : `步骤 6 — 确认在 main 分支 git branch --show-current → 必须为 "main"。如不是：git checkout main`} 步骤 7 — 暂存 skill 文件 git add openclaw/agents/skills/${slug}/ git status → 确认只有 ${slug} 的文件被暂存，注意检查意外改动步骤 8 — 提交 git commit -m "feat: add ${slug}@${version} — auto-generated by automatic-skill" → 记录 commit hash：git rev-parse HEAD 步骤 9 — ${usePR ? '推送分支并创建 PR' : '推送到 main'}${dryRun ? '（已跳过 — dry-run）' : ''} ${dryRun ? `DRY-RUN：将运行： ${usePR ? `git push -u origin ${branchName} gh pr create --title "feat: add ${slug}@${version} skill" \\ --body "auto-generated by automatic-skill pipeline" \\ --base main --head ${branchName}` : 'git push origin main'}` : usePR ? `git push -u origin ${branchName} 用 gh 创建 PR： gh pr create \\ --title "feat: add ${slug}@${version} skill" \\ --body "由 automatic-skill 流水线自动生成。\\n\\nSkill：${slug}\\n版本：${version}\\n目录：openclaw/agents/skills/${slug}/" \\ --base main \\ --head ${branchName} → 记录 PR 号：gh pr view --json number --jq '.number' 自动合并（如分支保护允许）： gh pr merge --squash --auto` : `git push origin main 验证推送成功： gh api repos/${githubRepo}/commits/main --jq '.sha + " | " + .commit.message' → 应在最顶部看到新 commit`} ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 第三部分 — clawHub 发布 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 步骤 7 — 验证 clawHub 认证 clawhub whoami → 必须返回你的 clawHub 用户名（退出码 0） → 如报错：在 shell 环境中设置 CLAWHUB_TOKEN 后重试步骤 8 — 发布到 clawHub${dryRun ? '（已跳过 — dry-run）' : ''} ${dryRun ? 'DRY-RUN：将运行 clawhub publish 命令' : ` clawhub publish ${skillDir} --version ${version}`} → 成功后：记录 clawhub publish 返回的 skill ID ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 输出格式（写入 data/current-pipeline.json 的 "upload" 键） ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ { "stage": "upload", "skillDir": "${skillDir}", "slug": "${slug}", "version": "${version}", "dryRun": ${dryRun}, "workflow": "${usePR ? 'pr' : 'direct-push'}", "github": { "repo": "${githubRepo}", "branch": "${usePR ? branchName : 'main'}", "commitHash": "", "prNumber": ${usePR ? '""' : 'null'}, "status": "SUCCESS | FAILED | SKIPPED", "error": null }, "clawhub": { "publishedVersion": "${version}", "skillId": "", "status": "SUCCESS | FAILED | SKIPPED", "error": null }, "completedAt": "" } 如果任何部分 FAILED：记录错误并停止，不进入阶段 9。如果 SUCCESS 或 SKIPPED（dry-run）：进入阶段 9：node scripts/verify-upload.js --from-pipeline `); } FILE:scripts/verify-upload.js #!/usr/bin/env node /** * Automatic Skill — Stage 9: Verify Upload * * PROMPT GENERATOR ONLY — this script makes NO outbound network requests. * Outputs an agent prompt that uses the gh CLI (github skill pattern) for all * GitHub verification: live commit check, directory existence, file count via gh api. * * Usage: * node scripts/verify-upload.js * node scripts/verify-upload.js --from-pipeline */ const fs = require('fs'); const path = require('path'); const args = process.argv.slice(2); const langIdx = args.indexOf('--lang'); const lang = langIdx !== -1 ? args[langIdx + 1] : 'zh'; let slug = ''; let commitHash = ''; let version = ''; let prNumber = null; let workflow = 'direct-push'; function loadPipelineState() { try { const p = path.join(__dirname, '..', 'data', 'current-pipeline.json'); if (!fs.existsSync(p)) return null; delete require.cache[require.resolve(p)]; return require(p); } catch (e) { return null; } } if (args.includes('--from-pipeline')) { const p = loadPipelineState(); if (p) { slug = (p.design && p.design.slug) || (p.research && p.research.selected && p.research.selected.slug) || ''; commitHash = (p.upload && p.upload.github && p.upload.github.commitHash) || ''; version = (p.upload && p.upload.version) || (p.seo && p.seo.version) || (p.design && p.design.version) || '1.0.0'; prNumber = (p.upload && p.upload.github && p.upload.github.prNumber) || null; workflow = (p.upload && p.upload.workflow) || 'direct-push'; } } if (!slug) { slug = args.filter(a => a !== '--lang' && a !== lang && !a.startsWith('--'))[0] || ''; } if (!slug) { console.error('Usage: node scripts/verify-upload.js '); console.error(' node scripts/verify-upload.js --from-pipeline'); process.exit(1); } const repo = '$GITHUB_REPO'; const skillPath = `openclaw/agents/skills/${slug}`; if (lang === 'en') { console.log(`=== AUTOMATIC SKILL — Stage 9: Verify Upload === Skill: ${slug} version: ${version} Commit hash: ${commitHash || '(read from pipeline)'} GitHub repo: ${repo} Workflow used: ${workflow}${prNumber ? ` PR: #${prNumber}` : ''} Verify that the skill is fully published on both GitHub and clawHub. All checks use the gh CLI — no git fetch or local clone required. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ PART 1 — GITHUB VERIFICATION (gh api) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ CHECK 1 — Verify authentication is still valid gh auth status → Must show ✓ Logged in. If expired: gh auth refresh CHECK 2 — Verify commit landed on GitHub gh api repos/${repo}/commits/main \\ --jq '[.sha, .commit.message, .commit.author.date] | @tsv' → The top commit SHA must match: ${commitHash || ''} → The commit message must contain "${slug}" ${prNumber ? ` (PR workflow) Confirm PR was merged: gh pr view ${prNumber} --json state,mergedAt,mergeCommit --jq '{state,mergedAt,sha:.mergeCommit.oid}' → state must be "MERGED"` : ''} CHECK 3 — Verify skill directory exists on GitHub (live, no git fetch needed) gh api repos/${repo}/contents/${skillPath} \\ --jq '[.[].name] | sort | .[]' → Must list at minimum: SKILL.md, package.json, _meta.json → If 404: the push did not include this path — re-run upload.js CHECK 4 — Verify file count in skill directory gh api "repos/${repo}/git/trees/main?recursive=1" \\ --jq '[.tree[] | select(.path | startswith("${skillPath}/")) | .path] | length' → Must be ≥ 4 (SKILL.md, package.json, _meta.json, ≥1 script) → If 0: skill directory was not committed — check git add path in upload step CHECK 5 — Verify SKILL.md exists and has content on GitHub gh api repos/${repo}/contents/${skillPath}/SKILL.md \\ --jq '{name, size, encoding}' → name must be "SKILL.md" → size must be > 0 (non-empty file) → Confirms the file was uploaded and is accessible ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ PART 2 — CLAWHUB VERIFICATION ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ CHECK 6 — Query clawHub for the published skill clawhub get ${slug} → Must return: slug, version, ownerId → Exit code must be 0 → If error: check CLAWHUB_TOKEN and re-run clawhub publish CHECK 7 — Verify version matches _meta.json clawhub get ${slug} | grep '"version"' → Must show: "${version}" → If mismatch: a previous version may have been cached — run clawhub publish with --version ${version} CHECK 8 — Verify skill is searchable (optional) clawhub search ${slug} → Should return this skill in results within 1–2 minutes of publish ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ OUTPUT FORMAT (write to data/current-pipeline.json under "verifyUpload" key) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ { "stage": "verify-upload", "slug": "${slug}", "version": "${version}", "github": { "commitFound": true | false, "commitHashMatch": true | false, "directoryExists": true | false, "fileCount": , "skillMdNonEmpty": true | false, "status": "VERIFIED | FAILED", "detail": "..." }, "clawhub": { "skillFound": true | false, "publishedVersion": "...", "versionMatch": true | false, "status": "VERIFIED | FAILED", "detail": "..." }, "overallVerdict": "FULLY_VERIFIED | PARTIAL | FAILED", "completedAt": "" } If FAILED: identify which check failed, re-run Stage 8 (upload.js) for that part only. If FULLY_VERIFIED or PARTIAL: proceed to Stage 9b: node scripts/scan-check.js --from-pipeline ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ PART 3 — SECURITY SCAN (VirusTotal + OpenClaw) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ After confirming clawHub publish succeeded, check security ratings: node scripts/scan-check.js --from-pipeline This will: 1. Wait for VirusTotal and OpenClaw scan results (polls up to 5 min) 2. Run static analysis on the skill's scripts for known trigger patterns 3. If Suspicious: output targeted fix instructions + re-publish guidance 4. Repeat until PASS or max 3 attempts reached → PASS or TIMEOUT: proceed to Stage 10: node scripts/final-review.js --from-pipeline → SUSPICIOUS (after fixes): proceed to Stage 10 with a scan warning in the final report `); } else { console.log(`=== AUTOMATIC SKILL — 阶段 9：验收 === Skill：${slug} 版本：${version} Commit hash：${commitHash || '（从 pipeline 读取）'} GitHub 仓库：${repo} 使用的工作流：${workflow}${prNumber ? ` PR：#${prNumber}` : ''} 验证 skill 已完整发布到 GitHub 和 clawHub。所有检查使用 gh CLI — 无需 git fetch 或本地 clone。 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 第一部分 — GitHub 验证（gh api） ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 检查 1 — 确认认证仍然有效 gh auth status → 必须显示 ✓ Logged in。如已过期：gh auth refresh 检查 2 — 验证 commit 已到达 GitHub gh api repos/${repo}/commits/main \\ --jq '[.sha, .commit.message, .commit.author.date] | @tsv' → 最顶部 commit SHA 必须匹配：${commitHash || ''} → commit message 必须包含 "${slug}" ${prNumber ? ` （PR 工作流）确认 PR 已合并： gh pr view ${prNumber} --json state,mergedAt,mergeCommit --jq '{state,mergedAt,sha:.mergeCommit.oid}' → state 必须为 "MERGED"` : ''} 检查 3 — 验证 skill 目录在 GitHub 上存在（实时，无需 git fetch） gh api repos/${repo}/contents/${skillPath} \\ --jq '[.[].name] | sort | .[]' → 必须至少列出：SKILL.md, package.json, _meta.json → 如 404：push 未包含此路径 — 重新运行 upload.js 检查 4 — 验证 skill 目录文件数量 gh api "repos/${repo}/git/trees/main?recursive=1" \\ --jq '[.tree[] | select(.path | startswith("${skillPath}/")) | .path] | length' → 必须 ≥ 4（SKILL.md, package.json, _meta.json, ≥1 脚本） → 如为 0：skill 目录未被提交 — 检查 upload 步骤中的 git add 路径检查 5 — 验证 SKILL.md 在 GitHub 上存在且有内容 gh api repos/${repo}/contents/${skillPath}/SKILL.md \\ --jq '{name, size, encoding}' → name 必须为 "SKILL.md" → size 必须 > 0（非空文件） → 确认文件已上传且可访问 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 第二部分 — clawHub 验证 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 检查 6 — 从 clawHub 查询已发布的 skill clawhub get ${slug} → 必须返回：slug, version, ownerId → 退出码必须为 0 → 如报错：检查 CLAWHUB_TOKEN 并重新运行 clawhub publish 检查 7 — 验证版本与 _meta.json 匹配 clawhub get ${slug} | grep '"version"' → 必须显示："${version}" → 如不匹配：可能是旧版本缓存 — 用 --version ${version} 重新 clawhub publish 检查 8 — 验证 skill 可被搜索（可选） clawhub search ${slug} → 发布后 1~2 分钟内应能在结果中找到该 skill ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 输出格式（写入 data/current-pipeline.json 的 "verifyUpload" 键） ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ { "stage": "verify-upload", "slug": "${slug}", "version": "${version}", "github": { "commitFound": true | false, "commitHashMatch": true | false, "directoryExists": true | false, "fileCount": , "skillMdNonEmpty": true | false, "status": "VERIFIED | FAILED", "detail": "..." }, "clawhub": { "skillFound": true | false, "publishedVersion": "...", "versionMatch": true | false, "status": "VERIFIED | FAILED", "detail": "..." }, "overallVerdict": "FULLY_VERIFIED | PARTIAL | FAILED", "completedAt": "" } 如果 FAILED：确定哪项检查失败，仅针对该部分重新运行阶段 8（upload.js）。如果 FULLY_VERIFIED 或 PARTIAL：进入阶段 9b：node scripts/scan-check.js --from-pipeline ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 第三部分 — 安全扫描（VirusTotal + OpenClaw） ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 确认 clawHub 发布成功后，检查安全评级： node scripts/scan-check.js --from-pipeline 此命令将： 1. 等待 VirusTotal 和 OpenClaw 扫描结果（最多轮询 5 分钟） 2. 对 skill 脚本进行静态分析，查找已知触发模式 3. 如为 Suspicious：输出针对性修复指令 + 重新发布指引 4. 最多重复 3 次，直到 PASS 为止 → PASS 或 TIMEOUT：进入阶段 10：node scripts/final-review.js --from-pipeline → SUSPICIOUS（修复后仍是）：带扫描警告进入阶段 10，在 final report 中标注 `); }

Automatic Skill

Comments (0)