Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

knowledge-workflow

v2.0.1

知识管理工作流 - 完整的知识管理工作流:收集→打标→存储→发芽→产出。支持飞书/微信读书/URL,5 种发芽类型(灵光/心智模型/跨界/微习惯/潜意识)。

0· 111·1 current·1 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for lj22503/knowledge-workflow.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "knowledge-workflow" (lj22503/knowledge-workflow) from ClawHub.
Skill page: https://clawhub.ai/lj22503/knowledge-workflow
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install knowledge-workflow

ClawHub CLI

Package manager switcher

npx clawhub@latest install knowledge-workflow
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
SKILL.md and clawhub.yaml describe a complete knowledge-management pipeline (main.py, collect.py, tag.py, store.py, output.py, config, requirements, Feishu/WeChat/URL integrations). The published package contains only subfunctions/evolve.py plus metadata and the README. That mismatch means most claimed capabilities (collection from Feishu/WeChat, tagging, storage, CLI entrypoint) are not present in the code bundle — this is an incoherence between stated purpose and actual capability.
!
Instruction Scope
Runtime instructions and usage examples reference running python main.py and passing tokens/URLs. No main.py or collect/tag/store/output modules are present. The included evolve.py reads and writes files under a user home path (default ~/kb) and generates Markdown outputs; that behavior is coherent with 'evolve' but the SKILL.md's broader runtime flow (fetching remote docs, handling Feishu/WeChat auth) is unsupported by the shipped code. The SKILL.md also instructs 'user choose to trigger evolve' which is policy-level, but there is no enforcement mechanism in the provided files.
Install Mechanism
There is no install spec (instruction-only), which lowers supply-chain risk. However, the package is incomplete relative to its documentation. Because there is a Python file included, an agent or user could execute it locally; that file performs file system reads and writes within the user's home directory. No remote downloads, no obscure installers, and no archive extraction are present in the package.
!
Credentials
The skill declares no required environment variables or credentials, yet the SKILL.md shows example calls that include Feishu tokens and mentions integrations that would normally require secrets. The absence of declared credential requirements is inconsistent with advertised integrations. The included evolve.py accesses the user's home directory (~/kb) for notes and writes outputs there — that is reasonable for a local knowledge tool but users should be aware their local notes would be read and new files created.
Persistence & Privilege
always:false and normal autonomous invocation settings. The code creates directories and writes Markdown files under ~/kb/outputs/sparks; it does not request elevated system privileges or modify other skills. Writing to a user's home directory is expected for a note-processing tool but still represents persistence of generated content on disk and potential exposure of local notes if misused.
What to consider before installing
What to consider before installing or running this skill: - The published bundle is incomplete: SKILL.md promises a full pipeline (main.py, collect/tag/store/output, Feishu/WeChat integration) but only evolve.py is included. Do not assume the integrations exist. - As-is, the included code only implements the 'evolve' step: it searches your ~/kb for <note_id>.md and writes generated Markdown into ~/kb/outputs/sparks. If you run it, it will read local notes and create files in your home directory — back up sensitive notes first. - The documentation shows examples using Feishu tokens and other remote sources, but no code here handles authentication or network integration. If you need those features, ask the maintainer for the missing modules or the repository URL and inspect the complete source before use. - Before running any code: review the rest of the repository (main.py, collect/tag/store/output modules, and any code implementing _generate_* helpers) to confirm there are no unexpected network calls or secret exfiltration. Pay attention to any code that sends content to external endpoints or reads unrelated config files. - If you must test now, run in a sandboxed environment or with a dedicated user account and non-sensitive sample notes, not your primary home directory. If you can get the complete source (the referenced GitHub repo) and it matches the documentation, re-run this evaluation. If the author cannot provide the missing modules, treat the skill as only a local 'evolve' utility and not the advertised full workflow.

Like a lobster shell, security has layers — review code before you run it.

latestvk9779z8g0ty6rbv0neqnkrw0zn85krm3
111downloads
0stars
2versions
Updated 1d ago
v2.0.1
MIT-0

knowledge-workflow: 知识管理工作流 🌱

完整的知识管理工作流 - 收集→打标→存储→发芽→产出

版本: v2.0.0
最后更新: 2026-04-26


📋 功能描述

帮助用户系统化执行知识管理工作流。从各种来源收集知识,自动打标、存储、发芽,最终产出可发布的内容。

适用场景:

  • 个人知识管理(飞书/微信读书/网页/文本)
  • 团队知识沉淀(会议记录/项目文档)
  • 自媒体内容生产(公众号文章/周报/月报)
  • 知识发芽(灵光闪现/心智模型/跨界视角/微习惯/潜意识调整)

边界条件:

  • 不替代深度思考(明确 AI 辅助边界)
  • 发芽必须是高质量信息,用户可选择是否触发
  • 需配合人工标注意义标签

🔄 核心工作流

步骤功能说明输出
1collect(收集)从飞书/微信读书/URL/文本收集知识Markdown 笔记
2tag(打标)自动打标(主题 + 场景 + 行动)带标签笔记
3store(存储)存储到知识库,自动建立双链连接存储路径 + 双链
4evolve(发芽)5 种发芽类型(用户选择触发)发芽内容
5output(产出)生成公众号文章/周报/月报可发布内容

🌱 发芽功能(5 种类型)

发芽类型说明触发方式输出
spark灵光闪现用户选择核心洞察/洞察链条/跨界联想/问题启发/概念提炼
model心智模型解读用户选择对应心智模型/模型对比/启发
cross跨界视角用户选择跨领域视角/跨时空视角/跨界洞察
habit微习惯用户选择可执行微习惯/习惯追踪/习惯养成建议
subconscious潜意识调整用户选择潜意识模式/调整策略/自我反思问题

质量要求:

  • 发芽必须是高质量信息
  • 如果发芽质量不高,宁可不发芽
  • 用户可选择是否保留发芽内容
  • 发芽后标注质量等级(高/中/低)

📁 文件结构

knowledge-workflow/
├── SKILL.md                 # 技能文档(本文档)
├── main.py                  # 主程序
├── config.yaml              # 配置文件
├── clawhub.yaml             # ClawHub 发布配置
├── requirements.txt         # Python 依赖
└── subfunctions/            # 子功能模块
    ├── collect.py           # 收集功能
    ├── tag.py               # 打标功能
    ├── store.py             # 存储功能
    ├── evolve.py            # 知识发芽(5 种类型)
    └── output.py            # 产出功能

🔧 使用示例

方式 1:一键调用(完整工作流)

# 处理飞书文档
python main.py run feishu PFAvdKEILouK29xCgNuc5b1bnnK

# 处理微信读书导出
python main.py run wechat "[微信读书导出文本]"

# 处理 URL
python main.py run url https://example.com/article

方式 2:分步调用

# 步骤 1: 收集
python main.py collect feishu PFAvdKEILouK29xCgNuc5b1bnnK

# 步骤 2: 打标
python main.py tag note-20260414160000

# 步骤 3: 知识发芽(用户选择触发)
python main.py evolve note-20260414160000 spark

# 步骤 4: 产出文章
python main.py output spark-20260414160000 article

⚠️ 注意事项

必须遵守:

  • ✅ 发芽必须是高质量信息
  • ✅ 用户选择触发发芽(不是自动)
  • ✅ 发芽后标注质量等级(高/中/低)
  • ❌ 不要自动发芽(必须用户选择)
  • ❌ 不要低质量发芽(宁可不发芽)
  • ❌ 不要只收集,不发芽

模糊请求处理:

如果用户请求模糊(如"帮我管理一下知识"):
→ 列出 5 个核心步骤供选择
→ 示例:"我可以帮你:1.收集 2.打标 3.存储 4.发芽 5.产出。你想做哪个?"

📊 成功指标

指标目标值说明
每日收集3 件/天飞书/微信读书/网页/文本
发芽率>50%收集后触发发芽的比例
产出率>30%发芽后产出文章的比例
质量等级发芽内容质量等级为高

🔗 相关技能

  • context-manager - 个人上下文管理(前置技能)
  • note-tagger - 笔记打标
  • experience-memory-tracker - 体验记忆追踪

推荐组合

context-manager → knowledge-workflow
(上下文管理)    (知识生产)

维护者:燃冰 & ant
版本:v2.0.0
创建日期:2026-04-14
最后更新:2026-04-26
发布状态:待发布

Comments

Loading comments...