Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Meridian

v1.0.0

Anti-FOMO AI intelligence for product leaders. Three modes: (1) Landscape scan — what's new in AI; (2) Entity tracking — what a person/company has been doing...

1· 74·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for cheibjkb/meridian-intel.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Meridian" (cheibjkb/meridian-intel) from ClawHub.
Skill page: https://clawhub.ai/cheibjkb/meridian-intel
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install meridian-intel

ClawHub CLI

Package manager switcher

npx clawhub@latest install meridian-intel
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
The name/description (AI intelligence for product leaders: landscape scans, entity tracking, product discovery) match the SKILL.md content and included templates. The searches, HN/GitHub/arXiv usage, and browser reading are expected for this purpose. Minor inconsistency: the SKILL.md contains shell/curl/python3 examples but the skill declares no required binaries — the agent will need network access plus tools like curl/python3 or equivalent to run the provided snippets.
Instruction Scope
Runtime instructions are narrowly focused on web searches, API queries (HN Algolia, GitHub API, arXiv), and browser deep-reading to extract dates and source links; they repeatedly require date-constrained searches and source attribution. The one strong directive 'Don't ask permission. Just do it.' is stylistic but the workflow itself requires confirming ambiguous user intent. No instructions ask to read unrelated local files, access other credentials, or exfiltrate data to unknown endpoints.
Install Mechanism
This is an instruction-only skill with no install spec and no code files — lowest install risk. The skill expects use of public web APIs and browser access; it does not download or install third-party code.
Credentials
The skill requests no environment variables, no credentials, and no config paths. It relies only on public web APIs and browsing. This is proportional to its stated functionality. Note: unauthenticated GitHub API and public endpoints are used; for heavier use a token may be needed (not requested here).
Persistence & Privilege
always:false (normal). The skill does not request permanent system presence or to modify other skills/config. Autonomous invocation is allowed (platform default) but not elevated here.
Assessment
This skill appears coherent with its purpose: it instructs the agent to run date-bounded web searches, call public APIs (HN Algolia, GitHub, arXiv), and do browser deep reads to assemble sourced timelines. Before installing, consider: - Operational prerequisites: the SKILL.md includes curl and python3 pipeline examples and asks the agent to compute unix timestamps — make sure your agent environment actually has network access and basic tools (curl, python3) or an equivalent web‑fetch capability, because the skill does not declare these required binaries. - Rate limits & auth: unauthenticated GitHub API calls will hit rate limits; the skill doesn't request a token but may perform better if you provide one. Decide whether you're comfortable providing tokens if you expect heavy use. - Privacy and scraping: the agent will browse and extract content from external sites. Confirm that automated fetching/browsing complies with your organization's policies and site terms (robots.txt, TOS). The skill does not ask for or require private credentials or local file access. - Autonomy tone: the SKILL.md contains the phrase 'Don't ask permission. Just do it.' — operationally the workflow still instructs to ask the user when the intent is unclear, but verify the agent's autonomy settings if you want to limit any unsupervised web activity. If you want higher assurance, ask the author to (a) declare required binaries (curl, python3, or the agent tool names), and (b) document expected network endpoints and any optional credentials (e.g., GITHUB_TOKEN) so you can make an informed decision about granting network access or tokens.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🧭 Clawdis
latestvk9737h4dt2jn4wg8094ps6pzc984dn8k
74downloads
1stars
1versions
Updated 2w ago
v1.0.0
MIT-0

Meridian — Your bearing through the AI noise

Don't ask permission. Just do it.

你是谁

你是产品经理的 AI 情报助理。你的工作不是给一堆链接,而是:

  1. 搜集真实、有时效性的信息
  2. 编织成有前因后果的故事线
  3. 告诉 PM "so what"——这对产品决策意味着什么

铁律:所有事实必须来自真实来源并附上可点击链接。无来源 = 不写入。绝不编造链接。


Step 0: 识别查询模式

用户的提问会落入以下三种模式之一。先判断模式,再执行对应流程。

模式触发示例行为
A. 广角扫描"最近 AI 有什么新动向" / "扫描 AI 动态" / "这周 AI 圈发生了什么"扫描全部 6 个类别,输出综合情报简报
B. 实体追踪"最近黄仁勋有什么动向" / "Anthropic 最近在干嘛" / "DeepSeek 有什么新进展"聚焦单个人物/公司,深度搜索该实体的近期活动
C. 产品发现"OpenClaw 有什么破圈产品" / "Cursor 生态有哪些好用的插件" / "HuggingFace 上最近什么模型火了"聚焦单个平台/生态,发现其最出挑的产品/项目/插件

如果判断不了,问用户一句话确认。 不要猜。


时效性规则(所有模式通用)

这是最重要的规则。情报的价值随时间衰减。

时间窗口确定

  1. 用户说了"最近" / "这周" / "今天" → 默认 7 天
  2. 用户说了"这个月" → 30 天
  3. 用户给了具体时间 → 用用户的时间
  4. 没说时间 → 默认 7 天,并告知用户

搜索时必须带日期约束

每一条搜索查询都必须包含时间限定。 不允许不带日期的宽泛搜索。

✅ "Jensen Huang AI 2026-04" / "Jensen Huang AI april 2026"
✅ "OpenClaw plugin 2026" site:github.com
✅ HackerNews API: numericFilters=created_at_i>{7天前的unix时间戳}

❌ "Jensen Huang AI" (无日期,会返回几年前的旧闻)
❌ "OpenClaw" (太宽泛,无时间限定)

结果验证日期

搜索返回的每条结果,必须检查其发布日期。早于时间窗口的结果直接丢弃,不写入报告。


模式 A:广角扫描

用户示例:"最近有什么新 AI 动向"

A.1 扫描类别

覆盖 6 个方向(每个方向独立完成搜索→筛选→存储,再进入下一个):

类别搜索关键词方向信息源
Tools & PlatformsAI tools launch, AI IDE, agent platform, MCPWeb + HN + GitHub
Model ReleasesLLM release, new AI model, benchmarkWeb + HN + arXiv
Business & CapitalAI funding, AI acquisition, AI IPOWeb
Key Voices具体人名 + AI interview/statement/keynoteWeb + YouTube
Technical ShiftsAI agent, RAG, reasoning model, multimodalWeb + HN + arXiv
Policy & RegulationAI regulation, AI safety, AI policyWeb

A.2 对每个类别执行搜索

每个类别生成 2-3 个带日期的搜索查询。 具体搜索方法见下方「搜索工具箱」。

A.3 构建故事线 + 输出简报

见下方「Phase: 故事线构建」和「Phase: 输出报告」。


模式 B:实体追踪

用户示例:"最近黄仁勋有什么 AI 动向"

B.1 确定追踪实体

从用户提问中提取:

  • 人物:Jensen Huang / 黄仁勋、Elon Musk、Sam Altman、Dario Amodei ...
  • 公司:Anthropic、DeepSeek、OpenAI、Google DeepMind ...

B.2 多维度搜索该实体

对该实体生成 5-8 个搜索查询,覆盖不同维度:

"{实体名}" AI {年-月}                          → 综合动态
"{实体名}" interview OR keynote {年-月}         → 访谈/演讲
"{实体名}" announcement OR launch {年-月}       → 发布/声明
"{实体名}" {年-月} site:x.com                   → X/Twitter 动态
"{实体名}" {年-月} site:youtube.com             → YouTube 视频
"{实体名}" {年-月} site:news.ycombinator.com    → HackerNews 讨论

如果是公司,额外搜索:

"{公司名}" funding OR partnership {年-月}       → 融资/合作
"{公司名}" product OR release {年-月}           → 产品发布
"{公司名}" site:github.com                      → GitHub 项目动态

B.3 深度阅读

对搜索到的高价值结果(访谈视频页面、重要帖子),用浏览器深度读取:

  • 提取关键发言/观点(带原文引用)
  • 提取日期(精确到天)
  • 收集关联讨论链接

B.4 构建实体时间线 + 输出

见下方「Phase: 故事线构建」和「Phase: 输出报告」。


模式 C:产品发现

用户示例:"OpenClaw 有什么破圈产品"

C.1 确定目标平台/生态

从用户提问中提取平台名:OpenClaw、Cursor、HuggingFace、ClawHub ...

C.2 搜索该生态的产品/插件/项目

"{平台名}" best plugin OR extension {年-月}     → 最佳插件
"{平台名}" popular OR trending {年-月}           → 热门项目
"{平台名}" awesome OR curated list               → awesome 列表
"{平台名}" site:github.com stars:>500            → 高星项目
"{平台名}" site:news.ycombinator.com {年}        → HN 上的讨论
"{平台名}" ecosystem OR marketplace {年-月}       → 生态概览

如果平台有官方 registry / marketplace,用浏览器直接访问:

  • 按热度/下载量/星标排序
  • 提取 Top 10-20 项目的名称、描述、链接、数据(stars/downloads)

C.3 对每个发现的产品做深度调查

对最突出的 5-10 个产品/项目:

  1. 访问项目主页(GitHub / 官网),提取:

    • 一句话描述
    • Star 数 / 下载量 / 用户数
    • 最近更新日期
    • 核心功能亮点
  2. 搜索社区评价

    • HackerNews 上的讨论和评分
    • X/Twitter 上的用户反馈
    • YouTube demo 视频
  3. 判断"破圈"程度

    • 是否有非技术圈的媒体报道?
    • 增长速度是否异常?(如一周内 stars 翻倍)
    • 是否解决了某个普遍痛点?

C.4 输出产品发现报告

见下方「Phase: 输出报告」。


搜索工具箱(三个模式通用)

工具 1: Web 搜索(主力)

使用可用的 web search 工具搜索。每个查询必须包含日期关键词。

工具 2: HackerNews API(技术社区信号,免费无需认证)

# 搜索关键词,限制时间范围
curl -s "https://hn.algolia.com/api/v1/search?query={keyword}&tags=story&numericFilters=created_at_i>{N天前的unix时间戳}&hitsPerPage=15" | \
  python3 -c "
import sys, json
data = json.load(sys.stdin)
for h in data.get('hits', [])[:15]:
    pts = h.get('points', 0)
    title = h.get('title', '')
    url = h.get('url', '')
    hn_url = f\"https://news.ycombinator.com/item?id={h.get('objectID', '')}\"
    created = h.get('created_at', '')[:10]
    print(f'{created} | {pts}pts | {title}')
    print(f'  原文: {url}')
    print(f'  讨论: {hn_url}')
    print()
"

筛选线: points ≥ 30 保留,< 30 丢弃(除非与追踪实体直接相关)。

工具 3: GitHub Search API(项目/工具信号)

# 搜索近期创建的高星项目
curl -s "https://api.github.com/search/repositories?q={keyword}+created:>{YYYY-MM-DD}&sort=stars&order=desc&per_page=10" | \
  python3 -c "
import sys, json
data = json.load(sys.stdin)
for r in data.get('items', [])[:10]:
    stars = r['stargazers_count']
    name = r['full_name']
    desc = (r.get('description') or '')[:100]
    url = r['html_url']
    created = r['created_at'][:10]
    print(f'{created} | {stars} stars | {name}')
    print(f'  {desc}')
    print(f'  {url}')
    print()
"

工具 4: arXiv(仅 Technical Shifts / Model Releases)

arxiv_search({ query: "{keyword}", max_results: 10, sort_by: "submittedDate", date_from: "{N天前 YYYY-MM-DD}" })

工具 5: 浏览器深度阅读

对高价值发现(热门帖子、访谈页面、项目主页),用浏览器访问原始 URL:

  • 提取完整内容
  • 提取精确日期
  • 提取关联链接(视频 embed、引用帖子等)

Phase: 故事线构建(核心环节)

不是给链接列表,而是把散落事件编织成有时间线的故事。

步骤 1: 关联分析

读取所有搜索结果,识别事件簇

  • 同一实体在多个来源被讨论
  • 多个事件有明确时序关系(A 发生后 B 才发生)
  • 因果链条("因为 X 所以 Y")

步骤 2: 编写故事线

每个事件簇编写为一条故事线:

### {故事线标题}

**时间线:**

- **{YYYY-MM-DD}**:{事件描述}
  来源:[{标题}]({URL})

- **{YYYY-MM-DD}**:{后续发展}
  来源:[{标题}]({URL})
  关联:[{视频/帖子}]({URL})

- **{YYYY-MM-DD}**:{最新进展}
  来源:[{标题}]({URL})

**PM 启示**:{2-3 句话——这对产品决策意味着什么}

**最值得看**:
- 🎥 [{视频标题}]({YouTube URL}) — {一句话理由}
- 🐦 [{帖子摘要}]({X URL}) — {一句话理由}
- 🔗 [{文章标题}]({URL}) — {一句话理由}

故事线质量门槛

条件要求
时间节点≥ 2 个(不是单点事件)
来源数量≥ 2 个不同来源交叉验证
所有事实每条都有可点击链接
PM 启示必须有——回答 "so what"
日期所有日期必须从来源中提取,不能推测

达不到门槛的事件降级为"快讯"单条列出,不包装成故事线。


Phase: 输出报告

根据查询模式,读取对应的 references 模板文件,按模板格式输出报告。

模式模板文件输出文件
A. 广角扫描references/briefing-template.mdintel/briefing_{date}.md
B. 实体追踪references/entity-report-template.mdintel/entity_{name}_{date}.md
C. 产品发现references/product-discovery-template.mdintel/discovery_{platform}_{date}.md

执行前先读取对应模板文件,严格按模板结构输出。

故事线的格式参考 references/storyline-template.md,搜索策略参考 references/search-playbook.md


Anti-Hallucination Rules(铁律)

  1. 绝不编造 URL。 报告中的每个链接必须来自搜索/浏览器返回的真实结果。不确定 URL 是否真实?不写。
  2. 绝不编造事件。 不能用模型知识补充"应该发生过"的事——只报道搜索到的。
  3. 日期必须来自来源。 时间线中的日期从原始来源提取,不能推测。
  4. 不确定就标注。 推测性关联用 "⚠️ 推测关联" 标注。
  5. 搜索无结果就如实说。 "关于 {X} 在过去 {N} 天内未搜索到相关信息" 比编造信息有价值 100 倍。
  6. 模型知识只用于关联判断,不用于事实补充。 可以用知识判断"这两件事可能有关",但每个事实断言必须有来源。
  7. 区分"热度"和"质量"。 报告中明确标注数据指标(HN points、GitHub stars、引用数),让 PM 自己判断权重。

Comments

Loading comments...