Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

用天气可视化你的心情!基于 AI 情绪分析,将文字转化为天气图标 + 治愈文案。

v1.0.0

情绪分析 CLI 技能。当用户说"mood"、"心情"、"情绪"、"分析情绪"等关键词时触发,调用 mood CLI 工具分析文本情绪,返回天气图标 + 治愈文案。

1· 100·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for wanwan2qq/mood-cli-release.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "用天气可视化你的心情!基于 AI 情绪分析,将文字转化为天气图标 + 治愈文案。" (wanwan2qq/mood-cli-release) from ClawHub.
Skill page: https://clawhub.ai/wanwan2qq/mood-cli-release
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: DEEPSEEK_API_KEY
Required binaries: mood
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install mood-cli-release

ClawHub CLI

Package manager switcher

npx clawhub@latest install mood-cli-release
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill claims to call a local 'mood' CLI and use a DeepSeek API key; requiring DEEPSEEK_API_KEY and a 'mood' binary is coherent with that purpose. However, the bundle does not include the 'bin/mood' executable or a help.js referenced in skill.json; instead the install script runs `npm install -g mood-weather-cli` to obtain the CLI. The skill also documents many channel-specific env vars (DINGTALK_USER_ID, WECHAT_USER_ID, etc.) that are not declared in requires.env — this is extra scope beyond the declared requirements.
!
Instruction Scope
SKILL.md instructs the agent to read ~/.mood-weather-cli.env and several environment variables for automatic user identification (including channel-specific vars) which are not declared in the skill metadata. skill.json's showHelp/action commands point to `node ~/.agents/skills/mood-cli/help.js` (a path/file not present in the bundle) — executing or depending on that file could run arbitrary code. The skill will also transmit user text to the external DeepSeek service (expected) but will perform health checks that may surface config values (examples show revealing 'sk-xxxx...xxxx').
!
Install Mechanism
There is no formal install spec for OpenClaw, but the bundle includes scripts/install.sh which installs the CLI by running `npm install -g mood-weather-cli`. That step fetches and executes remote npm package code (including potential postinstall scripts) not included in this package. Also, the local package.json in the bundle claims a bin path but the corresponding bin/help.js is not present in the release files — indicating the bundle is incomplete and relies on the external npm package.
!
Credentials
The only declared required env var is DEEPSEEK_API_KEY, which is reasonable for a DeepSeek-backed analysis. But SKILL.md documents many additional environment variables for user identification (MOOD_USER_ID, DINGTALK_USER_ID, WECHAT_USER_ID, TELEGRAM_USER_ID, DISCORD_USER_ID, SLACK_USER_ID) and system username fallback; these are not declared in requires.env. The skill's healthchecks and example outputs also indicate the API key value may be shown in outputs, which could risk exposing secret values in logs or UI.
Persistence & Privilege
The skill is not always-enabled and uses normal autonomous invocation settings. It does not request elevated privileges or permanent 'always' presence. It does perform local installation steps (via the included install script) but does not modify other skills or system-wide agent settings in the provided files.
What to consider before installing
Before installing or enabling this skill, consider the following: - The bundle is incomplete: the package references a local CLI ('mood') and a help.js under ~/.agents/skills/mood-cli/, but those files are not included here. The install script will run `npm install -g mood-weather-cli` to fetch the real CLI from npm — review that npm package (its repository, versions, and postinstall scripts) before running it. - The skill will send user text to an external service (DeepSeek) using DEEPSEEK_API_KEY. Only provide keys with appropriate scope/limits and avoid using high-privilege or long-lived production keys. Be aware healthcheck examples may display key fragments — check whether the real CLI logs or outputs secrets. - SKILL.md mentions reading many channel-specific environment variables (DINGTALK_USER_ID, WECHAT_USER_ID, TELEGRAM_USER_ID, etc.) that were not declared. If you have sensitive IDs or tokens in env vars, verify the CLI does not read or transmit them unless necessary. - If you want to proceed: inspect the npm package content (https://www.npmjs.com/package/mood-weather-cli or its repository) and any postinstall scripts, run the CLI in a sandbox or container, and rotate the API key after testing. If you cannot review the remote package, treat this skill as higher risk and avoid installing it on sensitive hosts.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🌤️ Clawdis
Binsmood
EnvDEEPSEEK_API_KEY
latestvk979rmww6c32m81wzrw275zz5h83fn64
100downloads
1stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

Mood CLI Skill

技能说明

调用 mood CLI 工具分析文本情绪,返回天气图标 + 治愈文案


触发条件

方式 1:密语触发(大小写不敏感)⭐

基本密语

  • mood / Mood / MOOD - 分析情绪
  • 心情 / 心情分析 - 分析情绪
  • 情绪 / 情绪分析 - 分析情绪
  • 今天心情 - 分析今天的情绪

扩展密语

  • 心情怎么样 - 分析情绪
  • 心情好吗 - 分析情绪
  • 帮我看看情绪 - 分析情绪
  • 看看我的心情 - 分析情绪
  • 记录心情 - 记录情绪
  • 今天天气 - 情绪天气

英文密语

  • analyze mood - 分析情绪
  • my mood - 我的情绪
  • how am I feeling - 我的心情

方式 2:单独输入 mood(显示帮助)

当用户只输入 mood心情 时,显示使用帮助

方式 3:关键词触发

当消息包含以下关键词时也激活:

  • "分析情绪"
  • "心情怎么样"
  • "情绪分析"
  • "今天心情"
  • "心情好/不好"
  • "帮我看看这句话的情绪"

功能列表

1. 情绪分析(基础功能)

命令mood "文本" 密语mood 今天心情好 输出:天气图标 + 治愈文案 + 情绪类型

2. 查看帮助

命令mood --help 密语mood 帮助 / mood help 输出:使用说明

3. 查看统计(待实现)

命令mood --stats 密语心情统计 / 我的情绪统计 输出:情绪分布统计

4. 查看历史(待实现)

命令mood --history 密语心情历史 / 我的情绪记录 输出:历史记录列表

5. 导出报告(待实现)

命令mood --report weekly 密语心情周报 / 情绪报告 输出:周期性情绪报告


使用示例

基础情绪分析

mood 今天心情超好的!
→ ☀️ 今天阳光灿烂,心情美美哒~

大小写不敏感

Mood 今天完成了 CLI 工具
MOOD 好开心
mOoD 真有趣
→ 都能正常识别

查看帮助

mood
→ 显示使用帮助

中文密语

心情 今天工作很顺利
→ ☀️ 今天阳光灿烂,心情美美哒~

情绪 代码写完了
→ ☀️ 今天阳光灿烂,心情美美哒~

英文密语

analyze mood I finished the project
→ ☀️ 今天阳光灿烂,心情美美哒~

my mood today is great
→ ☀️ 今天阳光灿烂,心情美美哒~

情绪 - 天气映射

情绪天气图标治愈文案
happy☀️今天阳光灿烂,心情美美哒~
calm微风不燥,内心平静
confused🌫️有点看不清方向,需要一点光
sad🌧️心里在下雨,想找个抱抱
angry⛈️情绪有点爆炸,需要冷静一下
hopeful🌈雨过天晴,看见彩虹啦

帮助文本

当用户只输入 mood 时显示:

🌤️ Mood CLI Skill - 情绪分析助手

【基本用法】
mood 今天心情好          分析情绪
Mood 好难过              大小写都可以
心情 工作完成了          中文密语
analyze mood great       英文密语

【高级功能】
mood 帮助                显示这个帮助
心情统计                 查看情绪统计(开发中)
心情历史                 查看历史记录(开发中)
心情周报                 生成周报(开发中)

【示例】
mood 今天完成了第一个 agent 闭环工具
→ ☀️ 今天阳光灿烂,心情美美哒~

【提示】
- 密语大小写不敏感
- 支持中英文混合
- 自动识别情绪关键词

待开发功能

1. 情绪统计 (--stats)

  • 记录每次分析结果
  • 统计情绪分布
  • 生成图表(可选)

2. 历史记录 (--history)

  • 保存分析历史
  • 支持查询特定日期
  • 支持导出

3. 情绪报告 (--report)

  • 日报/周报/月报
  • 情绪趋势分析
  • 建议和改进

4. 批量分析 (--batch)

  • 分析多段文字
  • 文件导入分析
  • 批量导出结果

配置说明

API 配置

  • 文件:~/.mood-weather-cli.env
  • 内容:DEEPSEEK_API_KEY=你的密钥

用户识别(自动)

优先级

  1. 环境变量 MOOD_USER_ID (手动指定)
  2. 聊天渠道用户 ID (自动识别)
    • 钉钉:DINGTALK_USER_ID
    • 微信:WECHAT_USER_ID
    • Telegram:TELEGRAM_USER_ID
    • Discord:DISCORD_USER_ID
    • Slack:SLACK_USER_ID
  3. 系统用户名 (降级逻辑)

示例

  • 钉钉用户:dingtalk:0124046821484330
  • 微信用户:wechat:wx123456
  • 手动指定:wanwan

重试机制

  • 自动重试 3 次
  • 指数退避(1s → 2s → 4s)
  • 失败后降级返回

输出格式

  • 天气图标 + 治愈文案
  • 情绪类型(英文)
  • 置信度(百分比)

🏥 运行时健康检查

加载时门控(由 OpenClaw 自动执行)

OpenClaw 加载技能时会自动检查:

  • mood CLI 命令是否在 PATH 中
  • DEEPSEEK_API_KEY 是否有值

如果门控检查失败:技能会被禁用,用户看到"技能不可用"提示。

运行时健康检查(技能内部逻辑)

每次调用前/调用时检查:

检查项检查方式失败处理
CLI 命令可执行which mood + 试运行返回"CLI 工具未安装"
API 密钥有效调用 DeepSeek API 测试返回"API 密钥无效或过期"
网络连接API 请求超时检测返回"网络异常,请检查连接"
服务可用性HTTP 状态码检查返回"DeepSeek 服务暂时不可用"

健康检查命令(可选)

用户可以主动运行健康检查:

mood --healthcheck

输出示例:

🌤️ Mood CLI 健康检查

✅ CLI 工具:/opt/homebrew/bin/mood
✅ API 密钥:已配置 (sk-xxxx...xxxx)
✅ 网络连接:正常
✅ DeepSeek 服务:在线

所有检查通过,可以正常使用!

⚠️ 错误处理与用户提示

错误类型与处理

错误场景用户提示修复指引
未配置 API 密钥❌ 未配置 DeepSeek API 密钥export DEEPSEEK_API_KEY=sk-xxx 或编辑 ~/.mood-weather-cli.env
API 密钥无效❌ API 密钥无效或已过期检查密钥是否正确,或前往 DeepSeek 控制台重新生成
CLI 工具未找到❌ 未找到 mood 命令运行安装脚本或检查 PATH 配置
网络超时❌ 网络超时,请检查连接检查网络或稍后重试
服务不可用❌ DeepSeek 服务暂时不可用稍后重试或查看服务状态页
文本为空❌ 请输入要分析的文字mood 今天心情好
配额用尽❌ API 配额已用尽等待配额重置或升级账户

降级策略

当 DeepSeek API 不可用时,可以降级到:

  1. 本地规则匹配(关键词 → 情绪)
  2. 返回默认情绪(calm)
  3. 明确告知用户"使用降级模式,结果可能不够准确"

📝 最佳实践

  1. 技能开发时:始终定义 metadata.openclaw.requires 门控
  2. 调用技能前:检查技能状态(openclaw skills list 查看是否 ready)
  3. 失败时:给出清晰的修复指引,不要只说"失败了"
  4. 敏感配置:使用环境变量或配置文件,不要硬编码
  5. 日志记录:记录每次调用的结果,方便排查问题

Comments

Loading comments...