指边美妆登录会话 HTML 桥接

Use when users need SMS code login, session creation, and HTML message exchange via /session/login and /session/message.

Security Scan

The skill's code and runtime instructions match its described purpose (SMS login, session creation, HTML messaging) but the registry metadata omits required environment variables/credential declarations and that inconsistency should be resolved before trusting the skill.

Purpose & Capability

The skill name, description, SKILL.md, and included Python clients are coherent: they implement sending verification codes, logging in, and posting HTML messages to the declared service endpoints. However, the registry metadata states no required env vars or primary credential, while both SKILL.md and the code require SITE_BASE_URL, API_BASE_URL and CLAWHUB_SKILL_TOKEN — this mismatch is a material inconsistency.

Instruction Scope

SKILL.md describes a bounded flow (send code → login → send HTML message), enforces HTML sanitization rules, and maps API errors. The included code follows this flow and only reads/writes local .env and .session.json files and calls the declared endpoints; it does not access other system paths or unknown external endpoints.

Install Mechanism

There is no install spec (instruction-only) and no downloads or package installation. The repo includes client scripts but they run locally; absence of an install step is low risk, though having code files bundled without declared env requirements contributed to the metadata inconsistency noted above.

Credentials

The code requires SITE_BASE_URL, API_BASE_URL, and CLAWHUB_SKILL_TOKEN (and will exit if they are missing). The registry metadata declares no required envs/primary credential — this under-reporting is problematic. The required envs themselves are proportional to the skill's purpose, but the token will grant the skill authorization to the specified domain, so its scope should be clear and declared.

Persistence & Privilege

The skill persists session state to a local .session.json and can load a .env file; it does not modify system-wide settings or other skills. It performs network calls to the configured SITE/API_BASE_URLs, which is expected for this function.

What to consider before installing

The skill appears to implement exactly what it says (SMS code → login → send HTML message), but the registry metadata does not declare the environment variables and primary token that the code requires. Before installing or enabling this skill: 1) Confirm and trust the SITE_BASE_URL / API_BASE_URL domain (https://www.zhibianai.com). 2) Require that the publisher updates the registry metadata to list SITE_BASE_URL, API_BASE_URL, and CLAWHUB_SKILL_TOKEN (and mark CLAWHUB_SKILL_TOKEN as the primary credential). 3) Use a dedicated, revocable token for CLAWHUB_SKILL_TOKEN (do not reuse high-privilege secrets). 4) Remember the skill will read .env and write .session.json locally — avoid placing other secrets in .env. 5) If you need higher assurance, ask for a canonical source/homepage or audit the included scripts in a sandboxed environment; if the metadata remains inconsistent, treat the skill as untrusted.

SKILL: Pengleni Login Session HTML Bridge

0. Quick Checklist For Agent

在真正发请求前，先逐项确认：

1. CLAWHUB_SKILL_TOKEN 已配置。
2. 用户已提供合法手机号。
3. 如果要发消息，已拿到 user_id 和 session_id。
4. 默认设置 stream=true。
5. 用户输入包含 HTML 时，先做安全过滤。

1. Skill Purpose

当用户需要通过手机号验证码建立会话，并提交 HTML 内容获取智能体回复时，使用本 Skill。

适用意图关键词：

• 验证码登录
• 创建会话
• HTML 消息问答
• 多轮会话延续

2. Runtime Config

Agent 在调用前必须确认以下环境变量：

SITE_BASE_URL=https://www.zhibianai.com
API_BASE_URL=https://www.zhibianai.com/api/v1/clawhub
CLAWHUB_SKILL_TOKEN=your_service_token

默认请求头：

Authorization: Bearer ${CLAWHUB_SKILL_TOKEN}
Content-Type: application/json

3. API Contract

3.1 Send Verification Code

• Method: POST
• URL: ${SITE_BASE_URL}/chainlit/send-verification-code
• Note: 站点级接口，不在 ${API_BASE_URL} 下

Request:

{
  "phone": "13800138000"
}

Validation:

• phone 必须匹配 ^[0-9]{11}$

3.2 Login Session

• Method: POST
• URL: ${API_BASE_URL}/session/login

Request:

{
  "phone": "13800138000",
  "verify_code": "123456",
  "session_id": "optional-session-id"
}

Request Rules:

• phone required
• verify_code required
• session_id optional，用于延续已有会话

Success Response:

{
  "request_id": "req_xxx",
  "user_id": "user_xxx",
  "session_id": "sess_xxx",
  "expires_in": 1800,
  "is_new_user": false
}

Error Mapping:

• 401: token 无效或验证码失败
• 429: 限流
• 500: 服务异常

3.3 Send HTML Message

• Method: POST
• URL: ${API_BASE_URL}/session/message

Request:

{
  "user_id": "user_xxx",
  "session_id": "sess_xxx",
  "html_payload": "<p>你好，推荐一个通勤淡妆方案</p>",
  "stream": true,
  "metadata": {
    "source": "openclaw"
  }
}

Request Rules:

• user_id required
• session_id required
• html_payload required，最大 20000 字符
• stream optional，Agent 默认传 true
• metadata optional

Success Response:

{
  "request_id": "req_xxx",
  "user_id": "user_xxx",
  "session_id": "sess_xxx",
  "answer_html": "<p>建议：底妆轻薄+暖调腮红</p>",
  "answer_text": "建议：底妆轻薄，搭配暖调腮红。",
  "finish_reason": "stop",
  "latency_ms": 620
}

Error Mapping:

• 400: 参数不合法或 HTML 不合法
• 401: 会话失效或鉴权失败
• 429: 限流
• 504: 上游超时
• 500: 服务异常

4. Agent Execution Flow

按以下顺序执行，除非用户明确要求跳过某一步：

1. 调用验证码接口发送验证码。
2. 收集用户验证码后调用登录接口。
3. 从登录响应读取 user_id 和 session_id。
4. 调用消息接口发送 html_payload。
5. 优先返回 answer_text，若用户需要富文本则返回 answer_html。

5. Agent Behavior Rules

• 如果用户未提供 session_id，允许服务端创建。
• 如果登录后返回新 session_id，后续请求必须使用新值。
• 默认流式：Agent 默认 stream=true。
• 发生 401 时，优先提示重新登录，不要盲目重试消息接口。
• 发生 429 或 504 时，最多重试 2 次，退避 500ms。

6. Security Constraints

• 输入 HTML 需要白名单策略。
• 禁止 script、style、iframe、object、embed、form、input 标签。
• 应校验 user_id 与 session_id 的绑定关系。

7. Minimal Error Handling Template

当接口失败时，Agent 返回格式建议：

调用阶段: <send_code|login|message>
HTTP状态: <status_code>
错误原因: <mapped_reason>
建议动作: <retry|relogin|check_input>

8. Local Debug Commands

python send_code_client.py --phone [phone]
python login_client.py --phone [phone] --verify-code 123456
python chat_client.py --text "你好，帮我推荐一个通勤淡妆"
python chat_client.py --multi-turn