Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Smart Prompt Builder

v2.0.0

智能提示构建器 - 根据语料库检索结果生成优化的写作提示。当需要为小说创作场景生成结构化提示词时使用,支持描写/对话/动作/情感 4 种场景类型,可注入 Voice Profile 和上下文信息。

0· 104·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for yuzhihui886/smart-prompt-builder.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Smart Prompt Builder" (yuzhihui886/smart-prompt-builder) from ClawHub.
Skill page: https://clawhub.ai/yuzhihui886/smart-prompt-builder
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install smart-prompt-builder

ClawHub CLI

Package manager switcher

npx clawhub@latest install smart-prompt-builder
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The included scripts implement prompt-building functionality that matches the description (build_prompt.py). However, there is an additional script (build_prompt_llm.py) that acts as a client to an external LLM service (POST to coding.dashscope.aliyuncs.com) and requires an environment variable DASHSCOPE_API_KEY. The registry metadata declared no required env vars and SKILL.md does not document the need for this API key or the external endpoint, which is an incoherence.
!
Instruction Scope
SKILL.md documents CLI usage for scripts/build_prompt.py and general integration examples but does not describe the LLM client behavior or the required DASHSCOPE_API_KEY. The LLM script will transmit the provided style/context/prompt to a remote service — this is outside what the SKILL.md declares and could expose user-supplied context/corpus to an external endpoint.
Install Mechanism
There is no install spec (instruction-only), which is low-risk. However, scripts/requirements.txt only lists 'rich' while both scripts import PyYAML and build_prompt_llm.py imports requests; SKILL.md also mentions PyYAML. The mismatch between declared dependencies and requirements.txt is inconsistent and may lead users to install the wrong set of packages.
!
Credentials
build_prompt_llm.py reads DASHSCOPE_API_KEY from the environment and will abort if not set. The skill manifest declares no required env vars and SKILL.md doesn't mention this secret. Requesting an API key (and sending prompts/context) to an external service is a sensitive operation; declaring and justifying that credential in the manifest would be expected but is missing.
Persistence & Privilege
The skill does not request permanent presence (always:false) and does not modify other skills or system-wide settings. It runs as simple CLI tools and has no install hook that would persist or elevate privileges.
Scan Findings in Context
[ENV_VAR_USAGE:DASHSCOPE_API_KEY] unexpected: build_prompt_llm.py requires environment variable DASHSCOPE_API_KEY to call an external LLM API; the manifest and SKILL.md do not declare this requirement. If you plan to use the LLM client this is expected, but it should be documented in the skill metadata.
[EXTERNAL_HTTP:coding.dashscope.aliyuncs.com] unexpected: The LLM script posts prompts and context to https://coding.dashscope.aliyuncs.com/v1/chat/completions. Sending user-provided context/corpus to an external endpoint is functionally consistent with an LLM-backed mode, but SKILL.md did not disclose this endpoint or its privacy/ownership, which is an omission.
[MISSING_DEPENDENCIES:requests,PyYAML] unexpected: Both scripts import yaml and the LLM script imports requests, but scripts/requirements.txt only lists 'rich'. SKILL.md mentions PyYAML. The requirements file is incomplete and inconsistent with the code.
What to consider before installing
This skill appears to implement the advertised prompt-building features, but the LLM-backed script will send your style/context/corpus to an external service and requires an environment variable DASHSCOPE_API_KEY — neither of which are declared in the skill metadata or SKILL.md. Before installing or running: (1) decide whether you will use the LLM script; if not, avoid running build_prompt_llm.py or remove it. (2) If you do use it, verify and trust the endpoint (coding.dashscope.aliyuncs.com) and the owner, and only provide an API key you are willing to send prompt/context to that service. (3) Fix the dependency list (add requests and PyYAML) and ensure SKILL.md and manifest are updated to declare required env vars and the external endpoint. (4) Consider auditing or running the scripts in a sandbox to see what data would be transmitted. If you cannot verify the endpoint or owner, treat the LLM mode as high-risk and avoid supplying sensitive corpus or context.

Like a lobster shell, security has layers — review code before you run it.

latestvk97c5zkzkmc4696ydbbzqb88f184t9rf
104downloads
0stars
2versions
Updated 1w ago
v2.0.0
MIT-0

Smart Prompt Builder - 智能提示构建器

Overview

根据语料库检索结果和上下文信息,生成结构化的写作提示词,包含系统提示、用户提示和约束条件。支持 Voice Profile 注入,确保生成内容符合作者风格。

使用场景

  • 需要为小说章节生成写作提示
  • 需要保持作者风格一致性(Voice Profile)
  • 需要结合语料库检索结果进行创作
  • 需要结构化提示词用于后续生成任务

场景类型

支持 4 种写作场景:

场景类型参数值用途
描写description环境/场景描写,营造氛围
对话dialogue人物对话,展现性格
动作action动作场景,展现紧张感
情感emotion心理描写,刻画内心世界

CLI 使用

# 基本用法 - 描写场景
python3 scripts/build_prompt.py --scene-type description \
  --context '{"scene": "雨中的街道"}'

# 使用 Voice Profile
python3 scripts/build_prompt.py --scene-type dialogue \
  --style-file assets/style.yml \
  --context '{"characters": {"主角": "侦探"}}'

# 结合语料库结果
python3 scripts/build_prompt.py --scene-type action \
  --corpus-results '[{"title": "范例", "content": "...", "relevance_score": 0.9}]'

# 输出到文件
python3 scripts/build_prompt.py --scene-type emotion \
  --output prompt.txt

参数说明

参数必填说明
--scene-type场景类型:description/dialogue/action/emotion
--context上下文信息(JSON 格式)
--style-fileVoice Profile 配置文件(YAML)
--corpus-results语料库检索结果(JSON 数组)
--output输出文件路径

Context JSON 格式

{
  "summary": "前文摘要",
  "scene": "当前场景",
  "characters": {
    "角色名": "角色状态/身份"
  }
}

Corpus Results JSON 格式

[
  {
    "title": "语料标题",
    "content": "语料内容",
    "relevance_score": 0.95
  }
]

Voice Profile (style.yml) 格式

voice_profile:
  style_tags: ["温柔", "叙事性", "略带忧伤"]
  speech_rate: 0.9
  tone: "亲切的讲述者语气"
  emotion: 0.3
  anti_ai_rules:
    - "避免过度使用形容词"
    - "减少'的'字频率"

输出结构

生成的提示词包含 4 部分:

  1. 系统提示 - 定义 AI 角色和专长
  2. 用户提示 - 具体写作需求 + 上下文 + 语料参考
  3. 约束条件 - 写作规范和技巧要求
  4. 元数据 - 场景类型、语料数量等

依赖

  • Python 3.8+
  • rich (终端渲染)
  • PyYAML (配置文件解析)

安装依赖:

pip install -r scripts/requirements.txt

示例输出

============================================================
【系统提示】
============================================================
你是一名专业的环境描写大师,擅长通过细腻的笔触营造氛围。

============================================================
【用户提示】
============================================================
请根据以下描述需求生成一段富有画面感的环境描写:

[角色状态]
- 主角:疲惫的侦探

[当前场景]
雨中的街道

[Voice Profile]
风格标签:温柔,叙事性,略带忧伤,缓慢节奏
语速:0.9
语气:亲切的讲述者语气
情感倾向:0.3

============================================================
【约束条件】
============================================================
• 使用五感描写法(视觉、听觉、嗅觉、味觉、触觉)
• 包含至少 3 个具体的细节描写
• 使用比喻或拟人手法增强表现力
• 保持描写节奏的层次感

与其他技能集成

与 corpus-search 集成

# 1. 检索语料库
python3 ../corpus-search/scripts/search_corpus.py \
  --corpus xuanhuan-full \
  --query "环境描写" \
  --top-k 5 \
  --output corpus_results.json

# 2. 构建提示词
python3 scripts/build_prompt.py \
  --scene-type description \
  --corpus-results "$(cat corpus_results.json)" \
  --style-file assets/style.yml

与 novel-writer 集成

# 1. 构建提示词
python3 scripts/build_prompt.py \
  --scene-type dialogue \
  --context '{"scene": "咖啡馆", "characters": {"林风": "侦探"}}' \
  --output prompt.txt

# 2. 使用提示词生成内容(由 novel-writer skill 执行)

注意事项

  • 上下文 JSON 必须有效,否则报错退出
  • Voice Profile 文件必须存在且为有效 YAML
  • 语料库结果为 JSON 数组格式
  • 输出文件会自动创建(如不存在)

Comments

Loading comments...