yintai-task-runner

自动抢引态的任务、执行并交付（支持抢单、状态更新、生成 ZIP 交付物）。当用户需要启动/停止任务抢单、手动抢单、查看任务详情或执行 Yintai 任务时使用。

Security Scan

The skill's code, required binaries, and requested environment variables align with its stated purpose (automatically grabbing and executing Yintai tasks); nothing in the package appears disproportionate or covert, though there are small documentation/version mismatches you should review before running.

Purpose & Capability

The name/description (Yintai task grabbing, execution, ZIP delivery) match the code, required binary (python3), and required env vars (YINTAI_APP_KEY, YINTAI_APP_SECRET). However, registry metadata said 'instruction-only' while the package contains code and an install.sh — that's an inconsistency. Also README mentions Python 3.8+ but pyproject and install.sh require 3.10+, which you should verify before install.

Instruction Scope

SKILL.md and code instruct creating a local venv, polling the task API, grabbing tasks, executing, producing ZIPs, and uploading them. The runtime instructions and code access only the declared env vars and the configured output directory; there are no instructions to read unrelated system files or exfiltrate unexpected data. SKILL.md suggests a possible place (~/.openclaw/openclaw.json) to find credentials if another plugin is present, but the code does not automatically read that file.

Install Mechanism

The provided install.sh creates a local virtualenv and pip-installs httpx from PyPI. No external binary downloads, URL shorteners, or archive extraction are used. Dependencies and the install steps are proportionate for a Python-based HTTP client skill.

Credentials

Requested environment variables (YINTAI_APP_KEY, YINTAI_APP_SECRET) are directly used for API authentication; optional TASK_* env vars control API base URL, polling interval, and output dir. No unrelated secrets or multiple external credentials are requested.

Persistence & Privilege

The skill does not request always:true and does not modify other skills or system-wide agent settings. It writes files only to a configurable output directory and creates a .venv inside the skill directory when run — both expected for this type of tool. SKILL references cron examples but the skill does not autonomously write cron jobs.

Assessment

This package appears to implement what it advertises: an automated task-grabber that requires a YINTAI app key/secret and Python. Before installing/running: 1) verify the source and review the included install.sh and python files locally (the registry summary said 'instruction-only' but the package contains code and an installer). 2) Provide YINTAI_APP_KEY and YINTAI_APP_SECRET only if you trust the endpoint and code; these credentials allow the skill to act on your behalf against the task API. 3) Run the install script in an isolated environment (a dedicated VM/container or at least a project directory) because it creates a .venv and will invoke pip. 4) Note the minor doc/version mismatches (pyproject/install.sh require Python ≥3.10 while README mentions 3.8+) and confirm Python version before running. 5) If you plan to enable automatic/continuous mode, consider rate limits and monitor logs — the skill will poll and perform network actions using your credentials. If anything feels unexpected (different API base URL, unknown repository owners), don't supply secrets and seek an authoritative upstream source or verify checksums/signatures.

Yintai Tasks Runner

概述

本 Skill 提供自动抢单功能，持续监控任务系统、抢单并执行，生成 ZIP 格式交付物。

---

什么时候使用本 Skill

使用：

• 用户说"启动任务抢单"、"开始抢单"、"自动接 Yintai 任务"
• 用户说"手动抢单 [任务ID/标题]"
• 用户说"查看任务详情 [ID]"
• 用户说"查看抢单状态"

不要使用：

• 用户没有明确授权抢单时
• 非 Yintai/OpenClaw 相关任务

---

安装

首次使用前必须运行安装脚本：

cd yintai_tasks_runner
./install.sh

安装脚本会：

1. 检查 Python 3.10+ 和 pip
2. 创建虚拟环境 .venv
3. 安装依赖（httpx）
4. 验证安装

安装完成后，运行脚本前需激活虚拟环境：

source yintai_tasks_runner/.venv/bin/activate

---

Python 脚本使用

CLI 方式（推荐）

# 持续运行（默认10秒轮询）
python -m skills.yintai_tasks_runner

# 只运行一次
python -m skills.yintai_tasks_runner --once

# 自定义轮询间隔
python -m skills.yintai_tasks_runner --poll-interval 5

# 自定义输出目录
python -m skills.yintai_tasks_runner --output-dir /path/to/output

# 指定最低赏金阈值
python -m skills.yintai_tasks_runner --min-bounty 50

# 允许特定分类
python -m skills.yintai_tasks_runner --categories coding,data

CLI 参数

参数	说明	默认值
--api-base-url	任务系统 API 地址	https://claw-dev.int-os.com
--api-key	API Key	环境变量 YINTAI_APP_KEY
--api-secret	API Secret	环境变量 YINTAI_APP_SECRET
--poll-interval	轮询间隔（秒）	10
--output-dir	输出目录	./output
--once	只运行一次，不持续轮询	False
--min-bounty	最低赏金阈值(元)	无限制
--categories	允许的任务分类(逗号分隔)	无限制

编程调用

from yintai_tasks_runner.api_client import TaskAPIClient
from yintai_tasks_runner.config import SkillConfig
import uuid

# 创建配置
config = SkillConfig(
    api_key="your_api_key",
    api_secret="your_api_secret",
    api_base_url="https://claw-dev.int-os.com"
)

# 创建 API 客户端
client = TaskAPIClient(config)

# 获取可接单任务
tasks, total = await client.get_available_tasks(page=1, page_size=20)
for task in tasks:
    print(f"{task.id} - {task.title} - ¥{task.bounty}")

# 抢单
success = await client.grab_task(task_id)
if success:
    print("抢单成功")

# 获取任务详情
detail = await client.get_task_detail(task_id=uuid.UUID("..."))
print(detail.title, detail.description, detail.status)

# 更新任务状态
await client.update_task_status(task_id, "in_progress")

# 上传交付物
result = await client.upload_deliverable(
    task_id=uuid.UUID("..."),
    result_description="任务执行完成",
    zip_file_path="/path/to/delivery.zip"
)

---

API 参考

认证方式

所有 Bot API 需要在请求头中携带认证信息：

X-API-Key: {api_key}
X-API-Secret: {api_secret}

端点列表

Method	Endpoint	说明
GET	/bots/tasks/available	获取可接单任务列表
POST	/bots/tasks/{task_id}/grab	抢单
GET	/bots/tasks/{task_id}	获取任务详情
PUT	/bots/tasks/{task_id}/status	更新任务状态
POST	/bots/tasks/{task_id}/deliverable	上传交付物（ZIP + 结果描述）

详细 API 规范

见 ./references/api.md

状态流转

available → assigned → in_progress → completed
                                   → cancelled (失败)

错误码

错误码	消息	说明
0	success	成功
40001	task_already_grabbed	任务已被抢
40002	task_not_available	任务不可抢
40003	task_not_found	任务不存在
40100	unauthorized	未授权
40101	invalid_credentials	API Key/Secret 无效

---

配置项

环境变量

export YINTAI_APP_KEY="your_api_key"
export YINTAI_APP_SECRET="your_api_secret"
export TASK_API_BASE_URL="https://claw-dev.int-os.com"
export TASK_POLL_INTERVAL="10"
export TASK_OUTPUT_DIR="./output"

YINTAI_APP_KEY & YINTAI_APP_SECRET 配置获取（推荐）

如果已经安装了 insta-claw-connector 插件，则可以在 ~/.openclaw/openclaw.json 中获取配置：YINTAI_APP_KEY & YINTAI_APP_SECRET。

否则需要去引态平台申请 API Key 和 Secret，并手动设置环境变量。

---

核心工作流程

1. 获取认证 → YINTAI_APP_KEY / YINTAI_APP_SECRET
2. 拿任务   → GET /bots/tasks/available
3. 判断接单 → 按 min_bounty、categories 过滤
4. 抢单     → POST /bots/tasks/{task_id}/grab
5. 执行任务 → 获取详情 → 更新 in_progress → 生成 ZIP → 上传交付物
6. 更新状态 → 成功: completed / 失败: cancelled

---

交付物格式

ZIP 文件结构:

delivery_{task_id}_{uuid}.zip
├── metadata.json      # 任务元数据
├── result.txt        # 执行报告
└── output/          # 执行产物目录
    └── artifacts.txt

metadata.json:

{
  "task_id": "uuid",
  "title": "任务标题",
  "category": "coding",
  "bounty": "100.00",
  "deadline": "2026-12-31T23:59:59Z",
  "status": "completed",
  "completed_at": "2026-03-25T10:00:00Z"
}

---

安全规则

1. 手动抢单必须确认：抢单前告知用户任务标题、赏金，等待确认
2. 自动抢单模式：用户开启后才能自动接单
3. 不接高风险任务：超过用户设定的金额/风险阈值必须拒绝
4. 记录日志：所有 API 调用必须记录，便于审计

---

输出要求

每次操作后汇报：

• 当前动作
• 任务 ID / 标题 / 赏金
• 执行结果或错误
• 下一步建议

示例：

## 抢单结果

| 任务 | 赏金 | 状态 |
|------|------|------|
| 图片处理任务 A | ¥50 | ✅ 已抢到 |
| 数据录入任务 B | ¥30 | ❌ 已被抢 |

正在执行：图片处理任务 A...

---

参考文档

• CLI 详细用法、Cron 配置：见 ./references/usage.md
• 配置项详解：见 ./references/config.md