Add 5 missing skills to repo for sync coverage

github-repo-search, gooddays-calendar, luxtts, openclaw-tavily-search, skill-vetter — previously only in workspace, now tracked in Gitea for full sync. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-14 20:36:22 +08:00
parent 6451d73732
commit 8bacc868bd
12 changed files with 1043 additions and 0 deletions
--- a/skills/github-repo-search/SKILL.md
+++ b/skills/github-repo-search/SKILL.md
@@ -0,0 +1,253 @@
+---
+name: github-repo-search
+description: 帮助用户搜索和筛选 GitHub 开源项目，输出结构化推荐报告。当用户说"帮我找开源项目"、"搜一下GitHub上有什么"、"找找XX方向的仓库"、"开源项目推荐"、"github搜索"、"/github-search"时触发。
+---
+
+# GitHub 开源项目搜索助手
+
+## 用途
+
+从用户自然语言需求出发，经过需求挖掘、检索词拆解、GitHub 检索、过滤分类、深度解读，最终产出结构化推荐结果。
+
+目标不是"给很多链接"，而是"给用户可理解、可比较、可决策、可直接行动的候选仓库列表"。
+
+## 适用范围（V1.1）
+
+- 数据源：GitHub 公开仓库。
+- 默认不授权（不使用用户 Token）。
+- 默认硬过滤：`stars >= 100`、`archived=false`、`is:public`。
+- 默认输出：单榜单（Top N），榜单内按"仓库归属类型"标注。
+- 本流程默认不包含安装与落地实施（除非用户单独提出）。
+
+### 配额说明（必须知晓）
+
+- 未授权 Core API：`60 次/小时`。
+- Search API：`10 次/分钟`（独立于 Core 额度）。
+- 需要在报告中注明检索时间与配额状态，避免结果不可复现。
+
+## 工作流程
+
+### 环节一：需求收敛（必须完成，不可跳过）
+
+> **硬性门控**：环节一是整个流程的前置条件。无论用户的需求描述多么清晰，都必须走完本环节并获得用户明确确认后，才能进入环节二。禁止根据用户的初始描述直接推断需求并开始检索。即使用户说"直接搜就行"，也要先输出需求摘要让用户确认。
+
+#### 第一步：需求挖掘与对齐
+
+**目标**：把"我想看看 XX"转成可执行、可排序、可解释的检索目标。
+
+**需确认信息（最少）**：
+
+1. 主题（如：agent 记忆、RAG、浏览器自动化）
+2. 数量（Top 10 / Top 20）
+3. 最低 stars（默认 100）
+4. 排序模式（必须二选一）：`相关性优先` / `星标优先`（默认：相关性优先）
+5. 目标形态（必须二选一或多选）：
+   `可直接使用的产品` / `可二次开发的框架` / `资料清单/方法论`
+
+**建议补充信息（可选）**：
+
+1. 偏好技术栈（Python/TS/Go 等）
+2. 使用场景（学习、生产、对标）
+3. 排除项（教程仓库、归档仓库、纯论文复现等）
+4. 部署偏好（本地优先/云端优先/混合）
+
+**阶段输出（固定格式）**：
+
+```text
+核心诉求：
+- 主题：xxx
+- 数量：Top N
+- 最低 stars：>= 100
+- 排序模式：相关性优先 / 星标优先（默认：相关性优先）
+- 目标形态：xxx
+- 偏好：xxx（可空）
+- 排除：xxx（可空）
+```
+
+向用户确认以上信息。**用户明确确认后才能进入环节二，否则停在这里继续对齐。**
+
+---
+
+### 环节二：检索执行（以下环节由模型自主执行，无需用户介入，直到环节四交付报告）
+
+#### 第二步：检索词拆解（5-10 组）
+
+**目标**：平衡"召回率"和"相关性"，避免只靠单词硬搜导致偏题。
+
+**拆词规则**：
+
+每组 query 由以下维度组合：
+
+1. 核心词：用户目标词
+2. 同义词：替代表达（如 long-term memory / stateful memory）
+3. 场景词：coding、mcp、tool、platform、awesome、curated
+4. 技术词：agent、sdk、framework、database、os
+5. 排除思路：不在 query 里硬写过多负例，放到后续过滤阶段
+
+**产出格式**：
+
+```text
+Query-1: "xxx"
+目的：高召回核心主题
+
+Query-2: "xxx"
+目的：补同义词盲区
+```
+
+#### 第三步：执行检索与候选召回
+
+**执行原则**：
+
+1. 每组 query 都执行检索（建议每组 30-50 条）。
+2. 合并结果形成候选池。
+3. 按 `owner/repo` 去重。
+4. 记录检索时间与 API 额度信息。
+
+**候选池字段（最少）**：
+
+1. `owner/repo`
+2. `stars`
+3. `description`
+4. `repo_url`
+5. `archived`
+6. `language`
+7. `updated_at`
+8. `topics`
+9. `license`
+
+#### 第四步：去重与硬过滤
+
+**硬过滤（默认）**：
+
+1. `stars >= 100`
+2. `archived = false`
+3. `is:public`
+
+**可选硬过滤（按需）**：
+
+1. `fork = false`
+2. 指定语言：`language:xxx`
+3. 更新时效：最近 6-12 个月
+
+---
+
+### 环节三：质量精炼
+
+#### 第五步：噪音剔除与相关性重排
+
+**目标**：解决"命中 memory 但其实不是 agent memory"的噪音问题。
+
+**噪音剔除规则（示例）**：
+
+1. 与主题无关的通用工程仓库（即使 stars 很高）
+2. 关键词误命中仓库（仅描述中偶然出现 memory/agent）
+3. 无实质内容或异常仓库
+
+**排序原则（V1.1）**：
+
+`star` 不再作为主排序，只作为召回门槛之一。
+建议综合排序权重：
+
+1. 需求相关性：35%
+2. 场景适用性：30%
+3. 活跃度（更新时效）：15%
+4. 工程成熟度（文档/示例/可维护）：15%
+5. stars：5%
+
+#### 第六步：仓库归属类型分类（必须）
+
+**目标**：让用户一眼看懂"这个仓库到底是什么角色"，避免把框架、应用、目录混为一谈。
+
+**推荐类型字典**：
+
+1. 通用框架层
+2. 应用产品层（可直接使用）
+3. 记忆层/上下文基础设施
+4. MCP 服务层
+5. 目录清单层（awesome/curated）
+6. 垂直场景方案层
+7. 方法论/研究层
+
+#### 第七步：深读与项目介绍撰写（必须）
+
+**目标**：不是"仓库简介复述"，而是输出"对用户有决策价值"的详细介绍。
+
+**深读最低要求**：
+
+每个入选仓库至少查看：
+
+1. README 核心定位段
+2. 快速开始/功能章节标题
+3. 近期维护信号（更新时间、Issue/PR 活跃）
+
+**项目介绍写作要求（固定）**：
+
+"项目介绍"必须包含两部分并写细：
+
+1. 这是什么：它在系统架构中的角色和边界
+2. 为什么推荐：它在用户当前目标下的价值（不是泛泛优点）
+
+可补充：
+
+1. 典型适用场景（1-2 条）
+2. 限制或不适用场景（1 条）
+
+---
+
+### 环节四：交付与迭代
+
+#### 第八步：单榜生成与报告交付（最终）
+
+**交付结构（固定）**：
+
+1. 需求摘要
+2. 检索词清单（5-10 组 + 目的）
+3. 筛选与重排规则（明确写出）
+4. 结果总览（原始召回/去重后/过滤后）
+5. Top N 单榜（表格）
+6. 结论与下一步建议
+
+**Top N 表格字段（固定）**：
+
+| 仓库 | 星标 | 仓库归属类型 | 项目介绍（是什么 + 推荐理由） | 其它信息补充 | 链接 |
+|---|---:|---|---|---|---|
+
+**"其它信息补充"建议内容**：
+
+- 语言 / License / 最近更新时间
+- 上手复杂度（低/中/高）
+- 风险提示（若有）
+
+#### 第九步：用户确认与迭代（可选）
+
+**迭代触发条件**：
+
+用户反馈"太泛/太窄/不够准/解释不够细"。
+
+**迭代动作**：
+
+1. 调整检索词（增加场景词或同义词）
+2. 调整 stars 门槛（100 -> 200/500）
+3. 增加限定（语言/方向/更新时间）
+4. 调整类型权重（例如优先应用层或优先框架层）
+
+---
+
+## 默认参数（V1.1）
+
+1. 最低 stars：`100`
+2. 默认输出：`Top 10`
+3. 默认过滤：`archived=false`
+4. 默认必须分类：是
+5. 默认项目介绍粒度：详细（至少"是什么 + 为什么推荐"）
+
+## 质量检查清单（交付前自检）
+
+1. 是否完成需求对齐并明确"目标形态"
+2. 是否有 5-10 组 query 且每组有目的
+3. 是否记录了检索时间与配额状态
+4. 是否执行了去重、硬过滤和噪音剔除
+5. 是否完成仓库归属类型分类
+6. 是否每个推荐都有详细项目介绍（不是一句话）
+7. 是否使用固定表格字段交付
+8. 是否避免把安装实施混入本流程
--- a/skills/gooddays-calendar/SKILL.md
+++ b/skills/gooddays-calendar/SKILL.md
@@ -0,0 +1,46 @@
+---
+name: gooddays-calendar
+description: 讀寫 GoodDays 行程與今日吉時資訊。支援登入取得 JWT、查詢 `/api/unified-events`，以及呼叫 `/api/mystical/daily` 取得今日吉時/神祕學資料。
+---
+
+# gooddays-calendar
+
+此 skill 用於整合 GoodDays API，讓 agent 可以直接：
+
+1. 登入 GoodDays 取得 JWT
+2. 查詢未來事件（`/api/unified-events`）
+3. 查詢今日吉時/神祕學資訊（`/api/mystical/daily`）
+4. 用自然語言判斷是要查「吉時」還是「行程」
+
+## API 重點
+- Base URL：`GOODDAYS_BASE_URL`
+- Login：`POST /auth/login`
+- Mystical daily：`POST /api/mystical/daily`
+- Events：`/api/unified-events`
+
+## Mystical daily 實測格式
+必填欄位：
+- `year`
+- `month`
+- `day`
+
+選填欄位：
+- `hour`
+- `userId`
+
+範例：
+```json
+{"year":2026,"month":3,"day":13,"hour":9}
+```
+
+## 設定來源
+從 workspace `.env` 讀取：
+- `GOODDAYS_BASE_URL`
+- `GOODDAYS_EMAIL`
+- `GOODDAYS_PASSWORD`
+- `GOODDAYS_USER_ID`
+
+## 後續可擴充
+- 新增事件建立/更新/刪除
+- 將今日吉時整理成 daily-briefing 可直接引用的格式
+- 與 `life-planner` / `daily-briefing` skill 串接
--- a/skills/gooddays-calendar/handler.ts
+++ b/skills/gooddays-calendar/handler.ts
@@ -0,0 +1,192 @@
+import { readFileSync, existsSync } from 'fs';
+
+type EnvMap = Record<string, string>;
+
+function loadDotEnv(path: string): EnvMap {
+  const out: EnvMap = {};
+  if (!existsSync(path)) return out;
+  const text = readFileSync(path, 'utf-8');
+  for (const line of text.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const idx = trimmed.indexOf('=');
+    if (idx === -1) continue;
+    const key = trimmed.slice(0, idx).trim();
+    const value = trimmed.slice(idx + 1).trim();
+    out[key] = value;
+  }
+  return out;
+}
+
+async function login(baseUrl: string, email: string, password: string): Promise<string> {
+  const res = await fetch(`${baseUrl}/auth/login`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ email, password }),
+  });
+  const data = await res.json() as any;
+  if (!res.ok || !data?.data?.token) {
+    throw new Error(data?.error || 'GoodDays login failed');
+  }
+  return data.data.token;
+}
+
+async function getMysticalDaily(baseUrl: string, token: string, payload: any) {
+  const res = await fetch(`${baseUrl}/api/mystical/daily`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Authorization': `Bearer ${token}`,
+    },
+    body: JSON.stringify(payload),
+  });
+  const data = await res.json() as any;
+  if (!res.ok || data?.success === false) {
+    throw new Error(data?.error || 'GoodDays mystical daily failed');
+  }
+  return data;
+}
+
+async function getUnifiedEvents(baseUrl: string, token: string, userId: string, startDate: string, endDate: string) {
+  const url = new URL(`${baseUrl}/api/unified-events`);
+  url.searchParams.set('userId', userId);
+  url.searchParams.set('startDate', startDate);
+  url.searchParams.set('endDate', endDate);
+  const res = await fetch(url.toString(), {
+    method: 'GET',
+    headers: token ? { 'Authorization': `Bearer ${token}` } : {},
+  });
+  const data = await res.json() as any;
+  if (!res.ok || data?.success === false) {
+    throw new Error(data?.error || 'GoodDays unified-events failed');
+  }
+  return data;
+}
+
+function parseDateFromMessage(message: string): { year: number; month: number; day: number; hour?: number } {
+  const now = new Date();
+  const dateMatch = message.match(/(\d{4})-(\d{1,2})-(\d{1,2})/);
+  const hourMatch = message.match(/(?:hour|小時|時|點)\s*[:：]?\s*(\d{1,2})/i);
+  if (dateMatch) {
+    return {
+      year: Number(dateMatch[1]),
+      month: Number(dateMatch[2]),
+      day: Number(dateMatch[3]),
+      hour: hourMatch ? Number(hourMatch[1]) : undefined,
+    };
+  }
+  return {
+    year: now.getFullYear(),
+    month: now.getMonth() + 1,
+    day: now.getDate(),
+    hour: hourMatch ? Number(hourMatch[1]) : undefined,
+  };
+}
+
+function formatYmd(year: number, month: number, day: number): string {
+  return `${year}-${String(month).padStart(2, '0')}-${String(day).padStart(2, '0')}`;
+}
+
+function addDays(year: number, month: number, day: number, offset: number): { year: number; month: number; day: number } {
+  const d = new Date(year, month - 1, day);
+  d.setDate(d.getDate() + offset);
+  return { year: d.getFullYear(), month: d.getMonth() + 1, day: d.getDate() };
+}
+
+function detectIntent(message: string): 'events' | 'mystical' {
+  const m = message.toLowerCase();
+  if (/(行程|事件|日程|schedule|calendar|待會|今天有什麼安排|未來48小時)/i.test(m)) return 'events';
+  return 'mystical';
+}
+
+function summarizeEvents(events: any[]): string {
+  if (!Array.isArray(events) || events.length === 0) return '• 目前沒有查到符合條件的事件';
+  return events.slice(0, 20).map((evt: any, idx: number) => {
+    const title = evt?.title || evt?.name || evt?.summary || `事件 ${idx + 1}`;
+    const start = evt?.startDate || evt?.start || evt?.start_time || evt?.date || '未知時間';
+    const end = evt?.endDate || evt?.end || evt?.end_time || '';
+    return `• ${title}${start ? `｜${start}` : ''}${end ? ` → ${end}` : ''}`;
+  }).join('\n');
+}
+
+export async function handler(ctx: any) {
+  const workspace = ctx.env?.OPENCLAW_WORKSPACE || `${process.env.HOME}/.openclaw/workspace`;
+  const env = {
+    ...loadDotEnv(`${workspace}/.env`),
+    ...process.env,
+  } as EnvMap;
+
+  const baseUrl = env.GOODDAYS_BASE_URL;
+  const email = env.GOODDAYS_EMAIL;
+  const password = env.GOODDAYS_PASSWORD;
+  const userId = env.GOODDAYS_USER_ID;
+  const message = ctx.message?.text || ctx.message?.content || '';
+
+  if (!baseUrl || !email || !password) {
+    return { reply: '缺少 GoodDays 設定，請先檢查 workspace/.env。' };
+  }
+
+  try {
+    const token = await login(baseUrl, email, password);
+    const datePayload = parseDateFromMessage(message);
+    const intent = detectIntent(message);
+
+    if (intent === 'events') {
+      const startDate = formatYmd(datePayload.year, datePayload.month, datePayload.day);
+      const plusOne = addDays(datePayload.year, datePayload.month, datePayload.day, 1);
+      const endDate = formatYmd(plusOne.year, plusOne.month, plusOne.day);
+      const result = await getUnifiedEvents(baseUrl, token, userId, startDate, endDate);
+      const events = result?.data || [];
+      return {
+        reply:
+          `📅 GoodDays 行程查詢\n\n` +
+          `區間：${startDate} ~ ${endDate}\n` +
+          `${summarizeEvents(events)}`,
+        metadata: {
+          engine: 'gooddays-calendar',
+          endpoint: '/api/unified-events',
+          startDate,
+          endDate,
+          count: Array.isArray(events) ? events.length : 0,
+          result,
+        },
+      };
+    }
+
+    const payload = { ...datePayload, userId };
+    if (payload.hour == null) delete (payload as any).hour;
+
+    const result = await getMysticalDaily(baseUrl, token, payload);
+    const d = result?.data || {};
+    const goodHours = d?.good_hours?.good_hours_display || '未提供';
+    const isGoodNow = d?.good_hours?.is_good_hour;
+    const ganzhi = d?.ganzhi?.day || '未知';
+    const lunar = d?.lunar?.full_date || '未知';
+    const dongong = d?.dongong?.note || '未提供';
+    const twelve = d?.twelve_star?.description || '未提供';
+
+    return {
+      reply:
+        `📅 GoodDays 今日資訊\n\n` +
+        `日期：${payload.year}-${String(payload.month).padStart(2, '0')}-${String(payload.day).padStart(2, '0')}` +
+        `${payload.hour != null ? ` ${payload.hour}:00` : ''}` +
+        `\n干支：${ganzhi}` +
+        `\n農曆：${lunar}` +
+        `\n吉時：${goodHours}` +
+        `\n此刻是否吉時：${isGoodNow === true ? '是' : isGoodNow === false ? '否' : '未知'}` +
+        `\n董公：${dongong}` +
+        `\n十二建星：${twelve}`,
+      metadata: {
+        engine: 'gooddays-calendar',
+        endpoint: '/api/mystical/daily',
+        payload,
+        result,
+      },
+    };
+  } catch (error: any) {
+    return {
+      reply: `❌ GoodDays 查詢失敗：${error?.message || String(error)}`,
+      metadata: { error: error?.message || String(error) },
+    };
+  }
+}
--- a/skills/luxtts/SKILL.md
+++ b/skills/luxtts/SKILL.md
@@ -0,0 +1,47 @@
+---
+name: luxtts
+description: 使用本機 LuxTTS 將文字合成為語音，特別適合需要較高品質中文/英文 voice clone 的情況。用於：(1) 使用主人參考音檔做語音克隆，(2) 中英混合朗讀但希望維持主人音色，(3) 比較 LuxTTS 與 Kokoro 的輸出品質，(4) 需要 LuxTTS API-only 本機服務時。
+---
+
+# luxtts
+
+此 skill 提供 **LuxTTS** 文字轉語音能力，底層使用本機 **LuxTTS API**。
+
+## 目前架構
+
+- systemd 服務：`luxtts`
+- Port：`7861`
+- 綁定：`127.0.0.1`
+- Root path：`/luxtts`
+- 健康檢查：`http://127.0.0.1:7861/luxtts/api/health`
+- Web UI：**關閉**
+- API：保留
+
+## 推薦做法
+
+目前最穩定的整合方式是直接呼叫本機 API：
+
+```bash
+curl -sS -o /tmp/luxtts_test.wav \
+  -F "ref_audio=@/path/to/reference.wav" \
+  -F "text=这个世界已经改变了，人工智能AI改变了这个世界的运作方式。" \
+  -F "num_steps=4" \
+  -F "t_shift=0.9" \
+  -F "speed=1.0" \
+  -F "duration=5" \
+  -F "rms=0.01" \
+  http://127.0.0.1:7861/luxtts/api/tts
+```
+
+## 注意事項
+
+- 目前實測：**中文建議先轉簡體再輸入**。
+- LuxTTS 比較適合：
+  - 主人音色 clone
+  - 中文/英文都希望保持同一個 clone 聲線
+  - 品質優先、速度其次
+- 若只是快速中文朗讀、且不要求高擬真 clone，通常先考慮 `kokoro`。
+
+## 命名
+
+之後對外統一稱呼為 **luxtts**。
--- a/skills/luxtts/handler.ts
+++ b/skills/luxtts/handler.ts
@@ -0,0 +1,134 @@
+/**
+ * luxtts skill
+ * 文字轉語音：透過本機 LuxTTS API 進行 voice clone
+ */
+
+import { existsSync, readFileSync } from 'fs';
+import { execFileSync } from 'child_process';
+
+const LUXTTS_API = process.env.LUXTTS_API || 'http://127.0.0.1:7861/luxtts/api/tts';
+const DEFAULT_REF_AUDIO = process.env.LUXTTS_REF_AUDIO || '/home/selig/.openclaw/workspace/media/refs/ref_from_762.wav';
+const OUTPUT_DIR = '/home/selig/.openclaw/workspace/media';
+
+const TRIGGER_WORDS = [
+  'luxtts', 'lux', '文字轉語音', '語音合成', '唸出來', '說出來', '轉語音', 'voice',
+];
+
+const SPEED_MODIFIERS: Record<string, number> = {
+  '慢速': 0.85,
+  'slow': 0.85,
+  '快速': 1.15,
+  'fast': 1.15,
+};
+
+function parseMessage(message: string): { text: string; speed: number } {
+  let cleaned = message;
+  let speed = 1.0;
+
+  for (const trigger of TRIGGER_WORDS) {
+    const re = new RegExp(trigger, 'gi');
+    cleaned = cleaned.replace(re, '');
+  }
+
+  for (const [modifier, value] of Object.entries(SPEED_MODIFIERS)) {
+    const re = new RegExp(modifier, 'gi');
+    if (re.test(cleaned)) {
+      cleaned = cleaned.replace(re, '');
+      speed = value;
+    }
+  }
+
+  cleaned = cleaned.replace(/^[\s：:，,、]+/, '').replace(/[\s：:，,、]+$/, '').trim();
+  return { text: cleaned, speed };
+}
+
+function ensureDependencies() {
+  if (!existsSync(DEFAULT_REF_AUDIO)) {
+    throw new Error(`找不到預設參考音檔：${DEFAULT_REF_AUDIO}`);
+  }
+}
+
+function generateSpeech(text: string, speed: number): string {
+  const timestamp = Date.now();
+  const outputPath = `${OUTPUT_DIR}/luxtts_clone_${timestamp}.wav`;
+  const curlCmd = [
+    'curl', '-sS', '-o', outputPath,
+    '-F', `ref_audio=@${DEFAULT_REF_AUDIO}`,
+    '-F', `text=${text}`,
+    '-F', 'num_steps=4',
+    '-F', 't_shift=0.9',
+    '-F', `speed=${speed}`,
+    '-F', 'duration=5',
+    '-F', 'rms=0.01',
+    LUXTTS_API,
+  ];
+
+  execFileSync(curlCmd[0], curlCmd.slice(1), {
+    timeout: 600000,
+    stdio: 'pipe',
+    encoding: 'utf8',
+  });
+
+  if (!existsSync(outputPath)) {
+    throw new Error('LuxTTS 未產生輸出音檔');
+  }
+
+  const header = readFileSync(outputPath).subarray(0, 16).toString('ascii');
+  if (!header.includes('RIFF') && !header.includes('WAVE')) {
+    throw new Error(`LuxTTS 回傳非 WAV 音訊，檔頭：${JSON.stringify(header)}`);
+  }
+
+  return outputPath;
+}
+
+export async function handler(ctx: any) {
+  const message = ctx.message?.text || ctx.message?.content || '';
+
+  if (!message.trim()) {
+    return { reply: '請提供要合成的文字，例如：「luxtts 这个世界已经改变了」' };
+  }
+
+  const { text, speed } = parseMessage(message);
+
+  if (!text) {
+    return { reply: '請提供要合成的文字，例如：「luxtts 这个世界已经改变了」' };
+  }
+
+  try {
+    ensureDependencies();
+    const outputPath = generateSpeech(text, speed);
+
+    return {
+      reply:
+        '🔊 luxtts 語音合成完成' +
+        `\n\n📝 文字：${text}` +
+        `\n⏩ 語速：${speed}` +
+        `\n🎙️ 參考音檔：\`${DEFAULT_REF_AUDIO}\`` +
+        `\n🌐 API：\`${LUXTTS_API}\`` +
+        `\n📂 檔案：\`${outputPath}\``,
+      metadata: {
+        text,
+        speed,
+        refAudio: DEFAULT_REF_AUDIO,
+        output: outputPath,
+        engine: 'luxtts',
+        backend: 'luxtts-api',
+      },
+      files: [outputPath],
+    };
+  } catch (error: any) {
+    return {
+      reply:
+        '❌ luxtts 語音合成失敗，請檢查 luxtts 服務、API 與預設參考音檔是否正常。' +
+        (error?.message ? `\n\n錯誤：${error.message}` : ''),
+      metadata: {
+        text,
+        speed,
+        refAudio: DEFAULT_REF_AUDIO,
+        engine: 'luxtts',
+        backend: 'luxtts-api',
+        error: error?.message || String(error),
+      },
+    };
+  }
+}
--- a/skills/openclaw-tavily-search/.clawhub/origin.json
+++ b/skills/openclaw-tavily-search/.clawhub/origin.json
@@ -0,0 +1,7 @@
+{
+  "version": 1,
+  "registry": "https://clawhub.ai",
+  "slug": "openclaw-tavily-search",
+  "installedVersion": "0.1.0",
+  "installedAt": 1773208165907
+}
--- a/skills/openclaw-tavily-search/SKILL.md
+++ b/skills/openclaw-tavily-search/SKILL.md
@@ -0,0 +1,48 @@
+---
+name: tavily-search
+description: "Web search via Tavily API (alternative to Brave). Use when the user asks to search the web / look up sources / find links and Brave web_search is unavailable or undesired. Returns a small set of relevant results (title, url, snippet) and can optionally include short answer summaries."
+---
+
+# Tavily Search
+
+Use the bundled script to search the web with Tavily.
+
+## Requirements
+
+- Provide API key via either:
+  - environment variable: `TAVILY_API_KEY`, or
+  - `~/.openclaw/.env` line: `TAVILY_API_KEY=...`
+
+## Commands
+
+Run from the OpenClaw workspace:
+
+```bash
+# raw JSON (default)
+python3 {baseDir}/scripts/tavily_search.py --query "..." --max-results 5
+
+# include short answer (if available)
+python3 {baseDir}/scripts/tavily_search.py --query "..." --max-results 5 --include-answer
+
+# stable schema (closer to web_search): {query, results:[{title,url,snippet}], answer?}
+python3 {baseDir}/scripts/tavily_search.py --query "..." --max-results 5 --format brave
+
+# human-readable Markdown list
+python3 {baseDir}/scripts/tavily_search.py --query "..." --max-results 5 --format md
+```
+
+## Output
+
+### raw (default)
+- JSON: `query`, optional `answer`, `results: [{title,url,content}]`
+
+### brave
+- JSON: `query`, optional `answer`, `results: [{title,url,snippet}]`
+
+### md
+- A compact Markdown list with title/url/snippet.
+
+## Notes
+
+- Keep `max-results` small by default (3–5) to reduce token/reading load.
+- Prefer returning URLs + snippets; fetch full pages only when needed.
--- a/skills/openclaw-tavily-search/_meta.json
+++ b/skills/openclaw-tavily-search/_meta.json
@@ -0,0 +1,6 @@
+{
+  "ownerId": "kn78hhhbxwjs4nrcyn8my5fcw981wmys",
+  "slug": "openclaw-tavily-search",
+  "version": "0.1.0",
+  "publishedAt": 1772121679343
+}
--- a/skills/openclaw-tavily-search/scripts/tavily_search.py
+++ b/skills/openclaw-tavily-search/scripts/tavily_search.py
@@ -0,0 +1,159 @@
+#!/usr/bin/env python3
+import argparse
+import json
+import os
+import pathlib
+import re
+import sys
+import urllib.request
+
+TAVILY_URL = "https://api.tavily.com/search"
+
+
+def load_key():
+    key = os.environ.get("TAVILY_API_KEY")
+    if key:
+        return key.strip()
+
+    env_path = pathlib.Path.home() / ".openclaw" / ".env"
+    if env_path.exists():
+        try:
+            txt = env_path.read_text(encoding="utf-8", errors="ignore")
+            m = re.search(r"^\s*TAVILY_API_KEY\s*=\s*(.+?)\s*$", txt, re.M)
+            if m:
+                v = m.group(1).strip().strip('"').strip("'")
+                if v:
+                    return v
+        except Exception:
+            pass
+
+    return None
+
+
+def tavily_search(query: str, max_results: int, include_answer: bool, search_depth: str):
+    key = load_key()
+    if not key:
+        raise SystemExit(
+            "Missing TAVILY_API_KEY. Set env var TAVILY_API_KEY or add it to ~/.openclaw/.env"
+        )
+
+    payload = {
+        "api_key": key,
+        "query": query,
+        "max_results": max_results,
+        "search_depth": search_depth,
+        "include_answer": bool(include_answer),
+        "include_images": False,
+        "include_raw_content": False,
+    }
+
+    data = json.dumps(payload).encode("utf-8")
+    req = urllib.request.Request(
+        TAVILY_URL,
+        data=data,
+        headers={"Content-Type": "application/json", "Accept": "application/json"},
+        method="POST",
+    )
+
+    with urllib.request.urlopen(req, timeout=30) as resp:
+        body = resp.read().decode("utf-8", errors="replace")
+
+    try:
+        obj = json.loads(body)
+    except json.JSONDecodeError:
+        raise SystemExit(f"Tavily returned non-JSON: {body[:300]}")
+
+    out = {
+        "query": query,
+        "answer": obj.get("answer"),
+        "results": [],
+    }
+
+    for r in (obj.get("results") or [])[:max_results]:
+        out["results"].append(
+            {
+                "title": r.get("title"),
+                "url": r.get("url"),
+                "content": r.get("content"),
+            }
+        )
+
+    if not include_answer:
+        out.pop("answer", None)
+
+    return out
+
+
+def to_brave_like(obj: dict) -> dict:
+    # A lightweight, stable shape similar to web_search: results with title/url/snippet.
+    results = []
+    for r in obj.get("results", []) or []:
+        results.append(
+            {
+                "title": r.get("title"),
+                "url": r.get("url"),
+                "snippet": r.get("content"),
+            }
+        )
+    out = {"query": obj.get("query"), "results": results}
+    if "answer" in obj:
+        out["answer"] = obj.get("answer")
+    return out
+
+
+def to_markdown(obj: dict) -> str:
+    lines = []
+    if obj.get("answer"):
+        lines.append(obj["answer"].strip())
+        lines.append("")
+    for i, r in enumerate(obj.get("results", []) or [], 1):
+        title = (r.get("title") or "").strip() or r.get("url") or "(no title)"
+        url = r.get("url") or ""
+        snippet = (r.get("content") or "").strip()
+        lines.append(f"{i}. {title}")
+        if url:
+            lines.append(f"   {url}")
+        if snippet:
+            lines.append(f"   - {snippet}")
+    return "\n".join(lines).strip() + "\n"
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--query", required=True)
+    ap.add_argument("--max-results", type=int, default=5)
+    ap.add_argument("--include-answer", action="store_true")
+    ap.add_argument(
+        "--search-depth",
+        default="basic",
+        choices=["basic", "advanced"],
+        help="Tavily search depth",
+    )
+    ap.add_argument(
+        "--format",
+        default="raw",
+        choices=["raw", "brave", "md"],
+        help="Output format: raw (default) | brave (title/url/snippet) | md (human-readable)",
+    )
+    args = ap.parse_args()
+
+    res = tavily_search(
+        query=args.query,
+        max_results=max(1, min(args.max_results, 10)),
+        include_answer=args.include_answer,
+        search_depth=args.search_depth,
+    )
+
+    if args.format == "md":
+        sys.stdout.write(to_markdown(res))
+        return
+
+    if args.format == "brave":
+        res = to_brave_like(res)
+
+    json.dump(res, sys.stdout, ensure_ascii=False)
+    sys.stdout.write("\n")
+
+
+if __name__ == "__main__":
+    main()
--- a/skills/skill-vetter/.clawhub/origin.json
+++ b/skills/skill-vetter/.clawhub/origin.json
@@ -0,0 +1,7 @@
+{
+  "version": 1,
+  "registry": "https://clawhub.ai",
+  "slug": "skill-vetter",
+  "installedVersion": "1.0.0",
+  "installedAt": 1773199291047
+}
--- a/skills/skill-vetter/SKILL.md
+++ b/skills/skill-vetter/SKILL.md
@@ -0,0 +1,138 @@
+---
+name: skill-vetter
+version: 1.0.0
+description: Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
+---
+
+# Skill Vetter 🔒
+
+Security-first vetting protocol for AI agent skills. **Never install a skill without vetting it first.**
+
+## When to Use
+
+- Before installing any skill from ClawdHub
+- Before running skills from GitHub repos
+- When evaluating skills shared by other agents
+- Anytime you're asked to install unknown code
+
+## Vetting Protocol
+
+### Step 1: Source Check
+
+```
+Questions to answer:
+- [ ] Where did this skill come from?
+- [ ] Is the author known/reputable?
+- [ ] How many downloads/stars does it have?
+- [ ] When was it last updated?
+- [ ] Are there reviews from other agents?
+```
+
+### Step 2: Code Review (MANDATORY)
+
+Read ALL files in the skill. Check for these **RED FLAGS**:
+
+```
+🚨 REJECT IMMEDIATELY IF YOU SEE:
+─────────────────────────────────────────
+• curl/wget to unknown URLs
+• Sends data to external servers
+• Requests credentials/tokens/API keys
+• Reads ~/.ssh, ~/.aws, ~/.config without clear reason
+• Accesses MEMORY.md, USER.md, SOUL.md, IDENTITY.md
+• Uses base64 decode on anything
+• Uses eval() or exec() with external input
+• Modifies system files outside workspace
+• Installs packages without listing them
+• Network calls to IPs instead of domains
+• Obfuscated code (compressed, encoded, minified)
+• Requests elevated/sudo permissions
+• Accesses browser cookies/sessions
+• Touches credential files
+─────────────────────────────────────────
+```
+
+### Step 3: Permission Scope
+
+```
+Evaluate:
+- [ ] What files does it need to read?
+- [ ] What files does it need to write?
+- [ ] What commands does it run?
+- [ ] Does it need network access? To where?
+- [ ] Is the scope minimal for its stated purpose?
+```
+
+### Step 4: Risk Classification
+
+| Risk Level | Examples | Action |
+|------------|----------|--------|
+| 🟢 LOW | Notes, weather, formatting | Basic review, install OK |
+| 🟡 MEDIUM | File ops, browser, APIs | Full code review required |
+| 🔴 HIGH | Credentials, trading, system | Human approval required |
+| ⛔ EXTREME | Security configs, root access | Do NOT install |
+
+## Output Format
+
+After vetting, produce this report:
+
+```
+SKILL VETTING REPORT
+═══════════════════════════════════════
+Skill: [name]
+Source: [ClawdHub / GitHub / other]
+Author: [username]
+Version: [version]
+───────────────────────────────────────
+METRICS:
+• Downloads/Stars: [count]
+• Last Updated: [date]
+• Files Reviewed: [count]
+───────────────────────────────────────
+RED FLAGS: [None / List them]
+
+PERMISSIONS NEEDED:
+• Files: [list or "None"]
+• Network: [list or "None"]  
+• Commands: [list or "None"]
+───────────────────────────────────────
+RISK LEVEL: [🟢 LOW / 🟡 MEDIUM / 🔴 HIGH / ⛔ EXTREME]
+
+VERDICT: [✅ SAFE TO INSTALL / ⚠️ INSTALL WITH CAUTION / ❌ DO NOT INSTALL]
+
+NOTES: [Any observations]
+═══════════════════════════════════════
+```
+
+## Quick Vet Commands
+
+For GitHub-hosted skills:
+```bash
+# Check repo stats
+curl -s "https://api.github.com/repos/OWNER/REPO" | jq '{stars: .stargazers_count, forks: .forks_count, updated: .updated_at}'
+
+# List skill files
+curl -s "https://api.github.com/repos/OWNER/REPO/contents/skills/SKILL_NAME" | jq '.[].name'
+
+# Fetch and review SKILL.md
+curl -s "https://raw.githubusercontent.com/OWNER/REPO/main/skills/SKILL_NAME/SKILL.md"
+```
+
+## Trust Hierarchy
+
+1. **Official OpenClaw skills** → Lower scrutiny (still review)
+2. **High-star repos (1000+)** → Moderate scrutiny
+3. **Known authors** → Moderate scrutiny
+4. **New/unknown sources** → Maximum scrutiny
+5. **Skills requesting credentials** → Human approval always
+
+## Remember
+
+- No skill is worth compromising security
+- When in doubt, don't install
+- Ask your human for high-risk decisions
+- Document what you vet for future reference
+
+---
+
+*Paranoia is a feature.* 🔒🦀
--- a/skills/skill-vetter/_meta.json
+++ b/skills/skill-vetter/_meta.json
@@ -0,0 +1,6 @@
+{
+  "ownerId": "kn71j6xbmpwfvx4c6y1ez8cd718081mg",
+  "slug": "skill-vetter",
+  "version": "1.0.0",
+  "publishedAt": 1769863429632
+}