命理大师

Version 1.2.10 - Improved documentation and workflow details in references/intake-and-routing.md. - Expanded and clarified numerology interpretative guidance in references/numerology-framework.md. - Updated scripts/daily-push.js with new logic or adjustments for scheduled push notifications. - General refinements for better user clarity and system maintainability.

- Naming/命名相关场景与说明大幅强化，细化起名、改名、名字分析等多种用法示例。 - 警示语和数据隐私说明新增，明确提示本地存储内容及用途，增强用户知情权。 - skill-card.md 文件移除，无用户功能影响。 - 参考文档 references/naming-framework.md 更新，反映起名/命名流程与边界要求的最新变化。

# university-applications v1.2.8 Changelog - Documentation updates: improved and expanded content in SKILL.md and references/intake-and-routing.md. - Scripts updated: changes in bazi-analysis.js, daily-push.js, liuyao.js, and qimen.js for stability or internal logic. - Removed outdated file: skill-card.md. - No new features or critical breaking changes introduced.

# university-applications v1.2.7 Changelog - Updated _meta.json file. - No skill logic, documentation, or user-facing feature changes.

university-applications 1.2.6 - Updated version number in SKILL.md to 1.2.6. - No functional or content changes; only documentation/version references updated.

**Expanded into palmistry, physiognomy, naming, and dressing advice – now covers more metaphysics topics!** - Added frameworks for掌纹/手相 (palmistry), 面相 (physiognomy), 起名/命名 (naming), and 穿衣/搭配 (dressing). - Updated documentation, triggers, and routing menus to include new systems. - Broadened keyword set for skill activation (e.g., 掌纹, 起名, 颜色). - Removed obsolete/unused skill-card.md. - Updated output templates and references to reflect support for new topics.

- Updated displayName in metadata from "命理大师 · Chinese Divination Master" to "命理大师" for consistency. - No functional changes to skill logic or user experience. - Version bump to 1.2.3 for tracking metadata correction.

v1.2.2 安全与合规修复：1) 移除浏览器六爻页面的『自定义 API 地址』入口，仅保留 OpenAI/Anthropic/DeepSeek 三家官方端点白名单，resolveApiBase() 增加 isKnownEndpoint 双重校验，杜绝 Bearer Token 被诱导发往任意第三方 HTTPS 域；2) 收紧 SKILL.md 与 package.json 的 keywords，剔除『算命/占卜/命理/风水/今日运势/每日运程/fortune telling/divination/daily horoscope/Chinese astrology/feng shui/I Ching/numerology』等日常对话中容易误激活的宽泛词，仅保留具体体系名+具体动作；3) 在 SKILL.md description、metadata.displayName、_meta.json name、package.json displayName 中明确标注『中式命理与占卜排盘工具集 / Chinese Divination Master』，并补充 slug 历史标识说明，避免名称-行为不一致。

v1.2.1: skill-review polish — add co-author, top-level version aligned to 1.2.0->1.2.1, description shrunk 395->142 chars, bazi-analysis usage fixed to four-pillar, removed scripts/publish.sh from doc tree (B15 broken-link fix), ziwei.js NaN:00 hardening.

v1.2.0: fix 5 SkillSpector findings — --test now forces dry-run (removes --i-am-the-user live-delivery side door); explicit External Transmission SBOM for OpenAI/Anthropic/DeepSeek endpoints in liuyao UI; iztro pinned to 2.5.8 with package-lock.json sha512 integrity for reproducible install.

v1.1.9 mitigates 12 SkillSpector findings: liuyao HTML adds prominent third-party-transmission warning banner and tags custom endpoint as high-risk; daily-push --test now refuses non-opted-in users unless paired with --dry-run or --i-am-the-user; register --push requires explicit --i-consent to prevent silent opt-in; preference-tracker recordInteraction now rejects writes unless profile.preferences.allowPreferenceLearning is true with opt-in timestamp, and adds opt-in/opt-out subcommands; marriage.js CLI double-userId mode requires --i-am or OPENCLAW_OWNER_ID matching one of the two parties; chinese-methods.md gains privacy/minimization/biometric/minor warnings at the top and on shou-xiang/mian-xiang sections; tarot-framework.md gains explicit medical/legal/financial/marriage/employment/minor decision red-lines for symbolic draws

v1.1.8 mitigates 13 SkillSpector findings: forbid action directives in templates 1/3/4/5/7; drop sensitive 官司 topic from preference tracker; rewrite push topic templates to atmosphere-only side-views; remove 'search news' steps from push prompts; default-off push & notifications in register.js; soft-delete + DELETE confirmation in profile.js; tighten SKILL.md trigger keywords; privacy notice above sensitive-data table

v1.1.7: removed publish npm script, excluded publish.sh from bundle, removed --list --full path, dry-run truly no-write, double opt-in (pushOptInAt) for daily push, profile template stripped of all push fields, push content rewritten as ambience hints (no investment/surgery/marriage actions), templates global style guard added

v1.1.6: removed all external markdown ingestion and OPENCLAW_KNOWLEDGE_DIR (no more file-system enumeration); profile template defaults all push flags to false (matches push-default-state: disabled); each output template now embeds inline disclaimer; daily-push --list now aggregated only (no per-user morningTime/userId), privacy hints moved to stderr

Security hardening v1.1.5: align skill identity (name/skillKey/lock/publish.sh all → university-applications), strict HTTPS+IP/localhost block in liuyao consent dialog, default-masked profile/register/list outputs with --full opt-in, dry-run never streams personal fortune to stdout, hashed userId in push-log, outbox excluded from publish bundle, tightened triggers and disclaimers

Security hardening: align skill identity, add LLM consent dialog & endpoint allowlist, scope knowledge dir, mask push listings, write per-user outbox, add disclaimers

fix(liuyao): clean up LLM auth header to pass static scan (suspicious.exposed_secret_literal)

Resolve ClawScan findings: align slug/version across _meta.json, package.json, package-lock.json, SKILL.md; declare daily push as opt-in; disclose optional in-browser LLM network use and user-provided key; expose profile view/edit/delete controls; remove secret-literal false positive in liuyao/index.html.

- Improved liuyao/index.html for university-applications skill. - General updates and refinements applied in client-facing interface.

- Clarified and expanded the security and privacy policies in SKILL.md, including explicit opt-in requirements for network features. - Documented that all Node/Python scripts perform only local computation; optional LLM and font network calls are strictly browser-only and user-initiated. - Added step-by-step user controls for profile and data retention management. - Updated "push" mechanism details: now opt-in by default (disabled until enabled by user). - Improved transparency on optional credentials and clearly listed no bundled or required API tokens.