功能描述

Asset Library Skill. Use when the user expresses the overall end-to-end intent in one request, including “把这些材料建成资产库”“列出未来 60 天需要续办或补办的事项”“生成暑期实习申请材料包”, when...

使用说明 (SKILL.md)

\r \r

Asset Library Skill\r

Name: Asset Library Skill
Author: angjustinl

\r 在用户把整条主线一次性说出来，或还不确定应该先跑哪个阶段 skill 时，先使用这个主入口 skill。\r \r

Quick flow\r

\r

判断用户是在说整条主线，还是已经明确到某个阶段\r
选择当前最小必要的子 skill\r
说明当前阶段边界、缺失输入和下一步\r \r

Required tools\r

\r

不直接调用 MCP tools\r
只路由到默认 MVP 子 skill：ingest-materials、build-asset-library、maintain-asset-library、query-assets、check-lifecycle、build-package\r
submit-demo 是高级可选扩展，不属于默认 route\r \r

Required input\r

\r

用户当前意图\r
当前可用事实：本地文件路径、library_id、goal、package_plan_id 或 package_id\r \r

Workflow\r

\r

如果用户表达整条主线，或没有明确自己处在哪个阶段，先使用 caixu-skill。\r
如果这是第一次安装，或当前缺 key、缺 profile、缺 MCP/skills 注册，先读 references/install.md，引导完成安装和验活。\r
如果用户想做自然语言材料检索或显式要求语义扩展检索，且本地检索增强是否可用不明确，也先读 references/install.md，确认 embedding 配置和旧库索引是否已完成。\r
环境就绪后，再区分当前是 raw materials ingest、资产建库、资产维护、资产查询、生命周期判断，还是打包导出。\r
一次只选择一个当前阶段子 skill，不在这里展开整条流水线执行。\r
返回当前阶段边界、最小缺失输入，以及一个短名 next_recommended_skill。\r
路由完成后停止；后续执行责任属于对应子 skill。\r
如果用户明确要求外部演示页自动提交，再说明这是高级可选扩展，并引导查看扩展文档或手动启用 submit-demo。\r \r

Guardrails\r

\r

不直接调用 MCP tools、OCR、SQLite、docgen 或浏览器动作。\r
不把多个子 skill 串在同一次执行里。\r
用户已经明确要求某个阶段时，不要强行改成整条主线。\r
从 raw materials 开始时，不要跳过必须阶段。\r
第一次安装或环境未就绪时，不要假装已经可运行；必须先引导到 references/install.md。\r
检索增强环境或旧库索引状态不明确时，不要假装语义检索一定可用；先引导检查 references/install.md。\r
不要改写子 skill 的输入输出契约。\r

安全使用建议

This bundle is not pure 'instruction-only' despite metadata implying so: it includes many Node modules, MCP tool implementations, and scripts that access local files, a local SQLite DB, and run embedding/model code that may reach the network or local model caches. Before installing or running this skill, consider: 1) Ask the publisher for an install spec and explicit list of required environment variables (and why they're needed). 2) Review package.json / pnpm-lock to see third-party dependencies and their versions. 3) Run the code only in an isolated environment (sandbox/container) because it will read/write local paths and may download models. 4) Confirm whether any external credentials (Hugging Face tokens, model-hosting keys) are required — the manifest doesn't declare them but code may expect network/model access. 5) If you only want the routing behavior, verify how the platform will execute the child MCP tools (they may not be available without installing the Node packages). 6) Treat the 'system-prompt-override' scanner finding as a prompt to manually inspect the SKILL.md frontmatter for any hidden or authoritative instruction strings. If you cannot verify the install/runtime details or do not trust the source, do not enable this skill on sensitive systems.

功能分析

Type: OpenClaw Skill Name: asset-library-skill Version: 1.0.0 The skill bundle provides a comprehensive system for document ingestion, OCR processing, and personal asset library management. It utilizes the Model Context Protocol (MCP) to interface with local SQLite storage and external Zhipu AI APIs for file parsing and OCR. Security analysis shows that risky operations, such as executing external binaries (ffmpeg, pdftoppm) in 'caixu-ocr-mcp/src/tools/pdf-render.ts' and 'prepare-raster-image.ts', are properly mitigated using Zod schema validation and 'execFile' to avoid shell injection. The prompt instructions in 'SKILL.md' and 'references/' are aligned with the stated purpose and include explicit guardrails against data fabrication. No evidence of data exfiltration, malicious persistence, or unauthorized execution was found.

能力评估

ℹ Purpose & Capability

The top-level SKILL.md (caixu-skill) is a router that only routes to child phase skills and explicitly says it should not call MCP tools or touch files; that purpose matches the 'Asset Library Skill' description. However, the bundle also contains many code modules (caixu-data-mcp, caixu-ocr-mcp, embedding code, storage, scripts) that implement local MCP tools and local filesystem/embedding behavior. The registry metadata and top-level description imply an instruction-only / routing entrypoint but the package includes server tooling and binaries-equivalent Node code — an inconsistency the user should be aware of.

✓ Instruction Scope

The SKILL.md instructions for caixu-skill are narrowly scoped (route to a single phase skill, check install guidance, do not perform extraction or I/O). Child skills' SKILL.md files explicitly instruct agents to call MCP tools that read local files, run OCR, generate embeddings, persist to local SQLite, and export zips. That scope is consistent within the project (it's a multi-skill suite where some skills perform I/O), but the top-level router specifically promises not to perform those actions itself.

⚠ Install Mechanism

No install spec is declared despite numerous Node packages, PNPM lockfile, scripts, and runtime behavior that depend on installed packages (e.g., @huggingface/transformers, @modelcontextprotocol sdk). The embedding code spawns a Node subprocess that executes an inline worker which loads Hugging Face transformers and may access local model caches or the network. Without an explicit install mechanism, it's unclear how required dependencies or native models will be provisioned — this is a mismatch and a deployment risk.

⚠ Credentials

Registry metadata lists no required env vars, but source references several environment variables (CAIXU_SQLITE_PATH, CAIXU_EMBEDDING_CACHE_DIR, CAIXU_EMBEDDING_MODEL, CAIXU_EMBEDDING_TIMEOUT_MS and others) and will perform filesystem access and optional network calls to model libraries. No credentials are requested in metadata, which is good, but the code's reliance on optional env configuration is not documented in the skill manifest and may surprise operators.

✓ Persistence & Privilege

The skill does not set always:true and is user-invocable. It contains services (MCP server tools) that persist to local SQLite and write files (package preflight, storage). That level of privilege is consistent with a local asset-management skill, but it is powerful (local file and DB access + embedding/model invocations). Because it is not forced-always, this is acceptable but should be run in a trusted or isolated environment.

版本历史

v1.0.0

- Initial release of Asset Library Skill, providing a main entry point when users express an end-to-end intent or are unsure which phase to run. - Routes user requests to the minimal necessary child skill based on intent and available inputs. - Explains current boundaries, missing inputs, and next steps; guides first-time installation or missing setup to references/install.md. - Does not directly invoke MCP tools or combine multiple sub-skills in a single execution. - Emphasizes verification of installation, key/config readiness, and retrieval environment before proceeding.

元数据

Slug asset-library-skill

版本 1.0.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 1

常见问题

Asset Library Skill 是什么？

Asset Library Skill. Use when the user expresses the overall end-to-end intent in one request, including “把这些材料建成资产库”“列出未来 60 天需要续办或补办的事项”“生成暑期实习申请材料包”, when... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 95 次。

如何安装 Asset Library Skill？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install asset-library-skill」即可一键安装，无需额外配置。

Asset Library Skill 是免费的吗？

是的，Asset Library Skill 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。

Asset Library Skill 支持哪些平台？

Asset Library Skill 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Asset Library Skill？

由 ANGJustinl（@angjustinl）开发并维护，当前版本 v1.0.0。

Asset Library Skill