SKILLEMALL.ai
GitHub ↗ RU Sign in

BD ncm-listening-profile

当用户想在 Windows 或 macOS 上采集网易云音乐/NetEase Cloud Music 桌面版听歌画像数据、导出主歌单和听歌排行、生成本地 JSONL/CSV/aggregate 文件与 AI 分析 prompt 时使用。此 Skill 通过 CDP 启动或连接本机网易云音乐客户端，在已登录页面上下文用网易云 `/api` 采集用户创建歌单、主歌单、最近一周听歌排行和所有时间听歌排行；本 Skill 不在采集会话内做人格或画像分析。

ClawHub Agent Skills author: 龙骑士k v1.0.2 MIT-0 19 files body ≈ 2 208 tokens Open the sourceclawhub.ai↗ analyzed 2 d ago

当用户想在 Windows 或 macOS 上采集网易云音乐/NetEase Cloud Music 桌面版听歌画像数据、导出主歌单和听歌排行、生成本地 JSONL/CSV/aggregate 文件与 AI 分析 prompt 时使用。此 Skill 通过 CDP…

As a process D 48/100 · Unfinished process — weak spots: result and completion, when it triggers, inputs and preconditions

IntegrationAI and agentsData and analyticstype and topics are labelled automatically from the skill text
Runs in: OpenClaw Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) Goose OpenCode
JSON
Technical rating
B
81/100
safety, quality, tests
Safety 60%
85
Quality 40%
74
Run on models
none yet
Process rating
D
48/100
Unfinished process
Result and completion w 14
0
Inputs and preconditions w 11
0
Failures and branches w 10
0
the three weakest of ten parameters · all ten

How to improve

  1. Say in the description WHEN to use the skill ("use when…", example requests): that is the agent's main cue.
For the model run — optional
  • Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
  • A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 15

✓ No critical or high findings

Medium and low: 15
  • low Secrets in code secret-high-entropy-token references/schemas.md:163
    High-entropy token-like string (may be an id, hash or a credential)
    top3…unt
  • low Secrets in code secret-high-entropy-token references/schemas.md:164
    High-entropy token-like string (may be an id, hash or a credential)
    top3…unt
  • low Secrets in code secret-high-entropy-token references/schemas.md:166
    High-entropy token-like string (may be an id, hash or a credential)
    rece…are
  • low Secrets in code secret-high-entropy-token references/schemas.md:167
    High-entropy token-like string (may be an id, hash or a credential)
    top1…ise
  • low Secrets in code secret-high-entropy-token references/schemas.md:168
    High-entropy token-like string (may be an id, hash or a credential)
    bott…unt
  • low Secrets in code secret-high-entropy-token scripts/ncm_aggregate.py:307
    High-entropy token-like string (may be an id, hash or a credential) (placeholder value)
    "top2…nMs": sorted(primary_samples, key=lambda item: int(item.get("durationMs") or 0), reverse=True)[:20],
    placeholder
  • low Secrets in code secret-high-entropy-token scripts/ncm_aggregate.py:308
    High-entropy token-like string (may be an id, hash or a credential) (placeholder value)
    "top2…nMs": sorted(primary_samples, key=lambda item: int(item.get("durationMs") or 0))[:20],
    placeholder
  • low Secrets in code secret-high-entropy-token scripts/ncm_aggregate.py:320
    High-entropy token-like string (may be an id, hash or a credential) (placeholder value)
    "top2…cks": [_sample_primary(row, raw) for row, raw, _ in sorted(added_pairs, key=lambda item: item[2])[:20]],
    placeholder
  • low Secrets in code secret-high-entropy-token scripts/ncm_aggregate.py:321
    High-entropy token-like string (may be an id, hash or a credential) (placeholder value)
    "top2…cks": [_sample_primary(row, raw) for row, raw, _ in sorted(added_pairs, key=lambda item: item[2], reverse=True)[:20]],
    placeholder
  • low Secrets in code secret-high-entropy-token scripts/ncm_aggregate.py:326
    High-entropy token-like string (may be an id, hash or a credential) (placeholder value)
    "top2…unt": sorted(recent_samples, key=lambda item: int(item.get("playCount") or 0), reverse=True)[:20],
    placeholder
  • low Secrets in code secret-high-entropy-token scripts/test_ncm_profile.py:466
    High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
    self.assertEqual(aggregate["rankingStats"]["rece…are"], 0)
    fixturequoted
  • low Secrets in code secret-high-entropy-token scripts/test_ncm_profile.py:467
    High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
    self.assertEqual(aggregate["rankingStats"]["rece…are"], 0)
    fixturequoted
  • low Secrets in code secret-high-entropy-token scripts/test_ncm_profile.py:468
    High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
    self.assertEqual(aggregate["rankingStats"]["rece…are"], 0)
    fixturequoted
  • low Secrets in code secret-high-entropy-token scripts/test_ncm_profile.py:469
    High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
    self.assertEqual(aggregate["rankingStats"]["top2…unt"], [])
    fixturequoted
  • low Secrets in code secret-high-entropy-token scripts/test_ncm_profile.py:470
    High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
    self.assertEqual(aggregate["rankingStats"]["bott…unt"], [])
    fixturequoted

Files scanned: 19. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

  • warning description-no-when description does not say WHEN to use the skill (no "use when")

Process rating: all ten parameters 48/100

  • 0Result and completion. Does not say what the result is
  • 0Inputs and preconditions. Does not say what the process needs to start
  • 0Failures and branches. Linear process with no failure handling
  • 20When it triggers. No condition that starts the skill
  • 60Tools and files. Uses tools (web, python) that frontmatter does not declare
  • 100Steps. 34 steps
  • 100Consistency. Name and required fields are in place
  • 100Execution cost. Instruction body is 2208 tokens
  • 100Running it twice. No mutating operations
  • 100Progress reporting. Reports progress
  • low 15 top-level sections: this looks like several domains in one skill

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

  • +5Description has no quoted example phrases that should trigger the skill
  • +4Description does not say when NOT to use the skill (false activations)
  • +3Output format is not stated: the model decides each time
  • -37 of 8 scripts are never mentioned in SKILL.md
  • +2Single-language instructions
  • +3Description length 225: enough signal without eating the budget
  • +4Structure: 16 headings
  • +3Step-by-step instructions: 34 items
  • +4Has examples (20 code blocks)
  • +4Reference files are cited in the instructions (4 of 4)
  • +1License stated

Quality base 70; lint remarks subtract, signals add up to 100. Result: 74.

External checks

ClawHub: clean
This skill transparently collects a user's own NetEase Cloud Music listening data into local files for optional AI analysis, with no artifact evidence of upload, credential theft, or hidden behavior.
LLM: benign (high) · VirusTotal: · 13 Jun 2026