BF research-pro
系统化研究 skill — 螺旋收敛模型。把任何问题(模糊或清晰)分解成子问题,迭代搜索,越搜越清晰,直到每个子问题都有答案。 Triggers: "帮我研究", "研究一下", "调研", "分析对比", "research", "investigate", "look up" 也触发: 竞品分析、市场调研、技术选型对比、趋势了解 Setup triggers: "安装 research-pro", "配置 research-pro", "research-pro doctor", "setup research-pro", "research-pro 未就绪" **Gates:** 开始外部搜索前必须通过 READY doctor 与 Search Target Confirmation Gate;所有交互式多源/外部研究必须先展示 Search Contract 并收到用户明确确认。唯一例外是一个用户明确提供的 URL/文件、且只要求读取/提取/摘要、不作跨源比较或推断的 `NARROW_SELFCHECK`(见 SKILL Phase 1)。 Does NOT trigger normal multi-source research: - 已经知道答案的简单事实问题 - 用户直接给了 URL/文件、且只要读取/提取/摘要的,按 Step 1.2 的 `NARROW_SELFCHECK` 处理(不进入跨源 research) - 代码调试、写代码任务 Output: 结构化研究报告(结论 + 子问题答案 + 来源 + 争议点 + 未解决缺口)
系统化研究 skill — 螺旋收敛模型。把任何问题(模糊或清晰)分解成子问题,迭代搜索,越搜越清晰,直到每个子问题都有答案。 Triggers: "帮我研究", "研究一下", "调研", "分析对比", "research", "investigate", "look up" 也触发…
As a process F 38/100 · Will not run — References files that are not bundled: URL
How to improve
- For Hermes the description must be one sentence under 60 characters; move the conditions to a "When to Use" section.
- The SKILL.md body is over 5,000 tokens: move reference detail into references/ and load it when needed.
- The text references files that are not there: add them or drop the references.
- Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
- A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.
Guard findings · 4
✓ No critical or high findings
Medium and low: 4
-
low Exfiltration
net-credential-useSKILL.md:373Credential used in a network call (verify the destination is the intended service) (quoted — discussed, not commanded)> ⚠️ 下面凡是裸 CLI(tvly/firecrawl/youtube_transcript_api)或用到 `$XXX_API_KEY` 的 curl,**都要经凭据 shim**,否则冷启动报 "No API key"。
quoted -
low Exfiltration
exfil-secret-in-urlSKILL.md:396Credential passed in a URL query string (normal for some APIs — verify the host is the intended service) (destination is a well-known publishing service; quoted — discussed, not commanded)RWC bash -c 'curl "https://www.googleapis.com/youtube/v3/search?part=…&q=QUERY&type=video&maxResults=5&key=…"'
known servicequoted -
low Exfiltration
net-credential-useSKILL.md:396Credential used in a network call (verify the destination is the intended service) (destination is a well-known publishing service; quoted — discussed, not commanded)RWC bash -c 'curl "https://www.googleapis.com/youtube/v3/search?part=…&q=QUERY&type=video&maxResults=5&key=…"'
known servicequoted -
low Exfiltration
read-dotenvSKILL.md:428Reads a .env file# Credentials: scripts auto-load via lib/credentials.mjs — do NOT hardcode source ~/.openclaw/.env
Files scanned: 37. Evidence is masked. Grey chips explain why severity was lowered.
Against the Agent Skills spec
- warning
description-long-hermesdescription is 690 chars; the Hermes authoring standard requires ≤ 60 (one sentence, ending with a period) - warning
body-longSKILL.md body ≈ 6521 tokens (recommended < 5000); move details to references/ - warning
missing-refreference to a missing file: URL
Process rating: all ten parameters 38/100
- 0Tools and files. 1 referenced file(s) missing: URL
- 0Result and completion. Does not say what the result is
- 0Inputs and preconditions. Does not say what the process needs to start
- 30Running it twice. 1 mutating operations with no state check
- 50When it triggers. No condition that starts the skill
- 50Failures and branches. 0 branches, has a failure section
- 60Consistency. The Hermes dialect needs category and tags
- 70Execution cost. Instruction body is 6521 tokens
- 100Steps. 155 steps
- 100Progress reporting. Reports progress
- low 13 top-level sections: this looks like several domains in one skill
Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.
Quality signals
- +4Description does not say when NOT to use the skill (false activations)
- +3Output format is not stated: the model decides each time
- -247 emoji in the instructions: noise for the model
- -35 of 13 scripts are never mentioned in SKILL.md
- +1No license
- +2Single-language instructions
- +5Description quotes 8 example trigger phrases
- +3Description length 689: enough signal without eating the budget
- +4Structure: 32 headings
- +3Step-by-step instructions: 155 items
- +4Has examples (26 code blocks)
- +4Reference files are cited in the instructions (1 of 6)
Quality base 70; lint remarks subtract, signals add up to 100. Result: 66.