@memtensor/memos-local-openclaw-plugin 1.0.4-beta.2 → 1.0.4-beta.20

package/src/skill/evolver.ts

@@ -9,9 +9,11 @@ import { DEFAULTS } from "../types";
 import { SkillEvaluator } from "./evaluator";
 import { SkillGenerator } from "./generator";
 import { SkillUpgrader } from "./upgrader";
-import { SkillInstaller } from "./installer";
+import { SkillInstaller, type SkillInstallMode } from "./installer";
 import { buildSkillConfigChain, callLLMWithFallback } from "../shared/llm-call";
 
+export type SkillEvolvedCallback = (skillName: string, upgradeType: "created" | "upgraded") => void;
+
 export class SkillEvolver {
   private evaluator: SkillEvaluator;
   private generator: SkillGenerator;
@@ -19,6 +21,7 @@ export class SkillEvolver {
   private installer: SkillInstaller;
   private processing = false;
   private queue: Task[] = [];
+  onSkillEvolved: SkillEvolvedCallback | null = null;
 
   constructor(
     private store: SqliteStore,
@@ -93,10 +96,19 @@ export class SkillEvolver {
       return;
     }
 
+    const preferUpgrade = this.ctx.config.skillEvolution?.preferUpgradeExisting ?? DEFAULTS.skillPreferUpgrade;
     const relatedSkill = await this.findRelatedSkill(task);
 
     if (relatedSkill) {
       await this.handleExistingSkill(task, chunks, relatedSkill);
+    } else if (preferUpgrade) {
+      const nameCandidate = await this.findSkillByNameSimilarity(task);
+      if (nameCandidate) {
+        this.ctx.log.info(`SkillEvolver: preferUpgrade found name-similar skill "${nameCandidate.name}" for task "${task.title}"`);
+        await this.handleExistingSkill(task, chunks, nameCandidate);
+      } else {
+        await this.handleNewSkill(task, chunks);
+      }
     } else {
       await this.handleNewSkill(task, chunks);
     }
@@ -278,7 +290,12 @@ Use selectedIndex 0 when none is highly relevant.`;
 
       if (upgraded) {
         this.store.linkTaskSkill(task.id, freshSkill.id, "evolved_from", freshSkill.version + 1);
-        this.installer.syncIfInstalled(freshSkill.name);
+        if (freshSkill.installed) {
+          this.installer.syncIfInstalled(freshSkill.name);
+        } else {
+          this.autoInstallIfNeeded(freshSkill);
+        }
+        this.onSkillEvolved?.(freshSkill.name, "upgraded");
       } else {
         this.store.linkTaskSkill(task.id, freshSkill.id, "applied_to", freshSkill.version);
       }
@@ -300,6 +317,13 @@ Use selectedIndex 0 when none is highly relevant.`;
     const evalResult = await this.evaluator.evaluateCreate(task);
 
     if (evalResult.shouldGenerate && evalResult.confidence >= minConfidence) {
+      const existingByName = this.store.getSkillByName(evalResult.suggestedName);
+      if (existingByName && (existingByName.status === "active" || existingByName.status === "draft")) {
+        this.ctx.log.info(`SkillEvolver: skill "${evalResult.suggestedName}" already exists, redirecting to upgrade instead of create`);
+        await this.handleExistingSkill(task, chunks, existingByName);
+        return;
+      }
+
       this.ctx.log.info(`SkillEvolver: generating new skill "${evalResult.suggestedName}" — ${evalResult.reason}`);
       this.store.setTaskSkillMeta(task.id, { skillStatus: "generating", skillReason: evalResult.reason });
 
@@ -307,11 +331,9 @@ Use selectedIndex 0 when none is highly relevant.`;
       this.markChunksWithSkill(chunks, skill.id);
       this.store.linkTaskSkill(task.id, skill.id, "generated_from", 1);
       this.store.setTaskSkillMeta(task.id, { skillStatus: "generated", skillReason: evalResult.reason });
+      this.onSkillEvolved?.(skill.name, "created");
 
-      const autoInstall = this.ctx.config.skillEvolution?.autoInstall ?? DEFAULTS.skillAutoInstall;
-      if (autoInstall && skill.status === "active") {
-        this.installer.install(skill.id);
-      }
+      this.autoInstallIfNeeded(skill);
     } else {
       const reason = evalResult.reason || `confidence不足 (${evalResult.confidence} < ${minConfidence})`;
       this.ctx.log.debug(`SkillEvolver: task "${task.title}" not worth generating skill — ${reason}`);
@@ -326,6 +348,41 @@ Use selectedIndex 0 when none is highly relevant.`;
     this.ctx.log.debug(`SkillEvolver: marked ${chunks.length} chunks with skill_id=${skillId}`);
   }
 
+  private async findSkillByNameSimilarity(task: Task): Promise<Skill | null> {
+    const query = task.title.slice(0, 200);
+    const owner = task.owner ?? "agent:main";
+
+    try {
+      const ftsHits = this.store.skillFtsSearch(query, 5, "mix", owner);
+      for (const hit of ftsHits) {
+        if (hit.score < 0.5) continue;
+        const skill = this.store.getSkill(hit.skillId);
+        if (skill && (skill.status === "active" || skill.status === "draft")) {
+          return skill;
+        }
+      }
+    } catch { /* best-effort */ }
+
+    return null;
+  }
+
+  private autoInstallIfNeeded(skill: Skill): void {
+    if (skill.status !== "active") return;
+
+    const explicitAutoInstall = this.ctx.config.skillEvolution?.autoInstall ?? DEFAULTS.skillAutoInstall;
+    if (explicitAutoInstall) {
+      this.installer.install(skill.id);
+      this.ctx.log.info(`SkillEvolver: auto-installed "${skill.name}" (explicit autoInstall=true)`);
+      return;
+    }
+
+    const manifest = SkillInstaller.buildManifest(skill.dirPath, !!skill.installed, skill.name);
+    if (manifest.installMode === "install_recommended") {
+      this.installer.install(skill.id);
+      this.ctx.log.info(`SkillEvolver: auto-installed "${skill.name}" (install_recommended: ${manifest.scriptsCount} scripts, ${Math.round(manifest.totalSize / 1024)}KB)`);
+    }
+  }
+
   private readSkillContent(skill: Skill): string | null {
     const filePath = path.join(skill.dirPath, "SKILL.md");
     try {

package/src/skill/generator.ts

@@ -484,14 +484,55 @@ export class SkillGenerator {
 
   private buildConversationText(chunks: Chunk[]): string {
     const lines: string[] = [];
+    const redact = this.ctx.config.skillEvolution?.redactSensitiveInSkill ?? true;
+
     for (const c of chunks) {
-      if (c.role !== "user" && c.role !== "assistant") continue;
-      const roleLabel = c.role === "user" ? "User" : "Assistant";
-      lines.push(`[${roleLabel}]: ${c.content}`);
+      let roleLabel: string;
+      switch (c.role) {
+        case "user": roleLabel = "User"; break;
+        case "assistant": roleLabel = "Assistant"; break;
+        case "tool": roleLabel = "Tool"; break;
+        case "system": roleLabel = "System"; break;
+        default: continue;
+      }
+
+      let content = c.content;
+      if (c.role === "system") continue;
+
+      if (c.role === "tool") {
+        content = this.truncateToolOutput(content);
+      }
+
+      if (redact) {
+        content = SkillGenerator.redactSensitive(content);
+      }
+
+      lines.push(`[${roleLabel}]: ${content}`);
     }
     return lines.join("\n\n");
   }
 
+  private truncateToolOutput(content: string): string {
+    const MAX_TOOL_OUTPUT = 1500;
+    if (content.length <= MAX_TOOL_OUTPUT) return content;
+    const head = content.slice(0, MAX_TOOL_OUTPUT * 0.6);
+    const tail = content.slice(-MAX_TOOL_OUTPUT * 0.3);
+    return `${head}\n... (truncated ${content.length - MAX_TOOL_OUTPUT} chars) ...\n${tail}`;
+  }
+
+  static redactSensitive(text: string): string {
+    let result = text;
+    result = result.replace(/\bsk-[a-zA-Z0-9]{20,}\b/g, "sk-***REDACTED***");
+    result = result.replace(/\bBearer\s+[a-zA-Z0-9_\-.]{20,}\b/g, "Bearer ***REDACTED***");
+    result = result.replace(/\bAKIA[0-9A-Z]{16}\b/g, "AKIA***REDACTED***");
+    result = result.replace(/(api[_-]?key|secret|token|password|credential)\s*[:=]\s*["']([^"']{8,})["']/gi,
+      (match, key) => `${key}="***REDACTED***"`);
+    result = result.replace(/\/Users\/[a-zA-Z0-9._-]+\//g, "/Users/****/");
+    result = result.replace(/\/home\/[a-zA-Z0-9._-]+\//g, "/home/****/");
+    result = result.replace(/C:\\Users\\[a-zA-Z0-9._-]+\\/g, "C:\\Users\\****\\");
+    return result;
+  }
+
   private parseDescription(content: string): string {
     const match = content.match(/description:\s*"([^"]+)"/);
     if (match) return match[1];
@@ -499,6 +540,4 @@ export class SkillGenerator {
     if (match2) return match2[1];
     return "";
   }
-
-
 }

package/src/skill/installer.ts

@@ -3,6 +3,26 @@ import * as path from "path";
 import type { SqliteStore } from "../storage/sqlite";
 import type { PluginContext } from "../types";
 
+export type SkillInstallMode = "inline" | "on_demand" | "install_recommended";
+
+export interface CompanionFileInfo {
+  relativePath: string;
+  size: number;
+  type: "script" | "reference" | "eval" | "other";
+}
+
+export interface SkillCompanionManifest {
+  hasCompanionFiles: boolean;
+  installMode: SkillInstallMode;
+  installed: boolean;
+  installedPath?: string;
+  files: CompanionFileInfo[];
+  totalSize: number;
+  scriptsCount: number;
+  referencesCount: number;
+  evalsCount: number;
+}
+
 export class SkillInstaller {
   private workspaceSkillsDir: string;
 
@@ -13,6 +33,82 @@ export class SkillInstaller {
     this.workspaceSkillsDir = path.join(ctx.workspaceDir, "skills");
   }
 
+  getCompanionManifest(skillId: string): SkillCompanionManifest | null {
+    const skill = this.store.getSkill(skillId);
+    if (!skill) return null;
+    return SkillInstaller.buildManifest(skill.dirPath, !!skill.installed, skill.name, this.workspaceSkillsDir);
+  }
+
+  static buildManifest(dirPath: string, installed: boolean, skillName: string, workspaceSkillsDir?: string): SkillCompanionManifest {
+    const files: CompanionFileInfo[] = [];
+
+    const scanDir = (subDir: string, type: CompanionFileInfo["type"]) => {
+      const fullDir = path.join(dirPath, subDir);
+      if (!fs.existsSync(fullDir)) return;
+      try {
+        for (const f of fs.readdirSync(fullDir)) {
+          const fp = path.join(fullDir, f);
+          try {
+            const stat = fs.statSync(fp);
+            if (stat.isFile()) {
+              files.push({ relativePath: `${subDir}/${f}`, size: stat.size, type });
+            }
+          } catch { /* best-effort */ }
+        }
+      } catch { /* best-effort */ }
+    };
+
+    scanDir("scripts", "script");
+    scanDir("references", "reference");
+    scanDir("evals", "eval");
+
+    const scriptsCount = files.filter(f => f.type === "script").length;
+    const referencesCount = files.filter(f => f.type === "reference").length;
+    const evalsCount = files.filter(f => f.type === "eval").length;
+    const totalSize = files.reduce((sum, f) => sum + f.size, 0);
+    const hasCompanionFiles = files.filter(f => f.type !== "eval").length > 0;
+
+    let installMode: SkillInstallMode = "inline";
+    if (hasCompanionFiles) {
+      const executableScripts = files.filter(f => f.type === "script");
+      const largeFiles = files.filter(f => f.size > 5000);
+      if (executableScripts.length >= 3 || largeFiles.length >= 2 || totalSize > 20000) {
+        installMode = "install_recommended";
+      } else {
+        installMode = "on_demand";
+      }
+    }
+
+    const installedPath = installed && workspaceSkillsDir
+      ? path.join(workspaceSkillsDir, skillName)
+      : undefined;
+
+    return { hasCompanionFiles, installMode, installed, installedPath, files, totalSize, scriptsCount, referencesCount, evalsCount };
+  }
+
+  readCompanionFile(skillId: string, relativePath: string): { content: string; size: number } | { error: string } {
+    const skill = this.store.getSkill(skillId);
+    if (!skill) return { error: "Skill not found" };
+
+    const normalized = relativePath.replace(/\.\./g, "");
+    const fullPath = path.join(skill.dirPath, normalized);
+
+    if (!fullPath.startsWith(skill.dirPath)) {
+      return { error: "Path traversal not allowed" };
+    }
+
+    if (!fs.existsSync(fullPath)) {
+      return { error: `File not found: ${relativePath}` };
+    }
+
+    try {
+      const content = fs.readFileSync(fullPath, "utf-8");
+      return { content, size: content.length };
+    } catch (err) {
+      return { error: `Cannot read file: ${err}` };
+    }
+  }
+
   install(skillId: string): { installed: boolean; path: string; message: string } {
     const skill = this.store.getSkill(skillId);
     if (!skill) return { installed: false, path: "", message: "Skill not found" };
@@ -22,8 +118,7 @@ export class SkillInstaller {
     }
 
     const dstDir = path.join(this.workspaceSkillsDir, skill.name);
-    fs.mkdirSync(dstDir, { recursive: true });
-    fs.cpSync(skill.dirPath, dstDir, { recursive: true });
+    this.cleanSync(skill.dirPath, dstDir);
     this.store.updateSkill(skillId, { installed: 1 });
 
     this.ctx.log.info(`Skill installed: "${skill.name}" v${skill.version} → ${dstDir}`);
@@ -51,9 +146,17 @@ export class SkillInstaller {
     if (!skill || !skill.installed) return;
 
     const dstDir = path.join(this.workspaceSkillsDir, skill.name);
-    if (fs.existsSync(dstDir) && fs.existsSync(skill.dirPath)) {
-      fs.cpSync(skill.dirPath, dstDir, { recursive: true });
+    if (fs.existsSync(skill.dirPath)) {
+      this.cleanSync(skill.dirPath, dstDir);
       this.ctx.log.info(`Skill synced: "${skill.name}" v${skill.version} → workspace`);
     }
   }
+
+  private cleanSync(srcDir: string, dstDir: string): void {
+    if (fs.existsSync(dstDir)) {
+      fs.rmSync(dstDir, { recursive: true });
+    }
+    fs.mkdirSync(dstDir, { recursive: true });
+    fs.cpSync(srcDir, dstDir, { recursive: true });
+  }
 }

package/src/skill/upgrader.ts

@@ -91,18 +91,30 @@ export class SkillUpgrader {
       return { upgraded: false, qualityScore: null };
     }
 
+    const backupDir = skill.dirPath + ".backup-" + Date.now();
+    try { fs.cpSync(skill.dirPath, backupDir, { recursive: true }); } catch { /* best-effort */ }
+
     fs.writeFileSync(path.join(skill.dirPath, "SKILL.md"), newContent, "utf-8");
 
+    await this.rebuildCompanionFiles(skill, newContent, task);
+
     const validation = await this.validator.validate(skill.dirPath, {
       previousContent: currentContent,
     });
 
     if (!validation.valid) {
       this.ctx.log.warn(`SkillUpgrader: validation failed for "${skill.name}", reverting: ${validation.errors.join("; ")}`);
-      fs.writeFileSync(path.join(skill.dirPath, "SKILL.md"), currentContent, "utf-8");
+      if (fs.existsSync(backupDir)) {
+        fs.rmSync(skill.dirPath, { recursive: true });
+        fs.renameSync(backupDir, skill.dirPath);
+      } else {
+        fs.writeFileSync(path.join(skill.dirPath, "SKILL.md"), currentContent, "utf-8");
+      }
       return { upgraded: false, qualityScore: null };
     }
 
+    try { if (fs.existsSync(backupDir)) fs.rmSync(backupDir, { recursive: true }); } catch { /* cleanup */ }
+
     const newVersion = skill.version + 1;
     const newDescription = this.parseDescription(newContent) || skill.description;
 
@@ -216,4 +228,130 @@ export class SkillUpgrader {
     if (match2) return match2[1];
     return "";
   }
+
+  private async rebuildCompanionFiles(skill: Skill, newContent: string, task: Task): Promise<void> {
+    const chain = buildSkillConfigChain(this.ctx);
+    if (chain.length === 0) return;
+
+    const chunks = this.store.getChunksByTask(task.id);
+    const conversationText = chunks
+      .filter(c => c.role === "user" || c.role === "assistant" || c.role === "tool")
+      .map(c => `[${c.role === "user" ? "User" : c.role === "assistant" ? "Assistant" : "Tool"}]: ${c.content.slice(0, 500)}`)
+      .join("\n\n")
+      .slice(0, 6000);
+
+    const scriptsPrompt = `Based on the following upgraded SKILL.md and task record, extract reusable automation scripts.
+Rules:
+- Only extract if the task record contains concrete shell commands, Python scripts, or TypeScript code that form a complete, reusable automation.
+- Each script must be self-contained and runnable.
+- If there are no automatable scripts, return an empty array.
+- Don't fabricate scripts — only extract what was actually used.
+
+SKILL.md:
+${newContent.slice(0, 4000)}
+
+Task conversation highlights:
+${conversationText}
+
+Reply with a JSON array only:
+[{"filename": "deploy.sh", "content": "#!/bin/bash\\n..."}]
+If no scripts, reply with: []`;
+
+    try {
+      const raw = await callLLMWithFallback(chain, scriptsPrompt, this.ctx.log, "SkillUpgrader.scripts", {
+        maxTokens: 3000, temperature: 0.1, timeoutMs: 60_000, openclawAPI: this.ctx.openclawAPI,
+      });
+      const scripts = this.parseJSONArray<{ filename: string; content: string }>(raw);
+
+      const scriptsDir = path.join(skill.dirPath, "scripts");
+      if (fs.existsSync(scriptsDir)) fs.rmSync(scriptsDir, { recursive: true });
+      if (scripts.length > 0) {
+        fs.mkdirSync(scriptsDir, { recursive: true });
+        for (const s of scripts) {
+          fs.writeFileSync(path.join(scriptsDir, s.filename), s.content, "utf-8");
+        }
+        this.ctx.log.info(`SkillUpgrader: rebuilt ${scripts.length} scripts for "${skill.name}"`);
+      }
+    } catch (err) {
+      this.ctx.log.warn(`SkillUpgrader: companion scripts rebuild failed: ${err}`);
+    }
+
+    try {
+      const evalsPrompt = `Based on the following skill, generate 3-4 realistic test prompts that should trigger this skill.
+Requirements:
+- Write test prompts that a real user would type, mix direct and indirect phrasings
+- LANGUAGE RULE: Write in the SAME language as the skill content.
+
+Skill:
+${newContent.slice(0, 4000)}
+
+Reply with a JSON array only:
+[{"id": 1, "prompt": "A realistic user message", "expectations": ["Expected behavior 1"], "trigger_confidence": "high"}]`;
+
+      const raw = await callLLMWithFallback(chain, evalsPrompt, this.ctx.log, "SkillUpgrader.evals", {
+        maxTokens: 2000, temperature: 0.3, timeoutMs: 60_000, openclawAPI: this.ctx.openclawAPI,
+      });
+      const evals = this.parseJSONArray<{ id: number; prompt: string; expectations: string[] }>(raw);
+
+      const evalsDir = path.join(skill.dirPath, "evals");
+      if (fs.existsSync(evalsDir)) fs.rmSync(evalsDir, { recursive: true });
+      if (evals.length > 0) {
+        fs.mkdirSync(evalsDir, { recursive: true });
+        fs.writeFileSync(
+          path.join(evalsDir, "evals.json"),
+          JSON.stringify({ skill_name: skill.name, evals }, null, 2),
+          "utf-8",
+        );
+        this.ctx.log.info(`SkillUpgrader: rebuilt ${evals.length} evals for "${skill.name}"`);
+      }
+    } catch (err) {
+      this.ctx.log.warn(`SkillUpgrader: companion evals rebuild failed: ${err}`);
+    }
+
+    try {
+      const refsPrompt = `Based on the following upgraded SKILL.md and task record, extract reference documentation worth preserving.
+Rules:
+- Only extract real reference content that appeared in the task (API docs, config examples, architecture notes).
+- Each reference should be a standalone document useful for understanding the skill's domain.
+- If there are no meaningful references, return an empty array.
+- Don't fabricate content — only extract what was actually discussed or used.
+- LANGUAGE RULE: Write in the SAME language as the skill content.
+
+SKILL.md:
+${newContent.slice(0, 4000)}
+
+Task conversation highlights:
+${conversationText}
+
+Reply with a JSON array only:
+[{"filename": "api-notes.md", "content": "# API Reference\\n..."}]
+If no references, reply with: []`;
+
+      const raw = await callLLMWithFallback(chain, refsPrompt, this.ctx.log, "SkillUpgrader.references", {
+        maxTokens: 3000, temperature: 0.1, timeoutMs: 60_000, openclawAPI: this.ctx.openclawAPI,
+      });
+      const refs = this.parseJSONArray<{ filename: string; content: string }>(raw);
+
+      const refsDir = path.join(skill.dirPath, "references");
+      if (fs.existsSync(refsDir)) fs.rmSync(refsDir, { recursive: true });
+      if (refs.length > 0) {
+        fs.mkdirSync(refsDir, { recursive: true });
+        for (const r of refs) {
+          fs.writeFileSync(path.join(refsDir, r.filename), r.content, "utf-8");
+        }
+        this.ctx.log.info(`SkillUpgrader: rebuilt ${refs.length} references for "${skill.name}"`);
+      }
+    } catch (err) {
+      this.ctx.log.warn(`SkillUpgrader: companion references rebuild failed: ${err}`);
+    }
+  }
+
+  private parseJSONArray<T>(raw: string): T[] {
+    const match = raw.match(/\[[\s\S]*\]/);
+    if (!match) return [];
+    try {
+      const arr = JSON.parse(match[0]);
+      return Array.isArray(arr) ? arr : [];
+    } catch { return []; }
+  }
 }

package/src/skill/validator.ts

@@ -31,6 +31,9 @@ export class SkillValidator {
     this.validateFormat(dirPath, result);
     if (!result.valid) return result;
 
+    this.checkCompanionConsistency(dirPath, result);
+    this.scanSecrets(dirPath, result);
+
     if (opts?.previousContent) {
       this.regressionCheck(dirPath, opts.previousContent, result);
     }
@@ -133,6 +136,82 @@ export class SkillValidator {
     }
   }
 
+  private checkCompanionConsistency(dirPath: string, result: ValidationResult): void {
+    const skillMdPath = path.join(dirPath, "SKILL.md");
+    const content = fs.readFileSync(skillMdPath, "utf-8");
+
+    const referencedScripts = [...content.matchAll(/`scripts\/([^`]+)`/g)].map(m => m[1]);
+    const referencedRefs = [...content.matchAll(/`references\/([^`]+)`/g)].map(m => m[1]);
+
+    const scriptsDir = path.join(dirPath, "scripts");
+    const refsDir = path.join(dirPath, "references");
+
+    for (const f of referencedScripts) {
+      if (!fs.existsSync(path.join(scriptsDir, f))) {
+        result.warnings.push(`SKILL.md references scripts/${f} but file does not exist`);
+      }
+    }
+    for (const f of referencedRefs) {
+      if (!fs.existsSync(path.join(refsDir, f))) {
+        result.warnings.push(`SKILL.md references references/${f} but file does not exist`);
+      }
+    }
+
+    if (fs.existsSync(scriptsDir)) {
+      try {
+        const actualScripts = fs.readdirSync(scriptsDir);
+        for (const f of actualScripts) {
+          if (!referencedScripts.includes(f)) {
+            result.warnings.push(`scripts/${f} exists but is not referenced in SKILL.md`);
+          }
+        }
+      } catch { /* best-effort */ }
+    }
+
+    const evalsPath = path.join(dirPath, "evals", "evals.json");
+    if (fs.existsSync(evalsPath)) {
+      try {
+        const evalsData = JSON.parse(fs.readFileSync(evalsPath, "utf-8"));
+        if (!Array.isArray(evalsData?.evals) && !Array.isArray(evalsData)) {
+          result.warnings.push("evals/evals.json exists but has unexpected structure");
+        }
+      } catch {
+        result.warnings.push("evals/evals.json exists but is not valid JSON");
+      }
+    }
+  }
+
+  private static readonly SECRET_PATTERNS: Array<{ label: string; regex: RegExp }> = [
+    { label: "API key (sk-...)", regex: /\bsk-[a-zA-Z0-9]{20,}\b/ },
+    { label: "Bearer token", regex: /\bBearer\s+[a-zA-Z0-9_\-.]{20,}\b/ },
+    { label: "AWS key", regex: /\bAKIA[0-9A-Z]{16}\b/ },
+    { label: "Generic secret assignment", regex: /(api[_-]?key|secret|token|password|credential)\s*[:=]\s*["'][^"']{8,}["']/i },
+    { label: "Base64 encoded secret (long)", regex: /\b[A-Za-z0-9+/]{40,}={0,2}\b/ },
+  ];
+
+  private scanSecrets(dirPath: string, result: ValidationResult): void {
+    const filesToScan = ["SKILL.md"];
+    const scriptsDir = path.join(dirPath, "scripts");
+    if (fs.existsSync(scriptsDir)) {
+      try {
+        for (const f of fs.readdirSync(scriptsDir)) filesToScan.push(path.join("scripts", f));
+      } catch { /* best-effort */ }
+    }
+
+    for (const relPath of filesToScan) {
+      const fullPath = path.join(dirPath, relPath);
+      if (!fs.existsSync(fullPath)) continue;
+      try {
+        const content = fs.readFileSync(fullPath, "utf-8");
+        for (const { label, regex } of SkillValidator.SECRET_PATTERNS) {
+          if (regex.test(content)) {
+            result.warnings.push(`Potential secret detected in ${relPath}: ${label}`);
+          }
+        }
+      } catch { /* best-effort */ }
+    }
+  }
+
   private async assessQuality(dirPath: string, result: ValidationResult): Promise<void> {
     const chain = buildSkillConfigChain(this.ctx);
     if (chain.length === 0) return;

package/src/storage/ensure-binding.ts

@@ -0,0 +1,52 @@
+import { existsSync, mkdirSync, copyFileSync } from "fs";
+import { execSync } from "child_process";
+import path from "path";
+import { createRequire } from "module";
+
+/**
+ * Ensure the better-sqlite3 native binary is available.
+ *
+ * OpenClaw installs plugins with `--ignore-scripts`, which skips
+ * the native compilation step. This function checks for the binary
+ * and restores it from bundled prebuilds if missing.
+ */
+export function ensureSqliteBinding(log?: { info: (msg: string) => void; warn: (msg: string) => void }): void {
+  const _req = typeof require !== "undefined" ? require : createRequire(__filename);
+  const bsqlPkg = _req.resolve("better-sqlite3/package.json");
+  const bsqlDir = path.dirname(bsqlPkg);
+  const bindingPath = path.join(bsqlDir, "build", "Release", "better_sqlite3.node");
+
+  if (existsSync(bindingPath)) return;
+
+  const platform = `${process.platform}-${process.arch}`;
+  const pluginRoot = path.resolve(__dirname, "..", "..");
+  const prebuildSrc = path.join(pluginRoot, "prebuilds", platform, "better_sqlite3.node");
+
+  if (existsSync(prebuildSrc)) {
+    log?.info(`[ensure-binding] Copying prebuild for ${platform}...`);
+    mkdirSync(path.dirname(bindingPath), { recursive: true });
+    copyFileSync(prebuildSrc, bindingPath);
+    log?.info(`[ensure-binding] Prebuild installed successfully.`);
+    return;
+  }
+
+  log?.warn(`[ensure-binding] No prebuild for ${platform}, attempting npm rebuild...`);
+  try {
+    const installDir = path.resolve(bsqlDir, "..", "..");
+    execSync("npm rebuild better-sqlite3", {
+      cwd: installDir,
+      stdio: "pipe",
+      timeout: 180_000,
+    });
+    if (existsSync(bindingPath)) {
+      log?.info(`[ensure-binding] Rebuilt better-sqlite3 successfully.`);
+      return;
+    }
+  } catch { /* fall through */ }
+
+  throw new Error(
+    `better-sqlite3 native binary not found for ${platform}.\n` +
+    `Prebuild not bundled and npm rebuild failed.\n` +
+    `Fix: cd ${path.resolve(bsqlDir, "..", "..")} && npm rebuild better-sqlite3`,
+  );
+}