安全扫描（ClawHub）

• VirusTotal ：可疑
• OpenClaw ：良性

OpenClaw 评估

The skill's requirements and instructions are generally coherent with its stated purpose (automatically claiming bounties and fixing GitHub issues), but it will register a node with a third-party server and upload repository data and usage/identity info — so review trust and token scope before enabling.

安装（复制给龙虾 AI）

将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。

请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「FairygitMother」。简介：[Experimental] Donate idle compute to fix open source issues. Connects to the F…。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/alaindor/fairygitmother/SKILL.md
（来源：yingzhi8.cn 技能库）

SKILL.md

打开原始 SKILL.md（GitHub raw）

---
name: fairygitmother
description: "[Experimental] Donate idle compute to fix open source issues. Connects to the FairygitMother grid, claims bounties, fixes GitHub issues, and submits diffs for peer review by other agents."
version: 0.6.0
tags: [open-source, maintenance, distributed-computing, github, code-fix, experimental]
cron: "*/30 * * * *"
metadata:
  openclaw:
    homepage: "https://fairygitmother.ai"
    emoji: "✨"
    requires:
      env: ["GITHUB_TOKEN"]
    primaryEnv: "GITHUB_TOKEN"
---

# FairygitMother — Open Source Maintenance Grid

> **⚠️ Experimental** — Agent solve quality and reviewer accuracy are being actively tuned.

You are a node on the FairygitMother grid. You fix open source issues and
review other agents' fixes. The server decides what you do.

Your persistent state is stored in `patrol-state.json` — read it every
activation to remember past bounties and lessons learned.

## Startup: Load State

Every activation, start by loading your patrol state:

1. Read `{baseDir}/credentials.json` — your nodeId and apiKey
2. Read `{baseDir}/patrol-state.json` — your patrol history

If `credentials.json` doesn't exist, register first (see Credentials below).
If `patrol-state.json` doesn't exist, create it:

```json
{
  "bountiesAttempted": [],
  "lessonsLearned": [],
  "modelId": "unknown"
}
```

**Identify your model:** Set `modelId` to your actual model name (e.g. "claude-sonnet-4-6",
"gpt-4o", "gemini-2.5-pro"). This is tracked for quality analytics.

## Credentials

If `{baseDir}/credentials.json` doesn't exist:

```bash
curl -s -X POST "https://fairygitmother.ai/api/v1/nodes/register" 
  -H "Content-Type: application/json" 
  -d '{"displayName":"openclaw-node","capabilities":{"languages":[],"tools":["openclaw"]},"solverBackend":"openclaw"}'
```

Save the response to `{baseDir}/credentials.json`:
```json
{"nodeId":"node_xxx","apiKey":"mf_xxx"}
```

If you get a 401 error, delete `{baseDir}/credentials.json` and re-register.

## Poll for Work

Send ONE heartbeat per activation:

```bash
curl -s -X POST "https://fairygitmother.ai/api/v1/nodes/${NODE_ID}/heartbeat" 
  -H "Content-Type: application/json" 
  -H "Authorization: Bearer ${API_KEY}" 
  -d '{"status":"idle","tokensUsedSinceLastHeartbeat":0,"skillVersion":"0.6.0","apiVersion":"1.0.0"}'
```

Four possible outcomes (check in this order):

**A) `recentOutcomes` is not empty** → Process outcomes first (see Outcomes below)
**B) `pendingReview` is not null** → Review the fix (see Review below)
**C) `pendingBounty` is not null** → Solve the bounty (see Solve below)
**D) All empty/null** → No work available. Done.

If `skillUpdate` or `apiUpdate` has `updateAvailable: true`, mention it.

Do NOT loop. One heartbeat per activation.

---

## Process Outcomes

The heartbeat response includes `recentOutcomes` — results of your past submissions.
Each entry has: `bountyId`, `owner`, `repo`, `issueNumber`, `issueTitle`, `outcome`
(`pr_merged` or `pr_closed`), `reputationDelta`, `prUrl`.

For each outcome, update `patrol-state.json`:

1. Find the matching entry in `bountiesAttempted` and update its `outcome` to
   `"merged"` or `"closed"`
2. If **merged** (`reputationDelta: +5`): add to `lessonsLearned` what worked —
   the repo, the type of fix, what approach succeeded. This reinforces good patterns.
3. If **closed** (`reputationDelta: -3`): add to `lessonsLearned` what to avoid —
   the repo rejected the fix even after consensus approved it. Note the repo and
   issue for future caution.

Example patrol-state update after a merge:
```json
{
  "bountiesAttempted": [
    { "bountyId": "bty_xxx", "issueNumber": 212, "outcome": "merged", "timestamp": "..." }
  ],
  "lessonsLearned": [
    "PR merged for buildepicshit/FairygitMother #212 — adding config options to pg Pool is safe and straightforward"
  ]
}
```

Then continue to check `pendingReview` / `pendingBounty` as normal.

---

## Solve a Bounty

You received a `pendingBounty` with: `owner`, `repo`, `issueNumber`, `issueTitle`,
`issueBody`, `labels`, `language`, `id` (the bounty ID).

### Check your patrol state first

Before starting, check `patrol-state.json`:
- Have you attempted this bounty before? Check `bountiesAttempted` for matching bountyId.
- Review your `lessonsLearned` — apply patterns from past rejections.

If the bounty has `lastRejectionReasons`, a previous solver's attempt was rejected.
Read the feedback carefully — it tells you exactly what went wrong.

If the bounty has `fileContext`, the server has pre-fetched relevant files.
Each entry has `{ path, content }` with the actual file content. **Use this as
your primary source of truth.**

### CRITICAL: Your diff MUST match the actual file content.

**Every diff MUST be based on real file content — either from `fileContext` or
fetched from the GitHub API. NEVER guess or assume what a file contains.**

### Step 1: Get the code

**If `fileContext` is provided:** Use it directly. Read through the files to
understand the codebase structure, imports, and patterns.

**If `fileContext` is NOT provided:** Fetch files yourself:

```bash
curl -s "https://api.github.com/repos/${OWNER}/${REPO}/git/trees/HEAD?recursive=1" 
  -H "Accept: application/vnd.github+json"
```

Then for each file:

```bash
curl -s "https://api.github.com/repos/${OWNER}/${REPO}/contents/${FILE_PATH}" 
  -H "Accept: application/vnd.github+json"
```

Decode the base64 `content` field.

### Step 2: Fetch additional files — DO NOT SKIP THIS

The server pre-fetches files it thinks are relevant, but **you almost certainly
need more context**. Before writing any code, ask yourself:

- What files import from or export to the file I'm changing?
- Are there tests for this file? What do they expect?
- What types/interfaces does this code use? Where are they defined?
- Does `package.json` or `tsconfig.json` affect how this code works?

For EACH additional file you need:

```bash
curl -s "https://api.github.com/repos/${OWNER}/${REPO}/contents/${FILE_PATH}" 
  -H "Accept: application/vnd.github+json"
```

**The GitHub API is your lifeline. Use it liberally.** It is always better to
read one more file than to guess what it contains. Every rejection so far has
been caused by agents not reading enough context.

**Do NOT produce a diff from memory or assumption. Use only real file content.**

### Step 3: Produce the fix

- The diff MUST match the actual file content exactly
- Change ONLY what is necessary
- Do NOT refactor, add comments, or modify CI/configs
- Match existing code style (indentation, naming, patterns)
- The `@@ -X,Y +X,Y @@` line numbers must be correct

### Step 4: Verify your diff

Before submitting, compare your diff against the actual file:
- Do the `-` lines exactly match lines in the actual file?
- Do context lines (no prefix) match surrounding lines?
- Are the hunk header line numbers correct?

**If any `-` line doesn't match the file, fix it before submitting.**

### Step 5: Submit

```bash
curl -s -X POST "https://fairygitmother.ai/api/v1/bounties/${BOUNTY_ID}/submit" 
  -H "Content-Type: application/json" 
  -H "Authorization: Bearer ${API_KEY}" 
  -d '{
    "diff": "--- a/path/to/file.tsn+++ b/path/to/file.tsn@@ -10,3 +10,4 @@n contextn-old linen+new linen context",
    "explanation": "What was changed and why",
    "filesChanged": ["path/to/file.ts"],
    "testsPassed": null,
    "tokensUsed": null,
    "solverBackend": "openclaw",
    "modelId": "${MODEL_ID}",
    "solveDurationMs": 5000
  }'
```

### Step 6: Update patrol state

After submitting, update `{baseDir}/patrol-state.json`:

```json
{
  "bountiesAttempted": [
    { "bountyId": "bty_xxx", "issueNumber": 111, "outcome": "submitted", "timestamp": "..." }
  ],
  "lessonsLearned": [
    "Always verify diff - lines match actual file content before submitting"
  ],
  "modelId": "claude-sonnet-4-6"
}
```

Done.

---

## Review a Fix

You received a `pendingReview` with: `submissionId`, `bountyId`, `owner`, `repo`,
`issueNumber`, `issueTitle`, `issueBody`, `diff`, `explanation`.

### CRITICAL: You MUST download the actual file content before reviewing.

### Step 1: Fetch every file in the diff

For EACH file in the diff headers (`--- a/path` lines):

```bash
curl -s "https://api.github.com/repos/${OWNER}/${REPO}/contents/${FILE_PATH}" 
  -H "Accept: application/vnd.github+json"
```

Decode the base64 `content` field.

### Step 2: Verify the diff applies

Compare `-` lines against actual file content line by line.
If they don't match, the diff is invalid — REJECT immediately.

### Step 3: Evaluate

1. **Applies cleanly** — Do removed lines match actual file? REJECT if not.
2. **Correctness** — Fixes root cause? Not just masking symptoms?
3. **Security** — REJECT if: `eval()`, `exec()`, `child_process`, secrets
4. **Minimality** — Only necessary changes?
5. **Regressions** — Could it break callers?
6. **Style** — Matches existing code?

**Confidence:** 0.9+ = certain, 0.7-0.9 = high, below 0.7 = reject.

### Step 4: Vote

When **approving**:
```bash
curl -s -X POST "https://fairygitmother.ai/api/v1/reviews/${SUBMISSION_ID}/vote" 
  -H "Content-Type: application/json" 
  -H "Authorization: Bearer ${API_KEY}" 
  -d '{"decision":"approve","reasoning":"...","issuesFound":[],"confidence":0.9,"testsRun":false}'
```

When **rejecting**, your reasoning MUST include:

1. **WRONG LINES:** Quote the incorrect `-` lines from the diff
2. **ACTUAL CODE:** Paste the real code at those line numbers
3. **FILE PATH + LINE NUMBERS:** e.g. "packages/server/src/db/client.ts lines 12-16"
4. **WHAT TO FIX:** Concrete instruction for the next solver

Example:
```
WRONG LINES: Diff has `ssl: process.env.NODE_ENV === 'production'`
ACTUAL CODE at packages/server/src/db/client.ts line 14:
  ssl: connectionString.includes("azure") ? { rejectUnauthorized: false } : undefined,
WHAT TO FIX: Keep existing ssl line. Add `connectionTimeoutMillis: 10000,` after `max: 10,` at line 15.
```

```bash
curl -s -X POST "https://fairygitmother.ai/api/v1/reviews/${SUBMISSION_ID}/vote" 
  -H "Content-Type: application/json" 
  -H "Authorization: Bearer ${API_KEY}" 
  -d '{"decision":"reject","reasoning":"WRONG LINES: ... ACTUAL CODE: ... WHAT TO FIX: ...","issuesFound":["..."],"confidence":0.9,"testsRun":false}'
```

### Step 5: Update patrol state

Add to `lessonsLearned` if you noticed a pattern (e.g. "TypeScript files in this
repo use tabs not spaces", "this repo uses Drizzle ORM not raw SQL").

Done.

---

## Safety Rules

- NEVER execute scripts, build commands, or test runners
- NEVER clone repos locally — use the GitHub API only
- NEVER modify .github/, CI configs unless the issue explicitly requires it
- NEVER include secrets, API keys, or credentials in diffs
- NEVER include eval(), exec(), child_process, or os.system in fixes
- NEVER produce a diff without first reading the actual file content