chore: add MIT license, SECURITY.md, and placeholder developer_ids

CHANGELOG.md

@@ -9,6 +9,26 @@
 - 小节正文写用户能看懂的变化（新能力、修复、注意事项），避免堆砌内部实现细节
 - 打 tag 前**必须**为即将发布的版本新增一节；找不到匹配小节时，本次发布不会更新 changelog 字段
 
+## 1.0.89
+
+- 仓库增加 MIT 许可证，版权归属深圳匠厂科技有限公司
+- 增加 SECURITY.md：未公开漏洞请通过匠厂官网联系，不要发在公开 Issue
+- 模板 developer_ids 改为占位 12345，复制后请换成自己的匠厂用户 ID
+
+## 1.0.88
+
+- `release.ps1` 默认 tag 说明改为 UTF-8 字节写入，不再依赖脚本源码里的中文默认参数（Windows PowerShell 5.1 会把无 BOM 的 UTF-8 按系统代码页解析）
+- 不改写已发布 tag（v1.0.86 / v1.0.87 说明仍可能乱码）
+
+## 1.0.87
+
+- `release.ps1` 打 annotated tag / 自动 commit 改为 UTF-8 消息文件 + `git -F`，避免 `-m` 走控制台代码页
+- 默认说明仍可能乱码（见 1.0.88）
+
+## 1.0.86
+
+- 去掉 `release.ps1` 里通过 `cmd /c` 调 git 的写法；中文 tag 说明在部分 Windows 控制台代码页下仍可能乱码，见 1.0.87
+
 ## 1.0.85
 
 - 新增开发主文 `development/PRODUCT_SURFACES.md`：说明对话 / 数据管理 / 定时任务平级关系、何时走哪个入口、如何做入口定位

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 深圳匠厂科技有限公司
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

SECURITY.md

@@ -0,0 +1,20 @@
+# 安全漏洞披露
+
+本仓库是匠厂技能开发模板。请把**未公开的安全漏洞**发给深圳匠厂科技有限公司，不要在公开 Issue、PR 或讨论区里贴完整复现步骤、PoC 或利用细节。
+
+## 怎么报告
+
+请通过匠厂官网联系渠道提交：[https://www.jc2009.com/](https://www.jc2009.com/)
+
+建议在联系时注明：
+
+- 标题或开头带 `[Security]`
+- 影响的仓库 / 版本（例如 `skill-template`、tag `v1.0.x`）
+- 问题类型、影响范围、复现步骤
+- 若已有修复思路，可一并说明
+
+我们会确认收悉，并在有结论后告知是否修复、是否公开披露。
+
+## 不在本页范围
+
+本页只说明**如何向我们报告漏洞**。技能运行时的权限、RPA 合规、加密发布等产品安全设计，见 `development/` 与 `references/`，不要写进本文件。

SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: 技能开发模板（通用业务版）
 description: "OpenClaw 通用业务技能开发模板，供复制后定制新业务 skill。定制步骤见 development/DEVELOPMENT.md。"
-version: 1.0.85
+version: 1.0.89
 author: 深圳匠厂科技有限公司
 metadata:
   openclaw:
@@ -10,8 +10,7 @@ metadata:
     emoji: "📦"
     category: "通用"
     developer_ids:
-      - 10032
-      - 12428
+      - 12345  # 占位，请换成你的匠厂用户 ID
 allowed-tools:
   - bash
 ---

release.ps1

@@ -17,7 +17,7 @@
 [CmdletBinding()]
 param(
   [string]$Prefix = "v",
-  [string]$Message = "正式发布",
+  [string]$Message,
   [switch]$AutoCommit,
   [switch]$RequireClean,
   [string]$CommitMessage,
@@ -28,6 +28,13 @@ param(
 Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
+# Default tag message is 「正式发布」 from UTF-8 bytes (not a Chinese literal in
+# this file). Windows PowerShell 5.1 parses UTF-8 scripts without BOM as the
+# system ANSI code page, which would turn a source literal into 「姝ｅ紡鍙戝竷」.
+if (-not $PSBoundParameters.ContainsKey("Message") -or [string]::IsNullOrWhiteSpace($Message)) {
+  $Message = [System.Text.Encoding]::UTF8.GetString([byte[]](0xE6, 0xAD, 0xA3, 0xE5, 0xBC, 0x8F, 0xE5, 0x8F, 0x91, 0xE5, 0xB8, 0x83))
+}
+
 function Remove-GitNoise {
   param([string[]]$Lines)
   return @($Lines | Where-Object {
@@ -35,40 +42,85 @@ function Remove-GitNoise {
   })
 }
 
+function Convert-GitOutputLines {
+  param($Output)
+  return @(
+    @($Output) | ForEach-Object {
+      if ($_ -is [System.Management.Automation.ErrorRecord]) { $_.ToString() }
+      else { "$_" }
+    }
+  )
+}
+
+# Call git.exe directly. Never wrap with `cmd /c`: on Chinese Windows, cmd
+# re-encodes the command line through the OEM code page.
+# Also never pass Chinese via `git -m`: Windows PowerShell 5.1 encodes native
+# argv using the console code page, so 「正式发布」 becomes 「姝ｅ紡鍙戝竷」
+# in the annotated tag. Commit/tag messages go through a UTF-8 file + `-F`.
+function Invoke-GitRaw {
+  param([Parameter(Mandatory = $true)][string[]]$GitArgs)
+  $prev = $ErrorActionPreference
+  $ErrorActionPreference = "Continue"
+  try {
+    $output = & git @GitArgs 2>&1
+    $code = $LASTEXITCODE
+  } finally {
+    $ErrorActionPreference = $prev
+  }
+  return [pscustomobject]@{
+    ExitCode = $code
+    Lines    = @(Remove-GitNoise -Lines @(Convert-GitOutputLines -Output $output))
+  }
+}
+
 function Invoke-Git {
-  param([Parameter(Mandatory = $true)][string]$Args)
-  Write-Host ">> git $Args" -ForegroundColor DarkGray
-  & cmd /c "git $Args 2>&1" | Out-Null
-  if ($LASTEXITCODE -ne 0) {
-    throw "git command failed: git $Args"
+  param([Parameter(Mandatory = $true)][string[]]$GitArgs)
+  Write-Host (">> git " + ($GitArgs -join " ")) -ForegroundColor DarkGray
+  $r = Invoke-GitRaw -GitArgs $GitArgs
+  if ($r.ExitCode -ne 0) {
+    throw "git command failed: git $($GitArgs -join ' ')"
+  }
+}
+
+function Invoke-GitWithMessageFile {
+  param(
+    [Parameter(Mandatory = $true)][string[]]$GitArgsPrefix,
+    [Parameter(Mandatory = $true)][string]$Message
+  )
+  $msgFile = Join-Path ([System.IO.Path]::GetTempPath()) ("jiangchang-git-msg-" + [guid]::NewGuid().ToString("N") + ".txt")
+  $utf8NoBom = New-Object System.Text.UTF8Encoding $false
+  [System.IO.File]::WriteAllText($msgFile, ($Message.TrimEnd() + "`n"), $utf8NoBom)
+  try {
+    Invoke-Git -GitArgs (@("-c", "i18n.commitEncoding=utf-8") + $GitArgsPrefix + @("-F", $msgFile))
+  } finally {
+    Remove-Item -LiteralPath $msgFile -Force -ErrorAction SilentlyContinue
   }
 }
 
 function Get-GitOutput {
-  param([Parameter(Mandatory = $true)][string]$Args)
-  $output = & cmd /c "git $Args 2>&1"
-  if ($LASTEXITCODE -ne 0) {
-    throw "git command failed: git $Args"
+  param([Parameter(Mandatory = $true)][string[]]$GitArgs)
+  $r = Invoke-GitRaw -GitArgs $GitArgs
+  if ($r.ExitCode -ne 0) {
+    throw "git command failed: git $($GitArgs -join ' ')"
   }
-  return @(Remove-GitNoise -Lines @($output))
+  return @($r.Lines)
 }
 
 function Test-Repo {
-  $output = & cmd /c "git rev-parse --is-inside-work-tree 2>&1"
-  if ($LASTEXITCODE -ne 0) {
+  $r = Invoke-GitRaw -GitArgs @("rev-parse", "--is-inside-work-tree")
+  if ($r.ExitCode -ne 0) {
     return $false
   }
-  $clean = Remove-GitNoise -Lines @($output)
-  return (($clean | Select-Object -First 1) -eq "true")
+  return (($r.Lines | Select-Object -First 1) -eq "true")
 }
 
 function Get-CurrentBranch {
-  $b = (Get-GitOutput "branch --show-current" | Select-Object -First 1).Trim()
+  $b = (Get-GitOutput -GitArgs @("branch", "--show-current") | Select-Object -First 1).Trim()
   return $b
 }
 
 function Get-StatusPorcelain {
-  $lines = @(Get-GitOutput "status --porcelain")
+  $lines = @(Get-GitOutput -GitArgs @("status", "--porcelain"))
   return $lines
 }
 
@@ -92,7 +144,7 @@ function Parse-SemVerTag {
 function Get-NextTag {
   param([string]$TagPrefix)
 
-  $tags = Get-GitOutput "tag --list"
+  $tags = Get-GitOutput -GitArgs @("tag", "--list")
   $parsed = @()
 
   foreach ($t in $tags) {
@@ -181,7 +233,7 @@ function Ensure-CleanOrAutoCommit {
 
   if ($NeedClean) {
     Write-Host "Working tree is not clean and -RequireClean is enabled." -ForegroundColor Yellow
-    Remove-GitNoise -Lines @(& cmd /c "git status --short 2>&1") | ForEach-Object { Write-Host $_ }
+    (Invoke-GitRaw -GitArgs @("status", "--short")).Lines | ForEach-Object { Write-Host $_ }
     throw "Abort: dirty working tree."
   }
 
@@ -200,8 +252,8 @@ function Ensure-CleanOrAutoCommit {
     return
   }
 
-  Invoke-Git "add -A"
-  Invoke-Git "commit -m `"$commitMsg`""
+  Invoke-Git -GitArgs @("add", "-A")
+  Invoke-GitWithMessageFile -GitArgsPrefix @("commit") -Message $commitMsg
 }
 
 try {
@@ -223,10 +275,10 @@ try {
   if ($DryRun) {
     Write-Host "[DryRun] Would run: git fetch --tags --prune origin" -ForegroundColor Yellow
   } else {
-    Invoke-Git "fetch --tags --prune origin"
+    Invoke-Git -GitArgs @("fetch", "--tags", "--prune", "origin")
   }
 
-  $skillRoot = (Get-GitOutput "rev-parse --show-toplevel" | Select-Object -First 1).Trim()
+  $skillRoot = (Get-GitOutput -GitArgs @("rev-parse", "--show-toplevel") | Select-Object -First 1).Trim()
   if (Test-Path -LiteralPath (Join-Path $skillRoot "SKILL.md")) {
     Assert-SkillReleasePackagingSources -SkillRoot $skillRoot
   }
@@ -235,8 +287,8 @@ try {
 
   Ensure-CleanOrAutoCommit -DoAutoCommit:$AutoCommit -NeedClean:$RequireClean -IsDryRun:$DryRun -Msg $CommitMessage
 
-  $null = Remove-GitNoise -Lines @(& cmd /c 'git rev-parse --abbrev-ref --symbolic-full-name "@{u}" 2>&1')
-  $hasUpstream = ($LASTEXITCODE -eq 0)
+  $upstream = Invoke-GitRaw -GitArgs @("rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}")
+  $hasUpstream = ($upstream.ExitCode -eq 0)
 
   if ($DryRun) {
     if ($hasUpstream) {
@@ -246,29 +298,29 @@ try {
     }
   } else {
     if ($hasUpstream) {
-      Invoke-Git "push"
+      Invoke-Git -GitArgs @("push")
     } else {
-      Invoke-Git "push -u origin $branch"
+      Invoke-Git -GitArgs @("push", "-u", "origin", $branch)
     }
   }
 
   $nextTag = Get-NextTag -TagPrefix $Prefix
   Write-Host "Next tag: $nextTag" -ForegroundColor Green
 
-  $existing = @(Get-GitOutput "tag --list `"$nextTag`"")
+  $existing = @(Get-GitOutput -GitArgs @("tag", "--list", $nextTag))
   if ($existing.Length -gt 0) {
     throw "Tag already exists: $nextTag"
   }
 
   if ($DryRun) {
-    Write-Host "[DryRun] Would run: git tag -a $nextTag -m `"$Message`"" -ForegroundColor Yellow
+    Write-Host "[DryRun] Would run: git tag -a $nextTag -F <utf8-msg-file> ($Message)" -ForegroundColor Yellow
     Write-Host "[DryRun] Would run: git push origin $nextTag" -ForegroundColor Yellow
     Write-Host "=== DryRun Complete ===" -ForegroundColor Cyan
     exit 0
   }
 
-  Invoke-Git "tag -a $nextTag -m `"$Message`""
-  Invoke-Git "push origin $nextTag"
+  Invoke-GitWithMessageFile -GitArgsPrefix @("tag", "-a", $nextTag) -Message $Message
+  Invoke-Git -GitArgs @("push", "origin", $nextTag)
 
   Write-Host "Release success: $nextTag" -ForegroundColor Green
   Write-Host "=== Release Script Done ===" -ForegroundColor Cyan

scripts/util/constants.py

@@ -1,6 +1,6 @@
 """技能标识、版本与平台公共库约束（复制后请修改 slug/version/logger）。"""
 
 SKILL_SLUG = "your-skill-slug"
-SKILL_VERSION = "1.0.85"
+SKILL_VERSION = "1.0.89"
 LOG_LOGGER_NAME = "openclaw.skill.your_skill_slug"
 PLATFORM_KIT_MIN_VERSION = "1.2.11"