← Back to Skills Marketplace
330
Downloads
0
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install tly
Description
Create T.LY short links through the T.LY API. Use when an agent needs to shorten a URL, generate a shareable T.LY link, return a `short_url`, or call T.LY pr...
Usage Guidance
This skill appears to do what it says (shorten URLs via T.LY) but has a metadata inconsistency and a few verification steps you should perform before use: 1) Only provide a TLY API token (TLY_API_TOKEN) when you trust the skill — the metadata should list this env var but currently doesn't. 2) Prefer setting the token as an environment variable rather than pasting it into chat or commands to avoid leakage in logs. 3) If you plan to install the recommended PyPI package, review its publisher, source code, and recent releases on PyPI/GitHub before pip installing. 4) Ask the skill maintainer (or registry) to update the registry metadata to declare TLY_API_TOKEN as the required primary credential so the permission model is accurate. If you cannot verify the PyPI package or the maintainer, treat the skill with caution.
Capability Analysis
Type: OpenClaw Skill
Name: tly
Version: 1.0.2
The skill is classified as suspicious due to a shell injection vulnerability in the fallback `curl` command within `SKILL.md`, where the `TLY_API_TOKEN` environment variable is expanded in a way that allows command execution. Additionally, the instructions strongly encourage the installation of a specific PyPI package (`tly-url-shortener-api`) labeled as 'official,' which could serve as a vector for a supply-chain attack if the package is not legitimately maintained by the service provider. While the skill includes some security guardrails regarding secret handling, these implementation flaws and the reliance on unverified external code pose a risk to the host environment.
Capability Assessment
Purpose & Capability
The skill's name and description (create T.LY short links) align with the runtime instructions which call the T.LY API or the official SDK/CLI. Requiring a T.LY API token is expected for this purpose.
Instruction Scope
SKILL.md stays within the shortener domain: it checks for TLY_API_TOKEN, validates URLs, prefers the official SDK/CLI, and gives a curl fallback to api.t.ly. It explicitly warns not to hardcode keys and to prefer env vars. It does not instruct reading unrelated files or exfiltrating data to unexpected endpoints.
Install Mechanism
This is an instruction-only skill with no install spec or code files. It recommends installing the published PyPI package (tly-url-shortener-api) if available, which is a reasonable, low-risk suggestion — but the PyPI package should be reviewed before installation.
Credentials
The SKILL.md explicitly requires a TLY_API_TOKEN env var, but the registry metadata lists no required environment variables or primary credential. That mismatch is an incoherence: the skill needs a secret to operate but the metadata does not declare it. Also, the curl example embeds the API token in the JSON payload (expected for the API) — the skill warns about not hardcoding keys, but users should avoid pasting tokens into public chats/command logs.
Persistence & Privilege
The skill does not request persistent installation, does not set always:true, and does not claim to modify other skills or global config. Autonomy is enabled by default (disable-model-invocation:false) which is normal; no additional privileges are requested.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install tly - After installation, invoke the skill by name or use
/tly - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.2
- Added a homepage field to the skill metadata, linking to https://t.ly/.
- No functional or workflow changes.
v1.0.1
tly v1.0.1
- Updated instructions to direct users to register at https://t.ly/register before creating an API key at https://t.ly/settings#/api if needed.
- Clarified user guidance in cases where an API key is missing.
v1.0.0
Initial release of tly-short-link-creator.
- Create short links using the T.LY API, requiring a user-provided API key.
- Supports both the official Python SDK/CLI (`tly-url-shortener-api`) and a direct API fallback.
- Provides clear guidance for token handling, URL validation, output format preferences, and error surfacing.
- Enforces important guardrails on secrets management and error handling.
- Includes comprehensive quick start, workflow, code samples, and troubleshooting guidance.
Metadata
Frequently Asked Questions
What is T.LY URL Shortener?
Create T.LY short links through the T.LY API. Use when an agent needs to shorten a URL, generate a shareable T.LY link, return a `short_url`, or call T.LY pr... It is an AI Agent Skill for Claude Code / OpenClaw, with 330 downloads so far.
How do I install T.LY URL Shortener?
Run "/install tly" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is T.LY URL Shortener free?
Yes, T.LY URL Shortener is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does T.LY URL Shortener support?
T.LY URL Shortener is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created T.LY URL Shortener?
It is built and maintained by Tim (@timleland); the current version is v1.0.2.
More Skills