← Back to Skills Marketplace
araujodgdev

Web Star Studio's Flow PMS

by Douglas Araújo · GitHub ↗ · v1.0.0 · MIT-0
cross-platform ⚠ suspicious
85
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install flow-pms
Description
Interact with FlowDeck Project Management API (projects, cycles, tasks). Use for CRUD + archive/unarchive operations via the FlowDeck REST API through Supaba...
README (SKILL.md)

FlowDeck Project Management API

Interact with the FlowDeck project management module via the REST API gateway (base URL: https://\x3Csupabase_url>/functions/v1/api-gateway).

Usage

Run the script using the absolute path (do NOT cd to the skill directory):

uv run ~/.codex/skills/flow-pms/scripts/flow_api.py \x3Caction> \x3Cresource> [options]

Important: Always run from the user's current working directory so any output files are saved where the user is working.

Actions

Action Description Example
list List resources (paginated) uv run ... list projects --limit 50
get Get single resource uv run ... get projects --id \x3Cuuid>
create Create resource uv run ... create projects --data '{"name":"X","prefix":"X"}'
update Update resource uv run ... update tasks --id \x3Cuuid> --data '{"status":"done"}'
delete Delete resource uv run ... delete tasks --id \x3Cuuid>
archive Archive project uv run ... archive projects --id \x3Cuuid>
unarchive Unarchive project (to on_hold) uv run ... unarchive projects --id \x3Cuuid>

PMS Resources

Resource Endpoint Notes
projects /projects Project management
cycles /projects/{projectId}/cycles Sprints, scoped to project
tasks /projects/{projectId}/tasks Tasks, scoped to project
comments /tasks/{taskId}/comments Comments on tasks

Filters for list

  • --limit N (default 50, max 200)
  • --offset N (default 0)
  • --status — filter by status enum
  • --priority — filter task priority (tasks)
  • --cycle-id — filter tasks by cycle
  • --assignee-id — filter tasks by assignee
  • --project-id — parent project ID for scoped resources (cycles, tasks, comments)

Status/Stage/Priority Enums

Projects

briefing, planning, in_progress, review, completed, post_launch, on_hold, continuous_support, archived

Cycles

draft, active, completed, cancelled

Tasks (status)

backlog -> todo -> in_progress -> in_review -> done / cancelled

Tasks (priority)

none, low, medium, high, urgent

Tasks (type)

feature, bug, improvement, task

Core workflows

Project status update

For prompts like Me atualize sobre o status do projeto X no flow:

  1. list projects to resolve project by name
  2. get projects --id \x3Cuuid> for full details
  3. list cycles --project-id \x3Cuuid> to find active cycle (prefer status=active, fallback to latest)
  4. list tasks --project-id \x3Cuuid> to get tasks
  5. Summarize: project status, deadline, active cycle progress, task counts by status/priority, risk signals (urgent open tasks, blocked high-priority items)

Current cycle status

  1. Resolve project
  2. list cycles --project-id \x3Cuuid>
  3. Pick cycle with status=active; mention if none exists
  4. list tasks --project-id \x3Cuuid> --cycle-id \x3Cuuid> for task-level detail
  5. Report: progress, scope, completed_scope, dates, deadline risk signals

Create a task

  1. Resolve the target project
  2. Determine status and cycle from the project's active cycle
  3. Include optional fields only when the user specified them or when you need one clarification

Required fields for project create: name, prefix

Required fields for task create: only title by API, but you MUST at minimum also:

  • Resolve the project (ask if missing)
  • Check for an active cycle and default cycle_id to it
  • Check for an assignee

Implement what is in a task

  1. Resolve the project
  2. Resolve the task by identifier (e.g. PRJ-42) or title
  3. Fetch the full task
  4. Summarize scope from title, description, type, priority, due date, cycle
  5. Use the task content as the implementation brief
  6. If code changes are made outside Flow, suggest or perform a task status update afterward

Mutation safety

Ask for confirmation before:

  • Deleting projects, cycles, or tasks
  • Broad updates when the target match is ambiguous

Do not ask when the user already clearly requested the destructive action and the target is unambiguous.

API Key

The script checks for API key in this order:

  1. --api-key argument (use if user provided key in chat)
  2. FLOWBOARD_API_KEY environment variable

If neither is available, the script exits with an error message.

API Key + Base URL Environment Variables

  • FLOWBOARD_API_KEY — Bearer API key
  • FLOWBOARD_BASE_URL — API base URL (default: https://mycivgjuujlnyoycuwrz.supabase.co/functions/v1/api-gateway)

Preflight + Common Failures

  • Preflight:
    • command -v uv (must exist)
    • test -n "$FLOWBOARD_API_KEY" (or pass --api-key)
  • Common failures:
    • Error: No API key provided. -> set FLOWBOARD_API_KEY or pass --api-key
    • HTTP 401 -> invalid/revoked key
    • HTTP 404 -> resource not found or doesn't belong to workspace
    • "quota/permission/403" -> wrong key, no access, or quota exceeded

Examples

List projects in progress:

uv run ~/.codex/skills/flow-pms/scripts/flow_api.py list projects --status in_progress --limit 20

Create a task in a project:

uv run ~/.codex/skills/flow-pms/scripts/flow_api.py create tasks \
  --project-id \x3Cuuid> \
  --data '{"title":"Implementar login social","priority":"high","type":"feature"}'

Move task to in_progress:

uv run ~/.codex/skills/flow-pms/scripts/flow_api.py update tasks \
  --id \x3Cuuid> --data '{"status":"in_progress"}'

Archive a project:

uv run ~/.codex/skills/flow-pms/scripts/flow_api.py archive projects --id \x3Cuuid>
Usage Guidance
Before installing or running this skill: 1) Treat it as untrusted until you verify the author — the source is unknown. 2) Do NOT export your primary Flow/organization API key globally; prefer a least-privileged key scoped for read-only testing. 3) Explicitly set FLOWBOARD_BASE_URL to your own trusted FlowDeck/Supabase gateway before running; do not rely on the hard-coded default (https://mycivgjuujlnyoycuwrz.supabase.co/functions/v1/api-gateway) because it will cause requests (and your API key) to be sent to that external domain. 4) Test first with read-only operations (list/get) and confirm responses are as expected. 5) Inspect or run the scripts in an isolated environment (sandbox or ephemeral VM) to verify behavior. 6) Ask the publisher to update registry metadata to declare required env vars and to remove or make explicit any default external endpoints. 7) If you cannot verify the owner or do not control the base URL, avoid providing any real API key; instead create a disposable/limited API key and rotate it after testing.
Capability Analysis
Type: OpenClaw Skill Name: flow-pms Version: 1.0.0 The skill bundle provides a legitimate integration for interacting with the FlowDeck Project Management API. The Python scripts (flow_api.py, flowboard_api.py, flowboard_lookup.py, and flowboard_status.py) implement standard RESTful CRUD operations, fuzzy search logic, and status reporting. The instructions in SKILL.md and the workflows are consistent with the stated purpose of managing projects and tasks, and they include safety recommendations such as requiring user confirmation for destructive actions. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.
Capability Tags
requires-oauth-token
Capability Assessment
Purpose & Capability
Name/description match the included scripts: the code implements CRUD and lookup flows against a FlowDeck REST API via a Supabase Edge Functions gateway. However the registry metadata claims no required env vars or primary credential while the code clearly requires an API key (FLOWBOARD_API_KEY) and optionally a base URL (FLOWBOARD_BASE_URL). Also the code ships a hard-coded default base URL pointing to a specific supabase.co domain, which is disproportionate for a generic 'FlowDeck' skill and can redirect traffic to that external endpoint unless the user overrides it.
Instruction Scope
SKILL.md instructs the agent to run the included Python scripts (via 'uv run') and to operate from the user's working directory. The runtime behavior is limited to calling the configured API gateway using provided API key/base URL and summarizing results. The scripts do not read unrelated system files or credentials. Minor oddity: the instruction 'Always run from the user's current working directory so any output files are saved there' is inconsistent with the scripts, which print JSON and do not create files.
Install Mechanism
There is no install spec (instruction-only skill with code files). The scripts declare a dependency on httpx (and require Python >=3.10) and expect the 'uv' runner to be present. That is lower-risk than downloading/executing remote archives, but the skill relies on the runtime to provide dependency resolution (uv) which the user must trust.
Credentials
The code expects FLOWBOARD_API_KEY (required) and FLOWBOARD_BASE_URL (optional) and also accepts keys passed via CLI args. Those env vars are proportionate to the stated purpose — the ability to authenticate to the Flow API is necessary — but the registry metadata does not declare these requirements (mismatch). Critically, a default FLOWBOARD_BASE_URL is hard-coded to a specific supabase.co domain in multiple files; if the user does not explicitly set FLOWBOARD_BASE_URL, their API key (or the key they export) may be sent to that external domain. This default endpoint is unexpected for a generic skill and raises an exfiltration risk unless the base URL is deliberately set to a trusted instance.
Persistence & Privilege
The skill does not request permanent inclusion (always:false) and does not modify other skills or system-wide settings. It runs on-demand and only uses environment variables and network calls consistent with its function.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install flow-pms
  3. After installation, invoke the skill by name or use /flow-pms
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of flow-pms, providing streamlined CLI access to FlowDeck Project Management via REST API. - Supports CRUD, archive, and unarchive operations for projects, cycles, tasks, and comments - Includes filters for listing by status, priority, assignee, and project/cycle - Provides robust project/cycle/task status reporting and workflow summaries - Safeguards destructive actions with confirmation prompts unless explicitly requested - Requires API key via argument or environment variable; enforces preflight checks - Thorough documentation with usage, examples, and error guidance
Metadata
Slug flow-pms
Version 1.0.0
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is Web Star Studio's Flow PMS?

Interact with FlowDeck Project Management API (projects, cycles, tasks). Use for CRUD + archive/unarchive operations via the FlowDeck REST API through Supaba... It is an AI Agent Skill for Claude Code / OpenClaw, with 85 downloads so far.

How do I install Web Star Studio's Flow PMS?

Run "/install flow-pms" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Web Star Studio's Flow PMS free?

Yes, Web Star Studio's Flow PMS is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does Web Star Studio's Flow PMS support?

Web Star Studio's Flow PMS is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Web Star Studio's Flow PMS?

It is built and maintained by Douglas Araújo (@araujodgdev); the current version is v1.0.0.

💬 Comments