← Back to Skills Marketplace
Shortcut Epic and Story skill
by
Sina Khelil
· GitHub ↗
· v1.0.2
501
Downloads
1
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install shortcut-skill
Description
Access and manage Shortcut.com (formerly Clubhouse) project management. Use when the user asks to: list stories, view backlog, search issues, check epics, up...
Usage Guidance
This skill appears to do what it says: it uses curl and jq to call Shortcut's REST API and needs your Shortcut API token. Before installing or using it: (1) Understand that Shortcut tokens described here are 'member-level' and grant broad access to your Shortcut account — only provide a token for an account you trust. (2) If you prefer not to persist the token on disk, follow the SKILL.md advice to export SHORTCUT_API_TOKEN for the session instead of saving to ~/.openclaw/secrets/shortcut. (3) If possible, issue a limited-purpose/throwaway token or rotate/delete the token after use. (4) Verify file permissions (chmod 600) if you do store the token. If you need stronger isolation or auditing, consider using a dedicated account or workspace with minimized privileges.
Capability Analysis
Type: OpenClaw Skill
Name: shortcut-skill
Version: 1.0.2
The skill bundle is benign. It provides instructions and code examples for an AI agent to interact with the Shortcut.com API using `curl` and `jq`. All API calls are directed to `api.app.shortcut.com` and use the `SHORTCUT_API_TOKEN` stored in the designated OpenClaw secrets location. The `SKILL.md` explicitly warns against shell injection and demonstrates safe JSON construction using `jq -n --arg`, indicating a focus on secure practices. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts designed to subvert the agent's purpose.
Capability Assessment
Purpose & Capability
Name/description, required binaries (curl, jq), and the sole credential (SHORTCUT_API_TOKEN) match a REST-API-based Shortcut integration. No unrelated services, binaries, or config paths are requested.
Instruction Scope
SKILL.md contains concrete curl/jq commands limited to the Shortcut API (api.app.shortcut.com). It reads/writes a single credential file at ~/.openclaw/secrets/shortcut and builds JSON safely with jq. The only minor scope note: the skill recommends persisting the API token to disk (or optionally exporting for the session) — storing a full-access token on disk is a design choice with privacy implications but not an incoherence.
Install Mechanism
Instruction-only skill with no install spec and no downloads. This is the lowest-risk install model and is appropriate for a shell-script-based integration.
Credentials
Only the SHORTCUT_API_TOKEN credential is required, which is proportionate to the functionality. Important caveat: Shortcut API tokens are described as having full member-level access (no finer scopes), so the single required secret grants broad permissions within the Shortcut workspace — users should be aware of this.
Persistence & Privilege
The skill is not force-included (always:false) and does not request system-wide privileges or modify other skills. Its only persistence behavior is optional: saving the token to ~/.openclaw/secrets/shortcut, which affects only the user's home directory and is within expected behavior for credential caching.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install shortcut-skill - After installation, invoke the skill by name or use
/shortcut-skill - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.2
**Major update: Adds mandatory safe JSON construction using jq for all API requests.**
- All commands for creating or updating data now require using jq (`jq -n --arg/--argjson`) to build JSON, preventing shell injection and quoting errors.
- Added a prominent section explaining and enforcing the safe JSON construction rule.
- Updated all write and some read examples to demonstrate proper, secure variable handling with jq.
- Improved comments and code samples for clarity and best security practices.
- No functional API/interface changes; all updates reinforce secure scripting usage.
v1.0.1
- Added metadata fields for homepage URL, required secrets, and primary API token environment variable.
- Included a credential note specifying where and how to generate/store the Shortcut API token.
- Clarified auth setup instructions, including alternative for session-only tokens.
- No changes to CLI usage or Shortcut API instructions.
v1.0.0
Major update: streamlined for direct API usage, concise setup, and richer Shortcut.com project management support.
- Replaced previous scripts and documentation with a clear, command-focused API skill file.
- Now documents shortcut usage for listing stories, handling epics, updating state, comments, and dependencies via direct API calls.
- Token setup is simplified and relocated for modern Openclaw directory structure.
- Includes curated bash+curl+jq examples for common Shortcut.com actions.
- Removed all shell scripts; operations are now described as API calls for flexible integration.
- Provides updated usage notes, output formats, and helpful tips for seamless Shortcut management.
Metadata
Frequently Asked Questions
What is Shortcut Epic and Story skill?
Access and manage Shortcut.com (formerly Clubhouse) project management. Use when the user asks to: list stories, view backlog, search issues, check epics, up... It is an AI Agent Skill for Claude Code / OpenClaw, with 501 downloads so far.
How do I install Shortcut Epic and Story skill?
Run "/install shortcut-skill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Shortcut Epic and Story skill free?
Yes, Shortcut Epic and Story skill is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Shortcut Epic and Story skill support?
Shortcut Epic and Story skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Shortcut Epic and Story skill?
It is built and maintained by Sina Khelil (@incognos); the current version is v1.0.2.
More Skills