← Back to Skills Marketplace
Statamic AI Gateway
by
Michael Stokoe
· GitHub ↗
· v0.2.0
· MIT-0
171
Downloads
1
Stars
0
Active Installs
8
Versions
Install in OpenClaw
/install statamic-ai-gateway
Description
Manage Statamic content through a tool execution gateway (composer require stokoe/ai-gateway).
Usage Guidance
This skill appears to do what it says, but it centralizes per-site bearer tokens in a single local file. Before installing: (1) verify the GitHub homepage/author and that you trust the AI gateway addon running on each site; (2) store sites.json in a protected location and use chmod 600 as recommended; (3) add only sites you control or trust (a malicious site URL/token could be used to extract or modify content); (4) prefer short-lived or scoped tokens if the site supports them and rotate tokens if compromised; (5) keep the agent configured so that any confirmation-gated operations require interactive user approval (do not auto-confirm write operations). If you see any additional install scripts, code files, or requests for unrelated credentials (AWS keys, SSH keys, etc.), stop and re-evaluate — those would change this assessment.
Capability Analysis
Type: OpenClaw Skill
Name: statamic-ai-gateway
Version: 0.2.0
The skill is a well-structured tool for managing Statamic CMS content via a dedicated API gateway (stokoe/ai-gateway). It follows security best practices by instructing the agent to use a local, permission-restricted configuration file (~/.config/ai-gateway/sites.json) for credentials and explicitly mandates a 'discovery-first' workflow with user confirmation for sensitive operations. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found across SKILL.md, INSTALL.md, or the API references.
Capability Tags
Capability Assessment
Purpose & Capability
Name/description (Statamic AI Gateway) align with the declared requirements: curl/jq and a sites registry containing base_url and token. Requested artifacts (sites.json and AI_GATEWAY_SITES_CONFIG) are exactly what you would expect for a gateway that proxies requests to multiple Statamic sites.
Instruction Scope
SKILL.md explicitly instructs the agent to read the configured sites.json, look up base_url and token, call /capabilities then /capabilities/{tool} before executing, and follow confirmation gates. The instructions do not ask the agent to read unrelated files or credentials; the only secret accessed is the declared sites.json. The guidance is narrow and discovery-first, which limits accidental misuse.
Install Mechanism
This is instruction-only and has no install spec or downloads, so nothing is written to disk by the skill itself. Required binaries (curl, jq) are standard and reasonable for the documented curl-based workflow.
Credentials
The skill asks for a single primary environment variable (AI_GATEWAY_SITES_CONFIG) and a local config path (~/.config/ai-gateway/sites.json) that stores site tokens. That is proportional to its purpose, but be aware this central registry stores bearer tokens that grant management access to each configured site; protecting that file and limiting what sites you add are important operational considerations.
Persistence & Privilege
always is false and the skill is user-invocable with normal autonomous invocation allowed. There is no attempt to modify other skills or persist beyond the documented sites.json; requested privileges are appropriate for operation.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install statamic-ai-gateway - After installation, invoke the skill by name or use
/statamic-ai-gateway - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.2.0
statamic-ai-gateway v0.2.0
- No changes were detected in this release.
- All documentation, configuration, and implementation remain the same as in the previous version.
v0.1.0
statamic-ai-gateway v0.0.8
- Documentation rewritten for clarity and brevity; legacy examples and redundant sections removed.
- "Discovery-first" guidance is now prominent; emphasizes using `/capabilities` endpoints before attempting tool use.
- Strict guidance on handling structured ("rich-text") fields—explained in fewer but clearer rules.
- Added quick error code reference table with actionable advice.
- Clarified request/response envelopes and site credential lookup process.
- Notes on cache warming tools (`stache.warm`, `static.warm`) included after bulk updates.
v0.0.6
Version 0.0.7
- Skill description updated for clarity and notes explicit dependency on `stokoe/ai-gateway` (Statamic addon).
- Version number updated in metadata.
- No changes to functionality or endpoints.
- Documentation streamlined; now more concise with clearer prerequisites.
v0.0.5
- Added "Working with Large Content" section to improve handling of bard fields with lots of content
v0.0.4
- Adds new endpoint: `GET /ai-gateway/capabilities/{tool}` for detailed, per-tool usage including argument schemas and behavioral notes.
- Documents a strong workflow for always using per-tool discovery before constructing requests.
- Hardens rules around "structured field values" (e.g. Bard, Replicator) — values are read-only trees; only literal text may be changed, never structure.
- Updates confirmation workflow: tools that require confirmation now mandate explicit user approval before sending the confirmation token.
- Improves documentation and reference flows to clarify best practices and critical error avoidance.
v0.0.3
statamic-ai-gateway v0.0.3 Changelog
- Added new read-only tools: `entry.get`, `entry.list`, `global.get`, `navigation.get`, `term.get`, and `term.list` for retrieving entries, globals, navigations, and taxonomy terms.
- Expanded tool argument documentation with precise envelope shapes and usage examples for each tool.
- Introduced a Tool Argument Quick Reference section for clarity and quick lookup.
- Clarified the multi-step confirmation flow, including how to extract and use the `confirmation_token` from responses.
- Updated and clarified rules and best practices for safer and more predictable use.
v0.0.2
Multi-site management support added.
- Skill now manages multiple Statamic sites via a sites.json registry and the AI_GATEWAY_SITES_CONFIG environment variable.
- Tokens and base URLs are no longer stored in separate environment variables; they're looked up per site.
- Documentation updated with examples and best practices for operating across multiple sites.
- Rules and error handling clarified to emphasize site-specific configuration and traceability.
v0.0.1
Initial public release of statamic-ai-gateway.
- Provides a secure, authenticated HTTP gateway to manage Statamic content, globals, navigation, taxonomy terms, and caches.
- Supports discovery of available tools and safe execution via unified endpoints.
- Detailed environment and request/response envelope documentation included.
- Comprehensive list of tools, error codes, and usage rules for robust operation.
- Requires `AI_GATEWAY_TOKEN` and `AI_GATEWAY_BASE_URL` for authorization.
Metadata
Frequently Asked Questions
What is Statamic AI Gateway?
Manage Statamic content through a tool execution gateway (composer require stokoe/ai-gateway). It is an AI Agent Skill for Claude Code / OpenClaw, with 171 downloads so far.
How do I install Statamic AI Gateway?
Run "/install statamic-ai-gateway" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Statamic AI Gateway free?
Yes, Statamic AI Gateway is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Statamic AI Gateway support?
Statamic AI Gateway is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Statamic AI Gateway?
It is built and maintained by Michael Stokoe (@michael-stokoe); the current version is v0.2.0.
More Skills