← Back to Skills Marketplace
rainsunsun

skill-1

by rainsunsun · GitHub ↗ · v1.0.5 · MIT-0
cross-platform ✓ Security Clean
135
Downloads
0
Stars
0
Active Installs
6
Versions
Install in OpenClaw
/install c2a
Description
应用商店管理 Skill。当用户想要搜索、安装、卸载或查看已安装应用时使用此 Skill。
README (SKILL.md)

App Store Skill

概述

此 Skill 提供应用商店管理功能,用户可以通过自然语言对话来:

  • 搜索应用商店 - "搜索 Redis"、"查找数据库应用"
  • 查看应用详情 - "查看 Redis 详情"、"Redis 有什么版本"
  • 查看已安装应用 - "我安装了哪些应用"、"列出所有应用"
  • 安装应用 - "帮我安装 MySQL"、"安装应用 nginx"
  • 卸载应用 - "卸载 MySQL"、"删除应用 wordpress"

配置要求

首次使用(推荐方式)

在首次使用时,通过对话设置配置(会自动保存到 Gateway 配置文件,后续对话会自动使用):

用户: 设置 1Panel 配置
       地址:http://your-server:port
       密钥:your-api-key-here
AI: [调用 gateway 配置保存] 配置已保存到 Gateway!
    后续所有对话都会自动使用此配置,无需重复输入。

配置会保存到 openclaw.json 文件中的 skills.entries.appstore-skill.config 路径下。

环境变量(备用方式)

如果需要通过环境变量配置,可以使用:

变量 说明 示例
ONEPANEL_BASE_URL 1Panel 服务器地址 http://your-server:port
ONEPANEL_API_KEY 1Panel API 认证密钥 your-api-key-here
ONEPANEL_TIMEOUT_MS 请求超时时间(可选) 30000

注:同时也支持 APPSTORE_* 环境变量以保持向后兼容 推荐使用对话配置方式,配置会持久化保存,新对话无需重复输入。

工作流程

搜索应用

  1. 用户发起搜索请求
  2. 调用 searchApps 工具
  3. 返回匹配的应用列表(包含名称、描述、是否已安装)

查看应用详情

  1. 用户请求查看应用详情
  2. 调用 getAppByKey 获取应用信息
  3. 返回应用详情(包含可用版本列表)

安装应用

  1. 用户请求安装应用
  2. 调用 getAppByKey 获取应用信息和可用版本
  3. 调用 getAppDetailId 获取 appDetailId(安装必需参数)
  4. 调用 installApp 执行安装

卸载应用

  1. 用户请求卸载应用
  2. 调用 listInstalledApps 获取已安装应用列表
  3. 找到目标应用的 installId
  4. 调用 uninstallApp 执行卸载

查看已安装应用

  1. 用户请求查看已安装应用
  2. 调用 listInstalledApps 工具
  3. 返回所有已安装应用的列表

配置示例

用户: 设置 1Panel 配置
       地址:http://your-server:port
       密钥:your-api-key-here
       超时:30秒
AI: [保存配置到 Gateway] 配置已保存到 openclaw.json!
    您的 1Panel 服务器地址和密钥已持久化保存。
    后续对话会自动使用此配置,无需重复输入。

用户: 验证一下配置
AI: [调用 search_apps] 测试连接成功,配置有效。

技术说明

配置读取优先级:

  1. Gateway 配置 (skills.entries.appstore-skill.config) - 优先级最高
  2. 环境变量 (ONEPANEL_*APPSTORE_*)
  3. 参数直接传递

对话示例

用户: 帮我看看安装了哪些应用
AI: [调用 listInstalledApps] 您已安装以下应用:
    - MySQL (ID: 62)
    - WordPress (ID: 63)
    - Hermes Agent (ID: 37)

用户: 搜索一下 Redis
AI: [调用 searchApps] 找到 Redis 应用:
    - Redis: 高性能开源键值数据库
    是否需要查看详情或安装?

用户: Redis 有什么版本?
AI: [调用 getAppByKey] Redis 可用版本:
    - 8.6.2 (最新)
    - 7.4.8
    - 6.2.21

用户: 帮我安装 Redis
AI: [执行安装流程] 正在安装 Redis(版本 8.6.2)...
    安装完成!实例名称: redis

CLI 使用方式

# 搜索应用
APPSTORE_BASE_URL=http://... APPSTORE_API_KEY=... node dist/cli.js search redis

# 查看应用详情
node dist/cli.js info redis

# 安装应用(默认最新版本)
node dist/cli.js install redis my-redis

# 安装指定版本
node dist/cli.js install redis my-redis 7.4.8

# 列出已安装应用
node dist/cli.js list

# 卸载应用
node dist/cli.js uninstall 67

注意事项

  • 安装应用时,如果不指定版本,默认使用最新版本
  • 安装应用时可以指定自定义实例名称,方便区分多个相同应用
  • 某些应用可能需要额外的安装参数,会提示用户输入
  • 卸载应用需要使用 installId,可以从已安装列表中获取
Usage Guidance
This skill appears to do what it says: manage 1Panel apps via the 1Panel API. Before installing: - Confirm the mismatch: the registry metadata said no required env vars, but the plugin and docs require a 1Panel base URL and API key (ONEPANEL_* or APPSTORE_* or Gateway-saved config). Expect to provide that credential. - Understand impact of the API key: it allows installing and uninstalling applications on your 1Panel server. Only provide a key with the minimum necessary permissions and only to a trusted server/agent. - Verify where the credential is stored by your OpenClaw/Gateway: SKILL.md says it will be saved to openclaw.json under skills.entries.appstore-skill.config. Ask the platform whether that file is encrypted/ACL-protected, and who can read it. - Review the included dist/*.js files (they are present in the package) and confirm the baseUrl points to a server you control or trust. The code constructs an auth token header locally and only calls the configured baseUrl endpoints — there are no hidden external endpoints. - Be cautious with batch-install/batch-uninstall commands: they can perform many changes; test with a non-production server first and consider rotating the API key after use. If you need higher assurance, ask the publisher to: (1) update registry metadata to list required env vars, and (2) confirm exactly how/where the platform persists the saved config and who can read it.
Capability Analysis
Type: OpenClaw Skill Name: c2a Version: 1.0.5 The skill bundle provides legitimate management functionality for a 1Panel server instance, allowing an AI agent to search, install, and uninstall applications via the 1Panel API. The implementation in dist/client.js correctly follows the 1Panel authentication protocol (MD5 hashing of the API key and timestamp), and all network requests are directed to the user-configured baseUrl. No evidence of data exfiltration, unauthorized execution, or malicious prompt injection was found.
Capability Tags
cryptorequires-sensitive-credentials
Capability Assessment
Purpose & Capability
The skill is an app-store/1Panel management tool and the code (client + appstore module + plugin) clearly calls 1Panel APIs. Needing a 1Panel base URL and API key is appropriate. Minor inconsistency: the registry metadata at the top of the submission reported 'Required env vars: none', but both the SKILL.md and the code expect either Gateway-stored config (skills.entries.appstore-skill.config) or environment variables (ONEPANEL_* or APPSTORE_*).
Instruction Scope
SKILL.md instructions stay within the appstore management scope (search, info, install, uninstall, list, batch ops). It instructs saving configuration into the Gateway config (openclaw.json path) or reading env vars. The plugin registers tools that validate the 1Panel config by making test requests. One minor ambiguity: SKILL.md states the config 'will be automatically saved to openclaw.json'; the plugin registers a 'set_appstore_config' tool that validates the config and returns success, but the submitted code does not show an explicit write to a file — likely the platform handles persisting the tool's config. This is a procedural detail to confirm with the platform but not a functional mismatch with purpose.
Install Mechanism
No install script is provided and this is effectively an instruction + packaged JS plugin (dist/*.js). There is no arbitrary remote download or extract step. The distributed files are typical for a plugin package and present no unusual install mechanism risk.
Credentials
The plugin legitimately needs a 1Panel baseUrl and API key (declared in openclaw.plugin.json and used throughout client.js). It does not request unrelated credentials. However, the registry-level 'Required env vars: none' metadata is inconsistent with the code and SKILL.md that list ONEPANEL_BASE_URL / ONEPANEL_API_KEY or APPSTORE_* env vars or saved Gateway config. The API key is sensitive and grants the ability to install/uninstall apps on the 1Panel server — this is proportionate to the skill's function but high-impact, so use least-privilege keys and verify the server.
Persistence & Privilege
The skill does not request always:true and does not modify other skills. It intends to persist its own configuration into the Gateway's skill config area (skills.entries.appstore-skill.config), which is normal for a skill storing its own settings. The skill can be invoked autonomously (disable-model-invocation is false), which is the platform default and not grounds for additional flagging here.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install c2a
  3. After installation, invoke the skill by name or use /c2a
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.5
- 支持通过对话自动设置和持久化 1Panel 配置,首次设置后将保存至 Gateway,后续无需重复输入。 - 优化配置优先级:优先使用 Gateway 配置,其次环境变量,最后参数传递。 - 新增示例指导用户如何通过对话设置及验证配置。 - 推荐对话配置方式,简化用户体验,环境变量方式保留为备用。
v1.0.4
Version 1.0.4 of c2a - No file changes detected in this release. - Functionality and documentation remain unchanged from the previous version.
v1.0.3
- Added initial CLI and library codebase for App Store Skill, including build output and dependencies. - Expanded documentation: 新增“查看应用详情”功能说明,补充了 CLI 工具用法示例。 - 支持 1Panel 环境变量(ONEPANEL_BASE_URL, ONEPANEL_API_KEY)并兼容原有 APPSTORE_* 设置。 - 优化安装流程,支持指定应用版本和自定义实例名称。 - 工作流步骤和对话示例同步更新,更加贴合实际操作。 - “注意事项”补充解释了应用安装、命名和卸载流程相关细节。
v1.0.2
- Removed the file CLOUDHUB_CHECKLIST.md. - No other changes were made in this version.
v1.0.1
- Added CLOUDHUB_CHECKLIST.md to the project. - Updated sample configuration values in SKILL.md for clarity and security (placeholders instead of real data).
v1.0.0
App Store Skill 1.0.0 - 初始版本,支持应用商店的搜索、安装、卸载和已安装应用查询 - 提供环境变量配置说明,支持 API 地址与密钥自定义 - 明确了每项功能的对话指令范例和操作流程 - 提供常见使用流程和注意事项,辅助用户顺畅操作
Metadata
Slug c2a
Version 1.0.5
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 6
Frequently Asked Questions

What is skill-1?

应用商店管理 Skill。当用户想要搜索、安装、卸载或查看已安装应用时使用此 Skill。 It is an AI Agent Skill for Claude Code / OpenClaw, with 135 downloads so far.

How do I install skill-1?

Run "/install c2a" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is skill-1 free?

Yes, skill-1 is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does skill-1 support?

skill-1 is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created skill-1?

It is built and maintained by rainsunsun (@rainsunsun); the current version is v1.0.5.

💬 Comments