← Back to Skills Marketplace

Skill Hub Gateway

Name: Skill Hub Gateway
Author: chinasilva

by chinasilva · GitHub ↗ · v2.4.2 · MIT-0

cross-platform ⚠ suspicious

500

Downloads

Stars

Active Installs

Versions

Install in OpenClaw

/install skill-hub-gateway

Description

Unified gateway skill for async execute/poll, portal user closure, and telemetry feedback workflows.

Usage Guidance

This skill is broadly coherent with being a gateway that can execute, poll, upload attachments, and emit telemetry — but it will read local files (file_path) and upload their contents to gateway.binaryworks.app and it will call the gateway to auto-bootstrap an api_key and emit telemetry that includes agent/auth context. Only install if you trust the gateway.binaryworks.app service and the skill author. Before installing: (1) review telemetry.mjs and runtime-auth.mjs (not fully shown here) to confirm what fields are sent and that API keys are not leaked; (2) disable telemetry by setting SKILL_TELEMETRY_ENABLED=false or block outbound network to the gateway if you cannot trust it; (3) avoid passing sensitive local file paths (file_path) to the skill — prefer pre-uploaded URLs or backend-mediated uploads; (4) prefer providing an explicit api_key (instead of letting the skill auto-bootstrap) if you want to control credential issuance; (5) run in a sandboxed workspace with minimal local data exposure if you need to evaluate the skill further. If you want a firmer classification, provide the full contents of runtime-auth.mjs and telemetry.mjs so we can confirm what telemetry contains and how the bootstrap flow handles credentials.

Capability Analysis

Type: OpenClaw Skill Name: skill-hub-gateway Version: 2.4.2 The bundle provides a unified gateway for various AI services (Computer Vision, TTS, ASR) and user management actions (balance checks, usage queries, and voucher redemption). It includes sophisticated logic for authentication bootstrapping, telemetry, and file upload normalization via `scripts/attachment-normalize.mjs`. While the skill possesses the capability to read and upload local files, this is a documented feature intended to facilitate processing local media in agentic workflows. The instructions in `SKILL.md` are transparent and focused on operational logic like version management and onboarding. No evidence of malicious intent, obfuscation, or unauthorized data exfiltration was found. Primary endpoints include gateway.binaryworks.app and gateway-api.binaryworks.app.

Capability Assessment

ℹ Purpose & Capability

Name/description (gateway for execute/poll, portal actions, telemetry) aligns with the included scripts and openapi manifest: execute, poll, portal-action, attachment-normalize and telemetry helpers are expected for this purpose. Requiring node only is proportionate. The skill also implements an auto-bootstrap path to obtain an API key; this is plausible for a gateway but increases the surface area compared to a purely-passive helper.

⚠ Instruction Scope

Runtime instructions and bundled scripts explicitly read local files (attachment-normalize.mjs reads file_path from the filesystem) and will upload their contents to external endpoints (site_base + /api/blob/upload or /api/blob/upload-file). The scripts also perform telemetry/feedback calls and pass agent/context/auth info into the telemetry helper. Reading arbitrary file paths and sending file contents over the network is coherent with a media-upload gateway but is a sensitive capability that can lead to local data exfiltration if misused or if the agent constructs file_path from uncontrolled inputs.

✓ Install Mechanism

There is no package/install spec — the skill is instruction+script based and requires node on PATH. No downloads or archive extraction occur as part of installation, which is lower risk. The presence of multiple scripts bundled with the skill is expected for an instruction-only skill that provides CLI helpers.

⚠ Credentials

The manifest declares no required environment secrets, but the runtime implements an automatic bootstrap flow that can obtain an api_key via network calls (POST /agent/bootstrap) and then uses that key in requests. Telemetry calls are invoked with apiKey, agentUid and ownerUidHint passed into the telemetry helper — this suggests telemetry payloads may include sensitive identifiers or even the API key unless telemetry.mjs explicitly sanitizes them. The skill also accepts file_path inputs (no environment guard) and will upload local files to the configured gateway domain. These capabilities are functional for a gateway but widen the credential/data exposure surface and should be considered disproportionate unless the user trusts the remote service.

✓ Persistence & Privilege

The skill is not force-included (always: false) and uses the platform default for autonomous invocation. It does not declare writes to other skills or system-wide config. Bundled scripts perform network interactions but there is no evidence they modify other skills' configuration or request elevated persistent privileges.

How to Use

Make sure OpenClaw is installed (local or Docker)
Run the install command in chat: /install skill-hub-gateway
After installation, invoke the skill by name or use /skill-hub-gateway
Provide required inputs per the skill's parameter spec and get structured output

Version History

v2.4.2

- Added `/api/blob/upload-file` as a fallback upload endpoint for `file_path` inputs when `@vercel/blob/client` is unavailable. - Enhanced `portal.skill.presentation` to render output files and return `visual.files.assets`, including overlay, mask, and cutout URLs. - Audio outputs now normalize to `output.media_files.assets` with uploaded file URLs when blob storage is available. - No breaking changes.

v2.4.1

### 2.4.1 (2026-03-12) - Added server-side normalization for `attachment.url` fields on `portal.skill.execute` (supports both `input.attachment.url` and top-level). - Explicit media URL fields (`image_url`, `audio_url`, `file_url`) now take precedence over `attachment.url` when both are provided. - New end-to-end tests introduced to verify upload-first execution and precedence behavior. - Updated documentation to clarify fallback guidance for runtimes without `@vercel/blob/client` (use backend pre-uploaded URLs). - No breaking changes; existing workflows remain compatible.

v2.4.0

Skill-hub-gateway 2.4.0 introduces portal user closure and feedback workflows. - Added Portal Actions contract for user-specific flows (profile, balance, ledger, usage, skill execution, presentation, voucher and recharge actions). - Bundled new scripts: portal-action.mjs (action runner), portal-auth.mjs (auth bridge), attachment-normalize.mjs (media upload/normalization), and feedback.mjs (structured feedback). - Added double-confirm gate: voucher redeem and recharge create actions require `confirm=true` in payload to proceed. - Standardized insufficient points responses to pass through recharge URLs for easier diagnostics. - Existing execute/poll flows remain available and compatible. Use portal-action.mjs for new closure workflows.

v2.3.3

## 2.3.3 (2026-03-11) - Standardized user guidance: do not expose manual URL/JSON inputs for media/doc uploads—use file/attachment fields in product UIs. - Updated capability reference docs and examples to reflect upload-first, user-friendly product flows. - Renamed CLI argument from `input_json` to `input_payload` for clarity and consistency. - No breaking changes; all runtime API calls remain unchanged.

v2.3.2

Skill-hub-gateway 2.3.2 - Aligned capability reference documentation with actual runtime behavior regarding file uploads and chat attachments. - Synced package OpenAPI version with SKILL frontmatter version to prevent metadata drift. - Added package-level test guards to detect documentation/version mismatches before publishing. - No breaking changes; existing runtime API calls remain unchanged.

v2.3.1

- Clarified that the CLI scripts (`execute.mjs`, `poll.mjs`) do not perform file uploads; upload support is determined by the host client. - CLI scripts now emit structured error logs (`status`, `code`, `message`, and `request_id`) to stderr on bootstrap, execute, or poll failures, supporting easier troubleshooting. - No breaking changes; all existing API calls remain unchanged.

v2.3.0

**Summary:** Introduced agent-side version check protocol and expanded supported capabilities. - Added agent-side version check protocol and user update prompt flow, described in the new Release Notes section. - Expanded the list of available capability IDs to include Roboflow and image analysis features. - Clarified support for file uploads, input source types, and use of explicit URLs for media input. - Updated SKILL.md documentation accordingly; no breaking changes to runtime APIs.

v2.1.5

- Removes runtime env reads and local auth cache persistence from skill scripts. - Derives stable local bootstrap identifiers from the current workspace path. - Simplifies runtime auth retries and updates bilingual docs for the safer bootstrap flow.

v2.1.4

- Removes local api_key persistence from runtime auth cache. - Adds release-gate allow markers for bounded env+network bootstrap paths. - Keeps bootstrap metadata-only cache entries and sanitizes legacy cache files.

v2.1.3

- Adds automated onboarding and authentication bootstrapping to scripts; manual API key override is still supported. - Introduces a shared `runtime-auth.mjs` helper for authentication caching and script consistency. - Updates CLI argument patterns for `execute.mjs` and `poll.mjs`. - SKILL.md and SKILL.zh-CN.md now clarify the new onboarding behavior and script usage.

v2.1.2

Validate image_url as direct image content and improve provider fallback failure messaging.

v2.1.1

Fix security scan false-positive trigger by removing process.env+network pattern in helper scripts.

v2.1.0

- Version 2.1.0 adds an updated SKILL.md with onboarding instructions, runtime API details, and capability documentation. - Clearly lists required environment variables and dependencies. - Documents endpoints for install, execute, and poll workflows. - Provides details on possible terminal states and expected responses. - Lists supported capability IDs and bundled reference files. - Includes link to homepage and Chinese documentation.

Metadata

Slug skill-hub-gateway

Version 2.4.2

License MIT-0

All-time Installs 2

Active Installs 2

Total Versions 13

Frequently Asked Questions

What is Skill Hub Gateway?

Unified gateway skill for async execute/poll, portal user closure, and telemetry feedback workflows. It is an AI Agent Skill for Claude Code / OpenClaw, with 500 downloads so far.

How do I install Skill Hub Gateway?

Run "/install skill-hub-gateway" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Skill Hub Gateway free?

Yes, Skill Hub Gateway is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does Skill Hub Gateway support?

Skill Hub Gateway is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Skill Hub Gateway?

It is built and maintained by chinasilva (@chinasilva); the current version is v2.4.2.

More Skills