← Back to Skills Marketplace
oliverw

Linkfuse

by Oliver Weichhold · GitHub ↗ · v1.0.4
cross-platform ⚠ suspicious
767
Downloads
0
Stars
1
Active Installs
5
Versions
Install in OpenClaw
/install linkfuse
Description
Create a Linkfuse affiliate short link from any URL. Trigger this skill when the user wants to create a Linkfuse link, shorten an affiliate URL, or says "/li...
README (SKILL.md)

Linkfuse Skill

Creates an affiliate short link via the Linkfuse REST API — same API used by the Chrome and Firefox extensions.

Trigger Conditions

Use this skill when the user:

  • Says /linkfuse [url]
  • Asks to "create a Linkfuse link" for a URL
  • Wants to shorten an affiliate/Amazon URL via Linkfuse

Authentication

This skill reads the Bearer token exclusively from the LINKFUSE_TOKEN environment variable. If it is not set, tell the user:

LINKFUSE_TOKEN is not set. Get your token from https://app.linkfuse.net/user/external-token and add it to your environment:

export LINKFUSE_TOKEN=your_token_here

Then retry.

Do not proceed without a token.

Workflow

Step 1 — Get the URL

If the user did not provide a URL, ask for one before proceeding.

Step 2 — Create the link

node scripts/create-link.js --url "\x3Curl>"
  • Exit 0: stdout contains JSON { "url": "...", "title": "..." } — proceed to Step 3.
  • Exit 2 (Unauthorized): Tell the user their LINKFUSE_TOKEN is invalid or expired and they should update it.
  • Exit 1: Display the stderr error message to the user.

Step 3 — Display result

Show the user:

✓ Link created: \x3Cshort-url>
  Title: \x3Ctitle>

Offer to copy the short URL to the clipboard:

echo -n "\x3Cshort-url>" | xclip -selection clipboard 2>/dev/null || echo -n "\x3Cshort-url>" | pbcopy 2>/dev/null || true

Notes

  • allowRecycle: true is sent with every request — if the same URL was shortened before, the existing link is returned rather than creating a duplicate.
  • The X-API-CLIENT: claude-skill header identifies this client to the server.
Usage Guidance
This skill appears to do exactly what it says: it uses the LINKFUSE_TOKEN you provide to call Linkfuse's API and create a short/affiliate link. Before installing, ensure the token you provide is from https://app.linkfuse.net/user/external-token and is stored securely (don't commit it to repos or share shells). The skill will make network requests to app.linkfuse.net and prints results to stdout; it does not request other credentials or access unrelated files. If you have concerns, inspect the included scripts (they are small and readable) and consider using a limited/rotatable token you can revoke if needed.
Capability Analysis
Type: OpenClaw Skill Name: linkfuse Version: 1.0.4 The skill is classified as suspicious due to a critical shell injection vulnerability identified in `SKILL.md`. The instruction `node scripts/create-link.js --url "<url>"` passes a user-provided URL directly into a shell command. If the OpenClaw agent does not properly sanitize or escape the `<url>` input before execution, an attacker could inject arbitrary shell commands, leading to Remote Code Execution (RCE). While the `scripts/create-link.js` script itself performs its stated function without malicious intent, and no prompt injection attempts or data exfiltration beyond the stated purpose were found, this vulnerability poses a significant risk.
Capability Assessment
Purpose & Capability
Name/description match the implementation: the skill only needs a Linkfuse bearer token and posts to Linkfuse's API to create short links. No unrelated services, binaries, or config paths are requested.
Instruction Scope
SKILL.md accurately documents runtime behavior: it requires LINKFUSE_TOKEN, asks for a URL, runs the included Node script, and prints the resulting short URL. Instructions do not ask the agent to read unrelated files or exfiltrate extra data.
Install Mechanism
No install spec; this is instruction-only with two small included Node scripts. There are no downloads from untrusted URLs or archive extraction steps.
Credentials
Only LINKFUSE_TOKEN is required (declared). The token is necessary and sufficient for the described API calls; no other secrets, credentials, or config paths are requested.
Persistence & Privilege
always is false and the skill does not attempt to modify other skills or system settings. It does perform normal network calls to app.linkfuse.net using the provided token.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install linkfuse
  3. After installation, invoke the skill by name or use /linkfuse
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.4
- Added an "emoji: 🧠" field under the "clawdbot" metadata section in SKILL.md. - No other changes to functionality or usage.
v1.0.3
- Added explicit environment variable metadata for LINKFUSE_TOKEN, including required status and description, to the skill manifest. - No changes to core functionality or workflow.
v1.0.2
- Updated compatibility text to clarify requirements: now specifies Node.js 18+, network access, and valid Linkfuse API key. - Added compatibility, metadata, and environment variable requirements in a new format under "metadata". - No behavioral changes; documentation update only.
v1.0.1
Minor update to metadata and naming conventions. - Added a "metadata" block with a source URL and environment variable details in SKILL.md. - Changed skill name from "linkfuse" to "Linkfuse" for consistency.
v1.0.0
Linkfuse Skill v1.0.0 - Initial release: create affiliate short links via the Linkfuse REST API. - Triggered by "/linkfuse [url]" or user requests to shorten affiliate links. - Requires the LINKFUSE_TOKEN environment variable for authentication. - Handles missing or invalid tokens with clear guidance to the user. - Returns or reuses a short Linkfuse URL and offers to copy it to the clipboard.
Metadata
Slug linkfuse
Version 1.0.4
License
All-time Installs 1
Active Installs 1
Total Versions 5
Frequently Asked Questions

What is Linkfuse?

Create a Linkfuse affiliate short link from any URL. Trigger this skill when the user wants to create a Linkfuse link, shorten an affiliate URL, or says "/li... It is an AI Agent Skill for Claude Code / OpenClaw, with 767 downloads so far.

How do I install Linkfuse?

Run "/install linkfuse" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Linkfuse free?

Yes, Linkfuse is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Linkfuse support?

Linkfuse is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Linkfuse?

It is built and maintained by Oliver Weichhold (@oliverw); the current version is v1.0.4.

💬 Comments