← Back to Skills Marketplace
375
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install prefy
Description
Connect to Prefy AI platform — Conductor API (19 models, OpenAI-compatible), server management, web search, image generation, phone calls (AutoCall). Use whe...
Usage Guidance
The skill appears to document genuine Prefy API endpoints, but the metadata fails to declare the secret keys the SKILL.md clearly expects. Before installing or enabling this skill: 1) Ask the author to explicitly list required environment variables (e.g., PREFY_API_KEY, SUPABASE_JWT, any Stripe keys) in the skill manifest. 2) Only provide the minimum-scoped credentials necessary (use per-skill API keys or short-lived tokens if possible). 3) Be cautious about granting server-agent JWTs or payment credentials — these enable remote shell commands and creating payment checkouts. 4) Verify the official Prefy documentation and TLS endpoints (https://prefy.com/docs) and confirm the skill's source/maintainer identity. 5) If you must test, do so in an isolated account or sandbox environment with limited privileges. If the author cannot justify the undeclared credentials, treat the skill as untrusted.
Capability Analysis
Type: OpenClaw Skill
Name: prefy
Version: 1.0.0
The skill bundle is classified as suspicious due to the high-risk capabilities exposed in the `SKILL.md` file. The 'Server Management' section describes an API endpoint (`POST /api/v1/servers/command`) that allows sending arbitrary commands to a provisioned server. Specifically, the `shell <cmd>` command enables direct remote code execution (RCE), and the `cron add` command allows for scheduling arbitrary commands, creating a persistence mechanism. While these capabilities might be intended for legitimate server management, their exposure to an AI agent creates a significant attack surface, allowing for potential misuse, RCE, and backdoor installation on user-provisioned servers if the agent is compromised or misdirected.
Capability Assessment
Purpose & Capability
The skill claims to connect to the Prefy platform (chat, search, images, servers, AutoCall). The SKILL.md shows it needs a Prefy API key (PREFY_API_KEY / pc_...), a Supabase JWT for server/agent APIs, and implies integration with Stripe and third-party audio providers. However, the registry metadata lists no required environment variables or primary credential. Declaring no credentials is inconsistent with the documented usage and credential patterns in SKILL.md.
Instruction Scope
SKILL.md provides concrete API endpoints and sample payloads and stays within the described Prefy capabilities. It does, however, document server management 'agent commands' that include 'shell <cmd>' (remote shell execution on provisioned servers) and creating Stripe checkouts, which are high-privilege actions. The instructions do not ask the agent to read local files or unrelated system state, but they do enable potentially dangerous remote operations if invoked with credentials.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing will be written to disk or downloaded at install time. That minimizes install-time risk.
Credentials
The SKILL.md expects secret credentials (Prefy API key, Supabase JWT) and hints at Stripe usage and third-party audio services, but the skill metadata lists none. Requiring multiple secrets for different subsystems (API, auth for server agents, payment) is plausible for the described functionality but must be explicitly declared; the omission is a proportionality and transparency issue. Any required tokens would grant significant access (API calls, server control, payment flow).
Persistence & Privilege
The skill is not marked always:true and is user-invocable with normal autonomous invocation settings. It does not request persistent presence or modifications to other skills. That privilege level is typical for an integration skill.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install prefy - After installation, invoke the skill by name or use
/prefy - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Prefy 1.0.0 — Initial Release
- Connects to the Prefy AI platform, supporting 19 AI models (OpenAI-compatible Conductor API).
- Provides server management features: provision, control VPS servers, manage agent commands.
- Integrates web search, image generation (FLUX Schnell), and upcoming city events lookup.
- Includes AutoCall: AI-driven phone calls to venues for tasks like bookings.
- Supports agent API with intent detection for chat, search, flights, hotels, and calling.
- Offers clear rate limits and easy authentication. Full docs at https://prefy.com/docs.
Metadata
Frequently Asked Questions
What is Prefy?
Connect to Prefy AI platform — Conductor API (19 models, OpenAI-compatible), server management, web search, image generation, phone calls (AutoCall). Use whe... It is an AI Agent Skill for Claude Code / OpenClaw, with 375 downloads so far.
How do I install Prefy?
Run "/install prefy" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Prefy free?
Yes, Prefy is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Prefy support?
Prefy is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Prefy?
It is built and maintained by runrelay (@runrelay); the current version is v1.0.0.
More Skills