← Back to Skills Marketplace
168
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install shellbot-website
Description
Build, deploy, and design micro apps and websites on Cloudflare Workers. Scaffolds from templates (React Router + Hono, Next.js, Astro, Remix), deploys, sets...
Usage Guidance
This skill is coherent for building and deploying Cloudflare Workers, but before installing or running it: 1) Treat the CLOUDFLARE_API_TOKEN as a high-privilege secret — create a narrowly-scoped API token (Workers Script: Edit, D1/KV/R2/Queue edits only as needed, DNS edit only if you need domain setup). 2) Review/manage any template URL you pass (--template-url) before using it — npm create / npm install will execute code from registries or GitHub during scaffolding. 3) Run scripts locally (not on untrusted remote agents) if you need to perform OAuth-based wrangler login (the OAuth flow relies on localhost callbacks). 4) Inspect scripts/manage-secrets.sh and other omitted files to confirm they handle secrets appropriately (they should use wrangler secret put and avoid echoing secrets to logs). 5) For CI use, prefer API tokens over OAuth and store tokens in your secret manager; avoid giving the token wider scopes than required.
Capability Analysis
Type: OpenClaw Skill
Name: shellbot-website
Version: 1.1.0
The shellbot-website skill bundle is a legitimate and well-documented tool for scaffolding, deploying, and managing Cloudflare Workers. It includes a suite of scripts (e.g., create-project.sh, deploy.sh, setup-domain.sh) that wrap the Wrangler CLI and Cloudflare API to automate project setup and resource provisioning (D1, KV, R2). While the setup-domain.sh script performs sensitive actions like reading OAuth tokens from the local ~/.wrangler/config/default.toml file and making direct API calls to api.cloudflare.com, these behaviors are strictly aligned with the stated purpose of providing a non-interactive deployment experience. No evidence of data exfiltration, persistence, or malicious prompt injection was found.
Capability Assessment
Purpose & Capability
Name/description (Cloudflare Workers scaffolding, deploy, domain, resources) match the declared primary credential (CLOUDFLARE_API_TOKEN) and the included scripts (create, deploy, provision, domain, secrets, teardown). Required binaries/env are proportionate to those tasks.
Instruction Scope
SKILL.md instructs the agent to run the provided bash scripts and use wrangler/curl to talk to api.cloudflare.com — exactly what a Cloudflare worker management tool needs. However, create-project.sh supports a --template-url and uses `npm create cloudflare` which will fetch and run code from external template repos (npm / GitHub). That is expected for scaffolding but increases the runtime attack surface (untrusted template code can execute during scaffold). The skill documents OAuth storage (~/.wrangler/config/default.toml) and uses wrangler whoami as fallback — the scripts rely on Cloudflare credentials (token or local OAuth). No instructions were found that read or exfiltrate unrelated system data or call unexpected external endpoints beyond Cloudflare and npm/template hosts.
Install Mechanism
There is no install spec; this is instruction+script based. All code is contained in repository scripts (no remote install step in the skill package itself). The risk from installs comes from the normal operations the scripts perform (npm create, npm install) which will fetch dependencies from public registries — expected for project scaffolding.
Credentials
The skill requests one main credential (CLOUDFLARE_API_TOKEN) and optionally an account ID — appropriate for modifying Workers, DNS, D1, KV, R2, Queues. This credential has broad power over the Cloudflare account; the skill's actions (create projects, provision resources, manage DNS/custom domains, secrets) legitimately require elevated Cloudflare scopes. Users should create a least-privilege API token with only the required scopes rather than a full global API key.
Persistence & Privilege
always:false and the skill is user-invocable. It does not request permanent platform-level presence and does not modify other skills or global agent configuration. It may read/create files in project directories and relies on wrangler OAuth tokens if present in the user's home directory (standard behaviour).
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install shellbot-website - After installation, invoke the skill by name or use
/shellbot-website - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.1.0
shellbot-website 1.1.0
- Added new resource provisioning scripts: provision-d1.sh, provision-kv.sh, provision-queue.sh.
- Improved and refactored deployment, secret management, and status scripts.
- Enhanced documentation in SKILL.md with expanded instructions and command usage.
- Provided clearer authentication guidance and non-interactive/automation notes.
- Expanded examples and quick start section for all supported provisioning commands.
v1.0.0
Initial release of shellbot-website.
- Build, deploy, and design micro apps and websites on Cloudflare Workers with production-ready scaffolds.
- Supports multiple templates including React Router + Hono (default), Next.js, Astro, Remix, and more.
- Automates deployment, custom domain setup, resource provisioning (D1, KV, R2, Queues), and secrets management.
- Non-interactive bash scripts tailored for safe agent invocation; destructive actions require explicit flags.
- Dual authentication: prioritizes API Token for CI/agents, with fallback to local OAuth via wrangler login.
- Handles complete project lifecycle, from scaffolding and deployment to teardown, using Cloudflare’s best practices.
Metadata
Frequently Asked Questions
What is Shellbot Website?
Build, deploy, and design micro apps and websites on Cloudflare Workers. Scaffolds from templates (React Router + Hono, Next.js, Astro, Remix), deploys, sets... It is an AI Agent Skill for Claude Code / OpenClaw, with 168 downloads so far.
How do I install Shellbot Website?
Run "/install shellbot-website" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Shellbot Website free?
Yes, Shellbot Website is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Shellbot Website support?
Shellbot Website is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Shellbot Website?
It is built and maintained by cohnen (@cohnen); the current version is v1.1.0.
More Skills