← 返回 Skills 市场

Appian Unnamedobjects

Name: Appian Unnamedobjects
Author: solarspiker

作者 solarspiker · GitHub ↗ · v1.3.0 · MIT-0

cross-platform ⚠ suspicious

109

总下载

当前安装

版本数

在 OpenClaw 中安装

/install appian-unnamedobjects

功能描述

Find Appian application objects that are missing a description. Exports the application, scans all object XML files, and reports name and UUID for each objec...

使用说明 (SKILL.md)

Appian Unnamed Objects

Exports an Appian application and scans every object XML file for objects whose \x3Cdescription> tag is empty or missing. Reports type, name, and UUID for each offending object.

Usage

node {baseDir}/scripts/index.js \x3CapplicationUuid>

Example

node {baseDir}/scripts/index.js _a-0000de15-1f1c-8000-5130-010000010000_12559

IMPORTANT: credentials are pre-configured

APPIAN_BASE_URL and APPIAN_API_KEY are already injected by OpenClaw at runtime. Never ask the user for credentials before running this skill. Just execute it with the UUID the user provided.

How users can ask for this

"Find Appian objects without descriptions in application \x3Cuuid>"
"Which Appian objects are undocumented in \x3Cuuid>"
"Audit Appian missing descriptions in \x3Cuuid>"
"Check Appian documentation coverage for \x3Cuuid>"

What it does

Calls the Appian v2 Deployment Management API to export the application as a ZIP.
Parses the ZIP in-process (no shell extraction) using Node.js built-ins — one object per XML file, type from directory name.
Iterates every XML file outside META-INF/.
For each object, checks whether \x3Cdescription> or \x3Ca:description> is absent or blank.
Prints a grouped report of offending objects.

After running

Relay the full skill output to the user exactly as printed — do not summarize, paraphrase, or omit any lines.

The output already contains every object type, name, and UUID in a compact readable format. Your job is to forward it verbatim, then offer to help further. Do not replace the list with a vague count like "15 objects were found" — the user needs the actual names and details.

External endpoints

POST ${APPIAN_BASE_URL}/deployments — triggers the export
GET ${APPIAN_BASE_URL}/deployments/{uuid} — polls for completion
GET \x3CpackageZip URL> — downloads the resulting ZIP

Security

Credentials (APPIAN_BASE_URL, APPIAN_API_KEY) are read from environment variables (injected by OpenClaw at runtime). If not injected, falls back to appian.json in the current working directory.
The ZIP is written to ~/appian-exports/ and mirrored to CWD/appian-exports/ when running in a container.
No data is sent to any third-party service.
No shell commands are executed; ZIP extraction uses Node.js built-in zlib.

安全使用建议

This skill appears to do what it claims: it uses your APPIAN_BASE_URL and APPIAN_API_KEY to export an application and scan XML files for empty/missing <description> tags. Before installing, consider: 1) The exported ZIP is written to your home directory and a copy to the current working directory — the package may contain sensitive data, so run in a safe/isolated workspace or clean up files after use. 2) The skill will read appian.json from the current directory or parent directories as a fallback, so ensure no unexpected credential files are present. 3) The SKILL.md requires the agent to forward the full raw output verbatim — be aware that this could expose sensitive object names or contents to whoever receives the output. 4) Limit the API key's scope where possible and rotate it if you decide to stop trusting the skill. 5) If you need higher assurance, review the full script in a sandbox or run it manually with a throwaway account first.

功能分析

Type: OpenClaw Skill Name: appian-unnamedobjects Version: 1.3.0 The skill is designed to audit Appian application objects for missing descriptions by exporting the application via the Appian API and scanning the resulting XML files. The implementation in `scripts/index.js` uses standard Node.js built-ins for network requests and file operations, including a custom ZIP parser to avoid external dependencies. While it writes exported ZIP files to the user's home directory and requires sensitive credentials (API keys), these behaviors are clearly documented in `SKILL.md` and are necessary for the stated functionality. There is no evidence of data exfiltration to third parties or malicious execution.

能力标签

requires-sensitive-credentials

能力评估

✓ Purpose & Capability

Name/description ask to export an Appian application and scan XML files; the skill only requires APPIAN_BASE_URL and APPIAN_API_KEY and the code calls Appian deployment endpoints and downloads the package ZIP as described — these requirements are proportionate to the declared purpose.

ℹ Instruction Scope

SKILL.md and the script keep behavior within the stated audit scope (trigger export, poll, download ZIP, scan XML entries). However the instructions insist the agent 'relay the full skill output verbatim' which increases the chance of exposing sensitive information if the export contains secrets or sensitive metadata. The runtime also falls back to reading appian.json for credentials if environment variables are not present.

✓ Install Mechanism

No install spec (instruction-only skill with a single Node script). Nothing is downloaded from unknown third-party URLs by the skill itself beyond the Appian package ZIP; low install risk.

ℹ Credentials

Only APPIAN_BASE_URL and APPIAN_API_KEY are required, which matches the API calls the skill performs. As a caveat, the script looks for an appian.json file up to 5 parent directories as a fallback and will populate process.env from it — this is reasonable but means local files containing credentials may be read if env vars are missing.

ℹ Persistence & Privilege

always is false and the skill does not alter other skills. It persists downloaded exports to ~/appian-exports and copies them into CWD/appian-exports when in a container; exported ZIPs therefore remain on-disk and may contain sensitive data. This persistent storage is expected for the stated purpose but is worth noting.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install appian-unnamedobjects
安装完成后，直接呼叫该 Skill 的名称或使用 /appian-unnamedobjects 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.3.0

appian-unnamedobjects 1.3.0 - Updated scripts/index.js (details not specified). - No changes to user-facing documentation or usage. - Maintained all core functionality and security practices. - Skill continues to scan Appian application objects for missing or empty descriptions and reports results as before.

v1.2.0

- Improved internal implementation in scripts/index.js; no user-facing changes. - All functionality and usage remain the same.

v1.1.2

- Updated trigger phrases in the description and usage section to explicitly mention "Appian" for clarity. - No changes to functionality; documentation only.

v1.1.1

- Updated instructions: Now requires the full skill output to be relayed to the user exactly as printed, without paraphrasing or summarizing. - Emphasized: Do not replace the report with only a count; users must see the actual object names and details. - Usage guidance expanded to clarify response handling expectations.

v1.1.0

- Added detailed SKILL.md documentation explaining usage, required environment variables, example commands, and output expectations. - Clarified that credentials (APPIAN_BASE_URL, APPIAN_API_KEY) are pre-configured and should never be requested from users. - Enhanced skill description with trigger phrases and security information. - Outlined supported Appian API endpoints and summarized application object export and scanning process. - Provided guidance on user prompts and how to interpret results.

元数据

Slug appian-unnamedobjects

版本 1.3.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 5

常见问题