← 返回 Skills 市场

Auth0 Token Vault

Name: Auth0 Token Vault
Author: deepu105

作者 Deepu K Sasidharan · GitHub ↗ · v0.4.0 · MIT-0

darwinlinux ✓ 安全检测通过

160

总下载

当前安装

版本数

在 OpenClaw 中安装

/install auth0-token-vault

功能描述

Access third-party services (Gmail, Slack, Google Calendar) on behalf of authenticated users via Auth0 Token Vault. Use when the user wants to search, read,...

使用说明 (SKILL.md)

Auth0 Token Vault CLI

Use the auth0-tv command-line tool to access third-party services on behalf of authenticated users via Auth0 Token Vault.

Current status

Auth status: !auth0-tv --json status 2>/dev/null || echo '{"error":{"code":"not_configured","message":"auth0-tv not configured or not logged in"}}'

When to use this skill

The user asks to read, search, send, reply, forward, archive, or delete emails
The user wants to manage email drafts or labels
The user wants to connect or disconnect a third-party service (Gmail, etc.)
The user asks about their authentication or connection status

Key patterns

Always use --json mode

All commands must use --json for structured output:

auth0-tv --json \x3Ccommand>

Alternatively, set AUTH0_TV_OUTPUT=json in the environment to avoid passing --json on every call.

Destructive actions require --confirm

Commands that modify data (send, delete, archive, forward, reply, draft send, draft delete) require --confirm:

auth0-tv --json --confirm gmail send --to [email protected] --subject "Subject" --body "Body"

Exit codes and recovery

Code	Meaning	Recovery action
0	Success	Parse JSON output
1	General error	Report error to user
2	Invalid input	Check command syntax and required flags
3	Auth required	Tell the user to run `auth0-tv login`
4	Connection required	Tell the user to run `auth0-tv connect \x3Cservice>`
5	Service error	Retry or report upstream API failure
6	Network error	Check connectivity, retry

Important: Exit codes 3 and 4 require human intervention — login and connect open a browser for OAuth. Do not attempt to run these commands autonomously; instead, tell the user what to run.

Body input for email composition

For send, reply, and draft create, the message body can be provided via:

--body "inline text" — short messages
--body-file ./message.txt — longer messages from a file
stdin: echo "body" | auth0-tv --json --confirm gmail send --to ... --subject ...

Prefer --body-file or stdin for messages containing special characters.

Available commands

Authentication & setup

auth0-tv login — authenticate via browser (human-in-the-loop)
auth0-tv logout — clear stored credentials
auth0-tv status — show current user and connected services
auth0-tv connect \x3Cservice> — connect a service via browser (human-in-the-loop)
auth0-tv disconnect \x3Cservice> — disconnect a service
auth0-tv connections — list connected services

Gmail

auth0-tv gmail search \x3Cquery> — search messages (supports Gmail search syntax)
auth0-tv gmail read \x3CmessageId> — read a message
auth0-tv gmail send — send a new message (destructive)
auth0-tv gmail reply \x3CmessageId> — reply to a message (destructive)
auth0-tv gmail forward \x3CmessageId> — forward a message (destructive)
auth0-tv gmail archive \x3CmessageId> — archive a message (destructive)
auth0-tv gmail delete \x3CmessageId> — move to trash (destructive)
auth0-tv gmail labels — list labels
auth0-tv gmail label \x3CmessageId> — add/remove labels
auth0-tv gmail draft create — create a draft
auth0-tv gmail draft list — list drafts
auth0-tv gmail draft send \x3CdraftId> — send a draft (destructive)
auth0-tv gmail draft delete \x3CdraftId> — delete a draft (destructive)

See references/commands.md for full command reference with flags and JSON output examples.

安全使用建议

This skill appears to do what it claims (call a local auth0-tv CLI to act on behalf of authenticated users). Before installing: 1) Verify the npm package source and publisher on the npm registry (look for homepage, repository, publisher identity, and recent versions); 2) Inspect the auth0-tv binary or its upstream repository if possible to confirm where it stores tokens and what it can do; 3) Be cautious about granting autonomous agents the ability to invoke this skill — destructive actions require --confirm but an agent could still send/read messages using stored tokens; 4) If you must install, run npm audit, review package files locally, and consider running the CLI manually first to understand its prompts and credential storage. The lack of a homepage/source and the small metadata version mismatch reduce confidence — verify provenance to raise your assurance level.

功能分析

Type: OpenClaw Skill Name: auth0-token-vault Version: 0.4.0 The skill is a legitimate wrapper for the `auth0-tv` CLI tool, designed to manage third-party services like Gmail via Auth0 Token Vault. It includes safety mechanisms such as requiring human intervention for authentication (`login`/`connect`) and mandatory confirmation flags (`--confirm`) for destructive actions. No evidence of malicious intent, data exfiltration, or prompt injection was found in SKILL.md or the command references.

能力评估

✓ Purpose & Capability

The name/description (Auth0 Token Vault, Gmail/Slack/Calendar access via Auth0) matches the runtime instructions and required binary (auth0-tv). The npm install (auth0-token-vault-cli) that provides auth0-tv is coherent with the stated purpose.

✓ Instruction Scope

SKILL.md confines agent behavior to invoking the auth0-tv CLI with --json and requires human-in-the-loop for login/connect flows. It specifies using --confirm for destructive actions and only mentions reading files explicitly for message body input. It does not instruct the agent to read unrelated files or env vars beyond an optional AUTH0_TV_OUTPUT setting.

ℹ Install Mechanism

Install is via an npm package (auth0-token-vault-cli), which is a typical distribution method for a CLI. This is moderate risk versus a vetted package manager tap or source, especially because the skill metadata has no homepage/source URL to verify the package origin. Also note the _meta.json version differs from the registry metadata (0.2.3 vs 0.4.0), a minor inconsistency worth checking.

ℹ Credentials

The skill declares no required env vars or credentials, which aligns with being a wrapper around a local CLI. However, auth0-tv will use locally stored Auth0/OAuth tokens (and may persist credentials locally), so the agent effectively gains the ability to act with those tokens. The skill does not declare where tokens are stored; this is proportionate to the purpose but important for user awareness.

ℹ Persistence & Privilege

The skill is not always-enabled and is user-invocable. Autonomous invocation is allowed (platform default). Because the CLI can perform actions on connected accounts, autonomous invocation increases blast radius if the agent is permitted to run destructive commands with --confirm; SKILL.md advises human intervention for login/connect and requires --confirm for destructive actions, which mitigates risk but does not eliminate it.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install auth0-token-vault
安装完成后，直接呼叫该 Skill 的名称或使用 /auth0-token-vault 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v0.4.0

update to v0.4.0

v0.3.1

update to v0.3.1

v0.3.0

Full command reference: Calendar, Slack, GitHub, fetch

v0.2.3

- Added detailed usage instructions and patterns to SKILL.md, including command structure, JSON output mode, and exit code handling. - Documented all supported commands for authentication, setup, and Gmail management, with clear conditions for when to use the skill. - Provided explicit guidance on safely composing and sending emails, including body input methods. - Clarified required human actions for authentication and service connection processes. - Outlined compatibility requirements and installation steps for Node.js and auth0-tv CLI.

v0.2.2

Initial ClawHub release

v0.2.1

Initial ClawHub release

元数据

Slug auth0-token-vault

版本 0.4.0

许可证 MIT-0

累计安装 1

当前安装数 1

历史版本数 6

常见问题