← 返回 Skills 市场
spzwin

cms-push-skill

作者 spzwin · GitHub ↗ · v1.6.6 · MIT-0
cross-platform ⚠ suspicious
205
总下载
0
收藏
1
当前安装
15
版本数
在 OpenClaw 中安装
/install cms-push-skill
功能描述
用于"发布 Skill / 上架 Skill / 推送 Skill / 更新已发布的 Skill / 下架 Skill / 把本地 Skill 上传到平台 / 同步到 ClawHub 或 GitHub"。一键完成 打包 → 七牛上传 → 平台注册/更新/下架。需要先通过 cms-auth-skills 取得 to...
使用说明 (SKILL.md)

当前版本: v1.6.1

cms-push-skill

只负责一件事:把已经准备好的 Skill 推送到平台。

这里说的“平台”,默认就是我们内部技能管理平台。

能力总览

# 能力 脚本 需要登录
1 注册新 Skill scripts/skill-management/register_skill.py
2 更新已有 Skill scripts/skill-management/update_skill.py
3 下架 Skill scripts/skill-management/delete_skill.py
4 一站式发布 scripts/skill-management/publish_skill.py
5 打包 Skill 目录为 ZIP scripts/skill-management/pack_skill.py
6 上传文件到七牛 scripts/skill-management/upload_to_qiniu.py

路由

  • 发布到我们内部平台:python3 cms-push-skill/scripts/skill-management/publish_skill.py ./my-skill --code my-skill --name "My Skill" --internal
  • 更新我们内部平台上的 Skill:python3 cms-push-skill/scripts/skill-management/publish_skill.py ./my-skill --code my-skill --update --version 1.1.0 --internal
  • 外部发布:python3 cms-push-skill/scripts/skill-management/publish_skill.py ./my-skill --code my-skill --name "My Skill" --external
  • 注册:python3 cms-push-skill/scripts/skill-management/register_skill.py --code my-skill --name "My Skill"
  • 更新:python3 cms-push-skill/scripts/skill-management/update_skill.py --code my-skill --name "New Name"
  • 下架:python3 cms-push-skill/scripts/skill-management/delete_skill.py --id \x3Cskill-id> --reason "原因"

如果用户要提交问题、查看问题列表、关闭问题,统一转到 references/issue-report/README.md 对应的 cms-report-issue;如果用户还没创建 Skill,可先使用 cms-create-skill

内部平台发布指引

如果你当前要把 Skill 发布到我们内部平台,最短路径是:

# 先准备鉴权
npx clawhub@latest install cms-auth-skills --force

# 首次发布到内部平台
python3 cms-push-skill/scripts/skill-management/publish_skill.py \
  ./my-skill --code my-skill --name "My Skill" --internal

# 更新内部平台上的 Skill
python3 cms-push-skill/scripts/skill-management/publish_skill.py \
  ./my-skill --code my-skill --update --version 1.1.0 --internal

如果你当前不是在做发布,而是遇到了线上问题、要反馈问题,不在本 Skill 内处理,直接转到 cms-report-issue

问题反馈接力

如果你当前正在 cms-push-skill 里发布或更新 Skill,后来要反馈问题,最短路径是:

# 安装问题反馈 Skill
npx clawhub@latest install cms-report-issue --force

# 提交问题
python3 cms-report-issue/scripts/issue_report/report_issue.py \
  --skill-code my-skill --version 1.1.0 --error "..."

# 查看问题列表
python3 cms-report-issue/scripts/issue_report/list_issues.py --skill-code my-skill

# 标记已解决
python3 cms-report-issue/scripts/issue_report/update_issue.py \
  --issue-id abc123 --status resolved --resolution "已修复"

同步选项

publish_skill.py 支持同步到 ClawHub 和 GitHub:

  • --sync-clawhub:同步到 ClawHub。
  • --sync-github:同步到 GitHub。
  • --no-sync-clawhub:不同步到 ClawHub。
  • --no-sync-github:不同步到 GitHub。

内部 Skill 默认两者都推,外部 Skill 不支持推送到 ClawHub。

规则

  1. 所有推送动作统一使用 scripts/skill-management/ 下的脚本。
  2. 推送前先通过 cms-auth-skills 准备好 access-token
  3. 内部 Skill 走七牛上传 + 平台注册。
  4. 外部 Skill 跳过七牛上传,直接使用 ClawHub 下载地址。
  5. 本 Skill 只维护推送链路;问题闭环统一交给 cms-report-issue
  6. 所有说明文档统一使用 Markdown,不维护旧接口文档目录。

能力树

cms-push-skill/
├── SKILL.md
├── references/
│   ├── issue-report/
│   │   └── README.md
│   └── skill-management/
│       └── README.md
└── scripts/
    └── skill-management/
        ├── delete_skill.py
        ├── pack_skill.py
        ├── publish_skill.py
        ├── register_skill.py
        ├── update_skill.py
        └── upload_to_qiniu.py
安全使用建议
Before installing or running this skill: (1) Review the Python scripts locally — they will POST your access token to the configured API_BASE and upload ZIPs to Qiniu. (2) Ensure you set and provide only tokens meant for the target platform (XG_USER_TOKEN / access-token / ACCESS_TOKEN); the registry metadata fails to declare these required env vars. (3) Do not use the --external option unless you trust the external download host (the code uses a hard-coded convex.site URL for external downloads). (4) Fix or be aware of verify=False in requests (consider changing to verify=True) because current code disables TLS certificate verification. (5) Run in an isolated environment or review network calls (API_BASE, CMS_API_BASE, Qiniu domain) if you are unsure. If you need a clean verdict, request the publisher to (a) declare required env vars in metadata, (b) remove/justify the hard-coded external URL, and (c) enable TLS verification by default.
功能分析
Type: OpenClaw Skill Name: cms-push-skill Version: 1.6.6 The skill bundle provides functional scripts for packaging, uploading, and registering skills to a CMS platform. However, it consistently disables SSL certificate verification (verify=False) in common.py, upload_to_qiniu.py, and all API-calling scripts, which is a significant security vulnerability that allows for Man-in-the-Middle (MITM) attacks. Additionally, publish_skill.py hardcodes an external third-party domain (convex.site) for downloading 'external' skills, which introduces an external dependency outside the primary platform's control.
能力评估
Purpose & Capability
The scripts included (pack, upload, register, update, delete, publish) align with the stated purpose of pushing skills to a platform; requiring an access-token via cms-auth-skills is expected. However the package registry metadata lists no required environment variables while the code clearly expects XG_USER_TOKEN / access-token / ACCESS_TOKEN and optionally XG_CORP_ID and CMS_API_BASE, which is an inconsistency.
Instruction Scope
Runtime instructions tell the agent to run the included Python scripts which make network requests to API_BASE (default https://skills.mediportal.com.cn), obtain Qiniu upload tokens, and upload ZIPs — consistent with purpose. Concerns: (1) an EXTERNAL_DOWNLOAD_URL_TEMPLATE points to a third-party domain (https://wry-manatee-359.convex.site) for external-mode download URLs — this redirects external skill download addresses to an unexpected host; (2) the scripts call requests with verify=False and suppress SSL warnings, disabling TLS verification (enables MITM risk); (3) scripts read environment variables (tokens, corp id, CMS_API_BASE) that were not declared in registry metadata.
Install Mechanism
This is an instruction-only skill with bundled Python scripts; there is no installer that fetches code from arbitrary URLs and no package manager install spec. Nothing is being downloaded at install time by the skill itself.
Credentials
The code legitimately needs an access token and optional corp ID to interact with the platform, but the skill metadata does not declare these required env vars. It also supports overriding API base via CMS_API_BASE. Requiring an access token is proportional for a publish tool, but be aware the token will be used to call platform APIs and to obtain Qiniu upload credentials; only provide tokens you trust for this use. The code's suppression of SSL verification increases risk if tokens are used against an attacker-controlled network.
Persistence & Privilege
The skill is not always-enabled and does not request persistent system-wide privileges. It does not modify other skills' config files. Autonomous invocation is allowed by default but not combined with other high privileges here.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install cms-push-skill
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /cms-push-skill 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.6.6
同步内部平台版本 1.6.2 到 ClawHub
v1.6.5
同步内部平台 1.6.2 更新到 ClawHub,版本号提升至 1.6.5 以保持版本一致性
v1.6.4
- Bumped version from 1.6.1 to 1.6.2. - Updated SKILL.md with latest version and details. - Removed _meta.json and package.json files.
v1.6.3
CMS Skill 创建工具更新 - 版本 1.21.1,优化技能创建流程和文档结构
v1.6.2
更新到版本 1.6.2,同步内部平台更新
v1.6.1
更新到版本 1.6.1,同步内部平台更新
v1.5.1
- 添加 --sync-robot 参数支持,report_issue.py 可以触发 Issue 机器人(同步到 GitHub Issue),与 --sync-github 等价 - 更新问题上报命令与示例:新增 --sync-robot 相关参数说明,并修正文档示例 - auto_catch 装饰器增加 sync_robot 参数示例 - SKILL.md 文档修正,反映同步选项的最新用法
v1.5.0
Sync from internal platform update
v1.0.8
sync internal update 1.0.8
v1.0.7
v1.0.7 更新简要 - 文档更新:SKILL.md 版本号由 v1.0.2 升级为 v1.0.7,描述内容同步调整优化,补充更加精炼的说明与用例细节。 - 多个脚本文件(包含发布、打包、上传、问题上报和状态管理等模块)更新,提升代码可靠性和易用性。 - 用户操作和路由命令及相关环境变量要求在说明文档中进行了进一步澄清。 - 保持所有脚本和功能点与平台协议和依赖统一,强化与 ClawHub/GitHub 双向同步支持。
v1.0.6
Sync from internal platform release 1.0.6
v1.0.5
sync internal platform update
v1.0.2
No functional or content changes in this release. - Updated documentation to add version marker (v1.0.2) in SKILL.md. - No file or feature changes detected.
v1.0.1
- 新增 cms-push-skill,负责 Skill 的打包、上传、注册/更新/下架及同步到 ClawHub、GitHub - 增加完整的一站式 Skill 发布、管理脚本(21 个核心脚本新增,包含 skill-management 与 issue_report) - 引入问题反馈和状态管理工具,支持问题自动捕获、上报、筛选与状态流转 - 提供标准化 GitHub Issue 表单模板(多类型 YAML 配置) - 移除旧的鉴权脚本与文档(scripts/auth/) - SKILL.md 全面重写,明确能力、用法与依赖
v1.0.0
Initial release of the CMS 基础鉴权 Skill. - Provides a standardized way for all upper-layer Skills to obtain appKey and access-token, strictly prohibiting hardcoding or custom assembly. - Defines clear responsibilities: only returns appKey or access-token, does not handle other business capabilities. - Outlines complete usage conventions, context handling, header construction, and result output rules. - Specifies Python-only scripts with zero dependencies, consistent stdout/stderr handling, and secure logging. - Establishes robust caching, environment variable fallback, and command-line usage patterns. - Includes detailed documentation on proper invocation, authentication flow, and error handling.
元数据
Slug cms-push-skill
版本 1.6.6
许可证 MIT-0
累计安装 1
当前安装数 1
历史版本数 15
常见问题

cms-push-skill 是什么?

用于"发布 Skill / 上架 Skill / 推送 Skill / 更新已发布的 Skill / 下架 Skill / 把本地 Skill 上传到平台 / 同步到 ClawHub 或 GitHub"。一键完成 打包 → 七牛上传 → 平台注册/更新/下架。需要先通过 cms-auth-skills 取得 to... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 205 次。

如何安装 cms-push-skill?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install cms-push-skill」即可一键安装,无需额外配置。

cms-push-skill 是免费的吗?

是的,cms-push-skill 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。

cms-push-skill 支持哪些平台?

cms-push-skill 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 cms-push-skill?

由 spzwin(@spzwin)开发并维护,当前版本 v1.6.6。

💬 留言讨论