← 返回 Skills 市场
simonfunk

Coda.io

作者 simonfunk · GitHub ↗ · v1.2.0
cross-platform ⚠ suspicious
804
总下载
0
收藏
0
当前安装
3
版本数
在 OpenClaw 中安装
/install coda-io
功能描述
Interact with Coda.io docs, tables, rows, pages, and automations via the Coda REST API v1. Use when the user wants to read, write, update, or delete data in...
使用说明 (SKILL.md)

Coda API Skill

Interact with Coda.io via its REST API v1. Base URL: https://coda.io/apis/v1

Setup

  1. Get API token at https://coda.io/account → "API settings" → "Generate API token"
  2. Set env var: export CODA_API_TOKEN="\x3Ctoken>"
  3. Verify: bash scripts/coda.sh whoami

Helper Script

scripts/coda.sh wraps common operations. Run bash scripts/coda.sh help for usage.

Examples:

# List docs
bash scripts/coda.sh list-docs | jq '.items[].name'

# List tables in a doc
bash scripts/coda.sh list-tables AbCDeFGH | jq '.items[] | {id, name}'

# List columns (discover IDs before writing)
bash scripts/coda.sh list-columns AbCDeFGH grid-abc | jq '.items[] | {id, name}'

# Read rows with column names
bash scripts/coda.sh list-rows AbCDeFGH grid-abc 10 true | jq '.items'

# Insert rows
echo '{"rows":[{"cells":[{"column":"c-abc","value":"Hello"}]}]}' | \
  bash scripts/coda.sh insert-rows AbCDeFGH grid-abc

# Upsert rows (match on key column)
echo '{"rows":[{"cells":[{"column":"c-abc","value":"Hello"},{"column":"c-def","value":42}]}],"keyColumns":["c-abc"]}' | \
  bash scripts/coda.sh upsert-rows AbCDeFGH grid-abc

# Share doc
bash scripts/coda.sh share-doc AbCDeFGH [email protected] write

Workflow: Reading Data

  1. list-docs → find the doc ID
  2. list-tables \x3CdocId> → find the table ID
  3. list-columns \x3CdocId> \x3CtableId> → discover column IDs/names
  4. list-rows \x3CdocId> \x3CtableId> → read data

Workflow: Writing Data

  1. Discover column IDs first (step 3 above)
  2. Build row JSON with cells array using column IDs
  3. insert-rows (new data) or upsert-rows (with keyColumns for idempotent writes)
  4. Write ops return HTTP 202 + requestId → poll with mutation-status if confirmation needed

Key Concepts

  • IDs over names: Use resource IDs (stable) rather than names (user-editable)
  • Eventual consistency: Writes are async (HTTP 202). Poll mutation-status to confirm.
  • Pagination: List endpoints return nextPageToken. Pass as pageToken for next page.
  • Rate limits: Read 100/6s, Write 10/6s, Doc content write 5/10s. Respect 429 with backoff.
  • Fresh reads: Add header X-Coda-Doc-Version: latest to ensure non-stale data (may 400).
  • valueFormat: simple (default), simpleWithArrays, rich for structured data.
  • Doc ID from URL: https://coda.io/d/Title_d\x3CDOC_ID> → the part after _d is the doc ID.

Direct curl (when script doesn't cover it)

curl -s -H "Authorization: Bearer $CODA_API_TOKEN" \
  "https://coda.io/apis/v1/docs/{docId}/tables/{tableId}/rows?useColumnNames=true&limit=50"

For writes:

curl -s -H "Authorization: Bearer $CODA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -X POST -d '{"rows":[...]}' \
  "https://coda.io/apis/v1/docs/{docId}/tables/{tableId}/rows"

Full API Reference

See references/api-endpoints.md for complete endpoint listing with parameters, body schemas, and response details.

Searchable by section: Account, Folders, Docs, Pages, Tables, Columns, Rows, Formulas, Controls, Permissions, Publishing, Automations, Analytics, Miscellaneous.

安全使用建议
This skill is a coherent Coda API client, but note that the SKILL.md and included script require CODA_API_TOKEN even though the registry metadata does not declare it — that's a packaging inconsistency. Before installing: (1) only provide a Coda API token you trust and create a token with least privileges possible (dedicated account or restricted scope) so you can revoke it easily; (2) review the scripts/coda.sh content yourself (it is short and uses curl to call https://coda.io/apis/v1); (3) avoid pasting a high-privilege or personal token into untrusted agents — create a scoped token for this skill; (4) if you need stronger assurance, ask the publisher for a homepage/source repository or verify the publisher identity, since the skill's source/homepage are unknown. If you are comfortable with these points, the skill appears to do what it claims.
功能分析
Type: OpenClaw Skill Name: coda-io Version: 1.2.0 The skill bundle is classified as suspicious due to a JSON injection vulnerability in `scripts/coda.sh`. Several commands (e.g., `create-doc`, `create-folder`, `share-doc`, `trigger-automation`) construct JSON request bodies by directly interpolating user-provided arguments into JSON strings. If these arguments contain double quotes or backslashes, an attacker could inject arbitrary JSON, potentially altering the API request in unintended ways (e.g., changing folder IDs, adding unauthorized permissions, or manipulating automation payloads). While there is no evidence of intentional malicious behavior like data exfiltration or persistence, this lack of input sanitization for JSON construction is a significant vulnerability.
能力评估
Purpose & Capability
Name, description, SKILL.md, API reference, and the included script all align with a Coda REST API helper. The operations the skill performs (list/read/write/share/automations) match the stated purpose. However, the registry metadata lists no required environment variables or primary credential while SKILL.md and scripts explicitly require CODA_API_TOKEN — a packaging/metadata inconsistency.
Instruction Scope
Runtime instructions and the helper script limit actions to calling Coda's documented REST endpoints using the CODA_API_TOKEN. The skill does not instruct reading unrelated files, other env vars, or contacting unexpected external endpoints. All documented commands are scoped to Coda API interactions.
Install Mechanism
There is no install spec (instruction-only) and a small helper script is included. Nothing in the manifest downloads or extracts external code from untrusted URLs, so install risk is low. The script will be executed locally when run.
Credentials
The skill requires a single API credential (CODA_API_TOKEN), which is appropriate for the declared purpose. However, the registry metadata/requirements do not declare that env var (registry says none required) while SKILL.md and scripts require it — this mismatch can mislead users into thinking no credentials are needed. The requested secret name is appropriate for Coda, but users should limit the token's scope and treat it as sensitive.
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges. It does not modify other skills or system-wide agent settings. Autonomous invocation (disable-model-invocation=false) is the default and not by itself a red flag; it is not combined with other high-risk requests here.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install coda-io
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /coda-io 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.2.0
Fix: Move env declaration to metadata field for proper validation
v1.1.0
Fix: Declare required CODA_API_TOKEN env var in frontmatter metadata
v1.0.0
Initial release: Full Coda.io API v1 skill with helper script and endpoint reference
元数据
Slug coda-io
版本 1.2.0
许可证
累计安装 0
当前安装数 0
历史版本数 3
常见问题

Coda.io 是什么?

Interact with Coda.io docs, tables, rows, pages, and automations via the Coda REST API v1. Use when the user wants to read, write, update, or delete data in... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 804 次。

如何安装 Coda.io?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install coda-io」即可一键安装,无需额外配置。

Coda.io 是免费的吗?

是的,Coda.io 完全免费(开源免费),可自由下载、安装和使用。

Coda.io 支持哪些平台?

Coda.io 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Coda.io?

由 simonfunk(@simonfunk)开发并维护,当前版本 v1.2.0。

💬 留言讨论