功能描述

Manage private Coda Packs by listing, creating, updating metadata, and deleting Packs using the Coda REST API v1 and CODA_API_TOKEN.

使用说明 (SKILL.md)

Coda Packs Skill

Name: Coda Packs
Author: 0x7466

Manage Coda Packs through the REST API v1. Create, list, update, and delete private Packs.

⚠️ API Limitations

The Coda REST API v1 has limited Pack management capabilities:

Feature	REST API	Pack SDK CLI
List Packs	✅ Available	✅
Create Pack	✅ Available	✅
Update Pack	✅ Available	✅
Delete Pack	✅ Available	✅
Build Versions	❌ Not available	✅ Required
Gallery Submit	❌ Not available	✅ Required
Analytics	❌ Not available	✅ Required
Collaborators	❌ Not available	✅ Required

For builds, gallery submission, and advanced features, use:

npx @codahq/packs-sdk register    # Create account
npx @codahq/packs-sdk build       # Build Pack
npx @codahq/packs-sdk release     # Submit to Gallery

When to Use

Use this skill when the user wants to:

List existing Coda Packs
Create new private Pack shells
Update Pack metadata (name, description)
Delete unused Packs

When NOT to Use

Do NOT use for Doc management (tables, rows, pages) → use coda skill
Do NOT use for building Pack versions → use Pack SDK CLI
Do NOT use for Gallery submission → use Pack SDK CLI
Do NOT use for viewing analytics → use Pack SDK CLI or Coda web UI

Prerequisites

API Token: Set environment variable CODA_API_TOKEN
- Get token at: https://coda.io/account -> API Settings
- Must have Pack management permissions
Python 3.7+ with requests library

Quick Start

# Setup
export CODA_API_TOKEN="your_token_here"

# List your Packs
python scripts/coda_packs_cli.py packs list

# Create new Pack shell
python scripts/coda_packs_cli.py packs create \
  --name "My Integration" \
  --description "Does cool things"

# Update Pack
python scripts/coda_packs_cli.py packs update my-pack-id \
  --description "Updated description"

# Delete Pack (requires confirmation)
python scripts/coda_packs_cli.py packs delete my-pack-id

Full Pack Development Workflow

Since the REST API only supports basic Pack management, here's the complete workflow:

Step 1: Create Pack Shell (via REST API)

python scripts/coda_packs_cli.py packs create \
  --name "Karakeep Bookmarks" \
  --description "Save and search bookmarks"

Step 2-4: Use Pack SDK CLI (Required)

# Install Pack SDK
npm install -g @codahq/packs-sdk

# Initialize Pack project
npx @codahq/packs-sdk init karakeep-pack

# Develop your Pack (edit pack.ts)
# See: https://coda.io/packs/build/latest/guides/quickstart/

# Build and upload
npx @codahq/packs-sdk build
npx @codahq/packs-sdk upload

# Submit to Gallery (when ready)
npx @codahq/packs-sdk release

CLI Tool Usage

Pack Management

# List all your Packs
python scripts/coda_packs_cli.py packs list

# Get Pack details
python scripts/coda_packs_cli.py packs get 48093
python scripts/coda_packs_cli.py packs get "Karakeep"

# Create new Pack
python scripts/coda_packs_cli.py packs create \
  --name "My Pack" \
  --description "Description" \
  --readme "# My Pack\
\
Details here"

# Update Pack metadata
python scripts/coda_packs_cli.py packs update my-pack-id \
  --name "New Name" \
  --description "New description"

# Delete Pack (requires confirmation)
python scripts/coda_packs_cli.py packs delete my-pack-id
# Or skip confirmation: --force

Pack ID Resolution

The CLI accepts both numeric Pack IDs and Pack Names:

# These are equivalent:
python scripts/coda_packs_cli.py packs get 48093
python scripts/coda_packs_cli.py packs get "Karakeep"

If the name is ambiguous, the CLI lists matches and exits.

Safety Guardrails

Operations Requiring Confirmation

Operation	Risk	Confirmation
Delete Pack	Irreversible	"Delete Pack 'X'? This cannot be undone."

No Confirmation Required

Create Pack: Safe, reversible
List/Get Packs: Read-only
Update Pack: Reversible

Error Handling

Common API errors:

Code	Meaning	Resolution
`401`	Invalid token	Refresh CODA_API_TOKEN
`403`	Insufficient permissions	Ensure token has Pack management rights
`404`	Pack not found	Check Pack ID or name
`429`	Rate limited	Wait and retry (handled automatically)

References

Pack SDK Guides: https://coda.io/packs/build/latest/guides/overview/
Pack SDK Quickstart: https://coda.io/packs/build/latest/guides/quickstart/
Coda API Docs: https://coda.io/developers/apis/v1
Pack SDK NPM: https://www.npmjs.com/package/@codahq/packs-sdk

Example: Karakeep Pack Shell

Created for testing:

Name: Karakeep
ID: 48093
Description: Karakeep bookmark manager - save URLs, search, and organize with tags

Next steps for full Pack development:

Use Pack SDK CLI: npx @codahq/packs-sdk init karakeep-pack
Implement Karakeep API integration (see https://docs.karakeep.app/api/)
Build and upload: npx @codahq/packs-sdk build && npx @codahq/packs-sdk upload

安全使用建议

This skill appears to do what it says (manage Coda Packs) and the included Python code matches the documentation, but the registry metadata incorrectly omits the required CODA_API_TOKEN. Before installing: (1) confirm the publisher and trust the source; (2) only provide a CODA API token scoped to Pack management (least privilege); (3) prefer creating a dedicated account/token for automation that can be revoked; (4) review and, if possible, run the included script in a sandbox or test environment first to observe network calls (they should be to coda.io only); (5) ask the publisher to update registry metadata to declare CODA_API_TOKEN so automated permission checks are accurate. If you cannot verify the source or cannot scope the token safely, avoid installing.

功能分析

Type: OpenClaw Skill Name: coda-packs Version: 1.0.0 The OpenClaw AgentSkills skill bundle for Coda Packs is benign. The `SKILL.md` clearly defines the skill's purpose (managing Coda Packs via REST API) and its limitations, directing users to the Coda Pack SDK CLI for out-of-scope features. It explicitly requires a `CODA_API_TOKEN` environment variable, which is necessary for its stated function. The `scripts/coda_packs_cli.py` script uses this token to interact solely with the official Coda API (`https://coda.io/apis/v1`). It includes safety confirmations for destructive operations like deleting packs and does not contain any evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent to perform unauthorized actions. All observed behaviors are aligned with the stated purpose.

能力评估

ℹ Purpose & Capability

The SKILL.md and the included Python CLI implement Coda Pack management via the Coda REST API and explicitly require CODA_API_TOKEN — that capability matches the name/purpose. However, the registry metadata lists no required environment variables even though the skill needs an API token, which is an inconsistency between declared metadata and actual requirements.

✓ Instruction Scope

Runtime instructions are scoped to listing/creating/updating/deleting private Packs and to using the Pack SDK for builds/advanced features. The SKILL.md does not instruct the agent to read unrelated system files or exfiltrate data to unexpected endpoints; it only requires the Coda API token and standard HTTP access to coda.io.

ℹ Install Mechanism

There is no install spec (instruction-only), which reduces install-time risk. However, the skill includes an executable Python CLI script (scripts/coda_packs_cli.py) that will be run by the agent; the package does not provide an automated install step or sandboxing guidance. This is reasonable but worth noting: code will run locally when invoked.

⚠ Credentials

The tool legitimately requires a single credential (CODA_API_TOKEN) for the coda.io API, which is proportionate. The concern is that the registry metadata does not declare this required environment variable while SKILL.md and the script both require it. Missing metadata can lead users or automated systems to grant incorrect permissions or miss required secrets.

✓ Persistence & Privilege

The skill does not request always:true and does not attempt to modify other skills or system-wide settings. It runs on-demand (or can be invoked autonomously per platform defaults), which is normal for skills.

版本历史

v1.0.0

Initial release: Manage Coda Pack shells via REST API v1. Supports listing, creating, updating, and deleting private Packs. Note: Builds, Gallery submission, Analytics require Pack SDK CLI (npx @codahq/packs-sdk).

元数据

Slug coda-packs

版本 1.0.0

许可证 —

累计安装 3

当前安装数 2

历史版本数 1

常见问题

Coda Packs 是什么？

Manage private Coda Packs by listing, creating, updating metadata, and deleting Packs using the Coda REST API v1 and CODA_API_TOKEN. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 962 次。

如何安装 Coda Packs？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install coda-packs」即可一键安装，无需额外配置。

Coda Packs 是免费的吗？

是的，Coda Packs 完全免费（开源免费），可自由下载、安装和使用。

Coda Packs 支持哪些平台？

Coda Packs 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Coda Packs？

由 TFM（@0x7466）开发并维护，当前版本 v1.0.0。

Coda Packs