← 返回 Skills 市场
picodozbotdoz

dxyz-cPanel

作者 picodozbotdoz · GitHub ↗ · v1.0.0 · MIT-0
cross-platform ⚠ suspicious
106
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install dxyz-cpanel
功能描述
Manage cPanel hosting accounts via API for version 134.0.11 and compatible versions. Supports account management, DNS zones, email accounts, databases (MySQL...
使用说明 (SKILL.md)

dxyz-cPanel Skill

Manage cPanel hosting accounts via API (version 134.0.11 compatible).

Quick Start

Connect to cPanel API

# Using API token (recommended)
export CPANEL_HOST="https://your-server.com:2087"
export CPANEL_TOKEN="your-api-token"

# Test connection
exec command="curl -s -H 'Authorization: whm $CPANEL_TOKEN' '$CPANEL_HOST/json-api/version' | jq ."

Common Operations

List Accounts:

exec command="curl -s -H 'Authorization: whm $CPANEL_TOKEN' '$CPANEL_HOST/json-api/listaccts?api.version=1' | jq ."

Create Email Account:

exec command="curl -s -H 'Authorization: cpanel $CPANEL_TOKEN' '$CPANEL_HOST/execute/Email/add_pop?email=user&password=secure123&domain=example.com' | jq ."

API Types

API Purpose Endpoint Prefix
WHM API Server admin, account management /json-api/
UAPI cPanel user operations /execute/
cPanel API 2 Legacy (deprecated) /json-api/cpanel2

Authentication

API Token (Recommended)

  1. Generate in WHM → Development → Manage API Tokens
  2. Use header: Authorization: whm \x3Ctoken> (WHM) or Authorization: cpanel \x3Ctoken> (UAPI)

Basic Auth (Less Secure)

curl -u 'username:password' 'https://server:2087/json-api/...'

Core Operations

Account Management (WHM API)

Create Account:

exec command='curl -s -H "Authorization: whm $CPANEL_TOKEN" "$CPANEL_HOST/json-api/createacct?api.version=1&username=newuser&domain=newdomain.com&password=secure123&plan=default" | jq .'

Suspend/Unsuspend:

# Suspend
exec command='curl -s -H "Authorization: whm $CPANEL_TOKEN" "$CPANEL_HOST/json-api/suspendacct?api.version=1&user=username&reason=non-payment" | jq .'

# Unsuspend
exec command='curl -s -H "Authorization: whm $CPANEL_TOKEN" "$CPANEL_HOST/json-api/unsuspendacct?api.version=1&user=username" | jq .'

Terminate Account:

exec command='curl -s -H "Authorization: whm $CPANEL_TOKEN" "$CPANEL_HOST/json-api/removeacct?api.version=1&user=username" | jq .'

DNS Management (UAPI)

List DNS Zones:

exec command='curl -s -H "Authorization: cpanel $CPANEL_TOKEN" "$CPANEL_HOST/execute/DNS/zone_records?domain=example.com" | jq .'

Add DNS Record:

exec command='curl -s -H "Authorization: cpanel $CPANEL_TOKEN" "$CPANEL_HOST/execute/DNS/add_zone_record?domain=example.com&name=www&type=A&address=192.168.1.1&ttl=3600" | jq .'

Email Management (UAPI)

List Email Accounts:

exec command='curl -s -H "Authorization: cpanel $CPANEL_TOKEN" "$CPANEL_HOST/execute/Email/list_pops?domain=example.com" | jq .'

Create Email Account:

exec command='curl -s -H "Authorization: cpanel $CPANEL_TOKEN" "$CPANEL_HOST/execute/Email/add_pop?email=newuser&password=secure123&domain=example.com&quota=250" | jq .'

Set Email Forwarder:

exec command='curl -s -H "Authorization: cpanel $CPANEL_TOKEN" "$CPANEL_HOST/execute/Email/add_forwarder?domain=example.com&email=user&fwdopt=fwd&[email protected]" | jq .'

Database Management (UAPI)

Create MySQL Database:

exec command='curl -s -H "Authorization: cpanel $CPANEL_TOKEN" "$CPANEL_HOST/execute/Mysql/create_database?name=mydb" | jq .'

Create MySQL User:

exec command='curl -s -H "Authorization: cpanel $CPANEL_TOKEN" "$CPANEL_HOST/execute/Mysql/create_user?name=myuser&password=secure123" | jq .'

Grant Privileges:

exec command='curl -s -H "Authorization: cpanel $CPANEL_TOKEN" "$CPANEL_HOST/execute/Mysql/set_privileges_on_database?user=myuser&database=mydb&privileges=ALL%20PRIVILEGES" | jq .'

SSL Certificates (UAPI)

List SSL Certificates:

exec command='curl -s -H "Authorization: cpanel $CPANEL_TOKEN" "$CPANEL_HOST/execute/SSL/list_certs" | jq .'

Install Let's Encrypt:

exec command='curl -s -H "Authorization: cpanel $CPANEL_TOKEN" "$CPANEL_HOST/execute/SSL/install_ssl?domain=example.com&cert=$(cat cert.pem | jq -sR .)&key=$(cat key.pem | jq -sR .)" | jq .'

File Operations (UAPI)

List Files:

exec command='curl -s -H "Authorization: cpanel $CPANEL_TOKEN" "$CPANEL_HOST/execute/Fileman/list_files?dir=public_html" | jq .'

Upload File:

exec command='curl -s -H "Authorization: cpanel $CPANEL_TOKEN" "$CPANEL_HOST/execute/Fileman/upload_files?dir=public_html&[email protected]" | jq .'

Backup Operations (WHM API)

Create Account Backup:

exec command='curl -s -H "Authorization: whm $CPANEL_TOKEN" "$CPANEL_HOST/json-api/backupacct?api.version=1&user=username" | jq .'

Restore Account:

exec command='curl -s -H "Authorization: whm $CPANEL_TOKEN" "$CPANEL_HOST/json-api/restoreacct?api.version=1&user=username" | jq .'

Scripts

The skill includes helper scripts:

  • scripts/cpanel_api.sh - Generic API caller with error handling
  • scripts/create_account.sh - Create hosting account
  • scripts/manage_dns.sh - DNS zone management
  • scripts/manage_email.sh - Email account operations
  • scripts/manage_database.sh - MySQL/PostgreSQL operations
  • scripts/backup_account.sh - Backup/restore operations

Execute scripts using exec tool:

exec command="bash ~/.picoclaw/workspace-default/skills/dxyz-cpanel/scripts/cpanel_api.sh listaccts"

References

Load reference files using read_file tool when needed:

Configuration

Environment Variables

CPANEL_HOST="https://your-server.com:2087"  # WHM port
CPANEL_TOKEN="your-api-token"                # API token
CPANEL_USER="root"                           # WHM username

Config File

Create ~/.cpanel/config.json:

{
  "host": "https://your-server.com:2087",
  "token": "your-api-token",
  "default_plan": "default",
  "default_quota": 1000,
  "default_bwlimit": 10000
}

Version Compatibility

This skill supports:

  • cPanel 134.0.11 (primary target)
  • cPanel 134.x.x (all 134 minor versions)
  • cPanel 130.x - 133.x (backward compatible, some features may differ)

Version-Specific Notes

  • 134.0.11: Current target version
  • 134.0.x: API stable, minor bug fixes
  • 134.1.x: Feature additions, API backward compatible
  • Pre-134: Some UAPI modules may differ

Best Practices

  1. Use API Tokens: More secure than basic auth
  2. Rate Limiting: Max 100 requests/minute for WHM API
  3. Error Handling: Check metadata.result for status
  4. Idempotency: Use api.version=1 for consistent responses
  5. Logging: Enable API logs in WHM for audit trail
  6. Backups: Always backup before destructive operations

Common Errors

Error Cause Solution
Access denied Invalid token/permissions Regenerate token, check ACL
Account exists Duplicate username Use different username
Invalid domain Domain format/syntax Check DNS, use FQDN
Quota exceeded Disk limit reached Increase quota or cleanup

Security Notes

  • Store API tokens securely (use environment variables or encrypted config)
  • Use HTTPS (port 2087 for WHM, 2083 for cPanel)
  • Limit API token permissions via ACL
  • Enable two-factor authentication for WHM access
  • Audit API token usage regularly
安全使用建议
Before installing: (1) Expect to provide CPANEL_HOST and CPANEL_TOKEN — the skill needs a cPanel/WHM API token with appropriate ACLs; registry metadata failing to declare those is an omission. (2) Only grant the token the minimal permissions required (e.g., createacct, listaccts, DNS, Email, Mysql) and consider scoping by IP and expiration. (3) Review the included scripts (under scripts/) yourself; they will read ~/.cpanel/config.json (if present) and can read local files (e.g., cert.pem) when you run SSL/install commands. (4) Do not run these scripts with an over-privileged token on production servers until validated in a test/staging environment. (5) Confirm the publisher/source before trusting the skill (homepage is missing and owner ID is unfamiliar). (6) If you proceed, rotate tokens after testing and monitor API usage/logs in WHM for unexpected activity.
功能分析
Type: OpenClaw Skill Name: dxyz-cpanel Version: 1.0.0 The skill provides comprehensive cPanel/WHM management capabilities but contains several security vulnerabilities related to input handling. Multiple helper scripts, including manage_dns.sh, manage_email.sh, and create_account.sh, lack proper input sanitization or URL encoding for parameters, making them susceptible to API parameter injection. Additionally, backup_account.sh allows downloading backups to arbitrary local file paths via the -o flag, which poses a risk of unauthorized file overwrites on the agent's host system. While these appear to be unintentional design flaws rather than intentional malice, they represent a significant attack surface if the agent is prompted to process untrusted input.
能力评估
Purpose & Capability
Name, README, SKILL.md and included scripts all implement cPanel/WHM API operations (accounts, DNS, email, DB, backups). However the registry metadata declares no required environment variables or primary credential even though the runtime explicitly requires CPANEL_HOST and CPANEL_TOKEN (and optionally CPANEL_USER/CPANEL_CONFIG). The missing declaration is an incoherence that could surprise users.
Instruction Scope
SKILL.md and scripts instruct the agent to run curl via exec and to read files (e.g., cert.pem for SSL install) and to load a local config (~/.cpanel/config.json). Those actions are consistent with the stated functionality, but they permit reading local files and the local config file—so verify which local files the agent will be asked to access.
Install Mechanism
No install spec or remote downloads; the skill is instruction-plus-local-scripts only. That reduces supply-chain risk because nothing arbitrary is fetched or auto-executed from external URLs during install.
Credentials
Registry claims no required env vars or primary credential, yet all scripts and docs rely on CPANEL_HOST and CPANEL_TOKEN (and optionally CPANEL_USER or a config file path). This mismatch is a material omission: the skill will need a privileged API token which is not advertised in the registry metadata.
Persistence & Privilege
The skill does not request always:true and does not attempt to alter other skills or global agent settings. It includes helper scripts stored in the skill workspace that the agent may execute, which is typical for this kind of skill.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install dxyz-cpanel
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /dxyz-cpanel 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.0
dxyz-cpanel 1.0.0 - Initial release of the dxyz-cpanel skill for managing cPanel/WHM servers via API (version 134.0.11+ compatible) - Provides command, script, and reference examples for account management, DNS, email, databases, file operations, SSL, and backups - Integrates with UAPI, WHM API, and cPanel API 2; uses exec/read_file/write_file tool interfaces - Includes best practices, configuration samples, and compatibility notes for versions 130.x–134.x
元数据
Slug dxyz-cpanel
版本 1.0.0
许可证 MIT-0
累计安装 0
当前安装数 0
历史版本数 1
常见问题

dxyz-cPanel 是什么?

Manage cPanel hosting accounts via API for version 134.0.11 and compatible versions. Supports account management, DNS zones, email accounts, databases (MySQL... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 106 次。

如何安装 dxyz-cPanel?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install dxyz-cpanel」即可一键安装,无需额外配置。

dxyz-cPanel 是免费的吗?

是的,dxyz-cPanel 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。

dxyz-cPanel 支持哪些平台?

dxyz-cPanel 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 dxyz-cPanel?

由 picodozbotdoz(@picodozbotdoz)开发并维护,当前版本 v1.0.0。

💬 留言讨论