功能描述

Call EngageLab Web Push REST APIs to send push notifications and in-app messages to web browsers (Chrome, Firefox, Safari, Edge, etc.); manage tags and alias...

使用说明 (SKILL.md)

\r \r

EngageLab Web Push API Skill\r

Name: EngageLab Web Push
Author: devengagelab

\r This skill enables interaction with the EngageLab Web Push REST API (MTPush Web). The service supports push notifications and in-app messages to web platforms only, with support for EngageLab channel and system channels (Chrome, Firefox, Safari, Edge, Opera).\r \r It covers these areas:\r \r

Create Push — Send notification or message to single/multiple web devices (broadcast, tag, alias, registration_id)\r
Batch Single Push — Batch push by registration_id or alias (up to 500 per request)\r
Group Push — Push to all apps in a group\r
Scheduled Tasks — Create, get, update, delete scheduled web push tasks (single, periodical, intelligent)\r
Tag & Alias — Query/set/delete device tags and aliases; query tag count\r
Delete User — Delete a user (registration_id) and all associated data\r
Statistics — Message lifecycle stats (targets, sent, delivered, impressions, clicks by channel)\r
Callback — Webhook setup and signature verification\r \r

Resources\r

\r

scripts/\r

\r

webpush_client.py — Python client class (EngageLabWebPush) wrapping create push, batch push (regid/alias), device get/set/delete, tag count, scheduled tasks CRUD, and message details. Handles Basic auth and typed error handling.\r \r

references/\r

\r

error-codes.md — Web Push API error codes and descriptions\r
http-status-code.md — HTTP status code specification\r
callback-api.md — Callback address, validation, security (X-CALLBACK-ID, HMAC-SHA256)\r \r Source API docs: doc/webpush/REST API/ (REST API Overview, Create Push API, Batch Single Push API, Group Push API, Scheduled Tasks API, Tag Alias API, Delete User API, Statistics API, Callback API, HTTP Status Code).\r \r

Authentication\r

\r All EngageLab Web Push API calls use HTTP Basic Authentication.\r \r

Base URL (choose by data center):\r
- Singapore: https://webpushapi-sgp.engagelab.com\r
- Hong Kong: https://webpushapi-hk.engagelab.com\r
Header: Authorization: Basic base64(appKey:masterSecret)\r
Content-Type: application/json\r \r Obtain AppKey and Master Secret from Console → Application Settings → Application Info.\r \r Group Push uses different auth: username = group- + GroupKey, password = Group Master Secret (from Group management).\r \r Example (curl):\r \r

curl -X POST https://webpushapi-sgp.engagelab.com/v4/push \\r
  -H "Content-Type: application/json" \\r
  -u "YOUR_APP_KEY:YOUR_MASTER_SECRET" \\r
  -d '{ "from": "push", "to": "all", "body": { "platform": "web", "notification": { "web": { "alert": "Hello!", "title": "Web Push", "url": "https://example.com" } } } }'\r
```\r
\r
If the user hasn't provided credentials, ask for **AppKey** and **Master Secret** before generating API calls.\r
\r
## Request Rate Limits\r
\r
- **Standard**: 500 requests per second per AppKey.\r
- Batch Single Push shares the same QPS quota as the Push API (1 target = 1 QPS).\r
\r
## Quick Reference — Main Endpoints\r
\r
| Operation | Method | Path |\r
|-----------|--------|------|\r
| Create push | `POST` | `/v4/push` |\r
| Batch push by registration_id | `POST` | `/v4/batch/push/regid` |\r
| Batch push by alias | `POST` | `/v4/batch/push/alias` |\r
| Group push | `POST` | `/v4/grouppush` |\r
| Create scheduled task | `POST` | `/v4/schedules` |\r
| Get scheduled task | `GET` | `/v4/schedules/{schedule_id}` |\r
| Update scheduled task | `PUT` | `/v4/schedules/{schedule_id}` |\r
| Delete scheduled task | `DELETE` | `/v4/schedules/{schedule_id}` |\r
| Tag count | `GET` | `/v4/tags_count` |\r
| Get device (tags/alias) | `GET` | `/v4/devices/{registration_id}` |\r
| Set device tags/alias | `POST` | `/v4/devices/{registration_id}` |\r
| Delete device (user) | `DELETE` | `/v4/devices/{registration_id}` |\r
| Message statistics | `GET` | `/v4/messages/details` (message_ids) |\r
\r
## Create Push (`POST /v4/push`)\r
\r
Push a notification or message to web devices. Platform is **web** only.\r
\r
### Request structure (summary)\r
\r
| Field | Type | Required | Description |\r
|-------|------|----------|-------------|\r
| `from` | string | No | Sender, e.g. `"push"` |\r
| `to` | string or object | Yes | Target: `"all"` (broadcast, devices active within 30 days), or object with `tag`, `tag_and`, `tag_not`, `alias`, `registration_id` |\r
| `body` | object | Yes | See below |\r
| `request_id` | string | No | Client-defined request ID returned in response |\r
| `custom_args` | object | No | Returned on callback |\r
\r
### body\r
\r
| Field | Type | Required | Description |\r
|-------|------|----------|-------------|\r
| `platform` | string | Yes | Must be `"web"` |\r
| `notification` | object | Optional* | Notification content (web: alert, title, url, icon, image, extras) |\r
| `message` | object | Optional* | In-app/custom message (msg_content, title, content_type, extras) |\r
| `options` | object | No | time_to_live, override_msg_id, big_push_duration, web_buttons, multi_language, third_party_channel (w3push.distribution), plan_id, cid |\r
\r
*One of notification or message must exist; they cannot coexist.\r
\r
### notification.web\r
\r
| Field | Type | Required | Description |\r
|-------|------|----------|-------------|\r
| `alert` | string | Yes | Message content |\r
| `url` | string | Yes | Click jump URL |\r
| `title` | string | No | Message title |\r
| `icon` | string | No | Notification icon (recommended 192×192px; ≤1MB; JPG/PNG/GIF; Chrome, Firefox) |\r
| `image` | string | No | Big image (recommended 360×180px; ≤1MB; Chrome, Edge) |\r
| `extras` | object | No | Custom key-value for business |\r
\r
### options (highlights)\r
\r
- **time_to_live**: Offline retention in seconds (default 86400, max 15 days); 0 = online only.\r
- **override_msg_id**: Override a previous message (effective 1 day).\r
- **big_push_duration**: Throttled push over n minutes (max 1440); max 20 throttled pushes at once.\r
- **web_buttons**: Array of up to 2 buttons (id, text, icon, url); Chrome 48+.\r
- **multi_language**: Per-language content/title (e.g. en, zh-Hans).\r
- **third_party_channel.w3push.distribution**: `first_ospush` | `mtpush` | `secondary_push` | `ospush` for system channel priority.\r
- **plan_id**, **cid**: Push plan ID and duplicate-prevention ID (max 64 chars, unique per AppKey).\r
\r
### Push target `to` examples\r
\r
- Broadcast: `"to": "all"`\r
- Tags (OR): `"to": { "tag": ["tag1","tag2"] }`\r
- Tags (AND): `"to": { "tag_and": ["tag3","tag4"] }`\r
- Tag NOT: `"to": { "tag_not": ["tag5"] }`\r
- Alias: `"to": { "alias": ["user1","user2"] }` (up to 1000)\r
- Registration IDs: `"to": { "registration_id": ["id1","id2"] }` (up to 1000)\r
\r
### Response (success)\r
\r
```json\r
{ "request_id": "12345678", "msg_id": "1828256757" }\r
```\r
\r
Notification body length limit: 2048 bytes (doc); total message limit 4000 bytes. See `doc/webpush/REST API/Create Push API.md`. Error codes: `references/error-codes.md`.\r
\r
## Batch Single Push\r
\r
- **By registration_id**: `POST /v4/batch/push/regid`\r
- **By alias**: `POST /v4/batch/push/alias`\r
\r
Request body: `{ "requests": [ { "target": "reg_id_or_alias", "platform": "web", "notification": { "web": { "alert", "title", "url", ... } }, "message": {...}, "options": {...}, "custom_args": {...} } ] }`. Max **500** items per request; `target` must be unique. See `doc/webpush/REST API/Batch Single Push API.md`.\r
\r
## Group Push\r
\r
`POST /v4/grouppush` — Same body structure as Create Push (platform `web`, notification.web). Auth: Basic with `group-{GroupKey}` and Group Master Secret. override_msg_id and Schedule API not supported for group push.\r
\r
## Scheduled Tasks\r
\r
- Create: `POST /v4/schedules` — Body: `name`, `enabled`, `trigger` (single / periodical / intelligent), `push` (same as Create Push body with platform web).\r
- Get: `GET /v4/schedules/{schedule_id}`.\r
- Update: `PUT /v4/schedules/{schedule_id}`.\r
- Delete: `DELETE /v4/schedules/{schedule_id}`.\r
\r
Trigger types: **single** (time, zone_type), **periodical** (start, end, time, time_unit, point, zone_type), **intelligent** (backup_time: `"now"` or `"yyyy-MM-dd HH:mm:ss"`). Max 1000 valid scheduled tasks. See `doc/webpush/REST API/Scheduled Tasks API.md`.\r
\r
## Tag & Alias\r
\r
- **Tag count**: `GET /v4/tags_count?tags=tag1&tags=tag2&platform=web` (up to 1000 tags; platform for Web Push is typically `web` — confirm in doc).\r
- **Get device**: `GET /v4/devices/{registration_id}` — Returns `tags`, `alias`.\r
- **Set device**: `POST /v4/devices/{registration_id}` — Body: `{ "tags": { "add": ["t1"], "remove": ["t2"] }, "alias": "alias1" }`.\r
\r
Limits: 100,000 tags per app; 40 bytes per tag; 100 tags per device; 100,000 devices per tag; one alias per device (40 bytes); 100,000 aliases per app. See `doc/webpush/REST API/Tag Alias API.md`.\r
\r
## Delete User\r
\r
`DELETE /v4/devices/{registration_id}` — Asynchronously deletes user and all related data. Cannot be restored. Batch deletion not supported.\r
\r
## Statistics\r
\r
- **Message details**: `GET /v4/messages/details?message_ids=id1,id2` (up to 100 message_ids). Returns targets, sent, delivered, impressions, clicks, and sub-stats by channel (sub_web: engageLab_web, chrome, safari, firefox, edge, opera). Data retained up to one month. See `doc/webpush/REST API/Statistics API.md`.\r
\r
## Callback\r
\r
Configure callback URL (via Engagelab support). Validation: server sends POST with `echostr` in body; respond with body = `echostr` value. Security: use `X-CALLBACK-ID` header; `signature = HMAC-SHA256(secret, timestamp+nonce+username)`. Respond with 200/204 within 3 seconds for success. See `references/callback-api.md` and `doc/webpush/REST API/Callback API.md`.\r
\r
## Generating Code\r
\r
When the user asks to send web push or use other Web Push APIs, generate working code. Default to **curl** unless the user specifies a language. Supported: **curl**, **Python** (requests), **Node.js** (fetch/axios), **Java** (HttpClient), **Go** (net/http). Always include the Authorization header and error handling. Use placeholders `YOUR_APP_KEY` and `YOUR_MASTER_SECRET` if credentials are not provided.\r
\r
### Python Example — Create Web Push\r
\r
```python\r
import requests\r
\r
APP_KEY = "YOUR_APP_KEY"\r
MASTER_SECRET = "YOUR_MASTER_SECRET"\r
BASE_URL = "https://webpushapi-sgp.engagelab.com"\r
\r
resp = requests.post(\r
    f"{BASE_URL}/v4/push",\r
    auth=(APP_KEY, MASTER_SECRET),\r
    headers={"Content-Type": "application/json"},\r
    json={\r
        "from": "push",\r
        "to": "all",\r
        "body": {\r
            "platform": "web",\r
            "notification": {\r
                "web": {\r
                    "alert": "Hello, Web Push!",\r
                    "title": "Web Push Title",\r
                    "url": "https://example.com",\r
                    "extras": {"key": "value"},\r
                }\r
            },\r
            "options": {"time_to_live": 86400},\r
        },\r
        "request_id": "req_001",\r
    },\r
)\r
result = resp.json()\r
if resp.status_code == 200:\r
    print("msg_id:", result.get("msg_id"))\r
else:\r
    print("Error:", result.get("error"))\r
```\r

安全使用建议

This skill appears to be a straightforward client for EngageLab Web Push. Before installing: (1) be prepared to provide your AppKey and Master Secret (these are sensitive — treat them like passwords and do not paste them into untrusted public chats); (2) note that the registry metadata does not declare those credentials, so the agent will prompt you at runtime — confirm you understand where and how you'll supply them; (3) the included Python client uses the requests library, so your environment must have Python and requests available if the skill code is executed; (4) if you plan to use callbacks, implement the echostr validation and (optionally) HMAC-SHA256 signature verification on your server as documented; and (5) if you have a policy against agents making network calls with long-lived credentials, avoid granting the skill direct access to those secrets or rotate credentials after use.

功能分析

Type: OpenClaw Skill Name: engagelab-web-push Version: 1.0.1 The skill bundle is a legitimate integration for the EngageLab Web Push REST API. The Python client in `scripts/webpush_client.py` uses standard HTTP requests to interact with official EngageLab endpoints (e.g., `webpushapi-sgp.engagelab.com`) for managing notifications, tags, and scheduled tasks. No evidence of data exfiltration, malicious code execution, or harmful prompt injection was found; the instructions and code are consistent with the stated purpose of the skill.

能力评估

✓ Purpose & Capability

The name/description describe sending web push and managing tags/aliases/schedules, and the included Python client and reference docs implement exactly those operations (push, batch, group push, device/tag APIs, schedules, statistics, callback guidance). No unrelated capabilities or unexpected system access are present.

✓ Instruction Scope

SKILL.md and the Python client confine actions to calling the EngageLab Web Push REST endpoints and to providing guidance for callback verification. The instructions do not direct the agent to read arbitrary local files, other credentials, or to send data to third-party endpoints outside EngageLab. The skill will prompt for AppKey and Master Secret if not provided, which is appropriate for an API client.

✓ Install Mechanism

There is no install spec (instruction-only) and the Python client is included as a simple wrapper that uses the requests library; nothing is downloaded from external arbitrary URLs and no archive extraction or elevated installation is performed.

ℹ Credentials

The API uses HTTP Basic Auth (AppKey and Master Secret) which is appropriate and proportionate. However, the registry metadata lists no required environment variables or primary credential; the SKILL.md expects the agent to ask the user for AppKey/Master Secret at runtime. This is a transparency omission (credentials are required in practice but not declared in metadata). The skill does not request any other unrelated secrets.

✓ Persistence & Privilege

The skill is not set to always: true and does not request system-wide configuration changes or persistent privileges. It also does not modify other skills' configs. Autonomous invocation is allowed but is the platform default and not combined with other high-risk indicators here.

版本历史

v1.0.1

engagelab-web-push 1.0.1 - No file changes detected in this release. - Functionality, documentation, and behavior remain unchanged from the previous version.

v1.0.0

engagelab-web-push 1.0.0 - Initial release of EngageLab Web Push API integration. - Supports sending web push notifications and in-app messages to browsers (Chrome, Firefox, Safari, Edge, etc). - Includes push (broadcast, tags, alias, registration_id), batch single push, group push, and scheduled tasks (CRUD). - Tag and alias management, user deletion, and message/statistics queries. - Full support for callback configuration and signature verification. - Requires EngageLab AppKey and Master Secret for authentication; supports multiple data center endpoints.

元数据

Slug engagelab-web-push

版本 1.0.1

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 2

常见问题

EngageLab Web Push 是什么？

Call EngageLab Web Push REST APIs to send push notifications and in-app messages to web browsers (Chrome, Firefox, Safari, Edge, etc.); manage tags and alias... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 270 次。

如何安装 EngageLab Web Push？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install engagelab-web-push」即可一键安装，无需额外配置。

EngageLab Web Push 是免费的吗？

是的，EngageLab Web Push 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。

EngageLab Web Push 支持哪些平台？

EngageLab Web Push 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 EngageLab Web Push？

由 DevEngageLab（@devengagelab）开发并维护，当前版本 v1.0.1。

EngageLab Web Push