← 返回 Skills 市场

Epragma Redmine Issue

Name: Epragma Redmine Issue
Author: agelospanagiotakis

作者 Angelos Panagiotakis · GitHub ↗ · v0.0.1

cross-platform ⚠ suspicious

464

总下载

当前安装

版本数

在 OpenClaw 中安装

/install epragma-redmine-issue

功能描述

Read Redmine issues from any Redmine server via REST API with configurable URL and credentials. Use when you need to fetch a single issue, list/filter issues...

使用说明 (SKILL.md)

ePragma Redmine Issue

Read Redmine issues through REST API.

Configuration

This skill requires REDMINE_URL and REDMINE_API_KEY to be configured.

Setup with OpenClaw CLI

Run these commands to configure the skill:

# Set your Redmine URL
openclaw skills config epragma-redmine-issue set REDMINE_URL https://your-redmine-server.com

# Set your API key (generate from Redmine My Account page)
openclaw skills config epragma-redmine-issue set REDMINE_API_KEY your-api-key-here

Get your API Key

Log in to your Redmine server
Go to "My Account"
Click "Show" next to "API access key"
Copy the key

Get one issue

node {baseDir}/scripts/issues.mjs get --id 123

List issues

node {baseDir}/scripts/issues.mjs list
node {baseDir}/scripts/issues.mjs list --project-id my-project --status-id open --limit 20 --offset 0
node {baseDir}/scripts/issues.mjs list --assigned-to-id me --sort "updated_on:desc"
node {baseDir}/scripts/issues.mjs list --project my-project

List projects

node {baseDir}/scripts/issues.mjs projects

List statuses

node {baseDir}/scripts/issues.mjs statuses

Update one issue

node {baseDir}/scripts/issues.mjs update --id 123 --status-id 2 --notes "this is ok"
node {baseDir}/scripts/issues.mjs update --id 123 --assigned-to-id 6 --priority-id 3
node {baseDir}/scripts/issues.mjs update --id 123 --done-ratio 50 --notes "done 50%"

Add comment to issue

node {baseDir}/scripts/issues.mjs comment --id 123 --notes "This is a comment"

Create new issue

# Required: --project-id (or project name), --subject
# Optional: --description, --tracker-id, --priority-id, --assigned-to-id, --status-id, --start-date, --due-date, --done-ratio, --estimated-hours

node {baseDir}/scripts/issues.mjs create --project-id 1 --subject "New issue title"
node {baseDir}/scripts/issues.mjs create --project-id epragma --subject "Bug report" --description "Details here" --priority-id 4

Time Entries

# List time entries (filters: --issue-id, --project-id, --user-id, --from, --to, --spent-on)
node {baseDir}/scripts/issues.mjs time-list
node {baseDir}/scripts/issues.mjs time-list --issue-id 232
node {baseDir}/scripts/issues.mjs time-list --project-id 1 --from 2026-01-01 --to 2026-01-31

# Add time entry (required: --issue-id OR --project-id, --hours; optional: --activity-id, --spent-on, --comments)
node {baseDir}/scripts/issues.mjs time-add --issue-id 232 --hours 2 --activity-id 9 --comments "Work done"
node {baseDir}/scripts/issues.mjs time-add --project-id 1 --hours 1.5 --activity-id 8

# List available activities
node {baseDir}/scripts/issues.mjs time-activities

Notes

URL and auth are variables by design for cross-environment deployment.
API responses are output as JSON.
For automation, prefer REDMINE_API_KEY over username/password.

安全使用建议

This skill appears to do what it says — interact with a Redmine instance using a base URL and API key — but check a few things before installing: - Verify and set the REDMINE_URL and REDMINE_API_KEY (the registry metadata omitted these even though SKILL.md and the code require them). The code also looks for REDMINE_BASE_URL as an alternate; decide which variables you'll use and be consistent. - Review and/or fix the env-var logic in scripts/lib/redmine.js: the REDMINE_URL initializer uses a startsWith check incorrectly (it may evaluate to a boolean and cause runtime errors). Consider patching that before relying on the skill in automation. - Keep your API key secret and test the skill in an isolated environment first (it will send any requests only to the configured Redmine URL). If you plan to use it in automation, ensure the agent runs with least privilege and rotate the API key if it was exposed during testing. - Ensure the Node runtime used supports global fetch (Node 18+), or add a fetch polyfill if needed. If you want higher assurance, ask the author to correct the metadata to list required env vars and to fix the env-handling bug; otherwise run the provided scripts locally against a test Redmine instance first.

功能分析

Type: OpenClaw Skill Name: epragma-redmine-issue Version: 0.0.1 The skill is classified as suspicious due to a significant vulnerability in its environment variable handling logic within `scripts/lib/redmine.js`. The code attempts to support 'swapped env vars' where `REDMINE_URL` or `REDMINE_API_KEY` might contain the URL or API key interchangeably, as explicitly noted in `memory/2026-02-25.md`. This convoluted logic makes credential configuration highly error-prone, potentially leading to the API key being sent as part of the URL (if `REDMINE_API_KEY` is a URL and `REDMINE_URL` is not set) or an empty API key being used, increasing the risk of accidental credential exposure or authentication failures. While not indicative of intentional malice, this design flaw represents a critical security vulnerability in credential management.

能力评估

ℹ Purpose & Capability

Name/description (read/create/update Redmine issues) align with the code and instructions. The skill legitimately needs a REDMINE_URL and REDMINE_API_KEY. However, registry metadata lists no required env vars while SKILL.md and the code require them; the code also accepts REDMINE_BASE_URL as an alternate which is undocumented in SKILL.md (memory note mentions swapped env support).

✓ Instruction Scope

SKILL.md tells the agent to run the included Node scripts which only call the Redmine REST API. The runtime instructions and code do not reference unrelated system files or external endpoints beyond the configured Redmine base URL.

✓ Install Mechanism

There is no install spec (instruction-only style). Code files are included but nothing is downloaded or auto-installed from external URLs, so install risk is low.

ℹ Credentials

Requested secrets (Redmine URL and API key) are proportionate to the skill. But the skill's metadata did not declare these required env vars, and the code also references REDMINE_BASE_URL and implements a swapped-vars fallback. This inconsistency could cause misconfiguration and surprises. Also the implementation of env-var handling appears buggy (see next guidance).

✓ Persistence & Privilege

The skill does not request persistent/system-wide privileges and always:false. It does not modify other skills or system settings.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install epragma-redmine-issue
安装完成后，直接呼叫该 Skill 的名称或使用 /epragma-redmine-issue 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v0.0.1

Initial release of epragma-redmine-issue. - Allows reading and updating Redmine issues via REST API with configurable server URL and credentials. - Supports fetching a single issue, listing/filtering issues, creating and commenting on issues. - Includes commands for listing projects, statuses, and time tracking entries/activities. - Credentials (URL and API key) are managed using environment variables for flexible deployment. - All API responses are returned in JSON format.

元数据

Slug epragma-redmine-issue

版本 0.0.1

许可证 —

累计安装 0

当前安装数 0

历史版本数 1

常见问题