← 返回 Skills 市场
notasign

Nota Sign

作者 notasign · GitHub ↗ · v1.0.2 · MIT-0
cross-platform ⚠ suspicious
114
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install esign
功能描述
Send files for e-signature with Nota Sign. Use for requests to send an envelope, initiate signing, send a signing link, configure Nota Sign credentials, or s...
使用说明 (SKILL.md)

Nota Sign

Use this skill when the user wants to send a supported file for signature through Nota Sign.

Supported tasks

  • Send a supported local file, uploaded attachment, or URL for signature
  • Collect one or more signer names and emails
  • Initialize Nota Sign credentials on first use
  • Update or replace existing credentials when the user explicitly asks
  • Send in PROD or UAT environment

Inputs

Collect only the missing fields.

Required to send:

  • file path, uploaded attachment path, or URL
  • at least one signer with userName and userEmail

Supported file formats:

  • doc, docx, pdf, xls, xlsx, bmp, png, jpg, jpeg

Size limit:

  • local files and uploaded attachments must be \x3C= 100MB

Optional:

  • subject Default to the file name when the user does not provide one.

Required only when config is missing or the user asks to reconfigure:

  • appId
  • appKey as Base64 PKCS#8 RSA private key
  • userCode
  • serverRegion in CN | AP1 | AP2 | EU1
  • environment in PROD | UAT Default to PROD.

Important:

  • PROD and UAT require separate credential sets
  • do not assume a PROD appId, appKey, userCode, or serverRegion can be reused in UAT
  • do not assume a UAT appId, appKey, userCode, or serverRegion can be reused in PROD
  • if the user switches environments, treat it as a full reconfiguration and collect the full target-environment credential set

Workflow

  1. Check whether ./notasign-config.json exists; if not, check ~/.notasign/config.json.
  2. If config is missing, ask only for the missing credential fields and write the config file.
  3. If the user wants to switch between PROD and UAT, do not only flip environment. Collect the full target-environment values for appId, appKey, userCode, and serverRegion, then rewrite the config.
  4. Validate the file input before sending:
    • local path must exist, or
    • uploaded attachment must resolve to a real local file path, or
    • remote input must start with http:// or https://
  5. Validate the file type against the supported list: doc, docx, pdf, xls, xlsx, bmp, png, jpg, jpeg.
  6. Reject local files and uploaded attachments larger than 100MB.
  7. If the user uploaded a supported file in chat, treat it as a valid file input when the client exposes a real attachment path. If no real path or URL is available, ask the user for the original file path or a URL instead of guessing.
  8. Normalize signer input into JSON:
[{"userName":"Alice","userEmail":"[email protected]"}]
  1. Check the local Node.js major version before execution.
  2. If node exists and the major version is 18+, run:
npx tsx scripts/send_envelope.ts --file "PATH_OR_URL" --signers '[{"userName":"Alice","userEmail":"[email protected]"}]' --subject "Optional subject"
  1. If local Node.js is missing or below 18, temporarily download node@20 and tsx for this run only:
npx -y -p node@20 -p tsx -c 'tsx scripts/send_envelope.ts --file "PATH_OR_URL" --signers '"'"'[{"userName":"Alice","userEmail":"[email protected]"}]'"'"' --subject "Optional subject"'
  1. Use the same fallback pattern for init:
npx -y -p node@20 -p tsx -c 'tsx scripts/send_envelope.ts init'
  1. On success, return the envelope ID and basic send summary.
  2. On failure, surface the exact validation or API error and state the next required action.

Config File

The shared config normally lives at ~/.notasign/config.json. The script also supports a local override at ./notasign-config.json.

Write the config in this shape:

{
  "appId": "your_app_id",
  "appKey": "base64_pkcs8_private_key",
  "userCode": "your_user_code",
  "serverRegion": "AP1",
  "environment": "PROD"
}

Notes:

  • environment is optional and defaults to PROD
  • the config stores one environment's credential set at a time
  • switching from PROD to UAT, or from UAT to PROD, requires replacing appId, appKey, userCode, and serverRegion with the target environment's values
  • do not switch environments by editing only the environment field
  • do not echo secrets back to the user after writing the config
  • do not overwrite an existing config unless the user asks to change credentials
  • if the temporary runtime fallback is needed, it requires network access to npm

Response Style

  • Ask concise follow-up questions only for missing information.
  • Prefer one grouped question instead of several small questions.
  • Do not ask for subject if the file name is good enough.
  • Do not invent emails, file paths, or credential values.
  • Keep credentials and private keys out of normal responses.
  • Prefer the direct scripts/send_envelope.ts command with a runtime check instead of inventing wrappers or extra helper files.
  • For user-uploaded files, prefer the attachment's real local path when available. If the attachment exists only as visual context and no path is available, ask for the original file path or URL.
  • Reject unsupported file types and local or attachment files above 100MB before trying to send.

Examples

This skill should trigger for requests like:

English:

  • "Send this file for signature with Nota Sign"
  • "Send the file I just uploaded to Daniel with Nota Sign"
  • "Use Nota Sign UAT to send this document to two signers"

Chinese:

  • "用 Nota Sign 发个信封给 Daniel,附件是 contract.pdf"
  • "把我刚上传的文件用 Nota Sign 发给 Daniel"
  • "帮我发起电子签署"
安全使用建议
This skill appears to do exactly what it claims: send documents to Nota Sign and manage Nota Sign credentials. If you plan to install it, be aware it will ask you for and store sensitive credentials (including a Base64 PKCS#8 private key) in ~/.notasign/config.json or a local override. Protect that file (e.g., chmod 600) and only provide PROD credentials if you trust the skill and its source. The script may transiently download node@20 and tsx from npm if your Node version is older than 18 — ensure outbound access to npm is acceptable. If you need higher assurance, review the full scripts/send_envelope.ts contents locally before entering secrets or run the skill in an isolated environment.
功能分析
Type: OpenClaw Skill Name: esign Version: 1.0.2 The skill provides a legitimate integration with the Nota Sign e-signature service, allowing users to send documents for signing. The core logic in `scripts/send_envelope.ts` handles file validation, RSA-SHA256 signing for API authentication, and document uploading to official Nota Sign endpoints (e.g., openapi-ap1.notasign.com). While the skill manages sensitive credentials (RSA private keys) and includes a fallback mechanism in `SKILL.md` to download a specific Node.js runtime via `npx` for compatibility, these behaviors are clearly documented, aligned with the stated purpose, and show no signs of malicious intent or unauthorized data exfiltration.
能力评估
Purpose & Capability
Name/description match the implementation: the script performs signing, token generation, file upload, and envelope creation against Nota Sign endpoints. The requested credential set (appId, appKey/private key, userCode, serverRegion, environment) is appropriate for this integration and appears necessary for cryptographic signing and API access.
Instruction Scope
SKILL.md clearly limits actions to reading the specified file/attachment or URL, validating file type/size, reading/writing a nota sign config at ./notasign-config.json or ~/.notasign/config.json, and invoking the bundled script. There are no instructions to read unrelated system files or environment variables. The script does read local files for upload and writes its own config file — behavior that aligns with its stated purpose.
Install Mechanism
There is no persistent install spec (instruction-only), which is low-risk. The runtime instructions use npx to transiently fetch node@20 and tsx if the local Node.js is older than 18; that requires network access to npm and pulls third-party packages at runtime. This is expected for the provided fallback but increases runtime network trust surface.
Credentials
No environment variables are declared, and none are required. The skill asks the user to supply and store a Base64 PKCS#8 private key (appKey) and other credentials in a local config file — this is proportionate to the need to sign requests, but these are sensitive secrets. The documentation recommends protecting the file (chmod 600); storing long-lived private keys on disk is expected here but should be considered sensitive.
Persistence & Privilege
The skill is not always-included and is user-invocable. It writes only its own config file (~/.notasign/config.json or ./notasign-config.json) and does not request system-wide privileges or modify other skills. Autonomous invocation is allowed (platform default) but not combined with other concerning privileges.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install esign
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /esign 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.2
- Skill renamed from "notasign" to "esign" - No functional or workflow changes - All existing features, commands, and descriptions remain unchanged under the new skill name
元数据
Slug esign
版本 1.0.2
许可证 MIT-0
累计安装 0
当前安装数 0
历史版本数 1
常见问题

Nota Sign 是什么?

Send files for e-signature with Nota Sign. Use for requests to send an envelope, initiate signing, send a signing link, configure Nota Sign credentials, or s... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 114 次。

如何安装 Nota Sign?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install esign」即可一键安装,无需额外配置。

Nota Sign 是免费的吗?

是的,Nota Sign 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。

Nota Sign 支持哪些平台?

Nota Sign 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Nota Sign?

由 notasign(@notasign)开发并维护,当前版本 v1.0.2。

💬 留言讨论