功能描述

Data processing pipelines for OpenClaw. Deploy skills from the Expanso marketplace to transform, analyze, and process data locally.

使用说明 (SKILL.md)

Expanso Skills for OpenClaw

Name: expanso
Author: aronchick

Deploy data processing pipelines to your local Expanso Edge. Skills run locally, keeping credentials secure and enabling offline operation.

What is Expanso?

Expanso Edge — Local runtime that executes pipelines on your machine
Expanso Cloud — Orchestrates and deploys pipelines to your Edge nodes
Expanso Skills — Pre-built pipelines for common data tasks

Setup

1. Create an Expanso Cloud account

Go to cloud.expanso.io and sign up
Create a new organization (or use an existing one)
Note your Cloud Endpoint URL (e.g., https://abc123.us1.cloud.expanso.io)

2. Install the tools

# Install Expanso Edge (local runtime)
curl -fsSL https://get.expanso.io/edge/install.sh | bash

# Install Expanso CLI (deploy to cloud)
curl -fsSL https://get.expanso.io/cli/install.sh | sh

3. Get a Bootstrap Token

In Expanso Cloud, go to Settings → Edge Nodes
Click "Add Edge Node"
Copy the Bootstrap URL and Bootstrap Token

4. Connect your Edge to the Cloud

# Set the bootstrap URL and token from Expanso Cloud
export EXPANSO_EDGE_BOOTSTRAP_URL="https://start.cloud.expanso.io"
export EXPANSO_EDGE_BOOTSTRAP_TOKEN="your-token-from-cloud"

# Start Edge (it will register automatically)
expanso-edge

This connects your local Edge node to your Expanso Cloud organization. Your Edge will now receive pipeline deployments from the cloud.

5. Deploy a skill

# Browse skills at https://skills.expanso.io
# Then deploy one:
expanso-cli job deploy https://skills.expanso.io/text-summarize/pipeline-cli.yaml

The pipeline will be deployed through Expanso Cloud to your local Edge node.

Available Skills

Browse 172+ skills at skills.expanso.io:

Category	Examples
AI	text-summarize, image-describe, audio-transcribe
Security	pii-redact, secrets-scan, hash-digest
Transforms	json-pretty, csv-to-json, array-filter
Utilities	uuid-generate, email-validate, mime-type

Example: PII Redaction

Ask OpenClaw to redact sensitive data:

"Redact the PII from this customer feedback"

OpenClaw will use the pii-redact skill running on your local Expanso Edge to process the data — your API keys and data never leave your machine.

How It Works

┌─────────────┐     ┌───────────────┐     ┌──────────────┐
│  OpenClaw   │────▶│ Expanso Edge  │────▶│ Your Data    │
│  (asks)     │     │ (processes)   │     │ (stays local)│
└─────────────┘     └───────────────┘     └──────────────┘
                           │
                    ┌──────┴──────┐
                    │Expanso Cloud│
                    │(orchestrates)│
                    └─────────────┘

Resources

Skills Marketplace — Browse and deploy skills
Expanso Cloud — Manage your Edge nodes
Documentation — Full guides and API reference
GitHub — Skill source code

安全使用建议

This skill appears to do what it says (connect your machine as an Expanso Edge and deploy pipelines), but there are two things to consider before installing: - Review the install scripts before running them. The SKILL.md recommends curl | bash from get.expanso.io; that runs remote code on your machine. Fetch the script first (curl ... -o install.sh) and review it, or prefer installation via your OS package manager if available. - Treat the bootstrap token as highly sensitive. Anyone with it (or a compromised marketplace entry) can deploy pipelines to your Edge that will execute locally. Use least-privilege tokens, create a dedicated org/node with limited access, and rotate/revoke tokens after testing. - Audit the marketplace pipelines you deploy. Ensure any pipeline you run is from a trusted publisher and inspect pipeline definitions if possible. If you want to proceed more safely: run the installer in an isolated environment (VM/container), manually inspect the install scripts, and verify the get.expanso.io TLS certificate and domain alignment with official Expanso pages before providing credentials. If you can, obtain bootstrap credentials scoped to test/development rather than your production environment.

功能分析

Type: OpenClaw Skill Name: expanso-edge Version: 1.0.2 The skill is classified as suspicious due to its installation method and operational model. It uses `curl -fsSL ... | bash` and `curl -fsSL ... | sh` commands in `SKILL.md` and `INSTALL.txt` to download and execute remote scripts, which is a significant supply chain risk. Furthermore, the skill establishes a remote control mechanism by connecting a local 'Expanso Edge' node to 'Expanso Cloud' using a bootstrap token, allowing pipelines (arbitrary code/logic) to be deployed from `skills.expanso.io` and executed locally. While these actions are described as the intended functionality of the Expanso platform, they grant extensive remote code execution capabilities, posing a high risk if the Expanso infrastructure were compromised.

能力评估

✓ Purpose & Capability

The name/description (deploy and run Expanso pipelines locally) matches the declared requirements: curl and the EXPANSO_EDGE_BOOTSTRAP_URL / EXPANSO_EDGE_BOOTSTRAP_TOKEN environment variables are exactly what a cloud‑managed edge node would need.

ℹ Instruction Scope

SKILL.md stays within the stated purpose: it instructs you to install the Edge and CLI, set bootstrap URL/token, start expanso-edge, and deploy pipelines from the marketplace. However, starting the Edge registers the node with Expanso Cloud and allows remote pipeline deployments — this is expected but grants the cloud the ability to run code on your machine, so the instructions have significant operational impact.

⚠ Install Mechanism

The instructions use curl -fsSL https://get.expanso.io/... | bash (and sh) — i.e., download-and-pipe-to-shell. Even if the domain matches other Expanso domains in the SKILL.md, piping remote install scripts to a shell is high-risk because it executes code fetched at install time without local review.

⚠ Credentials

The skill requires a bootstrap URL and token (EXPANSO_EDGE_BOOTSTRAP_URL and EXPANSO_EDGE_BOOTSTRAP_TOKEN) and designates the token as the primary credential. Those are necessary for the stated cloud-managed workflow, but the bootstrap token is a high‑privilege credential (it lets the cloud deploy pipelines to your Edge). Requesting that token is proportionate to the purpose, but it represents a sensitive capability and should be treated as such.

✓ Persistence & Privilege

always is false and the skill doesn't request system paths or to modify other skills. No persistent or force-included privilege is requested by the skill metadata.

版本历史

v1.0.2

- Switched required environment variables from EXPANSO_CLI_ENDPOINT to EXPANSO_EDGE_BOOTSTRAP_URL and EXPANSO_EDGE_BOOTSTRAP_TOKEN for improved Edge node bootstrapping. - Simplified setup: Edge now registers automatically when started with the new environment variables. - Updated documentation to guide users on providing both Bootstrap URL and Token, instead of just a Cloud Endpoint URL. - Metadata and config sections now reflect the new connection workflow for registering Edge nodes.

v1.0.1

- Improved and clarified setup instructions for connecting Expanso Edge to Expanso Cloud. - Added step-by-step guidance for creating an Expanso Cloud account and organization. - Introduced instructions for obtaining and using a Bootstrap Token to register Edge nodes. - Enhanced configuration details to ensure correct cloud endpoint and node registration. - General documentation improvements for smoother onboarding.

v1.0.0

Initial release of expanso-edge skill. - Deploy and run Expanso data processing pipelines locally with OpenClaw integration. - Install Expanso Edge and CLI tools directly via install scripts. - Connect to your Expanso Cloud instance using the EXPANSO_CLI_ENDPOINT environment variable. - Access a marketplace of over 170 skills for AI, security, transformation, and utility tasks. - Run pipelines entirely on your machine for enhanced privacy and offline support.

元数据

Slug expanso-edge

版本 1.0.2

许可证 —

累计安装 1

当前安装数 1

历史版本数 3

常见问题

expanso 是什么？

Data processing pipelines for OpenClaw. Deploy skills from the Expanso marketplace to transform, analyze, and process data locally. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 2128 次。

如何安装 expanso？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install expanso-edge」即可一键安装，无需额外配置。

expanso 是免费的吗？

是的，expanso 完全免费（开源免费），可自由下载、安装和使用。

expanso 支持哪些平台？

expanso 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 expanso？

由 Expanso（@aronchick）开发并维护，当前版本 v1.0.2。

expanso