← 返回 Skills 市场
araujodgdev

Web Star Studio's Flow PMS

作者 Douglas Araújo · GitHub ↗ · v1.0.0 · MIT-0
cross-platform ⚠ suspicious
85
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install flow-pms
功能描述
Interact with FlowDeck Project Management API (projects, cycles, tasks). Use for CRUD + archive/unarchive operations via the FlowDeck REST API through Supaba...
使用说明 (SKILL.md)

FlowDeck Project Management API

Interact with the FlowDeck project management module via the REST API gateway (base URL: https://\x3Csupabase_url>/functions/v1/api-gateway).

Usage

Run the script using the absolute path (do NOT cd to the skill directory):

uv run ~/.codex/skills/flow-pms/scripts/flow_api.py \x3Caction> \x3Cresource> [options]

Important: Always run from the user's current working directory so any output files are saved where the user is working.

Actions

Action Description Example
list List resources (paginated) uv run ... list projects --limit 50
get Get single resource uv run ... get projects --id \x3Cuuid>
create Create resource uv run ... create projects --data '{"name":"X","prefix":"X"}'
update Update resource uv run ... update tasks --id \x3Cuuid> --data '{"status":"done"}'
delete Delete resource uv run ... delete tasks --id \x3Cuuid>
archive Archive project uv run ... archive projects --id \x3Cuuid>
unarchive Unarchive project (to on_hold) uv run ... unarchive projects --id \x3Cuuid>

PMS Resources

Resource Endpoint Notes
projects /projects Project management
cycles /projects/{projectId}/cycles Sprints, scoped to project
tasks /projects/{projectId}/tasks Tasks, scoped to project
comments /tasks/{taskId}/comments Comments on tasks

Filters for list

  • --limit N (default 50, max 200)
  • --offset N (default 0)
  • --status — filter by status enum
  • --priority — filter task priority (tasks)
  • --cycle-id — filter tasks by cycle
  • --assignee-id — filter tasks by assignee
  • --project-id — parent project ID for scoped resources (cycles, tasks, comments)

Status/Stage/Priority Enums

Projects

briefing, planning, in_progress, review, completed, post_launch, on_hold, continuous_support, archived

Cycles

draft, active, completed, cancelled

Tasks (status)

backlog -> todo -> in_progress -> in_review -> done / cancelled

Tasks (priority)

none, low, medium, high, urgent

Tasks (type)

feature, bug, improvement, task

Core workflows

Project status update

For prompts like Me atualize sobre o status do projeto X no flow:

  1. list projects to resolve project by name
  2. get projects --id \x3Cuuid> for full details
  3. list cycles --project-id \x3Cuuid> to find active cycle (prefer status=active, fallback to latest)
  4. list tasks --project-id \x3Cuuid> to get tasks
  5. Summarize: project status, deadline, active cycle progress, task counts by status/priority, risk signals (urgent open tasks, blocked high-priority items)

Current cycle status

  1. Resolve project
  2. list cycles --project-id \x3Cuuid>
  3. Pick cycle with status=active; mention if none exists
  4. list tasks --project-id \x3Cuuid> --cycle-id \x3Cuuid> for task-level detail
  5. Report: progress, scope, completed_scope, dates, deadline risk signals

Create a task

  1. Resolve the target project
  2. Determine status and cycle from the project's active cycle
  3. Include optional fields only when the user specified them or when you need one clarification

Required fields for project create: name, prefix

Required fields for task create: only title by API, but you MUST at minimum also:

  • Resolve the project (ask if missing)
  • Check for an active cycle and default cycle_id to it
  • Check for an assignee

Implement what is in a task

  1. Resolve the project
  2. Resolve the task by identifier (e.g. PRJ-42) or title
  3. Fetch the full task
  4. Summarize scope from title, description, type, priority, due date, cycle
  5. Use the task content as the implementation brief
  6. If code changes are made outside Flow, suggest or perform a task status update afterward

Mutation safety

Ask for confirmation before:

  • Deleting projects, cycles, or tasks
  • Broad updates when the target match is ambiguous

Do not ask when the user already clearly requested the destructive action and the target is unambiguous.

API Key

The script checks for API key in this order:

  1. --api-key argument (use if user provided key in chat)
  2. FLOWBOARD_API_KEY environment variable

If neither is available, the script exits with an error message.

API Key + Base URL Environment Variables

  • FLOWBOARD_API_KEY — Bearer API key
  • FLOWBOARD_BASE_URL — API base URL (default: https://mycivgjuujlnyoycuwrz.supabase.co/functions/v1/api-gateway)

Preflight + Common Failures

  • Preflight:
    • command -v uv (must exist)
    • test -n "$FLOWBOARD_API_KEY" (or pass --api-key)
  • Common failures:
    • Error: No API key provided. -> set FLOWBOARD_API_KEY or pass --api-key
    • HTTP 401 -> invalid/revoked key
    • HTTP 404 -> resource not found or doesn't belong to workspace
    • "quota/permission/403" -> wrong key, no access, or quota exceeded

Examples

List projects in progress:

uv run ~/.codex/skills/flow-pms/scripts/flow_api.py list projects --status in_progress --limit 20

Create a task in a project:

uv run ~/.codex/skills/flow-pms/scripts/flow_api.py create tasks \
  --project-id \x3Cuuid> \
  --data '{"title":"Implementar login social","priority":"high","type":"feature"}'

Move task to in_progress:

uv run ~/.codex/skills/flow-pms/scripts/flow_api.py update tasks \
  --id \x3Cuuid> --data '{"status":"in_progress"}'

Archive a project:

uv run ~/.codex/skills/flow-pms/scripts/flow_api.py archive projects --id \x3Cuuid>
安全使用建议
Before installing or running this skill: 1) Treat it as untrusted until you verify the author — the source is unknown. 2) Do NOT export your primary Flow/organization API key globally; prefer a least-privileged key scoped for read-only testing. 3) Explicitly set FLOWBOARD_BASE_URL to your own trusted FlowDeck/Supabase gateway before running; do not rely on the hard-coded default (https://mycivgjuujlnyoycuwrz.supabase.co/functions/v1/api-gateway) because it will cause requests (and your API key) to be sent to that external domain. 4) Test first with read-only operations (list/get) and confirm responses are as expected. 5) Inspect or run the scripts in an isolated environment (sandbox or ephemeral VM) to verify behavior. 6) Ask the publisher to update registry metadata to declare required env vars and to remove or make explicit any default external endpoints. 7) If you cannot verify the owner or do not control the base URL, avoid providing any real API key; instead create a disposable/limited API key and rotate it after testing.
功能分析
Type: OpenClaw Skill Name: flow-pms Version: 1.0.0 The skill bundle provides a legitimate integration for interacting with the FlowDeck Project Management API. The Python scripts (flow_api.py, flowboard_api.py, flowboard_lookup.py, and flowboard_status.py) implement standard RESTful CRUD operations, fuzzy search logic, and status reporting. The instructions in SKILL.md and the workflows are consistent with the stated purpose of managing projects and tasks, and they include safety recommendations such as requiring user confirmation for destructive actions. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.
能力标签
requires-oauth-token
能力评估
Purpose & Capability
Name/description match the included scripts: the code implements CRUD and lookup flows against a FlowDeck REST API via a Supabase Edge Functions gateway. However the registry metadata claims no required env vars or primary credential while the code clearly requires an API key (FLOWBOARD_API_KEY) and optionally a base URL (FLOWBOARD_BASE_URL). Also the code ships a hard-coded default base URL pointing to a specific supabase.co domain, which is disproportionate for a generic 'FlowDeck' skill and can redirect traffic to that external endpoint unless the user overrides it.
Instruction Scope
SKILL.md instructs the agent to run the included Python scripts (via 'uv run') and to operate from the user's working directory. The runtime behavior is limited to calling the configured API gateway using provided API key/base URL and summarizing results. The scripts do not read unrelated system files or credentials. Minor oddity: the instruction 'Always run from the user's current working directory so any output files are saved there' is inconsistent with the scripts, which print JSON and do not create files.
Install Mechanism
There is no install spec (instruction-only skill with code files). The scripts declare a dependency on httpx (and require Python >=3.10) and expect the 'uv' runner to be present. That is lower-risk than downloading/executing remote archives, but the skill relies on the runtime to provide dependency resolution (uv) which the user must trust.
Credentials
The code expects FLOWBOARD_API_KEY (required) and FLOWBOARD_BASE_URL (optional) and also accepts keys passed via CLI args. Those env vars are proportionate to the stated purpose — the ability to authenticate to the Flow API is necessary — but the registry metadata does not declare these requirements (mismatch). Critically, a default FLOWBOARD_BASE_URL is hard-coded to a specific supabase.co domain in multiple files; if the user does not explicitly set FLOWBOARD_BASE_URL, their API key (or the key they export) may be sent to that external domain. This default endpoint is unexpected for a generic skill and raises an exfiltration risk unless the base URL is deliberately set to a trusted instance.
Persistence & Privilege
The skill does not request permanent inclusion (always:false) and does not modify other skills or system-wide settings. It runs on-demand and only uses environment variables and network calls consistent with its function.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install flow-pms
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /flow-pms 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.0
Initial release of flow-pms, providing streamlined CLI access to FlowDeck Project Management via REST API. - Supports CRUD, archive, and unarchive operations for projects, cycles, tasks, and comments - Includes filters for listing by status, priority, assignee, and project/cycle - Provides robust project/cycle/task status reporting and workflow summaries - Safeguards destructive actions with confirmation prompts unless explicitly requested - Requires API key via argument or environment variable; enforces preflight checks - Thorough documentation with usage, examples, and error guidance
元数据
Slug flow-pms
版本 1.0.0
许可证 MIT-0
累计安装 0
当前安装数 0
历史版本数 1
常见问题

Web Star Studio's Flow PMS 是什么?

Interact with FlowDeck Project Management API (projects, cycles, tasks). Use for CRUD + archive/unarchive operations via the FlowDeck REST API through Supaba... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 85 次。

如何安装 Web Star Studio's Flow PMS?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install flow-pms」即可一键安装,无需额外配置。

Web Star Studio's Flow PMS 是免费的吗?

是的,Web Star Studio's Flow PMS 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。

Web Star Studio's Flow PMS 支持哪些平台?

Web Star Studio's Flow PMS 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Web Star Studio's Flow PMS?

由 Douglas Araújo(@araujodgdev)开发并维护,当前版本 v1.0.0。

💬 留言讨论