← 返回 Skills 市场
oliverw

Linkfuse

作者 Oliver Weichhold · GitHub ↗ · v1.0.4
cross-platform ⚠ suspicious
767
总下载
0
收藏
1
当前安装
5
版本数
在 OpenClaw 中安装
/install linkfuse
功能描述
Create a Linkfuse affiliate short link from any URL. Trigger this skill when the user wants to create a Linkfuse link, shorten an affiliate URL, or says "/li...
使用说明 (SKILL.md)

Linkfuse Skill

Creates an affiliate short link via the Linkfuse REST API — same API used by the Chrome and Firefox extensions.

Trigger Conditions

Use this skill when the user:

  • Says /linkfuse [url]
  • Asks to "create a Linkfuse link" for a URL
  • Wants to shorten an affiliate/Amazon URL via Linkfuse

Authentication

This skill reads the Bearer token exclusively from the LINKFUSE_TOKEN environment variable. If it is not set, tell the user:

LINKFUSE_TOKEN is not set. Get your token from https://app.linkfuse.net/user/external-token and add it to your environment:

export LINKFUSE_TOKEN=your_token_here

Then retry.

Do not proceed without a token.

Workflow

Step 1 — Get the URL

If the user did not provide a URL, ask for one before proceeding.

Step 2 — Create the link

node scripts/create-link.js --url "\x3Curl>"
  • Exit 0: stdout contains JSON { "url": "...", "title": "..." } — proceed to Step 3.
  • Exit 2 (Unauthorized): Tell the user their LINKFUSE_TOKEN is invalid or expired and they should update it.
  • Exit 1: Display the stderr error message to the user.

Step 3 — Display result

Show the user:

✓ Link created: \x3Cshort-url>
  Title: \x3Ctitle>

Offer to copy the short URL to the clipboard:

echo -n "\x3Cshort-url>" | xclip -selection clipboard 2>/dev/null || echo -n "\x3Cshort-url>" | pbcopy 2>/dev/null || true

Notes

  • allowRecycle: true is sent with every request — if the same URL was shortened before, the existing link is returned rather than creating a duplicate.
  • The X-API-CLIENT: claude-skill header identifies this client to the server.
安全使用建议
This skill appears to do exactly what it says: it uses the LINKFUSE_TOKEN you provide to call Linkfuse's API and create a short/affiliate link. Before installing, ensure the token you provide is from https://app.linkfuse.net/user/external-token and is stored securely (don't commit it to repos or share shells). The skill will make network requests to app.linkfuse.net and prints results to stdout; it does not request other credentials or access unrelated files. If you have concerns, inspect the included scripts (they are small and readable) and consider using a limited/rotatable token you can revoke if needed.
功能分析
Type: OpenClaw Skill Name: linkfuse Version: 1.0.4 The skill is classified as suspicious due to a critical shell injection vulnerability identified in `SKILL.md`. The instruction `node scripts/create-link.js --url "<url>"` passes a user-provided URL directly into a shell command. If the OpenClaw agent does not properly sanitize or escape the `<url>` input before execution, an attacker could inject arbitrary shell commands, leading to Remote Code Execution (RCE). While the `scripts/create-link.js` script itself performs its stated function without malicious intent, and no prompt injection attempts or data exfiltration beyond the stated purpose were found, this vulnerability poses a significant risk.
能力评估
Purpose & Capability
Name/description match the implementation: the skill only needs a Linkfuse bearer token and posts to Linkfuse's API to create short links. No unrelated services, binaries, or config paths are requested.
Instruction Scope
SKILL.md accurately documents runtime behavior: it requires LINKFUSE_TOKEN, asks for a URL, runs the included Node script, and prints the resulting short URL. Instructions do not ask the agent to read unrelated files or exfiltrate extra data.
Install Mechanism
No install spec; this is instruction-only with two small included Node scripts. There are no downloads from untrusted URLs or archive extraction steps.
Credentials
Only LINKFUSE_TOKEN is required (declared). The token is necessary and sufficient for the described API calls; no other secrets, credentials, or config paths are requested.
Persistence & Privilege
always is false and the skill does not attempt to modify other skills or system settings. It does perform normal network calls to app.linkfuse.net using the provided token.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install linkfuse
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /linkfuse 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.4
- Added an "emoji: 🧠" field under the "clawdbot" metadata section in SKILL.md. - No other changes to functionality or usage.
v1.0.3
- Added explicit environment variable metadata for LINKFUSE_TOKEN, including required status and description, to the skill manifest. - No changes to core functionality or workflow.
v1.0.2
- Updated compatibility text to clarify requirements: now specifies Node.js 18+, network access, and valid Linkfuse API key. - Added compatibility, metadata, and environment variable requirements in a new format under "metadata". - No behavioral changes; documentation update only.
v1.0.1
Minor update to metadata and naming conventions. - Added a "metadata" block with a source URL and environment variable details in SKILL.md. - Changed skill name from "linkfuse" to "Linkfuse" for consistency.
v1.0.0
Linkfuse Skill v1.0.0 - Initial release: create affiliate short links via the Linkfuse REST API. - Triggered by "/linkfuse [url]" or user requests to shorten affiliate links. - Requires the LINKFUSE_TOKEN environment variable for authentication. - Handles missing or invalid tokens with clear guidance to the user. - Returns or reuses a short Linkfuse URL and offers to copy it to the clipboard.
元数据
Slug linkfuse
版本 1.0.4
许可证
累计安装 1
当前安装数 1
历史版本数 5
常见问题

Linkfuse 是什么?

Create a Linkfuse affiliate short link from any URL. Trigger this skill when the user wants to create a Linkfuse link, shorten an affiliate URL, or says "/li... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 767 次。

如何安装 Linkfuse?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install linkfuse」即可一键安装,无需额外配置。

Linkfuse 是免费的吗?

是的,Linkfuse 完全免费(开源免费),可自由下载、安装和使用。

Linkfuse 支持哪些平台?

Linkfuse 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Linkfuse?

由 Oliver Weichhold(@oliverw)开发并维护,当前版本 v1.0.4。

💬 留言讨论