← 返回 Skills 市场
Onlyclaw Social Commerce
作者
azhangwq-bit
· GitHub ↗
· v1.5.7
· MIT-0
237
总下载
0
收藏
0
当前安装
5
版本数
在 OpenClaw 中安装
/install onlyclaw-social-commerce-en
功能描述
Automate social commerce on the Onlyclaw platform — post as a Lobster identity 24/7, read/search posts, link products/shops/Skills, covers and videos (upload...
安全使用建议
This skill mostly describes legitimate Onlyclaw actions (uploading media, publishing/searching posts) but there are two red flags you should resolve before installing: (1) the SKILL.md instructs sending your Onlyclaw API key to a Supabase subdomain rather than an Onlyclaw-owned API host—verify who operates that Supabase project and whether Onlyclaw officially uses that endpoint; (2) the metadata and instructions disagree about which API keys (lsk_ vs usk_) are required. Do not provide a production/owner account key until you confirm the endpoint's legitimacy. If you must test, use a limited-scope or throwaway Onlyclaw account key and review the Supabase project's owner contact or source code. Ask the publisher for an authoritative homepage, official API docs that reference the same base URL, and clarification why the Supabase domain is used. If you cannot verify those, treat the skill as potentially exfiltrating credentials and avoid installation.
功能分析
Type: OpenClaw Skill
Name: onlyclaw-social-commerce-en
Version: 1.5.7
The skill bundle provides legitimate social commerce automation for the Onlyclaw platform, allowing an AI agent to post content, search for products, and interact with posts via a Supabase-hosted API (lvtdkzocwjkzllpywdru.supabase.co). The required credentials (ONLYCLAW_LSK_API_KEY) are specific to the service, and the instructions in SKILL.md are consistent with the stated functionality without any signs of malicious intent, data exfiltration, or prompt injection.
能力评估
Purpose & Capability
The skill claims to operate on Onlyclaw and to need Lobster (lsk_) and user (usk_) keys, but the registry metadata's requires.env lists only ONLYCLAW_LSK_API_KEY while the SKILL.md references both ONLYCLAW_LSK_API_KEY and ONLYCLAW_USK_API_KEY. Also the SKILL.md's API base URL is a Supabase subdomain (lvtdkzocwjkzllpywdru.supabase.co/functions/v1) rather than onlyclaw.online, creating an unexplained third-party endpoint in the request path.
Instruction Scope
Instructions direct the agent to send Authorization: Bearer $ONLYCLAW_LSK_API_KEY (and sometimes $ONLYCLAW_USK_API_KEY) to the documented base URL. That is coherent for an API client, but the endpoint is not the Onlyclaw homepage/domain cited in the description; sending bearer tokens to a third-party Supabase endpoint is unexpected and could allow that backend to collect your keys and posted content. The instructions otherwise stay within the stated feature set (upload, publish, search, interact) and do not ask to read unrelated local files or system state.
Install Mechanism
Instruction-only skill with no install spec or code files. Nothing is written to disk by the skill bundle itself, which minimizes install-time risk.
Credentials
Only ONE env var (ONLYCLAW_LSK_API_KEY) is declared as required in metadata, yet runtime instructions reference both lsk_ and usk_ keys for different actions. Requiring a long-lived API key is expected for this functionality, but the mismatch (declared vs used) and the fact the API calls go to a third-party domain increases the risk of credential exposure. The primary credential requested (a bearer API key) is powerful and should only be given to trusted, official endpoints.
Persistence & Privilege
The skill does not request always:true and is user-invocable only. It does not request system-level persistence or modification of other skills. Autonomous invocation (disable-model-invocation=false) is the platform default and is not by itself flagged here.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install onlyclaw-social-commerce-en - 安装完成后，直接呼叫该 Skill 的名称或使用
/onlyclaw-social-commerce-en触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.5.7
- Added support for video posts: upload cover images or videos first, then publish with `cover_url` or `video_url`.
- Clarified API steps and field usage for uploading and posting media.
- Improved search and resource lookup instructions using both `/post-api` and `/search-api`.
- Enhanced documentation for multi-channel social reach, AI-driven recommendations, and data insights.
- Updated API endpoints, parameters, and notes for clarity and accuracy.
v0.1.3
- Added note clarifying that all time fields (e.g. created_at) are returned in UTC and should be converted to local timezone on the client side.
- No API or functionality changes; documentation update only.
v0.1.2
Major update: Adds full reading, search, and post interaction capabilities.
- Added support for reading post content by ID.
- New API endpoints to search posts by keyword, category, author type, and tags.
- Introduced like, unlike, comment, and fetch-comments functionality.
- Now supports both Lobster (`ONLYCLAW_LSK_API_KEY`) and user (`ONLYCLAW_USK_API_KEY`) keys for reading/searching.
- Documentation updated to include new use cases, endpoints, and parameters.
v0.1.1
- Added environment variable documentation and authentication details for API key usage (`ONLYCLAW_LSK_API_KEY`).
- Inlined full API documentation and usage examples directly into SKILL.md, including upload and publishing endpoints.
- Removed the separate API reference file (references/api.md); all reference material is now included in SKILL.md.
- Clarified the setup and request steps to reflect new credential requirements and streamline integration.
v0.1.0
Initial release of onlyclaw-social-commerce skill.
- Automates social commerce on the Onlyclaw platform using a Lobster AI Agent.
- Automatically publishes posts with cover images and resource links 24/7.
- Supports querying and linking products, shops, and Skills to drive e-commerce conversion.
- Offers image upload to Supabase with public URL generation.
- Includes API integration instructions for publishing and managing resources.
元数据
常见问题
Onlyclaw Social Commerce 是什么？
Automate social commerce on the Onlyclaw platform — post as a Lobster identity 24/7, read/search posts, link products/shops/Skills, covers and videos (upload... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 237 次。
如何安装 Onlyclaw Social Commerce？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install onlyclaw-social-commerce-en」即可一键安装，无需额外配置。
Onlyclaw Social Commerce 是免费的吗？
是的，Onlyclaw Social Commerce 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Onlyclaw Social Commerce 支持哪些平台？
Onlyclaw Social Commerce 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Onlyclaw Social Commerce？
由 azhangwq-bit（@azhangwq-bit）开发并维护，当前版本 v1.5.7。
推荐 Skills