← 返回 Skills 市场

Skill Hub Gateway

Name: Skill Hub Gateway
Author: chinasilva

作者 chinasilva · GitHub ↗ · v2.4.2 · MIT-0

cross-platform ⚠ suspicious

500

总下载

当前安装

版本数

在 OpenClaw 中安装

/install skill-hub-gateway

功能描述

Unified gateway skill for async execute/poll, portal user closure, and telemetry feedback workflows.

安全使用建议

This skill is broadly coherent with being a gateway that can execute, poll, upload attachments, and emit telemetry — but it will read local files (file_path) and upload their contents to gateway.binaryworks.app and it will call the gateway to auto-bootstrap an api_key and emit telemetry that includes agent/auth context. Only install if you trust the gateway.binaryworks.app service and the skill author. Before installing: (1) review telemetry.mjs and runtime-auth.mjs (not fully shown here) to confirm what fields are sent and that API keys are not leaked; (2) disable telemetry by setting SKILL_TELEMETRY_ENABLED=false or block outbound network to the gateway if you cannot trust it; (3) avoid passing sensitive local file paths (file_path) to the skill — prefer pre-uploaded URLs or backend-mediated uploads; (4) prefer providing an explicit api_key (instead of letting the skill auto-bootstrap) if you want to control credential issuance; (5) run in a sandboxed workspace with minimal local data exposure if you need to evaluate the skill further. If you want a firmer classification, provide the full contents of runtime-auth.mjs and telemetry.mjs so we can confirm what telemetry contains and how the bootstrap flow handles credentials.

功能分析

Type: OpenClaw Skill Name: skill-hub-gateway Version: 2.4.2 The bundle provides a unified gateway for various AI services (Computer Vision, TTS, ASR) and user management actions (balance checks, usage queries, and voucher redemption). It includes sophisticated logic for authentication bootstrapping, telemetry, and file upload normalization via `scripts/attachment-normalize.mjs`. While the skill possesses the capability to read and upload local files, this is a documented feature intended to facilitate processing local media in agentic workflows. The instructions in `SKILL.md` are transparent and focused on operational logic like version management and onboarding. No evidence of malicious intent, obfuscation, or unauthorized data exfiltration was found. Primary endpoints include gateway.binaryworks.app and gateway-api.binaryworks.app.

能力评估

ℹ Purpose & Capability

Name/description (gateway for execute/poll, portal actions, telemetry) aligns with the included scripts and openapi manifest: execute, poll, portal-action, attachment-normalize and telemetry helpers are expected for this purpose. Requiring node only is proportionate. The skill also implements an auto-bootstrap path to obtain an API key; this is plausible for a gateway but increases the surface area compared to a purely-passive helper.

⚠ Instruction Scope

Runtime instructions and bundled scripts explicitly read local files (attachment-normalize.mjs reads file_path from the filesystem) and will upload their contents to external endpoints (site_base + /api/blob/upload or /api/blob/upload-file). The scripts also perform telemetry/feedback calls and pass agent/context/auth info into the telemetry helper. Reading arbitrary file paths and sending file contents over the network is coherent with a media-upload gateway but is a sensitive capability that can lead to local data exfiltration if misused or if the agent constructs file_path from uncontrolled inputs.

✓ Install Mechanism

There is no package/install spec — the skill is instruction+script based and requires node on PATH. No downloads or archive extraction occur as part of installation, which is lower risk. The presence of multiple scripts bundled with the skill is expected for an instruction-only skill that provides CLI helpers.

⚠ Credentials

The manifest declares no required environment secrets, but the runtime implements an automatic bootstrap flow that can obtain an api_key via network calls (POST /agent/bootstrap) and then uses that key in requests. Telemetry calls are invoked with apiKey, agentUid and ownerUidHint passed into the telemetry helper — this suggests telemetry payloads may include sensitive identifiers or even the API key unless telemetry.mjs explicitly sanitizes them. The skill also accepts file_path inputs (no environment guard) and will upload local files to the configured gateway domain. These capabilities are functional for a gateway but widen the credential/data exposure surface and should be considered disproportionate unless the user trusts the remote service.

✓ Persistence & Privilege

The skill is not force-included (always: false) and uses the platform default for autonomous invocation. It does not declare writes to other skills or system-wide config. Bundled scripts perform network interactions but there is no evidence they modify other skills' configuration or request elevated persistent privileges.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install skill-hub-gateway
安装完成后，直接呼叫该 Skill 的名称或使用 /skill-hub-gateway 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v2.4.2

- Added `/api/blob/upload-file` as a fallback upload endpoint for `file_path` inputs when `@vercel/blob/client` is unavailable. - Enhanced `portal.skill.presentation` to render output files and return `visual.files.assets`, including overlay, mask, and cutout URLs. - Audio outputs now normalize to `output.media_files.assets` with uploaded file URLs when blob storage is available. - No breaking changes.

v2.4.1

### 2.4.1 (2026-03-12) - Added server-side normalization for `attachment.url` fields on `portal.skill.execute` (supports both `input.attachment.url` and top-level). - Explicit media URL fields (`image_url`, `audio_url`, `file_url`) now take precedence over `attachment.url` when both are provided. - New end-to-end tests introduced to verify upload-first execution and precedence behavior. - Updated documentation to clarify fallback guidance for runtimes without `@vercel/blob/client` (use backend pre-uploaded URLs). - No breaking changes; existing workflows remain compatible.

v2.4.0

Skill-hub-gateway 2.4.0 introduces portal user closure and feedback workflows. - Added Portal Actions contract for user-specific flows (profile, balance, ledger, usage, skill execution, presentation, voucher and recharge actions). - Bundled new scripts: portal-action.mjs (action runner), portal-auth.mjs (auth bridge), attachment-normalize.mjs (media upload/normalization), and feedback.mjs (structured feedback). - Added double-confirm gate: voucher redeem and recharge create actions require `confirm=true` in payload to proceed. - Standardized insufficient points responses to pass through recharge URLs for easier diagnostics. - Existing execute/poll flows remain available and compatible. Use portal-action.mjs for new closure workflows.

v2.3.3

## 2.3.3 (2026-03-11) - Standardized user guidance: do not expose manual URL/JSON inputs for media/doc uploads—use file/attachment fields in product UIs. - Updated capability reference docs and examples to reflect upload-first, user-friendly product flows. - Renamed CLI argument from `input_json` to `input_payload` for clarity and consistency. - No breaking changes; all runtime API calls remain unchanged.

v2.3.2

Skill-hub-gateway 2.3.2 - Aligned capability reference documentation with actual runtime behavior regarding file uploads and chat attachments. - Synced package OpenAPI version with SKILL frontmatter version to prevent metadata drift. - Added package-level test guards to detect documentation/version mismatches before publishing. - No breaking changes; existing runtime API calls remain unchanged.

v2.3.1

- Clarified that the CLI scripts (`execute.mjs`, `poll.mjs`) do not perform file uploads; upload support is determined by the host client. - CLI scripts now emit structured error logs (`status`, `code`, `message`, and `request_id`) to stderr on bootstrap, execute, or poll failures, supporting easier troubleshooting. - No breaking changes; all existing API calls remain unchanged.

v2.3.0

**Summary:** Introduced agent-side version check protocol and expanded supported capabilities. - Added agent-side version check protocol and user update prompt flow, described in the new Release Notes section. - Expanded the list of available capability IDs to include Roboflow and image analysis features. - Clarified support for file uploads, input source types, and use of explicit URLs for media input. - Updated SKILL.md documentation accordingly; no breaking changes to runtime APIs.

v2.1.5

- Removes runtime env reads and local auth cache persistence from skill scripts. - Derives stable local bootstrap identifiers from the current workspace path. - Simplifies runtime auth retries and updates bilingual docs for the safer bootstrap flow.

v2.1.4

- Removes local api_key persistence from runtime auth cache. - Adds release-gate allow markers for bounded env+network bootstrap paths. - Keeps bootstrap metadata-only cache entries and sanitizes legacy cache files.

v2.1.3

- Adds automated onboarding and authentication bootstrapping to scripts; manual API key override is still supported. - Introduces a shared `runtime-auth.mjs` helper for authentication caching and script consistency. - Updates CLI argument patterns for `execute.mjs` and `poll.mjs`. - SKILL.md and SKILL.zh-CN.md now clarify the new onboarding behavior and script usage.

v2.1.2

Validate image_url as direct image content and improve provider fallback failure messaging.

v2.1.1

Fix security scan false-positive trigger by removing process.env+network pattern in helper scripts.

v2.1.0

- Version 2.1.0 adds an updated SKILL.md with onboarding instructions, runtime API details, and capability documentation. - Clearly lists required environment variables and dependencies. - Documents endpoints for install, execute, and poll workflows. - Provides details on possible terminal states and expected responses. - Lists supported capability IDs and bundled reference files. - Includes link to homepage and Chinese documentation.

元数据

Slug skill-hub-gateway

版本 2.4.2

许可证 MIT-0

累计安装 2

当前安装数 2

历史版本数 13

常见问题

Skill Hub Gateway 是什么？

Unified gateway skill for async execute/poll, portal user closure, and telemetry feedback workflows. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 500 次。

如何安装 Skill Hub Gateway？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install skill-hub-gateway」即可一键安装，无需额外配置。

Skill Hub Gateway 是免费的吗？

是的，Skill Hub Gateway 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。

Skill Hub Gateway 支持哪些平台？

Skill Hub Gateway 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Skill Hub Gateway？

由 chinasilva（@chinasilva）开发并维护，当前版本 v2.4.2。