← 返回 Skills 市场
330
总下载
0
收藏
0
当前安装
3
版本数
在 OpenClaw 中安装
/install tly
功能描述
Create T.LY short links through the T.LY API. Use when an agent needs to shorten a URL, generate a shareable T.LY link, return a `short_url`, or call T.LY pr...
安全使用建议
This skill appears to do what it says (shorten URLs via T.LY) but has a metadata inconsistency and a few verification steps you should perform before use: 1) Only provide a TLY API token (TLY_API_TOKEN) when you trust the skill — the metadata should list this env var but currently doesn't. 2) Prefer setting the token as an environment variable rather than pasting it into chat or commands to avoid leakage in logs. 3) If you plan to install the recommended PyPI package, review its publisher, source code, and recent releases on PyPI/GitHub before pip installing. 4) Ask the skill maintainer (or registry) to update the registry metadata to declare TLY_API_TOKEN as the required primary credential so the permission model is accurate. If you cannot verify the PyPI package or the maintainer, treat the skill with caution.
功能分析
Type: OpenClaw Skill
Name: tly
Version: 1.0.2
The skill is classified as suspicious due to a shell injection vulnerability in the fallback `curl` command within `SKILL.md`, where the `TLY_API_TOKEN` environment variable is expanded in a way that allows command execution. Additionally, the instructions strongly encourage the installation of a specific PyPI package (`tly-url-shortener-api`) labeled as 'official,' which could serve as a vector for a supply-chain attack if the package is not legitimately maintained by the service provider. While the skill includes some security guardrails regarding secret handling, these implementation flaws and the reliance on unverified external code pose a risk to the host environment.
能力评估
Purpose & Capability
The skill's name and description (create T.LY short links) align with the runtime instructions which call the T.LY API or the official SDK/CLI. Requiring a T.LY API token is expected for this purpose.
Instruction Scope
SKILL.md stays within the shortener domain: it checks for TLY_API_TOKEN, validates URLs, prefers the official SDK/CLI, and gives a curl fallback to api.t.ly. It explicitly warns not to hardcode keys and to prefer env vars. It does not instruct reading unrelated files or exfiltrating data to unexpected endpoints.
Install Mechanism
This is an instruction-only skill with no install spec or code files. It recommends installing the published PyPI package (tly-url-shortener-api) if available, which is a reasonable, low-risk suggestion — but the PyPI package should be reviewed before installation.
Credentials
The SKILL.md explicitly requires a TLY_API_TOKEN env var, but the registry metadata lists no required environment variables or primary credential. That mismatch is an incoherence: the skill needs a secret to operate but the metadata does not declare it. Also, the curl example embeds the API token in the JSON payload (expected for the API) — the skill warns about not hardcoding keys, but users should avoid pasting tokens into public chats/command logs.
Persistence & Privilege
The skill does not request persistent installation, does not set always:true, and does not claim to modify other skills or global config. Autonomy is enabled by default (disable-model-invocation:false) which is normal; no additional privileges are requested.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install tly - 安装完成后，直接呼叫该 Skill 的名称或使用
/tly触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.2
- Added a homepage field to the skill metadata, linking to https://t.ly/.
- No functional or workflow changes.
v1.0.1
tly v1.0.1
- Updated instructions to direct users to register at https://t.ly/register before creating an API key at https://t.ly/settings#/api if needed.
- Clarified user guidance in cases where an API key is missing.
v1.0.0
Initial release of tly-short-link-creator.
- Create short links using the T.LY API, requiring a user-provided API key.
- Supports both the official Python SDK/CLI (`tly-url-shortener-api`) and a direct API fallback.
- Provides clear guidance for token handling, URL validation, output format preferences, and error surfacing.
- Enforces important guardrails on secrets management and error handling.
- Includes comprehensive quick start, workflow, code samples, and troubleshooting guidance.
元数据
常见问题
T.LY URL Shortener 是什么？
Create T.LY short links through the T.LY API. Use when an agent needs to shorten a URL, generate a shareable T.LY link, return a `short_url`, or call T.LY pr... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 330 次。
如何安装 T.LY URL Shortener？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install tly」即可一键安装，无需额外配置。
T.LY URL Shortener 是免费的吗？
是的，T.LY URL Shortener 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
T.LY URL Shortener 支持哪些平台？
T.LY URL Shortener 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 T.LY URL Shortener？
由 Tim（@timleland）开发并维护，当前版本 v1.0.2。
推荐 Skills