← 返回 Skills 市场
1470
总下载
1
收藏
0
当前安装
3
版本数
在 OpenClaw 中安装
/install xapi-labs
功能描述
Use xapi CLI to access real-time external data — Twitter/X profiles, tweets, and timelines, crypto token prices and metadata, web search, news, and AI text p...
安全使用建议
This skill appears to do what it says: it calls the xapi CLI (via npx) to access social, crypto, web, and AI services and expects a single XAPI_API_KEY. Before installing/using: (1) verify you trust https://xapi.to and the npm package that npx will fetch (npx runs remote code); (2) consider installing the CLI locally or pinning a specific package/version rather than using npx each time; (3) be aware the CLI stores the API key in ~/.xapi/config.json — treat that file as sensitive (don’t put high‑privilege secrets there); (4) avoid sending confidential data through this skill because it proxies requests to third-party APIs; (5) if you allow autonomous agent invocation, limit what the agent can send to external services. If you want a stronger assessment, provide the actual npm package name or the package source code so it can be audited.
功能分析
Type: OpenClaw Skill
Name: xapi-labs
Version: 1.0.3
The skill bundle provides a comprehensive interface for the 'xapi' CLI (executed via npx xapi-to) to access Twitter data, crypto prices, web search, and AI services. It includes detailed instructions for the agent on handling API keys, OAuth flows, and service discovery, while explicitly including security warnings to protect the user's API key and avoid logging sensitive payment URLs. No evidence of malicious intent, obfuscation, or unauthorized data exfiltration was found.
能力评估
Purpose & Capability
The name/description match the runtime instructions: SKILL.md tells the agent to run the xapi CLI (via npx) to access Twitter/X, crypto, web/news search, and AI text services. Requesting a single primary credential XAPI_API_KEY is appropriate for a service that proxies external APIs.
Instruction Scope
The SKILL.md stays on topic: it instructs the agent to use npx xapi-to commands, to 'get' action schemas before calling, and to supply JSON inputs. It also documents that the CLI stores the API key at ~/.xapi/config.json or via XAPI_API_KEY. Note that the skill enables calls to third-party API proxies (arbitrary discovered APIs), so agent-invoked requests could send user-provided data to external services — users should be mindful about what data they allow the skill to send.
Install Mechanism
This is an instruction-only skill with no install spec, but it requires npx. That means each invocation will fetch/execute a package (npx xapi-to), which runs remote code from the npm ecosystem. This is expected for CLI wrappers but is higher-risk than invoking a pre-installed binary; consider pinning/verifying the package or installing it locally from a trusted source.
Credentials
Only one primary credential (XAPI_API_KEY) is declared and matches the described purpose. No unrelated environment variables or unrelated credentials are requested. The SKILL.md's mention of storing the key in ~/.xapi/config.json is relevant but means a key will be written to disk (likely in plaintext) unless the CLI manages encryption.
Persistence & Privilege
The skill does not request always: true and uses the platform defaults for invocation. It does direct the CLI to persist the API key in the user's home (~/.xapi/config.json), but it does not request access to other skills' configs or system-wide settings.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install xapi-labs - 安装完成后，直接呼叫该 Skill 的名称或使用
/xapi-labs触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.3
- Updated all CLI usage examples and setup instructions to use the new npx entrypoint: npx xapi-to (was npx @xapi-to/xapi)
- Revised command syntax throughout documentation for consistency with the new CLI alias xapi-to
- Updated references and examples for registration, configuration, and workflow steps to reflect the new npx usage
- No feature or functional changes; documentation update only
v1.0.2
xapi-labs v1.0.2 — Major update: new xapi CLI skill replaces previous MD reference.
- Switched from API registration workflow to using the official xapi CLI via npx, supporting real-time data access.
- Concisely documents Twitter/X, crypto, web search, news, and AI text actions with detailed CLI command examples.
- Shows new discovery/search methods for available capabilities and third-party APIs.
- Includes updated setup, authentication, and OAuth Twitter flow for read/write access.
- Improved agent usage guidance: always check required parameters with `get` before calling any action.
v1.0.1
xapi-labs v1.0.1
- Adds comprehensive SKILL.md documentation for the xapi aggregated API platform.
- Explains agent setup, registration flow, security rules, and best practices.
- Details step-by-step self-registration and Twitter account binding process for agents and humans.
- Includes critical security warnings and recommended usage patterns.
- SKILL.md now serves as a persistent agent reference for using xapi's unified MCP interface.
元数据
常见问题
xAPI 是什么？
Use xapi CLI to access real-time external data — Twitter/X profiles, tweets, and timelines, crypto token prices and metadata, web search, news, and AI text p... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 1470 次。
如何安装 xAPI？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install xapi-labs」即可一键安装，无需额外配置。
xAPI 是免费的吗？
是的，xAPI 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
xAPI 支持哪些平台？
xAPI 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 xAPI？
由 洛冰河（@glacier-luo）开发并维护，当前版本 v1.0.3。
推荐 Skills