CtrlK
BlogDocsLog inGet started
Tessl Logo

onecli-gateway

OneCLI Gateway: transparent HTTPS proxy that injects stored credentials into outbound calls. You MUST use this skill when the user asks you to read emails, check calendar, access GitHub repos, create issues, check Stripe payments, or interact with ANY external service or API. Do NOT use browser extensions or OAuth CLI tools. Make HTTP requests directly; the gateway injects credentials automatically.

60

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./container/skills/onecli-gateway/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill body is actionable and concise with concrete examples and a clear failure-recovery workflow, though the MCP stub-creation guidance lacks an explicit validation step before server startup.

Suggestions

Add an explicit validation checkpoint to the credential-stub flow (e.g., verify the stub file exists with 0600 permissions and contains 'onecli-managed' before starting the MCP server).

Confirm the external credential-stubs guide URL is stable and version-pinned, since time-sensitive or moving URLs weaken progressive disclosure.

Tighten the 'How to Access External Services' section, which slightly restates the intro, to remove minor redundancy.

DimensionReasoningScore

Conciseness

The body is efficient and assumes Claude's competence, giving direct curl examples and tight rules without explaining basic HTTP or proxying fundamentals; only minor phrasing could be trimmed.

4 / 5

Actionability

It provides copy-paste-ready curl commands for Gmail, GitHub, and Stripe, plus explicit guidance to rely on HTTPS_PROXY and concrete stub-file creation steps with permissions and placeholder values.

5 / 5

Workflow Clarity

The failure-recovery flow is clearly sequenced (show connect link, then retry after confirmation) with a feedback loop, but there is no validation checkpoint for the credential-stub creation step before starting an MCP server.

4 / 5

Progressive Disclosure

Content is well-organized into clear sections with a single one-level-deep external link (the credential-stubs guide URL); no bundle files exist, so the body appropriately stays self-contained with minor reliance on an external doc.

4 / 5

Total

17

/

20

Passed

Description

57%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly communicates the proxy's function and lists recognizable trigger services, but it is overly directive ('You MUST'), uses second-person voice, and over-claims with 'ANY external service,' weakening completeness and distinctiveness.

Suggestions

Rewrite the trigger clause as natural user-facing language ('Use when the user asks to read emails, check calendars, or query APIs like GitHub and Stripe') instead of an imperative 'You MUST use this skill.'

Convert to third-person voice (e.g., 'Injects stored credentials into outbound HTTPS calls') and remove second-person phrasing to satisfy the voice guideline.

Narrow the over-broad 'interact with ANY external service or API' to a concrete, bounded list of supported services to reduce conflict risk with other API skills.

DimensionReasoningScore

Specificity

It names the domain (HTTPS proxy injecting credentials) and a concrete action (injects stored credentials into outbound calls) but lists no additional specific capabilities beyond proxying, leaving coverage shallow rather than comprehensive.

3 / 5

Completeness

It gives a clear 'what' (transparent HTTPS proxy that injects credentials) but the 'when' is a directive to Claude ('You MUST use this skill when...') rather than natural user-facing trigger guidance, and it lacks a clean 'Use when...' clause.

3 / 5

Trigger Term Quality

It includes natural user phrases such as 'read emails, check calendar, access GitHub repos, create issues, check Stripe payments,' covering several real-world trigger terms, though it omits common synonyms and broader phrasings.

4 / 5

Distinctiveness Conflict Risk

The proxy/gateway niche is somewhat distinct, but the trigger list ('interact with ANY external service or API') is very broad and could overlap with many other integration or API skills.

3 / 5

Total

13

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
nanocoai/nanoclaw
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.