onecli-gateway

OneCLI Gateway: transparent HTTPS proxy that injects stored credentials into outbound calls. You MUST use this skill when the user asks you to read emails, check calendar, access GitHub repos, create issues, check Stripe payments, or interact with ANY external service or API. Do NOT use browser extensions or OAuth CLI tools. Make HTTP requests directly; the gateway injects credentials automatically.

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

85%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured, highly actionable guide with concrete curl examples, a sequenced error-recovery workflow, and clean sectioning. Its only weakness is mild redundancy in restating the credential-injection mechanism across multiple sections.

Suggestions

Consolidate the repeated 'gateway injects credentials automatically' restatements from the overview, How to Access, and Making Requests sections into a single statement to tighten conciseness toward anchor 3.

Dimension	Reasoning	Score
Conciseness	The body is lean and free of concepts Claude already knows, but restates the core mechanism ('the gateway injects credentials automatically' / 'injects credentials if the app is connected') across the overview, Making Requests, and How to Access sections, which is mild padding that could be tightened — matching the anchor-2 'mostly efficient but could be tightened'.	2 / 3
Actionability	It provides concrete, copy-paste-ready curl examples for Gmail, GitHub, and Stripe, plus specific operational values ('onecli-managed' placeholder with 0600 perms, the HTTPS_PROXY env var, connect_url handling), fully matching the anchor-3 'executable code/commands; copy-paste ready'.	3 / 3
Workflow Clarity	The 'When a Request Fails' section is a clearly sequenced two-step process (show connect link, then retry after connect) with an explicit feedback loop (retry; if it still fails, ask about setup), and the credential-stub section prescribes ordering ('create stubs before starting it'), meeting the anchor-3 bar with validation checkpoints.	3 / 3
Progressive Disclosure	No bundle files exist; the body is organized into clear, well-labeled sections (How to Access, Making Requests, Credential Stubs, When a Request Fails, Rules) with a single one-level external doc link that is clearly signaled, so per the under-50-lines / well-organized-sections guidance it earns the anchor-3 score.	3 / 3
	Total	11 / 12 Passed

Description

90%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, trigger-rich description that clearly states both capability and activation conditions, with concrete service examples and explicit negative guidance. The only meaningful weakness is the second-person voice, which the rubric flags as a specificity penalty.

Suggestions

Rewrite the description in third person ('Injects stored credentials into outbound HTTPS calls') instead of 'You MUST use this skill' / 'Make HTTP requests' to recover the specificity point lost to the second-person penalty.

Consider trimming the somewhat aggressive 'You MUST use this skill... or interact with ANY external service or API' phrasing, which risks over-triggering on unrelated external-service requests.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions ('read emails, check calendar, access GitHub repos, create issues, check Stripe payments') and the proxy mechanism, which is anchor-3 material, but the description is written in second person ('You MUST use this skill', 'Make HTTP requests'), which the rubric penalizes by reducing specificity by one level.	2 / 3
Completeness	It explicitly answers what ('transparent HTTPS proxy that injects stored credentials into outbound calls') and when ('You MUST use this skill when the user asks you to read emails...'), with an explicit trigger clause equivalent to 'Use when...', satisfying the anchor-3 bar and avoiding the missing-trigger cap of 2.	3 / 3
Trigger Term Quality	Natural user phrasings like 'read emails', 'check calendar', 'access GitHub repos', 'create issues', and 'check Stripe payments' give good coverage of terms a user would actually say, matching the anchor-3 example.	3 / 3
Distinctiveness Conflict Risk	It carves a clear niche (credential-injecting proxy for external services) and adds explicit anti-triggers ('Do NOT use browser extensions or OAuth CLI tools'), making it unlikely to fire for the wrong skill.	3 / 3
	Total	11 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: nanocoai/nanoclaw
Path: container/skills/onecli-gateway/SKILL.md
Commit: 641963c

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.