Jules and the Lobster API headless
v1.0.5Use the Jules REST API (v1alpha) via curl to list sources, create sessions, monitor activities, approve plans, send messages, and retrieve outputs (e.g., PR...
⭐ 1· 1.9k·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description, SKILL.md, and the included scripts consistently implement a Jules REST API client: listing sources, creating sessions, sending messages, approving plans, and retrieving activities. Declared dependencies (curl, python3) and optional node/jules wrapper are appropriate for these tasks. Note: registry metadata earlier reported "Required env vars: none" while SKILL.md and scripts require JULES_API_KEY — this is an inconsistency in metadata but not a functional mismatch.
Instruction Scope
Runtime instructions and scripts only call the documented base URL (https://jules.googleapis.com/v1alpha) using the x-goog-api-key header. They do not read arbitrary files, other environment variables, or send data to other endpoints. JSON payloads are constructed with python3 for safe escaping; node wrapper simply invokes a local 'jules' CLI if present.
Install Mechanism
This is an instruction-only skill with bundled helper scripts and no install spec. Nothing is downloaded or extracted during install and no unusual install host/URLs are used.
Credentials
Only a single credential (JULES_API_KEY) is required by SKILL.md and enforced by the bash script, which is appropriate. However, the registry metadata incorrectly lists no required env vars / no primary credential — the SKILL.md should be aligned with registry metadata to avoid confusion.
Persistence & Privilege
The skill does not request persistent presence (always: false) and does not modify other skills or system-wide agent settings. It runs on-demand via scripts and does not store credentials itself.
Assessment
This skill is coherent with its stated purpose, but before installing: 1) Be prepared to provide a Jules API key (JULES_API_KEY) from https://jules.google.com/settings#api and avoid placing keys in shared/global shells if you don't want them exposed. 2) Review and approve the GitHub app permissions for repositories you connect to Jules (the skill can create PRs if auto-pr is enabled). 3) Note the small metadata inconsistency — the registry says no env vars but the scripts require JULES_API_KEY; ask the publisher to correct metadata if that matters for automated deployment. 4) If you don't want to use the optional node wrapper that calls a local 'jules' binary, you can ignore it; the bash script is self-contained. 5) As always, only use this skill with repositories and API keys you trust.Like a lobster shell, security has layers — review code before you run it.
latestvk97e1g3sq6v6rgr0034j703hd581bjmm
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
