Solar Cloud API

Fetch inverter summary data from the Solax Cloud API using the npm package solax-cloud-api. Use when the user provides (or has configured) a Solax tokenId and inverter serial number (sn) and wants current/summary energy data returned as JSON (typed as SolaxSummary) for dashboards/automation.

Security Scan

The skill's code and instructions match its stated purpose (fetching Solax inverter summaries), but there are small inconsistencies and a manual npm install step that you should review before trusting it.

Purpose & Capability

The name/description, the script (fetch_summary.mjs), and package.json all align: they load solax-cloud-api@0.2.0 and call getAPIData() -> toSummary() to produce SolaxSummary JSON. One mismatch: registry metadata lists no required environment variables, but the runtime clearly expects SOLAX_TOKENID and SOLAX_SN (or CLI args).

Instruction Scope

SKILL.md instructs the agent to run npm install in the skill folder and then run the script with env vars or CLI args. It does not ask the agent to read unrelated files or exfiltrate data to unknown endpoints; network activity is the expected Solax Cloud API calls performed by the solax-cloud-api package. The script redacts the tokenId in error output but emits the inverter serial (sn) unredacted.

Install Mechanism

There is no automatic install spec; the skill relies on a manual `npm install` in the skill workspace. That will pull solax-cloud-api from the public npm registry (moderate trust surface). No arbitrary downloads or external URLs are used. Because the skill ships a package.json without a lockfile and instructs `npm install` (not `npm ci`), the exact transitive dependency graph can vary unless you pin/lock versions.

Credentials

The amount of secret access required is minimal and appropriate (a Solax tokenId and inverter serial). However, the registry metadata did not declare these required environment variables — a metadata mismatch that could cause surprise. Also note the script prints the serial number in error outputs unredacted (could reveal device identifiers); tokenId is redacted but still included in error JSON in a redacted form.

Persistence & Privilege

The skill does not request permanent presence (always:false), does not modify other skills or system settings, and is user-invocable only. It writes dependencies into the skill workspace only when you run npm install (manual step).

What to consider before installing

This skill appears to do what it says: use the solax-cloud-api npm package to fetch an inverter summary. Before installing or running it: 1) Verify and provide SOLAX_TOKENID and SOLAX_SN only via environment variables or secure vaults (do not paste tokens into chat). 2) Inspect the solax-cloud-api package (and its dependencies) from the npm registry before running npm install, and consider pinning/locking versions to avoid unexpected transitive packages. 3) Run npm install in a contained environment (build sandbox or CI runner) if you’re unsure. 4) Be aware the script emits the inverter serial (sn) in error output unredacted — if that is sensitive for you, modify the script to redact it. 5) Consider asking the publisher to update registry metadata to declare the required env vars and to include a lockfile to reduce supply-chain variability.

solax-summary-fetch

Fetch Solax inverter summary data as JSON.

Setup (one-time)

This skill uses Node.js and the npm package solax-cloud-api.

Install dependencies inside the skill folder:

cd /home/openclaw/.openclaw/workspace/skills/solax-summary-fetch/scripts
npm install

(We use npm install instead of npm ci because this skill does not ship with a lockfile.)

Inputs

You need:

• tokenId (Solax Cloud API token id)
• sn (inverter serial number)

Recommended: environment variables

Set these in your runtime (preferred so you don’t leak secrets into shell history):

• SOLAX_TOKENID
• SOLAX_SN

Do not hardcode credentials into the skill files.

Alternate: CLI arguments

Pass them explicitly as:

• --tokenId <tokenId>
• --sn <serial>

Command

cd /home/openclaw/.openclaw/workspace/skills/solax-summary-fetch/scripts
node fetch_summary.mjs --tokenId "$SOLAX_TOKENID" --sn "$SOLAX_SN"

Output

• Prints a single JSON object to stdout.
• The JSON conforms to the SolaxSummary interface exposed by solax-cloud-api (see references/solax-summary.d.ts).
• Under the hood (solax-cloud-api v0.2.0): fetches getAPIData() then converts via SolaxCloudAPI.toSummary().

Guardrails

• Never print or log the tokenId beyond confirming whether it is set (redact it).
• If the API call fails, return a structured error JSON with ok:false and a short error message.