readdy.ai-test

This skill should be used when the user asks to "create a website", "generate a website", "build a website", "modify a website", "update my Readdy project",...

Security Scan

The skill's code, instructions, and requirements are coherent with a CLI client for the Readdy.ai website platform — it needs Node and a Readdy API key (stored locally) and otherwise behaves as described.

Purpose & Capability

Name/description, declared binary requirement (node), and included code (readdy.mjs + config-store.mjs) align: the skill is a CLI wrapper that talks to https://readdy.ai and manages projects. Readdy API key storage is implemented locally (~/.openclaw/readdy.json), which fits the stated need for an API key rather than an environment variable or unrelated credentials.

Instruction Scope

SKILL.md provides strict runtime rules (must call node scripts/readdy.mjs, do not modify script, pass user text verbatim). Those rules tightly constrain the agent's actions which reduces unexpected behavior. The included SSE example (generate_sse_output.txt) contains 'tool' events that reference reading other skill files and project source paths — this appears to be the server-side workflow output rather than the script performing arbitrary local reads. The script itself (as provided) only reads/writes its own credentials file; there is no evidence in the visible code of silent exfiltration or arbitrary filesystem traversal. If you plan to run modification operations that touch a local project, be aware the project or build workflows may involve paths and files on your machine (the skill/sse outputs may reference them).

Install Mechanism

No install spec is present (instruction-only deployment), so nothing is downloaded or executed beyond the provided Node script. This is a low-risk distribution mechanism. The included code is packaged with the skill rather than pulled from external URLs.

Credentials

The skill requests no environment variables and requires only an API key for the Readdy service. The API key is stored to a local file (~/.openclaw/readdy.json) with mode 0600 (config-store.mjs implements this), which is a proportionate approach for an API-backed CLI. There are no requests for unrelated secrets or cloud credentials.

Persistence & Privilege

The skill does not request always:true and does not claim system-wide changes. Its only persistent action is saving the Readdy API key to its own config path (~/.openclaw/readdy.json). It does not modify other skills' configs or request elevated privileges in the visible code.

Assessment

This skill appears to do what it says: a Node CLI that exchanges your Readdy API key for a temporary token and calls Readdy.ai endpoints to manage projects. Before installing or running it: (1) only provide a Readdy API key you trust the readdy.ai service with; the key is stored locally at ~/.openclaw/readdy.json (0600). (2) Review the full readdy.mjs if you want to confirm there are no unexpected outgoing endpoints beyond https://readdy.ai. (3) When asking the skill to modify or preview projects, be aware server-generated SSE events may reference project file paths — confirm the agent/script will only access files you intend to share. (4) If you do not use Readdy.ai or do not trust the service, do not provide an API key. If you want a deeper audit, provide the full, untruncated readdy.mjs so the entire network and filesystem behavior can be inspected.

Readdy Website Builder

Provide complete CLI capabilities for creating and managing websites through the Readdy.ai platform. Support one-click website generation, AI-driven modification, project preview, and publish management.

Script Location

readdy.mjs is located in the scripts/ subdirectory relative to this SKILL.md. Derive the absolute path from this SKILL.md's fullPath by replacing SKILL.md with scripts/readdy.mjs.

Example: If SKILL.md path is /Users/me/.claude/skills/readdy/SKILL.md, then the script path is /Users/me/.claude/skills/readdy/scripts/readdy.mjs.

<SCRIPT> in this document refers to that absolute path.

Prerequisites

Configure an API Key (one-time setup):

node <SCRIPT> config --apiKey <your-key>

API Key is stored in ~/.openclaw/readdy.json (file permissions 0600). The script reads it internally — no need to pass it on the command line.

Command Reference

Create Project

node <SCRIPT> create --query "project description/requirements"

Defaults: framework=react_v2, device=web, category=2. Project name is auto-generated by AI. The script runs an 8-step workflow internally. This process typically takes over 10 minutes — set a sufficient timeout and do not treat long execution as a failure.

Modify Project

node <SCRIPT> modify --id <projectId> --query "modification requirements"

Runs a 6-step workflow internally. Project info and message history are fetched automatically. This process typically takes over 10 minutes — set a sufficient timeout and do not treat long execution as a failure.

Other Commands

node <SCRIPT> list [--page <n>] [--pageSize <n>]          # List projects
node <SCRIPT> info --id <projectId>                        # Get project info
node <SCRIPT> messages --id <projectId>                    # Get message history
node <SCRIPT> preview --id <projectId> [--versionId <v>]   # Preview project
node <SCRIPT> delete --id <projectId>                      # Delete project
node <SCRIPT> update --id <projectId> [--name <n>] [--logo <url>] [--email <e>] \
  [--businessName <bn>] [--introduction <t>] [--phoneNumber <p>] \
  [--businessHour <h>] [--languageStyle <s>]               # Update properties
node <SCRIPT> config --apiKey <key>                          # Set API Key
node <SCRIPT> config                                        # Check API Key status

Execution Rules

Strictly follow these rules — no improvisation allowed.

Mandatory Constraints

1. Script-only execution — Execute all operations via node <SCRIPT> <command> [options]. Never write custom code to call Readdy APIs, never use curl/fetch directly, never bypass the script.
2. Do not modify the script — Never modify readdy.mjs or config-store.mjs unless the user explicitly requests it.
3. Preserve user input verbatim — Pass the user's website requirement description word-for-word as the --query value. This prevents the agent from altering the user's intent. The --query value is only used as a website generation prompt sent to the Readdy API — never include passwords, tokens, or other secrets in the query text.
4. Do not skip steps — Internal workflow steps are handled automatically by the script.
5. Do not add extra parameters — Only pass parameters the user explicitly specifies. Never add --framework, --device, --category unless requested.
6. No alternative implementations — If the script fails, report the error and suggest troubleshooting. Never write replacement code.

Standard Rules

• Verify API Key configuration before execution; prompt the user to run node <SCRIPT> config --apiKey <key> if the script reports a missing key.
• Confirm with the user before delete operations.
• Provide clear error messages and suggested actions based on error codes (see references/API.md).
• SSE generation returning session_status: "waiting_build" is auto-handled by the script — no manual intervention needed.
• Never treat build log paths as preview URLs. The relative paths (e.g. /preview/...) printed during build are internal and not usable as final links. Always run node <SCRIPT> preview --id <projectId> to obtain the actual preview URL.

Examples

# Correct — args and --query match user's original text exactly
node <SCRIPT> create --query "做一个宠物商城网站"

# Correct — modify with project ID
node <SCRIPT> modify --id abc123 --query "把首页的banner换成蓝色"

# Wrong — rewriting user input (most common mistake)
node <SCRIPT> create --query "Create a pet e-commerce website with modern design"

# Wrong — adding parameters not requested by user
node <SCRIPT> create --query "做一个网站" --framework react_v2 --device web

# Wrong — bypassing the script
fetch('https://readdy.ai/api/project/generate', ...)