Manus

Create and manage AI agent tasks via Manus API. Manus 1.5 autonomously browses the web, uses tools, and delivers complete work products. Cost-efficient Manus...

Security Scan

The skill's code, instructions, and requested credential (MANUS_API_KEY) are coherent with its stated purpose of interacting with the Manus API; only minor implementation notes exist (e.g., reliance on jq and a config-path suggestion not declared in metadata).

Purpose & Capability

Name/description claim to create/manage Manus tasks and the skill only requests a single Manus API key and contains curl-based helpers that call https://api.manus.ai/v1 — this is proportionate and expected. One minor inconsistency: the shipped script and SKILL.md rely on utilities like jq but the metadata lists no required binaries.

Instruction Scope

SKILL.md instructs only API calls to Manus, polling tasks, and downloading output files — all within the described scope. It also mentions storing the key in an OpenClaw config path (skills.manus.apiKey), which is outside the declared required config paths; this is a documentation note rather than an obvious malicious action.

Install Mechanism

No install spec (instruction-only) which is low risk. The included shell helper uses curl and jq; the skill metadata does not declare jq as a required binary, so users should ensure jq is available. No external downloads or obscure install URLs are present.

Credentials

Only MANUS_API_KEY (primaryEnv) is required, which matches the API-key-based authentication described. No unrelated secrets, passwords, or multiple credentials are requested.

Persistence & Privilege

Skill is not always-enabled and does not request elevated persistent system privileges or modify other skills' configurations. It does suggest storing the key in OpenClaw config, which is a normal convenience but not inherently privileged.

Assessment

This skill appears to do what it claims: talk to the Manus API using MANUS_API_KEY. Before installing: (1) Verify you trust the Manus service and the author (source is listed as unknown though SKILL.md points at a GitHub repo); (2) Provide only a Manus API key with the minimum permissions you can; rotate the key if you later uninstall or suspect misuse; (3) Ensure jq and curl are available on the host (the helper script uses jq but the metadata doesn't declare it); (4) Review the shell script yourself (it performs API calls and downloads files) and confirm you’re comfortable with downloaded files being written to disk and attached/delivered to users; (5) Note the SKILL.md mentions storing the API key in your OpenClaw config (skills.manus.apiKey) — if you choose that, understand your agent config may contain the key alongside other settings. None of the findings indicate malicious intent, but always audit keys and third-party outputs before sharing sensitive data.

Manus AI Agent

Use the Manus API to create autonomous AI tasks. Manus can browse the web, use tools, and deliver complete results (reports, code, presentations, etc.).

API Base

https://api.manus.ai/v1

Authentication

Header: API_KEY: <your-key>

Set via:

• MANUS_API_KEY env var
• Or skills.manus.apiKey in openclaw config

Recommended Workflow

When using Manus for tasks that produce files (slides, reports, etc.):

1. Create the task with createShareableLink: true
2. Poll for completion using the task_id
3. Extract output files from the response and download them locally
4. Deliver to user via direct file attachment (don't rely on manus.im share links)

Create a Task

curl -X POST "https://api.manus.ai/v1/tasks" \
  -H "API_KEY: $MANUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "prompt": "Your task description here",
    "agentProfile": "manus-1.6",
    "taskMode": "agent",
    "createShareableLink": true
  }'

Response:

{
  "task_id": "abc123",
  "task_title": "Task Title",
  "task_url": "https://manus.im/app/abc123"
}

Agent Profiles

Profile	Description	Use for
manus-1.6	Standard (default)	Most tasks
manus-1.6-lite	Faster, lighter	Quick/simple stuff
manus-1.6-max	Complex, thorough	Deep research/analysis

Default: Always use manus-1.6 unless user specifies otherwise.

Task Modes

Mode	Description
chat	Conversational mode
adaptive	Auto-selects best approach
agent	Full autonomous agent mode (recommended for file creation)

Get Task Status & Output

curl "https://api.manus.ai/v1/tasks/{task_id}" \
  -H "API_KEY: $MANUS_API_KEY"

Status values: pending, running, completed, failed

Important: When status is completed, check the output array for files:

• Look for type: "output_file" entries
• Download files from fileUrl directly
• Save locally and send to user as attachments

Extracting Output Files

The task response includes output like:

{
  "output": [
    {
      "content": [
        {
          "type": "output_file",
          "fileUrl": "https://private-us-east-1.manuscdn.com/...",
          "fileName": "presentation.pdf"
        }
      ]
    }
  ]
}

Download these files with curl and deliver directly to the user rather than relying on share URLs.

List Tasks

curl "https://api.manus.ai/v1/tasks" \
  -H "API_KEY: $MANUS_API_KEY"

Best Practices

1. Always poll for completion before telling user the task is done
2. Download output files locally instead of giving manus.im links (they can be unreliable)
3. Use agent mode for tasks that create files/documents
4. Set reasonable expectations — Manus tasks can take 2-10+ minutes for complex work

Docs

• API Reference: https://open.manus.ai/docs
• Main Docs: https://manus.im/docs