1panel Skill

Comprehensive 1Panel server management skill for AI agents. Manage Linux servers, Docker containers, databases, websites, SSL certificates, and more through...

Security Scan

The skill's declared purpose and required credential (ONEPANEL_API_KEY) match the implementation, but there are inconsistencies and a few risky artifacts (dev/build scripts referencing absolute local paths, repository code present despite 'instruction-only' note, and the API key grants very broad control of a server) that warrant manual review before installing.

Purpose & Capability

The name/description (1Panel server management) align with required binary (node) and required env var (ONEPANEL_API_KEY). However the registry metadata indicated an instruction-only skill while the package actually contains a full TypeScript codebase (many src/ files, scripts, package.json). That mismatch is likely a packaging/documentation issue but should be confirmed.

Instruction Scope

SKILL.md instructs running the included CLI (scripts/1panel.mjs) which calls many 1Panel API endpoints (containers, files, system, websites, backups, etc.). Those actions are coherent with the stated purpose but carry high privilege: the skill can list and manipulate files, containers, users, and services on the target 1Panel server. Separately, several developer scripts in the repo reference absolute home paths (e.g. /home/EaveLuo/.openclaw/.../1panel_api_docs.json). Those generation scripts are not referenced in SKILL.md runtime steps, but if executed they would attempt to read local paths — review and avoid running them on your machine.

Install Mechanism

No install spec was published in the registry entry, but README/OPENCLAW_INSTALL.md recommend cloning and running 'npm install' and 'npm run build'. There are no network download URLs in install scripts; the package uses an npm build (tsc). Risk is moderate: building from source requires dev tooling (typescript) and will run local build steps, but there are no postinstall or remote-download steps in package.json. If you install from npm, prefer the published package (dist files) rather than building unknown source locally.

Credentials

The only required credential is ONEPANEL_API_KEY, which is appropriate for managing a 1Panel server. However this single key grants broad, powerful control (access to file operations, container management, backups, SSH/host actions, AI/XPack features, etc.). That level of privilege is expected for server-admin tasks but is high-risk if the skill or its runtime is untrusted. The SKILL.md also documents optional host/port/protocol env vars — those are reasonable.

Persistence & Privilege

The skill does not request 'always: true' and does not declare system-wide config modifications. It uses normal agent invocation (disable-model-invocation=false) which is the platform default. Note: allowing autonomous invocation combined with a full-power API key increases potential blast radius — consider restricting autonomous use if unsure.

What to consider before installing

This skill appears to implement what it claims (a full 1Panel API client/CLI), but exercise caution: - Review the code before installing. Pay special attention to scripts/* and any file that reads absolute paths (e.g. references to /home/EaveLuo/...). Those are developer artifacts and should not be run on your system. - Understand the privilege: ONEPANEL_API_KEY grants broad control of your 1Panel server (file access, container management, system settings). Only provide a key with the minimum necessary privileges, and only to code you trust. - Prefer installing the published package with prebuilt dist files rather than building source from an unknown repo. If you must build locally, do so in a disposable/isolated environment and inspect devDependencies and build scripts. - Do not run generation or developer scripts (generate_*.py, generate-api.cjs) unless you inspect them and understand what they access — they reference developer-local paths and could read unexpected files if executed. - If you allow the agent to invoke this skill autonomously, consider limiting that capability or rotating the API key after testing. If you want a safer go/no-go: request the maintainer to publish a release that contains only the built dist/, SKILL.md, and minimal package.json (no dev artifacts), and/or provide a reproducible build log so you can trust the distributed files. If you do not trust the repo owner, treat the API key as sensitive and avoid installing.

Manage 1Panel servers through AI agents. Full access to 580+ API endpoints covering containers, databases, websites, SSL, file management, system monitoring, and more.

Prerequisites

• 1Panel server (https://1panel.cn/)
• API key from 1Panel Dashboard → Profile → API

Configuration

Set environment variables:

export ONEPANEL_API_KEY="your-api-key"
export ONEPANEL_HOST="localhost"      # optional, default: localhost
export ONEPANEL_PORT="8080"           # optional, default: 8080
export ONEPANEL_PROTOCOL="http"       # optional, default: http

Quick Start

# List containers
node {baseDir}/scripts/1panel.mjs containers

# Get container info
node {baseDir}/scripts/1panel.mjs container <id>

# Start/Stop/Restart container
node {baseDir}/scripts/1panel.mjs start <id>
node {baseDir}/scripts/1panel.mjs stop <id>
node {baseDir}/scripts/1panel.mjs restart <id>

# List images
node {baseDir}/scripts/1panel.mjs images

# List websites
node {baseDir}/scripts/1panel.mjs websites

# List databases
node {baseDir}/scripts/1panel.mjs databases

# List files
node {baseDir}/scripts/1panel.mjs files /opt

# Get system info
node {baseDir}/scripts/1panel.mjs system

# Get dashboard info
node {baseDir}/scripts/1panel.mjs dashboard

Available Commands

Command	Description
containers	List all Docker containers
container <id>	Get container details
start <id>	Start a container
stop <id>	Stop a container
restart <id>	Restart a container
images	List Docker images
websites	List websites
databases	List databases
files <path>	List files in directory
system	Get system information
dashboard	Get dashboard information

API Coverage

Container & Docker (24 tools)

• Container lifecycle (create, start, stop, restart, pause, kill, remove)
• Image management (pull, push, build, tag, save, load)
• Network & Volume management
• Docker Compose operations

Website Management (24 tools)

• Website creation and configuration
• Domain management
• SSL certificate (Let's Encrypt, manual upload)
• HTTPS configuration
• Nginx configuration
• OpenResty (XPack)

Database (24 tools)

• MySQL (create, delete, bind user, change password)
• PostgreSQL
• Redis (config, password, status)

File Operations (19 tools)

• List, upload, download
• Compress/Decompress (zip, tar, tar.gz)
• Move, rename, delete
• Permissions (chmod, chown)

System & Security (20+ tools)

• System settings
• Firewall rules
• Fail2ban
• SSH management
• ClamAV antivirus
• FTP server

Monitoring (8 tools)

• Dashboard
• System monitor
• Device info
• Disk management

Backup & Recovery (13 tools)

• Backup operations
• Backup accounts (local, SFTP, OSS, S3)
• System snapshots
• Recycle bin

XPack Features (47 tools)

• AI Agent management
• MCP Server
• Ollama models
• GPU monitoring
• OpenResty
• Node.js runtime

Output Format

All commands output JSON:

{
  "data": [...],
  "success": true
}

Or on error:

{
  "error": true,
  "message": "Error description"
}

Advanced Usage

For full API access, use as a library:

import { OnePanelClient } from '1panel-skill';

const client = new OnePanelClient({
  host: 'localhost',
  port: 8080,
  apiKey: 'your-api-key',
  protocol: 'http'
});

// Full API access
const containers = await client.containers.list();
const websites = await client.websites.list();

Links

• GitHub
• npm
• 1Panel