GeeLark Complete

All-in-one Skill fuer GeeLark: Setup, lokale API, nativer Sync-Transport, UI/RPA-Fallback, Posting-Flow, Verifikation und Troubleshooting in einem durchgaeng...

Security Scan

The SKILL.md expects local apps, helper scripts, and a GEELARK_API_KEY secret and tells the agent to run Python/Node/osascript commands, but the registry metadata declares no env vars, no required binaries, and no install — these mismatches are significant and should be resolved before use.

Purpose & Capability

The skill claims to be an end-to-end operational runbook for GeeLark. The instructions, however, require local app binaries and helper scripts (scripts/geelark/local_client.py and sync_client.mjs), a local API base and bearer token (GEELARK_API_BASE, GEELARK_API_KEY), and a native mssvr — none of these are declared in the registry metadata (which lists no required env vars, binaries, or config paths). That mismatch is incoherent: a user installing this skill would reasonably expect those prerequisites to be declared.

Instruction Scope

SKILL.md instructs the agent to read/open openclaw-config/.env, run python3 and node scripts, probe local API endpoints, start/focus a GUI app (open/osascript), and document findings into Memory/Skill-Doku. The allowed-tools list (Read/Write/Edit/Grep/Glob/Bash) gives the agent filesystem and shell capabilities that could access other files or exfiltrate data if misused. The instructions do not limit which files to read beyond the expected scripts and .env, increasing the risk if the skill runs with broad file access.

Install Mechanism

There is no install spec and no downloaded code — the skill is instruction-only. That minimizes installation risk because nothing is fetched or written by an installer. However, the instructions expect local helper scripts to exist; the skill's behavior depends on those external files, which the registry does not provide or validate.

Credentials

The runbook explicitly requires GEELARK_API_BASE and GEELARK_API_KEY (bearer token) and refers to signed requests with app-id/app-auth, but the registry metadata lists no required environment variables or primary credential. Additionally, the instructions assume availability of python3, node, and OS app-control tools (open/osascript) but these binaries are not declared. Requesting or using bearer tokens and signing keys is proportional to the skill's purpose, but the omission from metadata and the lack of guidance on secure storage/usage is a material concern.

Persistence & Privilege

always is false (normal). The runbook tells the agent to store reproducible findings in Memory/Skill-Doku (persisting results), which is reasonable for an ops skill, but because the skill can read and write, you should confirm which persistent stores the agent will use and whether stored data (including tokens or session IDs) is protected and rotatable.

What to consider before installing

This skill is instruction-only but its instructions expect local helper scripts, a local GeeLark app, and sensitive environment variables (GEELARK_API_BASE and GEELARK_API_KEY) even though the registry metadata declares none. Before installing or enabling: 1) ask the publisher/source for the missing metadata, the helper scripts, and a homepage or repository so you can review the scripts' code; 2) verify you have python3, node, and the ability to run osascript/open on the host and decide whether to allow those tools; 3) do not provide your GEELARK_API_KEY unless you inspect how it's used and stored — prefer a short-lived token and ability to revoke it; 4) limit the skill's filesystem permissions (deny global Read/Write if possible) so it can only access the declared scripts and openclaw-config/.env; 5) if you cannot validate the script code or the publisher, treat this as untrusted and do not run commands from the skill on production systems. These mismatches are likely an omission but could enable accidental exposure of local secrets or execution of arbitrary scripts.

Dieser Skill ist der zentrale End-to-End Skill fuer GeeLark und deckt alle aktuell praktikablen Faehigkeiten im Workspace ab.

Scope

• GeeLark Setup und Betriebsbereitschaft
• Lokale Agent-API auf GEELARK_API_BASE
• Nativer Desktop-Sync ueber mssvr (signierte Requests)
• UI-Automation als Fallback bei API-Limits
• Browser-/Profil-Start und URL-Navigation
• Asset-Transfer und Posting-Vorbereitung
• Strikte Verifikation und reproduzierbares Troubleshooting

Voraussetzungen

• App: /Applications/GeeLark.app
• Env in openclaw-config/.env:
  • GEELARK_API_BASE=http://localhost:40185
  • GEELARK_API_KEY=<bearer token>
• Hilfsskripte:
  • scripts/geelark/local_client.py
  • scripts/geelark/sync_client.mjs
• Fuer Sync: GeeLark nativer mssvr muss aufloesbar/startbar sein

Faehigkeiten (Capability Matrix)

1. Setup

• Team/Workspace-Basis pruefen
• Proxy/Phone/App-Basis dokumentieren
• phone_id Mapping aus Dashboard/Baserow festhalten

2. API Ops

• Agent-Liveness und Port-Info pruefen
• Endpunkt-Footprint (probe, request)
• Lesende Ersttests vor schreibenden Calls
• Upload-/Task-Routen vorbereiten, sofern Methode/Payload belegt

3. Native Sync Ops

• Signierte Requests mit app-id + app-auth
• Session-Lifecycle: start -> config -> input/input_list -> stop
• Preconditions pruefen (sid, Handle-Anzahl, Handle-Matching)

4. UI/RPA Ops

• App starten/fokussieren
• Sichtbare Profile/Browser oeffnen
• Klare, belegbare Klickpfade ausfuehren
• Bei Captcha/MFA bis zum belegbaren Blocker gehen und stoppen

5. Posting Ops

• Asset-Transfer bis GeeLark-Endstation
• Plattformspezifische Posting-Sequenz vorbereiten
• Timing/Line-Disziplin aus dem Workflow einhalten

6. Verification Ops

• Nach Aktionen immer dual pruefen:
  • Zustand A: richtige Vordergrund-App/Fenster
  • Zustand B: inhaltliche Zielpruefung (z. B. URL, Session-ID, API-Response)
• Ohne Gegencheck gilt eine Aktion als nicht abgeschlossen

7. Recovery/Triage

• API 404: Methode/Payload pruefen statt Endpunkt sofort verwerfen
• Sync-Fehler: erst mssvr-Port und Signaturpfad checken
• UI-Fehler: Fokusproblem von Logikproblem trennen
• Jede reproduzierbare Erkenntnis in Memory/Skill-Doku hinterlegen

Standard-Runbook

1. Klasse bestimmen: Setup, API, Sync, UI, Posting.
2. API-first starten (harmloser Call zuerst).
3. Wenn Sync gebraucht wird: nur sync_client.mjs oder local_client.py sync-* nutzen.
4. Bei API-Blocker auf UI-Fallback wechseln.
5. Nach jedem Schritt verifizieren.
6. Nur bei validiertem Zustand weiter zum naechsten Schritt.

Kommandos (sicherer Einstieg)

python3 scripts/geelark/local_client.py info
python3 scripts/geelark/local_client.py health
python3 scripts/geelark/local_client.py probe --endpoint /v1/browser/core/list --methods GET OPTIONS POST --json-body '{}'
python3 scripts/geelark/local_client.py sync-info
node scripts/geelark/sync_client.mjs info

Kommandos (Sync-Lifecycle)

node scripts/geelark/sync_client.mjs start --main-hwnd 101 --hwnd 101 --hwnd 202
node scripts/geelark/sync_client.mjs config --sid abc --json-body '{"delay_range_before_click":[300,900]}'
node scripts/geelark/sync_client.mjs same-input --sid abc --text 'hello world' --input-interval 0,0
node scripts/geelark/sync_client.mjs stop --sid abc

Kommandos (UI-Fallback)

open -a "GeeLark"
osascript -e 'tell application "GeeLark" to activate'

Claw/OpenClaw Integration

• Lokale Nutzung: Skill liegt unter skills/geelark-complete/ und ist damit im Workspace verfuegbar.
• Mit ClawHub CLI publizieren:

clawdhub publish ./skills/geelark-complete \
  --slug geelark-complete \
  --name "GeeLark Complete" \
  --version 1.0.0 \
  --changelog "Initial all-in-one GeeLark skill"

Beziehungen zu vorhandenen Skills

• Nutzt und konsolidiert:
  • geelark-ops
  • geelark-setup
  • geelark-api-ops
  • geelark-rpa-ops
  • geelark-posting-ops
  • geelark-sync-operational
• Dieser Skill ist der zentrale Einstieg, die anderen bleiben als Deep-Dive erhalten.

Grenzen

• Keine destruktiven Calls ohne belegte Route, Methode, Payload
• Keine externen Postings ohne explizite User-Absicht
• Keine erfundenen Endpunkte oder ungepruefte Automationsversprechen

Zielbild

Ein einziger GeeLark Skill, der operative End-to-End Aufgaben von Diagnose bis Ausfuehrung mit Pflicht-Verifikation abdeckt und zugleich in ClawHub versionierbar ist.