Zyla API Hub Skill

Zyla API Hub Skill — Turn your OpenClaw AI agent into a real-world operator. Power it with 10,000+ production-ready APIs from Zyla API Hub — instant access to weather, finance, translation, email validation, geolocation, and more.

Security Scan

The skill's code, instructions, and requested credential (ZYLA_API_KEY) are coherent with its stated purpose (calling Zyla API Hub) and do not request unrelated access.

Purpose & Capability

Name/description, plugin behavior, CLI scripts, and the primary credential (ZYLA_API_KEY) all consistently relate to calling Zyla API Hub endpoints and browsing the Zyla catalog.

Instruction Scope

SKILL.md and the plugin instruct the agent/user to use local CLI scripts and a browser-based connect flow. The connect flow runs a temporary localhost HTTP server to capture a token (expected for OAuth-style flows). Minor inconsistency: README/SKILL.md claim the key is 'captured automatically and saved to your config', but the plugin writes the token to the process environment (process.env) and returns instructions for the user to add it to ~/.openclaw/openclaw.json — it does not itself persist the key to that file.

Install Mechanism

No external download URLs or archive extraction are used. This is an instruction-only skill with included source files (plugin + scripts) and standard npm dev dependencies (tsx, open). No high-risk install mechanism (no arbitrary remote binary downloads) is present in the provided files.

Credentials

Only ZYLA_API_KEY (primaryEnv) and an optional hub URL (ZYLA_HUB_URL / hubUrl config) are used. These are appropriate and necessary for authenticating to the advertised third‑party API hub; no unrelated secrets or system credentials are requested.

Persistence & Privilege

The skill does not request always:true or other elevated persistent privileges. It starts a short-lived localhost server for OAuth-style callback (bounded by a 5-minute timeout). It does not modify other skills' configs or system-wide settings; it writes the token only into process.env at runtime and asks the user to add it to ~/.openclaw/openclaw.json for persistence.

Assessment

This skill appears to do what it claims: call Zyla API Hub using a ZYLA_API_KEY. Before installing: (1) Verify you trust zylalabs.com (requests will be sent there and calls are billed per use). (2) Be aware the agent/tool can make arbitrary Zyla API calls using your key — those calls can incur charges; consider least-privilege keys or usage limits if available. (3) The connect flow opens your browser and runs a temporary localhost server to receive a callback token — this is typical for OAuth but ensure you’re comfortable with a local callback. (4) The plugin sets the key in process.env (ephemeral); follow the SKILL.md instructions to persist the key to ~/.openclaw/openclaw.json if you want long-term use. (5) If you’re security-conscious, review the plugin/scripts yourself (they’re included) and only install from a trusted distribution source; check for updates and verify the hub URL before entering or enabling credentials.

Turn your OpenClaw AI agent into a real-world operator. Power it with 10,000+ production-ready APIs from Zyla API Hub — instant access to weather, finance, translation, email validation, geolocation, and more, all through one unified API key, pay-as-you-go pricing, and zero vendor lock-in.

Setup

If ZYLA_API_KEY is not configured, guide the user:

1. Visit https://zylalabs.com/openclaw/connect to get an API key
2. Or run /zyla connect if the plugin is installed (opens browser automatically)
3. Add the key to ~/.openclaw/openclaw.json under skills.entries.zyla-api-hub-skill.apiKey

Never ask the user to paste their API key in chat. Ask them to set it via the config and confirm when ready.

Quick Start — Popular APIs

Use these directly without searching the catalog. Each includes the API ID, endpoint details, and parameters.

<!-- POPULAR_APIS_START --> <!-- This section is auto-generated by: npx tsx scripts/generate-popular.ts --> <!-- Run before publishing to update with the latest top 20 APIs by popularity -->

Weather by Zip API (ID: 781)

• Use when: user asks about weather, temperature, forecast, climate, conditions by zip code
• Category: Weather & Environment
• Call: npx tsx {baseDir}/scripts/zyla-api.ts call --api 781 --endpoint <endpoint_id> --params '{"zip":"10001"}'

Currency Conversion API (example)

• Use when: user asks about currency exchange, conversion rates, forex
• Category: Finance
• Call: npx tsx {baseDir}/scripts/zyla-api.ts call --api <id> --endpoint <endpoint_id> --params '{"from":"USD","to":"EUR","amount":"100"}'

Email Validation API (example)

• Use when: user asks to validate, verify, or check an email address
• Category: Data Validation
• Call: npx tsx {baseDir}/scripts/zyla-api.ts call --api <id> --endpoint <endpoint_id> --params '{"email":"[e-mail]"}'

Note: Run npx tsx {baseDir}/scripts/generate-popular.ts to regenerate this section with real API IDs and endpoints from the live catalog.

<!-- POPULAR_APIS_END -->

Discovering APIs

For APIs not listed above, search the catalog:

# Search by keyword
npx tsx {baseDir}/scripts/zyla-catalog.ts search "recipe"

# List APIs by category
npx tsx {baseDir}/scripts/zyla-catalog.ts list --category "Finance"

# Get endpoints for a specific API
npx tsx {baseDir}/scripts/zyla-catalog.ts endpoints --api 781

Calling APIs

Using the helper script (recommended)

# Basic call
npx tsx {baseDir}/scripts/zyla-api.ts call \
  --api <api_id> \
  --endpoint <endpoint_id> \
  --params '{"key":"value"}'

# Specify HTTP method (default: GET)
npx tsx {baseDir}/scripts/zyla-api.ts call \
  --api <api_id> \
  --endpoint <endpoint_id> \
  --method POST \
  --params '{"key":"value"}'

# Get info about an API
npx tsx {baseDir}/scripts/zyla-api.ts info --api <api_id>

# Check health and remaining quota
npx tsx {baseDir}/scripts/zyla-api.ts health

Using curl (fallback)

curl -H "Authorization: Bearer $ZYLA_API_KEY" \
  "https://zylalabs.com/api/{api_id}/{api_slug}/{endpoint_id}/{endpoint_slug}?param=value"

URL pattern: https://zylalabs.com/api/{api_id}/{api_name_slug}/{endpoint_id}/{endpoint_name_slug}

• api_id and endpoint_id are numeric IDs (these do the actual routing)
• api_name_slug and endpoint_name_slug are URL-friendly names (for readability)

Error Handling

• 401 Unauthorized: API key is invalid or expired. Ask the user to run /zyla connect or visit https://zylalabs.com/openclaw/connect to get a new key.
• 403 Forbidden: Subscription issue. The pay-as-you-go plan should handle this automatically. If it persists, ask the user to contact support.
• 429 Too Many Requests: Rate limit exceeded. Check the X-Zyla-RateLimit-Minute-Remaining response header. Wait before retrying.
• 404 Not Found: The API or endpoint does not exist. Verify the IDs using the catalog.
• 5xx Server Error: Upstream API issue. Retry after a short delay (2-5 seconds).

Rate Limit Headers

Every API response includes these headers:

• X-Zyla-RateLimit-Minute-Limit: Max requests per minute
• X-Zyla-RateLimit-Minute-Remaining: Remaining requests this minute
• X-Zyla-API-Calls-Monthly-Used: Total calls this billing cycle
• X-Zyla-API-Calls-Monthly-Remaining: Remaining calls this cycle

Billing

• Pay-as-you-go: No monthly fee. Each API call is billed at the API's per-call rate.
• Billing happens at the end of each cycle via Stripe.
• Use the health endpoint to check current usage: npx tsx {baseDir}/scripts/zyla-api.ts health