Remnawave Account Creator

自动调用 Remnawave API 创建用户账号，获取订阅信息，并使用模板自动发送开通邮件，支持抄送和内部分组配置。

Security Scan

The skill appears to do what its description says (create Remnawave accounts and send emails) but the package metadata omits required secrets/configs and the code/instructions contain several risky or inconsistent choices (mixed credential locations, advice to disable SSL checks, use of child_process, and unclear external endpoints).

Purpose & Capability

The skill's stated purpose (create Remnawave users and send SMTP mail) matches the included scripts, but the registry metadata declares no required environment variables or primary credential while the code and SKILL.md clearly require an API token and SMTP credentials stored in user files (e.g. ~/.openclaw/workspace/.env and ~/.openclaw/workspace/config/*.json). That mismatch between declared requirements and actual needs is incoherent and surprising to users.

Instruction Scope

SKILL.md and the scripts instruct the agent to read local config files (~/.openclaw/workspace/config/remnawave.json, smtp.json, remnawave-squads.json and ~/.openclaw/workspace/.env) and to call internal API endpoints on an IP (https://8.212.8.43). The docs also suggest disabling SSL verification (sslRejectUnauthorized: false) and even capture of management-panel requests via browser devtools — actions that expand scope and weaken security. Those behaviors are related to the task but include risky guidance and broaden what the skill will access.

Install Mechanism

There is no install spec (instruction-only), but the bundle contains many executable code files. That means installing the skill will place code on disk (no network downloads shown), which is fine, but the lack of an explicit install step combined with many scripts may surprise non-technical users. No external archives/unknown URLs are used in the provided files.

Credentials

The skill requires sensitive secrets (Remnawave API token and SMTP auth) in practice, yet the registry metadata lists no required env vars or primary credential. The code inconsistently reads credentials from different places (sometimes from remnawave.json.apiToken, sometimes from ~/.openclaw/workspace/.env REMNAWAVE_API_TOKEN), increasing the risk of accidental credential leakage or misconfiguration. SMTP credentials and API tokens are necessary for the stated purpose, but they should have been declared and the retrieval method should be consistent and secure.

Persistence & Privilege

The skill is not marked 'always: true' and is user-invocable (normal). disable-model-invocation is false (agent may invoke autonomously) which is the platform default — not flagged by itself. The skill does write/read config files in the user's workspace but does not request elevated system-wide privileges in the provided materials.

Scan Findings in Context

[reads_REMNAWAVE_API_TOKEN_from_.env] expected: The scripts read REMNAWAVE_API_TOKEN from ~/.openclaw/workspace/.env (or remnawave.json). An API token is required to call the Remnawave API, but the skill metadata does not declare this requirement.

[reads_SMTP_credentials_from_config] expected: SMTP host/user/pass are read from ~/.openclaw/workspace/config/smtp.json to send emails; this is expected for the stated feature but should be declared and handled securely.

[insecure_ssl_rejectUnauthorized_false] unexpected: SKILL.md and configs advise setting sslRejectUnauthorized: false and many https calls use verify=false / rejectUnauthorized disabled. This is sometimes needed for self-signed certs but weakens TLS security and is risky to recommend by default.

[child_process_exec_usage] unexpected: create-account.js imports child_process.exec and promisify; using exec can allow arbitrary shell command execution. It may be benign (used to call local logging scripts) but deserves manual review so it isn't executing untrusted input.

[hardcoded_api_host_ip] expected: Many files and docs reference API base URL https://8.212.8.43 (an IP). That's consistent with an internal service but authors should confirm endpoint ownership before use.

[multiple_credential_locations] unexpected: Credential handling is inconsistent: some code reads API token from remnawave.json.apiToken, some from .env REMNAWAVE_API_TOKEN. Inconsistent storage is a usability and security concern.

[example_external_subscription_domain] unexpected: README shows an example subscription URL hosted on an unusual domain (datat.cc). This may be harmless example data, but it is worth verifying that subscription URLs and external domains are legitimate.

What to consider before installing

This skill appears to implement what it claims (create Remnawave accounts and send onboarding emails) but there are several red flags you should address before installing: 1) The registry metadata claims no credentials are needed, yet the code and SKILL.md require a Remnawave API token and SMTP credentials — ask the author to declare required env vars (REMNAWAVE_API_TOKEN, SMTP credentials) and explain where they should be stored. 2) Review credential storage: the code reads tokens from both remnawave.json and ~/.openclaw/workspace/.env inconsistently — avoid committing credentials to repo and prefer a single secure location. 3) The docs recommend disabling SSL verification (sslRejectUnauthorized: false / verify=false) for self-signed certs — avoid enabling this in production; instead install proper certificates or run in an isolated environment. 4) Review any use of child_process.exec and search the code for exec() calls to ensure no user-supplied data is passed to the shell. 5) Verify the API host(s) and example external domains are legitimate for your org. If you are not comfortable auditing the code, run this skill only in a sandboxed environment and request the author to provide clearer metadata, a source repository/homepage, and a trimmed minimal installation guide that declares required secrets and secure defaults.

Remnawave 账号创建与邮件发送

技能 ID: remnawave-account-creator
版本: 1.1.0 (2026-03-19 修复)
作者: AI Assistant (小 a)
创建时间: 2026-03-08
更新时间: 2026-03-19
用途: 自动化创建 Remnawave 账号并发送开通邮件，支持分组管理

---

📋 技能描述

本技能用于自动化完成 Remnawave 账号的完整开通流程：

1. 调用 Remnawave API 创建新用户
2. 自动获取订阅地址和账号信息
3. 使用预设模板发送开通邮件
4. 支持抄送功能

适用场景:

• 运维组需要批量创建用户账号
• 自动化用户开通流程
• 标准化账号管理

---

🔧 前置配置

1. Remnawave API 配置

创建 ~/.openclaw/workspace/config/remnawave.json:

{
  "apiBaseUrl": "https://8.212.8.43",
  "apiToken": "YOUR_API_TOKEN",
  "sslRejectUnauthorized": false,
  "_status": "已验证连接成功",
  "_userCount": 43
}

获取 API Token:

1. 登录 Remnawave 管理后台
2. 进入 API 设置页面
3. 创建新的 API Token（选择 API 角色）
4. 复制 Token 到配置文件

2. SMTP 邮件配置

创建 ~/.openclaw/workspace/config/smtp.json:

{
  "host": "smtp.zoho.com",
  "port": 587,
  "secure": false,
  "auth": {
    "user": "[e-mail]",
    "pass": "YOUR_EMAIL_PASSWORD"
  },
  "tls": {
    "rejectUnauthorized": false
  },
  "from": {
    "email": "[e-mail]",
    "name": "AI Assistant"
  }
}

3. 邮件模板配置

确保模板文件存在：

• ~/.openclaw/workspace/config/email-templates/remnawave-account-created.md

4. 内部组 UUID 映射

创建 ~/.openclaw/workspace/config/remnawave-squads.json:

{
  "squads": {
    "Default-Squad": "751440da",
    "xray-default": "fe107de3",
    "QA Engineer": "1f85b65c",
    "Front-end Developer": "48a0679d",
    "TW": "25ef1b48",
    "Back-end Developer": "071aee4a",
    "Ops Debugging": "ccca8442"
  }
}

---

📖 使用方法

方式 1: 直接调用技能

claw skill run remnawave-account-creator \
  --username jim_pc \
  --email [e-mail] \
  --device-limit 1 \
  --traffic-gb 100 \
  --traffic-reset WEEKLY \
  --expire-days 365 \
  --squad "Ops Debugging" \
  --cc [e-mail]

方式 2: 使用脚本

cd ~/.openclaw/workspace/skills/remnawave-account-creator
node create-account.js \
  --username jim_pc \
  --email [e-mail] \
  --squad "Ops Debugging" \
  --cc [e-mail]

方式 3: 自然语言指令

直接告诉 AI 助理：

新增账号
账号：jim_pc
登录设备限制：1
流量限制：100G
流量重置：每周
过期时间：一年
内部分组：Ops Debugging
邮箱：[e-mail]
邮件抄送：[e-mail]

---

📋 参数说明

参数	必填	说明	示例
username	✅	账号用户名	jim_pc
email	✅	用户邮箱	[e-mail]
device-limit	❌	设备限制（默认 1）	1
traffic-gb	❌	流量限制 GB（默认 100）	100
traffic-reset	❌	流量重置周期	每周 / 每月 / 每天
expire-days	❌	过期天数（默认 365）	365
squad	❌	内部分组名称	Ops Debugging
cc	❌	邮件抄送地址	[e-mail]

API 参数映射：

• 流量重置：trafficLimitStrategy (WEEK/MONTH/DAY/NO_RESET)
• 内部分组：activeInternalSquads (UUID 数组)

---

🔄 执行流程

1. 读取配置文件
   ├── remnawave.json (API 配置)
   ├── smtp.json (邮件配置)
   └── remnawave-squads.json (组映射)

2. 调用 Remnawave API 创建用户
   POST /api/users
   ├── username
   ├── email
   ├── hwidDeviceLimit
   ├── trafficLimitBytes
   ├── trafficResetInterval
   ├── expireAt
   └── squadUuids

3. 解析 API 响应
   ├── subscriptionUrl (订阅地址)
   ├── shortUuid (短 UUID)
   ├── vlessUuid (VLESS UUID)
   ├── trojanPassword (Trojan 密码)
   └── ssPassword (SS 密码)

4. 渲染邮件模板
   ├── recipient_name
   ├── account_name
   ├── subscription_url
   ├── tutorial_url
   ├── download_url
   └── send_date

5. 发送邮件
   ├── 收件人：用户邮箱
   └── 抄送：指定邮箱（可选）

6. 输出结果
   ├── 账号信息
   ├── 订阅地址
   └── 邮件发送状态

---

📧 邮件模板变量

变量	说明	来源
{{recipient_name}}	收件人姓名	username
{{account_name}}	账号名称	username
{{subscription_url}}	订阅地址	API 响应
{{tutorial_url}}	证书安装教程	固定配置
{{download_url}}	客户端下载	固定配置
{{send_date}}	发送日期	当前日期

---

🛠️ 文件结构

remnawave-account-creator/
├── SKILL.md                      # 技能说明（本文件）
├── create-account.js             # 主执行脚本
├── send-template-email.js        # 邮件发送脚本
└── README.md                     # 使用文档

---

⚠️ 注意事项

1. API Token 安全

   • 不要将 Token 提交到版本控制
   • 定期更换 Token
   • 限制 Token 权限

2. SSL 证书

   • 如果使用自签名证书，设置 sslRejectUnauthorized: false
   • 生产环境建议使用正式证书

3. 邮件发送

   • 确保 SMTP 配置正确
   • 测试邮件发送功能
   • 注意邮件发送频率限制

4. 流量单位

   • API 使用 bytes 为单位
   • 1GB = 1073741824 bytes

5. 日期格式

   • API 使用 ISO 8601 格式
   • 示例：2027-03-08T00:00:00.000Z

---

🔍 故障排查

问题 1: API 连接失败

症状: curl: (60) SSL certificate problem

解决:

{
  "sslRejectUnauthorized": false
}

问题 2: 邮件发送失败

症状: SMTP connection failed

解决:

• 检查 SMTP 配置
• 验证邮箱密码
• 确认端口和加密方式

问题 3: 组 UUID 找不到

症状: Squad not found

解决:

• 运行 node list-squads.js 获取最新组列表
• 更新 remnawave-squads.json

---

📝 更新日志

v1.0.0 (2026-03-08)

• ✅ 初始版本发布
• ✅ 支持账号创建
• ✅ 支持邮件发送
• ✅ 支持抄送功能
• ✅ 支持流量重置配置
• ✅ 支持内部分组分配

---

📦 ClawHub 发布

技能 Slug: remnawave-account-creator 当前版本: 1.1.0 发布 ID: k978ydgq28482dtbyr8ey5vnp58375q3

安装命令:

clawhub install remnawave-account-creator --version 1.1.0

更新日志 (v1.1.0 - 2026-03-19):

• 修复 API 调用错误：更新分组端点从 PUT /api/users/{uuid} 改为 PATCH /api/users
• 修复分页参数：从 page=1&limit=500 改为 page=0&size=200
• 修复 callApi 响应解析
• 添加完整 API 参考文档

---

🔐 隐私设置

访问权限: 私密（仅作者可用） 发布平台: ClawHub 作者: AI Assistant (小 a)

---

📞 支持

如有问题，请联系：

• 作者：AI Assistant (小 a)
• 运维组：Crads
• 邮箱：[e-mail]