# Openlist

> OpenList v4 HTTP API integration for AgentDock: authentication, file browsing/search, safe text uploads, file operations, storage/driver inspection, and restricted generic API calls.

- **Type:** Skill
- **Install:** `agentstack add skill-uvwt-agentdock-openlist`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [uvwt](https://agentstack.voostack.com/s/uvwt)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [uvwt](https://github.com/uvwt)
- **Source:** https://github.com/uvwt/agentdock/tree/main/skill-sources/openlist
- **Website:** https://uvwt.github.io/agentdock-docs/

## Install

```sh
agentstack add skill-uvwt-agentdock-openlist
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# OpenList Skill

把 [OpenList](https://github.com/OpenListTeam/OpenList) v4 的 HTTP API 封装为 AgentDock 原生 Skill。

## 能力

- 服务状态与公开配置检查
- 登录、登出、本地会话保存与清理
- 当前用户查询
- 文件/目录列表、详情、目录树与搜索
- 新建目录、上传 UTF-8 文本文件、重命名、移动、复制、删除
- 管理员存储列表、驱动列表
- 受限通用 `/api/*` JSON 请求

## 默认连接

默认连接 `http://127.0.0.1:5244`。可在调用中传 `base_url`，或设置 `OPENLIST_URL`。

登录成功后默认把 token 保存到 `$XDG_STATE_HOME/openlist-skill/session.json`；未设置 `XDG_STATE_HOME` 时使用 `~/.local/state/openlist-skill/session.json`。目录权限为 `0700`、文件权限为 `0600`。也可通过 `OPENLIST_SESSION_FILE` 指定会话文件，在单次调用中传 `token`，或设置 `OPENLIST_TOKEN`。

AgentDock 安装会通过 `OPENLIST_SESSION_FILE` 将私有会话保存在 `~/.agentdock/skill-data/openlist/session.json`，因此升级不会迁移或丢失当前登录态。

## 环境变量

| 变量 | 类型 | 必填 | 说明 |
|---|---|---:|---|
| `OPENLIST_URL` | config | 否 | OpenList 服务地址，默认 `http://127.0.0.1:5244` |
| `OPENLIST_TOKEN` | secret | 否 | 直接提供访问令牌；未配置时尝试读取本地会话 |
| `OPENLIST_SESSION_FILE` | config | 否 | 自定义会话文件路径 |
| `XDG_STATE_HOME` | config | 否 | 未配置会话文件时的可移植状态目录 |

## 上传

`upload` 操作通过 OpenList 官方 `/api/fs/put` 接口上传 UTF-8 文本，默认限制 1 MiB，最高允许 10 MiB，并校验 SHA-256。

## 安全约束

- `base_url` 仅允许 `http`/`https`，禁止 URL 内嵌用户名和密码。
- 通用请求仅允许 `/api/*` 路径和 GET/POST/PUT/PATCH/DELETE 方法。
- 登录结果默认不回显 token；只有显式传 `return_token: true` 才返回。
- 不包含 OpenList 上游源码或二进制，仅提供 API 适配层；OpenList 本身继续遵循其 AGPL-3.0 许可证。

## 辅助脚本执行

Skill 本体是本说明文档。确需调用包内辅助脚本时，在 Skill 包根目录使用相对路径执行；运行宿主负责切换到包根目录并把所需变量注入当前子进程。

```bash
printf '%s' '{"skill_action":""}' | python3 run.py
```

输入必须是 JSON 对象。写操作仍按本文档中的确认规则执行。

| 动作 | 用途 |
|---|---|
| `status` | Check OpenList public settings endpoint and report connectivity. |
| `login` | Login to OpenList; saves token locally by default and does not echo it unless return_token=true. |
| `logout` | Logout from OpenList and clear the locally saved session by default. |
| `me` | Return the current authenticated OpenList user. |
| `list` | List a directory through /api/fs/list; guest access is supported when OpenList allows it. |
| `get` | Get file or directory details and raw URL through /api/fs/get. |
| `dirs` | List child directories through /api/fs/dirs. |
| `search` | Search the OpenList index. |
| `mkdir` | Create a directory. |
| `rename` | Rename a file or directory. |
| `move` | Move one or more names between directories. |
| `copy` | Copy one or more names between directories. |
| `remove` | Remove one or more names from a directory. |
| `upload` | Upload a small UTF-8 text file through /api/fs/put. Designed for safe automation and verification. |
| `storage-list` | List configured storages (admin token required). |
| `driver-list` | List OpenList storage driver definitions (admin token required). |
| `api-request` | Call an OpenList JSON API endpoint not covered by a dedicated action. |
| `session-status` | Show whether a local OpenList session token is saved without revealing it. |
| `session-clear` | Delete the locally saved OpenList session token. |

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [uvwt](https://github.com/uvwt)
- **Source:** [uvwt/agentdock](https://github.com/uvwt/agentdock)
- **License:** Apache-2.0
- **Homepage:** https://uvwt.github.io/agentdock-docs/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-uvwt-agentdock-openlist
- Seller: https://agentstack.voostack.com/s/uvwt
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.