Skip to content
Get packs

Guide · Agent skill

How to use the OneCLI Gateway Access agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

The OneCLI Gateway skill (skill name onecli-gateway) teaches an AI agent to reach outside services such as Gmail, Google Calendar, GitHub and Stripe by making ordinary web requests. This guide explains what the skill does, how to install it, how to trigger it, and what to check before you rely on it. By the end you will know how to set it up, what it needs, and how to handle the case where a service is not connected yet.

OneCLI Gateway Accessnanocoai/nanoclaw · MIT

Quick start

  1. 1Install OneCLI. Install the OneCLI gateway and make sure it is running on your machine.
  2. 2Download the skill ZIP. Download the onecli-gateway ZIP from this page.
  3. 3Unzip the skill. Unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder.
  4. 4Connect your services. Open the OneCLI dashboard and connect each account you want the agent to use, such as Gmail, GitHub or Stripe.
  5. 5Launch with the proxy. Start the agent with onecli run so HTTPS_PROXY is set.
  6. 6Ask in plain language. Make a request such as checking your email, and the agent will call the API through the gateway.

What the onecli-gateway skill does

Agent skills are folders of instructions that an AI agent loads when a task matches them. This one covers outbound web requests. Your agent's HTTPS traffic is routed through a local OneCLI proxy, which adds the stored login credentials for the user's connected accounts at the proxy boundary. According to the skill, the agent never sees or handles the credential values themselves.

The skill tells the agent to call the real API URL directly, with no auth headers of its own. If a service is not connected, the agent is told to show the user a connect link.

  • Reads email, calendar and repositories through the connected accounts
  • Works with OAuth apps such as Gmail, GitHub, Google Calendar and Google Drive, plus API key services
  • Presents a connect link when a service is missing

Install the skill from the ZIP download

Download the ZIP for the onecli-gateway skill from this page. The skill package contains two files: SKILL.md and instructions.md.

To install it for your user account, unzip it into ~/.claude/skills/. To install it for a single project, unzip it into that project's .claude/skills/ folder.

If you use the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills.

  • Personal install: ~/.claude/skills/
  • Project install: .claude/skills/ inside your project
  • Claude apps: Settings → Capabilities → Skills

Set up OneCLI before you use the skill

The skill depends on the OneCLI gateway. It needs the gateway installed and running, the HTTPS_PROXY environment variable set, and each service you want to use connected in the OneCLI dashboard. The skill's compatibility note says HTTPS_PROXY is set automatically when the agent is launched via onecli run.

Without OneCLI the skill will not work, because it has no other way to authenticate requests.

  • OneCLI gateway installed and running
  • HTTPS_PROXY set (automatic with onecli run)
  • Accounts connected in the OneCLI dashboard for each service (for example Gmail, GitHub, Stripe)
  • curl or another HTTP client
onecli run

Trigger the skill with natural requests

You do not need a special command. The skill's description lists requests that should load it, such as reading emails, checking the calendar, accessing GitHub repos, creating issues, checking Stripe payments, or interacting with any external service or API. Ask the agent in plain language and it should use the gateway.

If you want to load the full error-handling flow directly, the companion instructions file refers to running /onecli-gateway.

  • "Check my email for messages from the last day."
  • "What's on my calendar tomorrow?"
  • "List the 10 most recent repos on my GitHub account."
  • "Show me the last five Stripe charges."

Examples of the requests the agent makes

The skill shows the agent calling real API endpoints directly. Standard HTTP clients such as curl, fetch, requests, axios, Go net/http and git honor HTTPS_PROXY automatically, so no auth header is needed.

These are the example calls given in the skill:

  • Gmail: list recent messages
  • GitHub: list the user's repositories
  • Stripe: list recent charges
curl -s "https://gmail.googleapis.com/gmail/v1/users/me/messages?maxResults=5" curl -s "https://api.github.com/user/repos?per_page=10" curl -s "https://api.stripe.com/v1/charges?limit=5"

What happens when a connection is missing

If a request returns a 401, a 403 or a gateway error such as app_not_connected, the agent should show the user a connect link taken from the connect_url field of the error. If there is no connect_url, the user is told to open the OneCLI dashboard and connect the service there.

After the user connects the service, the agent retries the original request. If it still fails, the agent asks whether the user needs help with setup. If the gateway returns a policy error (a 403 with a JSON body), the agent must respect the block and not retry or work around it.

  • Show the connect_url as a bare link
  • Retry once the user confirms the connection
  • Stop if the gateway returns a policy block

Safety notes: scripts, network and approvals

This skill runs no scripts. It does use the network, because every outbound HTTPS request passes through the OneCLI proxy. Only use it in environments where you trust the proxy operator.

The skill has no per-action approval step. It tells the agent to make API calls directly and retry, so write actions such as creating issues or reading payments happen without a human check. For sensitive accounts, do not rely on this skill alone. The skill also tells the agent never to ask you for API keys or tokens; you connect services in the dashboard instead.

  • Runs scripts: no
  • Uses network: yes, all outbound HTTPS goes through the proxy
  • No per-action human approval
  • Credential stub files containing "onecli-managed" are managed by OneCLI; do not edit or delete them

Tips for getting reliable results

Connect each service in the OneCLI dashboard before asking for it, so the agent does not have to stop and ask. For MCP servers that need local credential files, the skill says to create placeholder stubs before starting the server, using "onecli-managed" as the value and file permissions 0600. The skill links to OneCLI's credential stubs guide for the details.

  • Connect services in the dashboard first
  • Use "onecli-managed" placeholders for MCP credential stubs, with 0600 permissions
  • Keep the skill folder in place and reload the agent after installing

What people use it for

  • Reading recent Gmail messages or calendar events without logging in through a browser
  • Listing GitHub repositories or creating issues from an agent workflow
  • Checking recent Stripe charges for a quick payments review
  • Testing how a credential-injecting proxy works with an AI agent

Frequently asked questions

How do I install the onecli-gateway skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps you can instead upload it under Settings → Capabilities → Skills.

Do I need OneCLI installed to use this skill?

Yes. The skill depends on the OneCLI HTTPS proxy and will not work without it. OneCLI must be installed and running, with HTTPS_PROXY set, and the services you need connected in its dashboard.

What do I need before the skill can read my email?

You need OneCLI running, HTTPS_PROXY set (automatic when launched with onecli run), and your Gmail account connected in the OneCLI dashboard. curl or another HTTP client is also required.

Does the agent see my passwords or API keys?

According to the skill, no. The OneCLI proxy adds the stored credentials to outbound requests, and the agent is instructed never to ask for or handle keys or tokens.

What happens if a service is not connected?

The gateway returns an error such as app_not_connected with a connect_url. The agent shows you that link, and after you connect the service it retries the original request.

Will the agent ask me before creating an issue or reading payments?

The skill does not add a per-action approval step. It tells the agent to make API calls directly and retry, so write actions happen without a separate human check. Consider this before using it on sensitive accounts.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use this skill if you run the NanoClaw agent setup or already use OneCLI, and you want your agent to read email, calendar or repos without manual authentication. Pick something else if you have not set up OneCLI, if you want to approve each action yourself, or if you do not trust the proxy operator, since all outbound HTTPS traffic passes through it.

Download the skill