← Back to Skills Marketplace
seanblanchfield

Group Activation

by Sean Blanchfield · GitHub ↗ · v1.0.0
cross-platform ⚠ suspicious
402
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install group-activation
Description
Handles joining and leaving group conversations on messaging platforms (WhatsApp, Signal, Telegram, etc.). Use when the owner tags the agent into a group cha...
README (SKILL.md)

Group Activation

When the owner tags you into a group on any messaging platform, follow this procedure.

Prerequisites

channels.\x3Cplatform>.groupPolicy, groupAllowFrom, and groups.*.requireMention are set so that only the owner can wake you in any group. Trigger phrases are defined in agents.list[main].groupChat.mentionPatterns. This applies to WhatsApp, Signal, Telegram, and other supported platforms.

Procedure

Step 1 — Capture context

From the inbound message metadata: platform (e.g. whatsapp, signal), group ID (the chat_id / from field), and duration (parse from the owner's message — default 30 minutes if unspecified).

Step 2 — Open the gate

Patch channels.\x3Cplatform>.groups.\x3Cgroup_id>.requireMention to false in openclaw.json. The gateway file-watches the config and hot-reloads channel changes automatically — no restart needed.

Step 3 — Respond naturally

Say hi, introduce yourself briefly if it's a new group. Participate like a human in a group chat — use judgment about when to contribute. Do not respond to every message.

Step 4 — Set a closing cron job

Create a one-shot cron job (kind: "at") for the parsed duration. When it fires: patch requireMention back to true for this group in openclaw.json, then send a brief goodbye to the group. The gateway hot-reloads and the gate closes — no owner action needed.

Step 5 — Confirm

Tell the owner the window is open and when it closes: "Joined! I'll be here for 60 minutes — going quiet at 4:19 PM."

Controls

  • Extend: owner says @\x3Cagent> stay for another X mins → cancel existing cron, set a new one
  • Close early: owner says @\x3Cagent> that's enough / close → patch requireMention: true immediately, cancel cron, say goodbye

Notes

  • Group ID is in inbound message metadata (chat_id / from field)
  • Config changes hot-reload — no gateway restart or Docker restart needed
  • When closing, remove the specific group entry from groups or set requireMention: true to return to the wildcard default
Usage Guidance
This skill asks the agent to edit openclaw.json (a global gateway config) and to create one-shot cron jobs, but the skill metadata doesn't declare any config paths, required binaries, or permissions. Before installing: (1) ask the author to explicitly declare required config paths and scheduling mechanism (e.g., an API vs. direct file edits), (2) prefer an implementation that uses a gateway control API rather than raw file edits, (3) ensure the agent runs with least privilege (deny write access to openclaw.json unless strictly necessary), (4) require audit/logging for any config changes and scheduled tasks, and (5) test in a staging environment first. Because the package is instruction-only and the scanner had no files to check, perform manual review or request more detail from the publisher before granting the agent permission to modify system configuration or create scheduled jobs.
Capability Analysis
Type: OpenClaw Skill Name: group-activation Version: 1.0.0 The `SKILL.md` file instructs the AI agent to perform high-risk actions based on user-controlled input. Specifically, it directs the agent to modify `openclaw.json` using `platform` and `group_id` derived from inbound message metadata, which could lead to configuration injection if these inputs are not properly sanitized. More critically, it instructs the agent to create a one-shot cron job with a duration parsed from the owner's message, posing a significant command injection or RCE vulnerability if the agent's cron job creation mechanism is insecure and allows user-controlled data to influence the executed command.
Capability Assessment
Purpose & Capability
Name and description match the runtime behavior: the skill is meant to open and close an agent's participation window in group chats. However, the procedure requires writing to a global gateway config (openclaw.json) and manipulating per-channel group entries; those capabilities are more privileged than the skill metadata declares (no required config paths or permissions).
Instruction Scope
SKILL.md explicitly instructs the agent to patch channels.<platform>.groups.<group_id>.requireMention in openclaw.json, create one-shot cron jobs, cancel them, and possibly remove group entries. Those steps modify system-wide configuration and scheduling, which go beyond simple message handling and are not scoped or constrained in the instructions (no safeguards, no explicit API usage, no limits on which files/entries may be changed).
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest install risk. The static scanner had no files to analyze.
Credentials
The skill declares no required env vars or config paths, yet asks to read inbound metadata and to modify openclaw.json and create cron/at jobs. Granting the ability to edit openclaw.json and schedule jobs is a high-privilege action not justified by the declared requirements; those accesses should be explicitly declared and limited.
Persistence & Privilege
Although always:false and autonomous invocation are normal, the skill's behavior requires changing a global gateway configuration (hot-reloaded) and creating scheduled jobs. This effectively gives the skill capability to change agent-wide access controls and persist state across restarts — a meaningful privilege that isn't surfaced in the metadata.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install group-activation
  3. After installation, invoke the skill by name or use /group-activation
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release: time-limited group chat participation for WhatsApp, Signal and other platforms. Config-patch based open/close with auto-closing cron.
Metadata
Slug group-activation
Version 1.0.0
License
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is Group Activation?

Handles joining and leaving group conversations on messaging platforms (WhatsApp, Signal, Telegram, etc.). Use when the owner tags the agent into a group cha... It is an AI Agent Skill for Claude Code / OpenClaw, with 402 downloads so far.

How do I install Group Activation?

Run "/install group-activation" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Group Activation free?

Yes, Group Activation is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Group Activation support?

Group Activation is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Group Activation?

It is built and maintained by Sean Blanchfield (@seanblanchfield); the current version is v1.0.0.

💬 Comments