OpenClaw Ops

Use when diagnosing, repairing, or maintaining an OpenClaw Gateway on the same machine. Designed for rescue agents to fix a down gateway or check operational...

This skill is coherent for its stated use: maintaining a local OpenClaw Gateway. Before installing, ensure you: (1) install it only on a separate, trusted rescue agent (the README repeats this warning), not on the primary gateway; (2) verify the rescue agent's access controls because the skill requires read/write access to ~/.openclaw/ and access to env files containing tokens; (3) review and keep copies of the SKILL.md so you understand what commands the agent will run, and require explicit user confirmation for destructive actions; (4) prefer running the rescue agent under a least-privilege account or inside a restricted container/VM to limit blast radius; (5) if you need stronger assurances, ask for an explicit list of local env filenames the skill will read and for any automated export/transmit steps (none are present in the current SKILL.md). If the package later includes code files or an install script that downloads archives or runs external binaries, re-evaluate before installing.

Type: OpenClaw Skill Name: openclaw-ops Version: 1.2.1 This skill is classified as suspicious due to the high-risk capabilities it grants to an AI agent, which could be exploited via prompt injection. The `SKILL.md` instructs the agent to read and copy sensitive files like `~/.openclaw/env` (which contains tokens) and perform destructive operations like `npm update -g openclaw` and `find ... -delete`. While the skill explicitly includes safety instructions such as 'Never print secrets' and 'Destructive operations require user confirmation', the reliance on these prompt-based directives creates a significant vulnerability. An attacker could potentially craft a prompt to bypass these instructions, leading to unauthorized data exfiltration or system modification.