OpenClaw Quickstart Setup

Complete OpenClaw setup automation skill. Installs gateway, hardens security (localhost binding, auth), routes to cost-effective models (DeepSeek/Kimi for si...

This guide appears to do what it says (quickstart/install/configure), but it also gives the agent recurring autonomous duties (cron/heartbeat) and tells you to install other skills from registries that may be unvetted. Before following it: 1) Inspect the openclaw npm package and the upstream source (GitHub repo, maintainers, recent releases) and pin a known-good version instead of blindly `npm i -g`. 2) Vet any third‑party skills (wacli, maton, etc.) before installing; avoid paste-installing commands from untrusted sources. 3) Only provide channel tokens (Telegram/Discord/WhatsApp/email) to config files you control; do not paste them into public chat. 4) Narrow the cron/heartbeat actions — make them non-executing tests first, or run them in a sandbox/VM/container. 5) Keep the gateway bound to localhost and prefer a secure tunnel (Tailscale) for remote access. 6) Backup configuration and review memory/heartbeat files for sensitive content. If you want higher assurance, request the upstream package sources, checksums, and a maintainers list before installing.

Type: OpenClaw Skill Name: openclaw-quickstart-setup Version: 1.0.0 The skill bundle is a comprehensive setup and configuration guide for the OpenClaw platform. It provides instructions for the agent to automate security hardening (binding to localhost, enabling authentication), cost-effective model routing, and channel integration (Telegram, Discord). It includes defensive recommendations, such as enabling skill allow-lists, and warns against potential ecosystem threats. While it references fictional or future-dated security vulnerabilities (e.g., CVE-2026-25253 in SKILL.md), the instructions are consistently aligned with its stated purpose of providing a secure and optimized production setup without any evidence of malicious intent or data exfiltration.