Openclaw Create Agent

Create and wire a new OpenClaw agent with a fixed workflow. Use when the user asks to create/add a new OpenClaw agent or says “我要创建一个新的 Agent”, automate mult...

This skill appears to do what it claims: create an OpenClaw Feishu agent and update your ~/.openclaw/openclaw.json. Before running it: 1) Confirm you have the OpenClaw CLI installed and on PATH and have python3 available — the SKILL.md expects these but the package metadata did not declare them. 2) Review the included scripts/upsert_openclaw_agent.py yourself (it is bundled and readable) and consider using the --dry-run flag first; the script will print a JSON summary. 3) Understand that if you provide app_secret/app_id those values will be written into ~/.openclaw/openclaw.json (a backup copy is created), so ensure that file is stored with appropriate permissions and that you trust this environment. 4) Follow the Step 0.5 gating for peer/group workflows to avoid accidental config changes. If you want higher assurance, run the script on a copy of your config or a test environment first.

Type: OpenClaw Skill Name: openclaw-create-feishu-agent-skills Version: 0.1.0 The skill's stated purpose is to configure OpenClaw agents, which is a legitimate administrative function. However, the `scripts/upsert_openclaw_agent.py` script, executed by the agent, passes the `--app-secret` as a command-line argument. This is a significant security vulnerability, as secrets passed on the command line can be exposed in process lists (`ps aux`), shell history, and system logs, leading to potential information disclosure. While there is no evidence of intentional malicious behavior like data exfiltration or persistence, this vulnerability makes the skill 'suspicious'.