← Back to Skills Marketplace
Signal
by
Blake Lucas
· GitHub ↗
· v1.0.2
756
Downloads
0
Stars
5
Active Installs
3
Versions
Install in OpenClaw
/install signal
Description
Comprehensive Signal channel integration via signal-cli. Use when you need to send messages, reactions, or handle group chat interactions in Signal, or when...
Usage Guidance
This skill appears to be a real Signal integration, but the manifest omits important runtime requirements. Before installing, verify these points: 1) You must have signal-cli available on the host (set channels.signal.cliPath appropriately). The skill does not declare or install it — the agent will expect the binary to exist. 2) The skill's instructions expect to read OpenClaw configuration and USER.md to determine the 'owner' and may write configuration (configWrites). If you don't want the skill to modify agent config, set channels.signal.configWrites=false and/or autoStart=false. 3) Use a separate bot phone number/account (as the SKILL.md recommends) — never reuse your personal Signal account. 4) Because the skill can spawn a daemon and execute signal-cli, run it first in a restricted or test environment and review any CLI commands it will run. 5) If you want stronger assurance, ask the publisher for a provenance link or an install script and a declared dependency on signal-cli; absence of those is why I flagged it as suspicious. If you cannot confirm these items, do not install or grant config-write privileges.
Capability Analysis
Type: OpenClaw Skill
Name: signal
Version: 1.0.2
The skill is designed for legitimate Signal integration via `signal-cli`. However, it includes instructions for installing `signal-cli` that involve downloading and executing external binaries from GitHub using `curl` and `tar`, and modifying user shell configuration files (`~/.bashrc` or `~/.zshrc`) to update the PATH. While these actions are plausibly needed for the skill's stated purpose, they represent 'risky capabilities' involving shell/network/file access, aligning with the definition of 'suspicious' rather than 'benign'. Notably, the `SKILL.md` also contains strong 'Group Chat Safeguards' designed to prevent prompt injection and malicious actions by the agent, indicating a lack of malicious intent within the skill itself.
Capability Assessment
Purpose & Capability
The SKILL.md describes a signal-cli based integration (sending messages, reactions, spawning a daemon, pairing, config writes). That purpose is coherent, but the skill manifest declares no required binary or install steps for signal-cli and no required config paths. A Signal integration would normally declare at least the signal-cli binary or an install; the omission is an incoherence.
Instruction Scope
The instructions reference reading OpenClaw configuration and USER.md to identify the owner, defaulting/falling back on global channel config, and enabling /config set|unset behavior (configWrites). They also describe auto-spawning a daemon and running signal-cli commands (sendTyping, send message, etc.). Those instructions imply reading/writing agent config and executing system binaries, but the manifest doesn't declare access to those resources.
Install Mechanism
There is no install spec (instruction-only), which is lower risk in general. However, the skill depends on an external binary (signal-cli) being present and possibly on spawning a daemon; that dependency is not declared. Lack of an install step is acceptable for instruction-only skills, but the missing declared binary is an inconsistency to be aware of.
Credentials
The SKILL.md expects knowledge of a bot account (phone number/account setting) and may read/write OpenClaw config and USER.md. Yet requires.env and required config paths are empty. The skill also defaults configWrites=true (allowing runtime config changes). Requesting no credentials in the manifest while describing behavior that needs account info and config access is disproportionate.
Persistence & Privilege
always is false (good). But defaults described in SKILL.md (autoStart=true when httpUrl unset, configWrites=true) mean the skill may spawn a daemon and write channel/agent config unless you override these settings. This is not automatically malicious, but it does grant the skill the ability to modify agent configuration if allowed — you should review/override configWrites and autoStart if you don't want that.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install signal - After installation, invoke the skill by name or use
/signal - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.2
No functional or documentation changes detected in this version.
- Internal version update with no changes to files or documentation.
- No user-facing impact.
v1.0.1
- Clarified group chat ownership: the owner is defined as the controller of the OpenClaw instance, not just the user in USER.md.
- Updated group safeguard language to reference "the owner" and generalized instructions.
- No functional changes; documentation refinement only.
v1.0.0
Signal channel integration is now available with robust group/DM handling and safety features.
- Initial release providing comprehensive integration with Signal via signal-cli for OpenClaw.
- Supports sending messages, emoji reactions (including reaction removal), and attachments in both DMs and group chats.
- Implements group chat safety: ignores destructive commands from non-owner users, and confirms destructive actions with the owner via DM.
- DM pairing feature: new DM senders must be explicitly approved before messages are processed.
- Configurable chunking, media limits, group/DM policies, reaction levels, and allowlists.
- Includes CLI command examples and troubleshooting guidance.
Metadata
Frequently Asked Questions
What is Signal?
Comprehensive Signal channel integration via signal-cli. Use when you need to send messages, reactions, or handle group chat interactions in Signal, or when... It is an AI Agent Skill for Claude Code / OpenClaw, with 756 downloads so far.
How do I install Signal?
Run "/install signal" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Signal free?
Yes, Signal is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Signal support?
Signal is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Signal?
It is built and maintained by Blake Lucas (@blake-lucas); the current version is v1.0.2.
More Skills