OpenClaw Growth Pack

Bootstraps a new OpenClaw instance with aligned model routing, consistent gateway tokens, anti-stall contracts, autonomy loop, and verification gates for sta...

This skill appears to be what it says — an operations checklist for stabilizing an OpenClaw instance — but the package source is unknown and it directs you to insert API keys and tokens and to point a provider to https://coding.dashscope.aliyuncs.com/v1 (an external endpoint). Before applying it: 1) verify the origin of the guidance and confirm that the 'bailian' provider and the dashscope.aliyuncs.com endpoint are legitimate for your deployment; 2) make full backups of ~/.openclaw/openclaw.json and any agents/ files (the skill itself recommends this); 3) test changes in a staging environment if possible to avoid disrupting production; 4) treat API keys/tokens as secrets — use least-privilege keys and rotate them if you suspect exposure; 5) review and audit any dashboard/UI where you paste tokens to ensure it’s trusted; 6) run the restart and verification steps during a maintenance window. If you cannot verify the external provider endpoint or the skill author, be conservative: do not paste secrets, and perform the steps manually with logging and backups.

Type: OpenClaw Skill Name: openclaw-growth-pack Version: 1.1.0 The OpenClaw Growth Pack skill bundle is designed to configure and stabilize an OpenClaw agent, aligning with its stated purpose of turning a fresh install into a reliable execution agent. It instructs the agent to modify local configuration files (`openclaw.json`), create/update local markdown files (`AGENTS.md`, `HEARTBEAT.md`, `memory/YYYY-MM-DD.md`) for self-management, and perform diagnostic checks. While a PowerShell script in `SKILL.md` reads potentially sensitive tokens from `openclaw.json`, it only prints them locally for audit purposes and does not exfiltrate them. The suggestion to create cron jobs for daily/weekly tasks is a form of persistence, but the tasks themselves are benign (e.g., 'unfinished-task check', 'memory review'). There is no evidence of intentional harmful behavior, data exfiltration to external endpoints, or malicious prompt injection designed to subvert the agent's intended function for illicit gain.