OpenClaw Zulip Channel Plugin

Zulip channel plugin for OpenClaw with topic threading, metadata DB, bot commands, and event queue processing. Install from source when you want to connect O...

What to check before installing: - Confirm the source repository (https://github.com/kagura-agent/openclaw-zulip) is the expected upstream and review recent commits/maintainer identity. The SKILL.md and package manifest point to that repo. - Verify and supply only a Zulip bot account with limited permissions. The plugin needs the bot email and API key — prefer a bot with narrowly scoped permissions and rotate the key if possible. - The plugin stores metadata in ~/.openclaw/data/zulip-metadata.sqlite. If you prefer isolation, run the gateway in a container or change the path in the code/config to a controlled location and ensure backups/permissions are appropriate. - Audit the package-lock.json dependency list before installing (npm install will pull these). The lockfile in the bundle contains a large set of transitive packages (including AWS/Anthropic-looking entries); confirm these are expected transitives from openclaw dependencies and not additional runtime components you don't want. Consider installing with production-only deps (npm ci --production) if you only need runtime. - Run tests and basic functional checks in a sandboxed environment first (e.g., a VM or container) and observe network activity to ensure only Zulip endpoints and the expected registries are contacted. - Because the registry metadata provided with the skill listing omitted required env vars, double-check your OpenClaw integration points (openclaw.plugin.json, SKILL.md, and secret contract files) to ensure the platform will surface prompts for the Zulip credentials and not any unexpected secrets. If you cannot perform these checks, treat the discrepancy between declared metadata and the code/manifest as a reason to be cautious.

Type: OpenClaw Skill Name: openclaw-zulip Version: 0.1.0 The openclaw-zulip skill bundle is a standard Zulip channel integration for the OpenClaw framework. It implements message long-polling via Zulip's event queue API, topic-to-thread mapping, and a local SQLite-backed metadata store for tracking topic statuses and labels. The code follows OpenClaw SDK patterns for secret management (ZULIP_API_KEY) and inbound/outbound message normalization. No evidence of malicious behavior, data exfiltration, or prompt injection was found; the logic is consistent with the stated purpose of connecting an AI agent to a Zulip organization.