← Back to Skills Marketplace
123
Downloads
0
Stars
0
Active Installs
6
Versions
Install in OpenClaw
/install orchard
Description
Agentic project and task management plugin for OpenClaw. Persistent SQLite-backed task board with a queue runner that auto-dispatches ready tasks as subagent...
Usage Guidance
What to consider before installing Orchard:
- Clarify permissions: confirm whether the plugin requires operator.write or other elevated gateway permissions to spawn subagents, and only grant the minimal scope needed.
- Run in a sandbox first: install and exercise Orchard in a local/dev OpenClaw instance (use ORCHARD_DEBUG_LOG_ONLY=1 and ORCHARD_DISABLE_ALL_SPAWNS=1) before enabling spawns on a production gateway.
- Keep the standalone UI loopback-only: do not enable uiServer.allowUnsafeBind or change bindAddress from 127.0.0.1 unless you understand the network exposure; the UI proxy forwards browser Authorization headers to the gateway.
- Treat gateway tokens carefully: avoid embedding tokens in HTML; use localStorage token entry as recommended and rotate tokens if you suspect exposure.
- Audit any configured contextInjection.apiKey or third-party API keys: only provide such keys if you trust the provider and understand how injected context will be used/stored.
- Review config.settings (dbPath, limits, debug flags) before enabling in multi-user or shared environments; set tight limits on concurrent executors and disable architects/spawns if you want manual control.
- If you need more assurance, ask the author to explicitly document required OpenClaw permission scopes and provide a minimal-permissions deployment guide. If that clarification is not available, consider classifying the plugin as higher-risk and avoid granting elevated privileges.
Capability Assessment
Purpose & Capability
The plugin implements exactly what its name/description state: a SQLite-backed task board, REST API, dashboard, and a queue runner that spawns subagent sessions. However the plugin documentation and manifest mention it will autonomously spawn subagents and requires operator-level write privileges for that behavior; the registry metadata presented to the evaluator shows no declared credential/permission requirement. This mismatch (behavior that requires elevated agent permissions vs. no declared credential) is unexpected and should be clarified.
Instruction Scope
SKILL.md and README instruct normal install and configuration and accurately describe agent tools, REST endpoints, and the queue runner behavior. The runtime instructions and code include an auth-forwarding standalone UI proxy that deliberately forwards the browser's Authorization header to the gateway (intended behavior), and the queue runner will dispatch ready tasks as subagents — both are within the stated purpose but significantly expand what the agent can do (autonomous dispatching and forwarding bearer tokens).
Install Mechanism
There is no external download/install step in the SKILL.md; source files and build scripts are present and dependencies are standard Node packages (better-sqlite3, TypeScript). No obscure URL downloads or archive extraction are used. The plugin appears packaged as an OpenClaw plugin and built locally via npm/tsc.
Credentials
The package declares no required runtime environment variables or credentials by default, but the README and config schema expose many optional debug env vars and a contextInjection.apiKey field (for embedding external KB providers). Crucially, the plugin's manifest and docs state it will spawn subagents and need operator.write scope, yet the registry metadata did not declare such a primary credential/permission. This is disproportionate: spawning subagents and performing operator-level actions requires elevated platform privileges and should be explicitly declared and gated.
Persistence & Privilege
always:false and standard autonomy settings are used (the agent may invoke the skill autonomously, which is platform-default). The plugin starts a standalone UI proxy by default bound to loopback; the code refuses non-loopback binds unless uiServer.allowUnsafeBind is explicitly set. The combination of autonomous subagent spawning + potential operator.write scope increases blast radius if misconfigured, but the skill does not request permanent 'always' inclusion and does not appear to modify other skills' configs.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install orchard - After installation, invoke the skill by name or use
/orchard - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.2.5-rc.5
Release 0.2.5-rc.5
v0.2.4
Security: block SSRF in fetchUrl (private/loopback IPs, non-http schemes); proxy now whitelists headers instead of forwarding all; manifest description explicitly documents autonomous spawning and proxy behavior
v0.2.3
Models endpoint now reads provider list from api.config.models.providers (in-memory, already-parsed OpenClaw config) instead of reading openclaw.json from disk
v0.2.2
Remove undeclared filesystem reads: gateway token now requires explicit uiServer.gatewayToken config, allowModelOverride moved to declared plugin config, models endpoint no longer reads openclaw.json
v0.2.1
Fix: stall reaper was excluding timed-out runs (inverted timeout_at condition); add orphan sweep on startup and each queue tick to reset tasks stuck running with no active run
v0.2.0
Security fixes: payload size limiting, redirect depth cap, XSS prevention in dashboard, input validation whitelists, session cleanup via deleteSession (gateway provides synthetic admin scope)
Metadata
Frequently Asked Questions
What is Orchard?
Agentic project and task management plugin for OpenClaw. Persistent SQLite-backed task board with a queue runner that auto-dispatches ready tasks as subagent... It is an AI Agent Skill for Claude Code / OpenClaw, with 123 downloads so far.
How do I install Orchard?
Run "/install orchard" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Orchard free?
Yes, Orchard is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Orchard support?
Orchard is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Orchard?
It is built and maintained by derp42 (@derp42); the current version is v0.2.5-rc.5.
More Skills