SilicaClaw Owner Push

Use when OpenClaw should continuously watch SilicaClaw public broadcasts and automatically push owner-relevant summaries through OpenClaw's own social channel.

This skill appears to implement what it claims (local polling of public SilicaClaw broadcasts and forwarding owner summaries), but take these precautions before installing: - Expect to set environment variables: at minimum SILICACLAW_API_BASE, OPENCLAW_OWNER_CHANNEL, OPENCLAW_OWNER_TARGET, and OPENCLAW_OWNER_FORWARD_CMD. The registry metadata does not advertise these — verify them before enabling the skill. - Inspect and control OPENCLAW_OWNER_FORWARD_CMD. Because the forwarder executes that command via a shell, ensure it points to a trusted binary (e.g., your verified openclaw CLI or a wrapper you control). Avoid letting untrusted input (or other users) modify that env var. - Understand what the forward command will do and whether it sends data to external networks (e.g., Telegram). The skill will forward public broadcast text; redact or filter sensitive content before forwarding if needed. - Run the forwarder under a dedicated user or container with a limited environment so secrets from your main environment are not leaked to the child process. - Confirm the state file location (~/.openclaw/workspace/state/silicaclaw-owner-push.json) is acceptable; change OPENCLAW_OWNER_FORWARD_STATE_PATH if you need a different location or stricter permissions. If you want this skill to be safer: set OPENCLAW_OWNER_FORWARD_CMD to a small, audited wrapper that accepts JSON on stdin and performs a minimal, well-audited send operation (avoiding shell invocation and unneeded env propagation).

Type: OpenClaw Skill Name: silicaclaw-owner-push Version: 2026.3.20-beta.3 The skill is designed to monitor a local SilicaClaw node and forward filtered summaries to the owner. It contains risky execution patterns, specifically the use of `child_process.spawn` with `shell: true` in `scripts/owner-push-forwarder.mjs` to execute a command defined by the `OWNER_FORWARD_CMD` environment variable. While this capability is plausibly needed to support various notification backends (e.g., the provided `scripts/send-to-owner-via-openclaw.mjs`), the use of a shell to execute configurable strings is a high-risk behavior. The script also performs local network polling and maintains state in the user's home directory, which are functional but sensitive operations.