New Player Package 800

OpenClaw deployment optimization guide based on 800 RMB (100 USD) of real-world experience. Helps new users quickly complete skill installation, configuratio...

This is a readable deployment guide, but it omits important metadata and suggests installing third‑party packages without specifying sources. Before running the recommended commands: 1) Verify you have Node.js/npm installed (the guide uses npm but doesn't declare it). 2) Confirm what 'uv' refers to (npm package vs. system binary) and inspect that package before installing. 3) Inspect the 'clawhub', 'session-monitor', and 'task-persistence' packages/repos (GitHub/npm pages) to ensure they are official/trusted and review their code or release provenance. 4) Do not paste gateway tokens or other secrets into commands without understanding where they will be stored/transmitted; prefer editing configuration files locally and backup openclaw.json first. 5) If the author, homepage, or package sources are provided (or you can point the install commands to official repositories), re-run this assessment — that information would raise confidence and could change the verdict to benign. If you cannot verify the packages' origins, avoid running the one‑click script and install components manually from trusted sources.

Type: OpenClaw Skill Name: new-player-package-800 Version: 1.0.0 The skill bundle is classified as suspicious due to its instruction to install skills with extremely broad system and filesystem access, specifically 'openclaw-anything' (for 'System management operations') and 'clawdbot-filesystem' (for 'Advanced filesystem operations'). While the provided SKILL.md does not instruct the agent to perform malicious actions with these capabilities, their installation significantly expands the agent's attack surface, making it vulnerable to future prompt injections or potential misuse if the installed skills themselves are compromised. The `npm install -g` command also grants global execution capabilities to `clawhub` and `uv`.