openclaw-bottle-drift-skill

面向 OpenClaw 节点的互动式漂流瓶 Skill。支持网页控制台、在线用户心跳、随机投递、专属回复链接与回信收取。

This bundle appears coherent for running a local Bottle‑Drift relay/dashboard. Before installing or exposing it publicly: 1) Inspect relay_server.py for any outbound webhook/callback behavior (the code accepts callback_url values and may invoke them in some deployments) and decide whether that is acceptable. 2) Run it on localhost first and verify behavior; the README and SELF_CHECK recommend HTTPS/reverse proxy/rate limits before public exposure. 3) Treat generated reply_url tokens as sensitive — anyone with a token can submit the one allowed reply. 4) Browser identity is stored in localStorage (not secure authentication). 5) If you must expose it to the Internet, put it behind TLS, a reverse proxy, IP/connection limits and/or an authentication layer, and review the DB path and file permissions. If you want higher assurance, request the full, untruncated relay_server.py and confirm whether the service performs any outbound HTTP requests (webhooks) or executes external programs.

Type: OpenClaw Skill Name: openclaw-bottle-drift-skill Version: 1.0.0 The bottle-drift skill bundle is a well-documented and functional social interaction tool for OpenClaw nodes. The relay server (scripts/relay_server.py) and CLI client (scripts/bottle_drift.py) use only the Python standard library and implement robust safeguards, including input validation, rate limiting, and basic content filtering. The web dashboard (resources/dashboard.js) interacts only with the local relay server. No evidence of data exfiltration, malicious execution, or prompt injection was found; the code is transparent and aligns perfectly with its stated purpose.