TeamClaw

A high-performance Agent subsystem for complex multi-agent orchestration. It provides a visual workflow canvas (OASIS) to coordinate OpenClaw agents, automat...

This package implements a full multi-agent orchestration platform (web UI, bots, scheduler, public tunnel) and matches its description — but several red flags mean you should not install it blindly: - Metadata mismatch: the registry says 'no required env vars' but the code and SKILL.md require many secrets (LLM_API_KEY, OPENCLAW_API_KEY, INTERNAL_TOKEN, TELEGRAM/QQ secrets). Treat that inconsistency as a transparency issue. - Highly privileged token: INTERNAL_TOKEN is used by bots to call the system as arbitrary users (INTERNAL_TOKEN:username:...). Do NOT provide an INTERNAL_TOKEN unless you fully trust the code and run it in an isolated environment. - Auto-downloads & tunneling: scripts claim to auto-download cloudflared and bark-server and can expose the service publicly. Verify exactly which URLs the scripts download from (inspect scripts/tunnel.py, packaging/launcher.sh, build scripts) and prefer running behind a firewall or in a disposable VM/container. - Filesystem access: the service will read local files such as an OpenClaw sessions.json and write .env, logs, and user_data. Provide only paths you are comfortable exposing to the service. - Prompt-injection artifact: SKILL.md contains detected unicode-control characters. Open the raw file and ensure there are no hidden control characters that could affect parsers or cause unexpected behavior. Practical next steps before installing: 1. Review the repository source locally (especially scripts/tunnel.py, selfskill/scripts/*, run.sh, launcher.py) to see what is downloaded and what URLs are used. 2. Run initially in an isolated VM or container with no outbound network access (or with controlled egress) to inspect behavior. 3. Do not set INTERNAL_TOKEN or any admin keys until you are confident of the code. If you must test bots, create a throwaway INTERNAL_TOKEN limited to a test account or run without bot integrations. 4. If you plan to expose the service, require strong UI authentication, limit public exposure to a reverse proxy with access controls, and rotate any keys/passwords you use during testing. If you want, I can: (A) list the specific files to inspect first (scripts/tunnel.py, selfskill/scripts/run.sh, packaging/launcher.py, chatbot/setup.py), or (B) scan the provided tunnel and downloader scripts for download URLs and extraction logic.

Type: OpenClaw Skill Name: teamclaw Version: 0.1.3 TeamClaw is a comprehensive multi-agent orchestration platform that provides a visual workflow canvas (OASIS), social bot integrations (Telegram/QQ), and computer use capabilities. It features a robust set of MCP tools for command execution (mcp_commander.py), file management (mcp_filemanager.py), and network access via Cloudflare Tunnels (scripts/tunnel.py). While the bundle includes high-risk capabilities such as remote command execution and automated binary downloads (e.g., bark-server from GitHub in scripts/launcher.py), these are clearly aligned with its stated purpose of enabling complex agent orchestration and computer use. The implementation demonstrates security awareness through features like command whitelisting, path traversal protection, user-level isolation, and SHA-256 password hashing.