Ops Framework

A 0-token jobs + monitoring framework for OpenClaw: run long-running read tasks via scripts, checkpoint/resume safely, and send periodic progress + immediate alerts to Telegram. Write jobs are blocked by default and must be explicitly approved and verified.

This package is coherent and implements what it says, but review before enabling: 1) Inspect ops-jobs.json and keep all jobs disabled until you trust commands; the script will run whatever command you configure and may include output (stdout/stderr tails) in Telegram alerts. 2) Check your ~/.openclaw/openclaw.json — it may contain a Telegram botToken that the script will use to send messages; only allow the script access if you intend it to send messages. 3) Run python3 ops-monitor.py --print-only / selftest to verify behavior and test with dummy jobs. 4) Do not enable or grant approval for write-type jobs unless you audited the commands and linked verification jobs. 5) Because the source is 'unknown', consider running the script in a limited user account or VM, confirm there are no unexpected network endpoints beyond Telegram API, and lock file permissions on your OpenClaw config/state. If you want higher assurance, request the upstream repo or a signed release for code review.

Type: OpenClaw Skill Name: ops-framework Version: 0.1.0 The skill provides a framework for running arbitrary shell commands via user-defined jobs, which is a high-risk capability. However, the code (`ops-monitor.py`) and agent instructions (`SKILL.md`, `OPS_FRAMEWORK.md`) implement significant security guardrails: write jobs are blocked by default and require explicit approval and a read-only verification step, and the agent is instructed to enforce these controls and seek user confirmation for risky actions. There is no clear evidence of intentional malicious behavior, data exfiltration to unauthorized endpoints, or persistence mechanisms installed by the skill itself. The prompt injection instructions are designed to enhance security and transparency, not bypass them. The inherent risk of executing arbitrary commands, even with strong controls, makes it suspicious rather than benign.