Openclaw Agent Builder

Use when creating OpenClaw agents, configuring workspaces, multi-agent routing, session isolation, or channel bindings.

This SKILL.md appears to be a legitimate guide for creating OpenClaw agents, but it instructs reading and writing files under ~/.openclaw (including auth.json and session histories) and references places where credentials might be stored. Before installing or enabling this skill: 1) Confirm you trust the OpenClaw CLI binary and its source on your system (the guide expects 'openclaw' to be present). 2) Inspect ~/.openclaw and the referenced files (auth.json, AGENTS.md, TOOLS.md, etc.) to ensure no sensitive secrets would be exposed to an agent you run. 3) Backup any config before applying changes. 4) If you run agents that will execute code or have 'exec' permissions, use sandboxing and least privilege (deny write/exec where unnecessary). 5) If you need higher assurance, test in an isolated environment or VM first. If you want, I can highlight exact lines in SKILL.md that reference credential locations and commands to watch for.

Type: OpenClaw Skill Name: openclaw-agent-builder Version: 0.1.0 The `SKILL.md` documentation describes how to configure OpenClaw agents with high-risk capabilities, such as arbitrary script execution via 'hooks' (e.g., `agent:bootstrap`, `before_tool_call`) and granting agents `exec` tool permissions. While these features are plausibly necessary for an 'agent builder' skill, they introduce significant security vulnerabilities (potential RCE) if the agent is prompted maliciously or if the configuration is insecure. The skill bundle itself does not contain malicious instructions or code, but it details how to enable powerful, risky functionalities.