ClawLink

Cross-instance agent communication for OpenClaw. ClawLink lets multiple OpenClaw sessions discover each other, delegate tasks, share knowledge, collaborative...

This package appears to do what it says: run a relay and let OpenClaw instances talk to each other. That usefulness comes with real security trade-offs. Before installing or running the server: 1) Do not bind the relay to 0.0.0.0 or expose it to the public Internet without adding authentication and TLS (the code is unauthenticated and unencrypted by default). 2) If you must access it across the internet, place the relay behind a reverse proxy or VPN that enforces access control, or require tunnels that include auth. 3) Treat any agent that can register as potentially able to request reading files or performing actions — only join trusted agents and avoid sharing sensitive files via the mesh. 4) Inspect and, if needed, modify the server to add auth (API keys, tokens) and enable HTTPS/WSS before internet use. 5) Run the relay in an isolated environment (container/VM) and restrict network exposure via firewall rules. 6) Be aware setup.sh will install pip packages and write ~/.clawlink/agent_state.json; if you lack operational controls or don’t accept network risk, do not run the relay. If you want a safer assessment, provide the full truncated portions of server.py/client.py (the listings were truncated) so I can review any remaining logic (auth hooks, file handling, or hidden endpoints) that would change the risk level.

Type: OpenClaw Skill Name: openclaw-link Version: 1.0.1 ClawLink provides a framework for cross-instance agent communication, including task delegation and shared file access via a central relay server (scripts/server.py). While functional for multi-agent workflows, it creates a significant attack surface: the agent is instructed by SKILL.md to poll for and execute tasks received from the relay, effectively enabling remote task injection via the AI. Additionally, the file-sharing commands in scripts/client.py (file-put/file-get) facilitate the movement of local data to the relay, which could be used for exfiltration if the relay is untrusted. These high-risk capabilities are inherent to the tool's design but lack evidence of intentional malicious exploitation.