OpenTangl Plugin

Integrates OpenTangl lifecycle tools into OpenClaw, enabling task queue viewing, task proposing, workflow execution, autopilot, wiring audits, and merge pipe...

This plugin legitimately wraps an OpenTangl CLI, but it will execute code from the workspace you point it at and run that code with the agent's environment. Before installing or enabling mutating tools: (1) only point workdir to repositories you trust (a malicious workspace file could run arbitrary code); (2) ensure credentials in the agent environment (OPENAI_API_KEY, ANTHROPIC_API_KEY, GitHub auth used by 'gh', etc.) have minimal scope and are not overly privileged; (3) enable mutating tools (propose/autopilot/merge) only if you understand and accept automated commits and merges; (4) prefer installing plugins from a verifiable homepage or repository — this package has no homepage listed in the registry; (5) if you need stronger isolation, run OpenClaw with restricted environment or in an isolated runner/container so workspace-executed CLIs cannot access sensitive network endpoints or secrets.

Type: OpenClaw Skill Name: opentangl-plugin Version: 0.1.1 The OpenTangl plugin provides a bridge between OpenClaw and the OpenTangl CLI for autonomous development tasks. The implementation in `index.ts` (and its compiled version `dist/index.js`) follows security best practices by using `spawnSync` without a shell to prevent command injection and implementing regex-based input validation for project IDs and variables. It also includes specific checks against path traversal in the `assertWorkflowPath` function. While the plugin facilitates high-privilege actions like code modification and PR management, these behaviors are explicitly documented and aligned with the tool's stated purpose, with no evidence of malicious intent, hidden backdoors, or unauthorized data exfiltration.