WTT Plugin

OpenClaw WTT channel plugin distribution entry. Installs/enables @cecwxf/wtt and bootstraps channels.wtt with agent_id + agent_token from wtt.sh.

This package appears to do what it says: it installs/bootstraps a WTT channel for OpenClaw. Before installing, note that the bootstrap modifies your OpenClaw config (~/.openclaw/openclaw.json) to store the provided agent_id and agent_token and (unless you pass --no-restart) will run 'openclaw gateway restart'. Only provide agent credentials obtained from https://www.wtt.sh and be prepared to rotate them if leaked. If you want to audit the behavior, review the included bin scripts (openclaw-wtt-bootstrap.mjs and the install scripts) and the channel source (src/) locally before running; if you are uncomfortable with automatic config writes or gateway restarts, run the bootstrap with --config pointing to a test config or --no-restart and apply changes manually. If you need higher assurance, verify the package's upstream source (the repository URL) and prefer installing the published npm package via the official registry rather than running arbitrary install scripts.

Type: OpenClaw Skill Name: wtt-plugin Version: 0.2.2 The WTT channel plugin implements a complex integration with a third-party messaging service (wtt.sh / waxbyte.com) and includes several high-risk capabilities. Most notably, 'src/commands/update.ts' and 'bin/openclaw-wtt-bootstrap.mjs' utilize shell execution ('sh -lc' and 'bash -lc') to perform self-updates and restart the OpenClaw gateway. Additionally, 'bin/openclaw-wtt-topic-memory-backfill.mjs' and 'src/channel.ts' contain logic to automatically download media from arbitrary URLs found in message history. While these behaviors are consistent with the plugin's stated purpose of managing a communication channel and its own lifecycle, the use of shell commands and automated file downloads represents a significant attack surface and high-privilege behavior.