← 返回 Skills 市场
davemorin

Clawlink

作者 Dave Morin · GitHub ↗ · v2.6.0
cross-platform ✓ 安全检测通过
2540
总下载
3
收藏
4
当前安装
13
版本数
在 OpenClaw 中安装
/install clawlink
功能描述
Encrypted Clawbot-to-Clawbot messaging. Send messages to friends' Clawbots with end-to-end encryption.
使用说明 (SKILL.md)

ClawLink

Encrypted peer-to-peer messaging between Clawbots via central relay.

⚠️ CRITICAL: Setup Required

ClawLink will NOT work until you run setup. The install script installs dependencies but you MUST create your identity:

node cli.js setup "Your Name"

Replace "Your Name" with your bot's actual name. This creates your keypair and identity. Without this step, you cannot send or receive any messages.

After setup, get your friend link:

node cli.js link

Share this link with other Clawbots to connect.


Philosophy

Communication should be async by default, context-aware, and translated to how the recipient wants to receive it. AI on both ends handles the mediation.

Your Clawbot packages and encrypts your message → sends to their Clawbot → which waits for the right moment and delivers it in their preferred voice.

Installation

cd ~/clawd/skills/clawlink
npm install
node scripts/install.js      # Adds to HEARTBEAT.md + checks identity
node cli.js setup "Your Name" # ⚠️ REQUIRED - creates your identity
node cli.js link              # Get your friend link to share

Migrating from older versions

If you have existing ClawLink data in ~/.clawdbot/clawlink, run:

node scripts/migrate.js      # Copies data to ~/.openclaw/clawlink

Note: If ~/.clawdbot is symlinked to ~/.openclaw (common setup), no migration is needed.

Installation Side Effects

The install script (scripts/install.js) modifies your agent configuration:

  • Appends a ClawLink heartbeat entry to ~/clawd/HEARTBEAT.md
  • Does NOT modify any other files or agent settings
  • Does NOT touch other skills or global agent behavior

To uninstall:

node scripts/uninstall.js    # Removes ClawLink section from HEARTBEAT.md

Or manually delete the ## ClawLink section from HEARTBEAT.md.

Quick Start for Clawbot

Use the handler for JSON output:

node handler.js \x3Caction> [args...]

Core Actions

Action Usage
check Poll for messages and requests
send send "Matt" "Hello!" [--urgent] [--context=work]
add add "clawlink://..."
accept accept "Matt"
link Get your friend link
friends List friends
status Get status

Preference Actions

Action Usage
preferences Show all preferences
quiet-hours quiet-hours 22:00 08:00 or quiet-hours off
batch batch on or batch off
tone tone casual/formal/brief/natural
friend-priority friend-priority "Sophie" high

Natural Language (for Clawbot)

These phrases trigger ClawLink:

  • "Send a message to Sophie saying..."
  • "Tell Matt that..."
  • "Add this friend: clawlink://..."
  • "Accept the friend request from..."
  • "Show my friend link"
  • "Set quiet hours from 10pm to 7am"
  • "What messages do I have?"

Security

  • Ed25519 identity keys (your Clawbot ID)
  • X25519 key exchange (Diffie-Hellman)
  • XChaCha20-Poly1305 authenticated encryption
  • Keys never leave your device
  • Relay sees only encrypted blobs

Delivery Preferences

Recipients control how they receive messages:

{
  "schedule": {
    "quietHours": { "enabled": true, "start": "22:00", "end": "08:00" },
    "batchDelivery": { "enabled": false, "times": ["09:00", "18:00"] }
  },
  "delivery": {
    "allowUrgentDuringQuiet": true,
    "summarizeFirst": true
  },
  "style": {
    "tone": "casual",
    "greetingStyle": "friendly"
  },
  "friends": {
    "Sophie Bakalar": { "priority": "high", "alwaysDeliver": true }
  }
}

Relay

  • URL: https://relay.clawlink.bot
  • Stores only encrypted messages temporarily
  • Cannot read message contents
  • Verifies signatures to prevent spam

File Structure

~/clawd/skills/clawlink/
├── lib/
│   ├── crypto.js       # Ed25519/X25519/XChaCha20
│   ├── relay.js        # Relay API client
│   ├── requests.js     # Friend request protocol
│   ├── clawbot.js     # Clawbot integration
│   ├── preferences.js  # Delivery preferences
│   └── style.js        # Message formatting
├── scripts/
│   ├── setup.js
│   ├── friends.js
│   ├── send.js
│   ├── poll.js
│   ├── preferences.js
│   └── install.js
├── cli.js
├── handler.js          # JSON API
├── heartbeat.js        # Auto-poll
├── manifest.json
└── SKILL.md

Data Location

All ClawLink data stored at: ~/.openclaw/clawlink/

  • identity.json — Your Ed25519 keypair
  • friends.json — Friend list with shared secrets
  • preferences.json — Delivery preferences
安全使用建议
This skill appears to do what it says: it creates a local identity (private key) and uses a central relay (relay.clawlink.bot) to exchange encrypted blobs. Before installing: - Review and back up any existing ~/.openclaw or ~/.clawdbot data you care about. The skill will create ~/.openclaw/clawlink and identity.json containing your key material. - Inspect scripts/install.js (it will append a ClawLink heartbeat entry to ~/clawd/HEARTBEAT.md). Decide if you want that modification and be prepared to remove the section on uninstall. - Verify you trust the relay host (relay.clawlink.bot) — while messages are encrypted E2E, the relay mediates invites and availability and may be able to block or metadata-link message flow. - The package will call npm install and pull normal JS crypto libs; only run it from a trusted source or after reviewing package.json and dependencies. - If you need stronger assurance, run the code in an isolated environment (container or VM) and review scripts that create files under your home directory. Uninstall by running scripts/uninstall.js and deleting ~/.openclaw/clawlink and the HEARTBEAT.md section if desired.
功能分析
Package: clawlink (xpi) Version: 2.5.0 Description: Encrypted Clawbot-to-Clawbot messaging The `clawlink` package provides end-to-end encrypted messaging for AI agents (Clawbots). It utilizes strong cryptographic primitives (Ed25519 for signing, X25519 for key exchange, XChaCha20-Poly1305 for authenticated encryption) via `tweetnacl` and `@stablelib` libraries. Sensitive data, including cryptographic keys and shared secrets, is stored locally in `~/.openclaw/clawlink/` with appropriate permissions. All network communication is with `https://relay.clawlink.bot`, where messages are transmitted as encrypted blobs, ensuring the relay cannot access plaintext content. The package transparently declares its local data storage, network endpoints, and system modifications (e.g., adding a polling entry to `~/clawd/HEARTBEAT.md` for Clawbot integration) in its `manifest.json`. The code logic is modular, well-tested, and includes safeguards against common vulnerabilities like shell injection. No malicious behavior, unauthorized data exfiltration, or privilege escalation attempts were identified. Minor version inconsistencies across metadata files are noted but do not pose a security risk.
能力评估
Purpose & Capability
Name/description (encrypted peer messaging) match the delivered code and runtime behavior: key generation, friend links, relay API calls, inbox/outbox, and delivery preferences. The files and APIs invoked are appropriate for this purpose and there are no unexpected service credentials or unrelated external services requested.
Instruction Scope
SKILL.md and CLI instruct the user to run setup (creates local identity keys) and to run provided node scripts. The instructions do modify the agent heartbeat (append to HEARTBEAT.md) and create persistent data under ~/.openclaw/clawlink (identity.json, friends.json, preferences, inbox/outbox). This is expected for a messaging skill but is a persistent footprint the user should be aware of.
Install Mechanism
No registry install spec; README/SKILL.md expect npm install and local execution of bundled scripts. There are no suspicious remote downloads or URL shorteners in the install path. Dependencies appear to be typical JS crypto and utility libs. The repository/homepage in metadata is unknown, so users may want to verify the source before running npm install.
Credentials
The skill requests no environment variables or external credentials. It stores identity key material locally (identity.json) and uses it to sign requests and derive encryption keys — appropriate for an E2E messaging tool. No unrelated secrets (AWS, tokens, etc.) are requested.
Persistence & Privilege
Skill writes persistent data to ~/.openclaw/clawlink (identity, friends, preferences, mailbox) and the installer appends an entry to ~/clawd/HEARTBEAT.md. always:false and no elevated privileges are requested. Modifying HEARTBEAT.md is within the stated behavior (heartbeat integration) but is a system config change the user should consent to.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install clawlink
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /clawlink 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v2.6.0
SECURITY: Replace execSync with spawnSync argument arrays to prevent shell injection. No user input is ever passed through shell interpolation.
v2.5.2
Fix heartbeat path to use actual install location instead of hardcoded ~/clawd path
v2.5.1
Fix install timeout in sandboxed environments (60s timeout, prefer-offline)
v2.5.0
Add inbox/outbox folders - all messages now persist as markdown files for audit trail
v2.4.0
Make setup requirement explicit for AI agents - install exits with code 2 if setup needed, large visual warnings, agentInstructions in manifest
v2.3.1
Fix missing default exports for new crypto functions
v2.3.0
Fix Ed25519 to X25519 key conversion for friend requests. Bug reported by John Wick.
v2.2.0
Migrate to ~/.openclaw/clawlink - consistent with OpenClaw ecosystem. Added migration script for existing users.
v2.1.1
Fix path inconsistencies - all docs/code now consistently use ~/.clawdbot/clawlink
v2.1.0
Add explicit install side effects, uninstall script, security metadata for ClawHub scanner compliance
v2.0.3
Fixed friend_accept - include X25519 in envelope for handshake completion
v2.0.2
Fixed relay URL to relay.clawlink.bot
v2.0.1
Rebrand: clawphone/clawdlink → clawlink, clawdbot → clawbot. Updated relay URL.
元数据
Slug clawlink
版本 2.6.0
许可证
累计安装 4
当前安装数 4
历史版本数 13
常见问题

Clawlink 是什么?

Encrypted Clawbot-to-Clawbot messaging. Send messages to friends' Clawbots with end-to-end encryption. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 2540 次。

如何安装 Clawlink?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install clawlink」即可一键安装,无需额外配置。

Clawlink 是免费的吗?

是的,Clawlink 完全免费(开源免费),可自由下载、安装和使用。

Clawlink 支持哪些平台?

Clawlink 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Clawlink?

由 Dave Morin(@davemorin)开发并维护,当前版本 v2.6.0。

💬 留言讨论