ohmyopenclaw

AI-native configuration and setup guides for OpenClaw

Before installing or allowing this skill to run automatically: - Do not run the provided 'curl | bash' or PowerShell 'iex' installer without auditing the remote script; prefer a vetted release (GitHub release tarball, signed binary, or manual inspection). The domain used by the installer (get.ohmyopenclaw.dev) is not a known trusted host. - Review the repository and installer script contents (or ask the author for a release tarball) so you know exactly what will be written and executed on your machine. - Expect the guides to request many API keys and to modify local config files under ~/.openclaw; only provide credentials you trust and store them securely (do not paste secrets into chat). - Be cautious about enabling cron jobs/heartbeats and webhooks: they cause periodic scanning and external callbacks. Inspect any webhook endpoints and restrict network access (use firewall rules, vetted endpoints). - The monitoring guide instructs scanning /var/log/myapp and GitHub issues; if you enable those, ensure the agent has only the minimum required file access and that sensitive logs are not exposed. - If you want to proceed, consider: (1) manually applying guide steps instead of granting autonomous execution; (2) running the installer in an isolated environment or container; (3) backing up existing openclaw.json and workspace files so you can revert changes; (4) limiting the skill's access to credentials and network at the OS or container level. Reason for rating: the skill is generally coherent with its stated purpose but includes high-risk installer commands, undocumented secret requirements, and instructions that allow system-level scanning and network callbacks — together these are suspicious and warrant manual review before trusting automatic installation or autonomous operation.

Type: OpenClaw Skill Name: ohmyopenclaw Version: 1.0.0 The skill bundle is classified as suspicious due to its extensive use of high-risk capabilities, including direct shell command execution, modification of the agent's core configuration (`openclaw.json`), creation of executable scripts (`check-costs.sh` in `guides/cost-optimization.md`), and instructions to create/modify sensitive files like `~/.openclaw/.env` (in `guides/chinese-providers.md`). Furthermore, `guides/monitor.md` configures autonomous scheduled tasks (cron jobs) for the AI, enabling it to perform actions without direct user prompting. While these actions are presented as legitimate configuration steps for an AI agent, they represent significant vulnerabilities if the skill bundle were malicious or if the agent were susceptible to prompt injection, as they grant broad control over the system and the agent's behavior. There is no clear evidence of intentional malicious behavior (e.g., data exfiltration, backdoors) within the provided files, but the inherent power and potential for misuse make it suspicious.