OpenClaw Docker Setup

Install and configure a fully operational Dockerized OpenClaw instance on macOS from scratch. Includes browser pairing, Discord channel setup, and optional G...

This guide appears coherent and matches its stated goal, but it handles sensitive credentials — Gmail App Passwords, Google OAuth client JSON, exported gog tokens, and optionally an Anthropic setup token/API key — and instructs you to place them inside persistent Docker volumes. Before proceeding: (1) ensure you trust the GHCR image source (verify upstream project and checksums if available); (2) prefer a dedicated bot account (as the guide recommends) and limit scopes/permissions when creating OAuth credentials; (3) avoid leaving temporary token export files on disk (remove /tmp exports after import); (4) understand that secrets stored in the named Docker volumes will persist until you remove them — rotate or revoke tokens if the instance is decommissioned; (5) follow the guide’s safer file-copy patterns (pipe via docker exec rather than docker cp) to avoid ownership issues; and (6) if you need higher assurance, inspect the actual OpenClaw GHCR image contents (or run it in an isolated VM) before giving it production credentials. If you want, I can point out every command that writes credentials to disk so you can audit or modify them before running.

Type: OpenClaw Skill Name: openclaw-docker-setup Version: 1.0.2 The skill is classified as suspicious due to inherent supply chain risks and the handling of sensitive credentials, despite demonstrating strong security awareness. It instructs the AI agent to install binaries (`himalaya`, `gogcli`) via `curl -L ... | tar -xz ...` from external GitHub repositories (`github.com/pimalaya/himalaya`, `github.com/steipete/gogcli`) within the Docker container (in `references/gmail-setup.md` and `references/google-drive-setup.md`), which introduces a supply chain vulnerability. Additionally, the agent is instructed to handle and configure sensitive credentials (Gmail App Password, Google OAuth tokens) by reading them from the host and piping them into the container's configuration, a necessary but risky capability. However, the skill explicitly uses Docker security hardening (`--cap-drop=ALL`), warns against insecure practices, and provides detailed instructions for secure credential transfer, indicating no clear malicious intent within the skill itself.