Openclaw Mention Skill

Model-agnostic WhatsApp @mention skill for OpenClaw. Converts @Name, @Phone, @LID to blue clickable WhatsApp mentions with any AI model.

This skill appears to do what it claims (convert @Name/@Phone into WhatsApp LIDs) and does not request secrets or call out to external servers, but it patches OpenClaw core files and restarts the service — actions that require root or package-owner privileges and carry risk if the code is malicious or buggy. Before installing: (1) review install.sh and the exact inserted patch (the large _LID_PATCH_V10 block) line-by-line to ensure it only touches the intended files and does not add hidden network calls or credential reads; (2) verify the repository/source and maintainers, and prefer installing on a test instance first; (3) back up your OpenClaw installation (even though the script creates .bak files); (4) check the LID_CACHE contents for any sensitive phone numbers you don't want stored; (5) be prepared to run uninstall.sh to restore backed-up files — note uninstall leaves LID_CACHE.json and mention-guide.md in place. If you are uncomfortable with core-file patches, ask the maintainer for a non-invasive plugin approach or request the patch be upstreamed into OpenClaw so no local modifications are required.

Type: OpenClaw Skill Name: openclaw-mention-skill Version: 1.0.1 The skill performs invasive patching of OpenClaw's core distribution files (deliver-reply-*.js and login-*.js) to intercept and modify outgoing messages. While the logic in install.sh and the injected JavaScript code appears aligned with the stated purpose of fixing WhatsApp @mentions, the practice of modifying core application code via shell and Python scripts is inherently risky. This behavior could lead to system instability or be used as a vector for persistence, although no evidence of data exfiltration or intentional backdoors was found.