OpenPot Awareness

Teaches this agent how to serve content to the OpenPot iOS client — cards, apps, page captures, calendar, voice, chat persistence, and onboarding

This package appears to be what it says: documentation and web-app templates to let an OpenClaw agent serve the OpenPot iOS client. Before installing, confirm you trust the agent/server that will host this skill because the skill enables and documents high-privilege surfaces (Terminal/SSH access, calendar access, chat persistence). Specifically: (1) only install on an agent/server you control and trust; (2) confirm device pairing/Ed25519 approval steps are done intentionally (don’t approve unknown devices); (3) protect the gateway (ws:// :18789) behind a LAN, Tailscale, or other secure route; (4) review whether the agent will expose SSH sessions or use existing SSH keys — if so, rotate or audit keys when appropriate; and (5) if you need higher assurance, request the complete SKILL.md and any runtime command templates from the author or host the HTML templates yourself rather than accepting remote installation from an unknown source.

Type: OpenClaw Skill Name: openpot-awareness Version: 6.0.0 The skill bundle provides a comprehensive integration for the OpenPot iOS app, but it includes high-risk instructions for the AI agent to modify system security settings. Specifically, SKILL.md directs the agent to add user-provided SSH public keys to '~/.ssh/authorized_keys' and to auto-approve remote device pairing requests using 'openclaw devices approve'. While these actions are aligned with the stated purpose of providing terminal access and onboarding, they create a significant attack surface for remote persistence and unauthorized access if the agent's logic is subverted. The included HTML applications (e.g., weather.html, billable-hours.html) appear benign, using standard local storage and legitimate external APIs (open-meteo.com).