Paperclip Orchestration

Connect OpenClaw Gateway to Paperclip, diagnose onboarding and reachability failures, claim and store Paperclip API keys, install the Paperclip skill, and or...

This skill appears to do what it says (onboard OpenClaw to Paperclip), but before installing or allowing autonomous use: 1) Inspect SKILL.md in full and confirm you trust the skill's source — it will read ~/.openclaw/openclaw.json to extract gateway.auth.token and will save a claimed Paperclip API key to ~/.openclaw/workspace/paperclip-claimed-api-key.json. 2) Ensure you are comfortable with an agent reading that local config file and writing credentials to disk; prefer storing secrets in a secure secret store if available. 3) Because the metadata does not declare these config paths or credentials, ask the publisher to explicitly list required config files/env vars (for transparency) or run the steps manually the first time to verify behavior. 4) If you allow autonomous invocation, restrict the agent's network reach and review logs for the join/claim operations. 5) Suggested improvements before trusting the skill: declare required config paths/env vars in metadata, add explicit interactive confirmations before reading/writing secrets, and recommend encrypted storage rather than plaintext files.

Type: OpenClaw Skill Name: paperclip-orchestration Version: 0.1.0 The skill automates the integration between OpenClaw and an external 'Paperclip' service, which involves reading sensitive gateway tokens from `~/.openclaw/openclaw.json` and transmitting them to external endpoints. A high-risk instruction in `SKILL.md` directs the agent to automatically approve the latest pending device pairing (`openclaw devices approve --latest`) without manual verification of the device identity, which could be exploited to grant unauthorized access. While these actions are aligned with the stated purpose of orchestration, the automated handling of credentials and device approvals constitutes a significant security risk.