Poke Bridge

Send SMS/iMessage to the user via Poke and process inbound Poke events. Use when the user asks to be texted, for SMS-based alerts, when processing events for...

Before installing or running these instructions: 1) Inspect the openclaw-poke npm package source (or run it in an isolated VM/container) — do not blindly run global npm installs from unknown publishers. 2) Backup any files the guide will modify (openclaw.json, the poke binary, node_modules) and verify the sed replacement strings are correct; consider asking the maintainer for an official fix rather than patching binary files. 3) Prefer OAuth rather than pasting API keys when possible, and review what data in openclaw.json will be read/written (it may contain bearer tokens). 4) Review the systemd unit content before enabling it; running a persistent service is expected but increases exposure. 5) If you cannot validate the npm package and the patch steps, consider using the alternative manual registration with a secure tunnel provider (Tailscale/ngrok) or ask for an audited release. 6) If you proceed, run the setup with least privilege (user-level, not root) and monitor changes (file diffs, service activation).

Type: OpenClaw Skill Name: poke Version: 0.6.5 The skill instructions in SKILL.md direct the agent to perform high-risk system modifications, including patching the 'poke' CLI binary and library files using sed to bypass SDK logic and establishing persistence via a systemd service for a network tunnel. While these actions are framed as a setup process for the Poke bridge, binary modification and automated tunnel persistence are significant security risks. Additionally, the skill requires global NPM installations and executes setup scripts (npx openclaw-poke setup) that interact with local configuration files like openclaw.json to extract auth tokens.