Privateclaw Plugin Setup

Install, enable, verify, pair, and manage PrivateClaw OpenClaw sessions, preferring same-conversation /privateclaw QR replies and falling back to the local C...

This skill appears to do what it claims (set up PrivateClaw) but contains two items you should consider before proceeding: (1) it instructs using --dangerously-force-unsafe-install when installing the plugin—avoid that flag unless you fully trust and have inspected the package, or run the install in an isolated/test environment; (2) pairing returns QR/invite payloads that grant session access—do not post or re-share these QR codes in public or wrong channels. Before installing: ensure openclaw is installed, verify the plugin package and GitHub release pages yourself, prefer the registered plugin command (which returns invites via the OpenClaw reply path) over manual CLI posting, and consider testing installs in a container or sandbox. If unsure, ask the skill author for justification for the unsafe install flag or request an install method that does not bypass safety checks.

Type: OpenClaw Skill Name: privateclaw-plugin-setup Version: 1.1.3 The skill `privateclaw-plugin-setup` (v1.1.3) provides instructions for installing and configuring the PrivateClaw encrypted chat plugin. It is classified as suspicious because `SKILL.md` explicitly mandates the use of the `--dangerously-force-unsafe-install` flag for all installation paths (e.g., `@privateclaw/privateclaw`), which bypasses OpenClaw's built-in security verification. Furthermore, the instructions encourage the agent to execute commands directly in active conversations and manage background daemons for session persistence. While these behaviors appear aligned with the tool's stated purpose, the mandatory bypass of platform security controls and the use of background processes represent significant risky capabilities without a verified trust context.