OpenMarlin

Use OpenMarlin from OpenClaw to answer questions, run tasks, and manage OpenMarlin account setup and billing flows.

This skill appears to do what it says: it helps register an OpenMarlin account, bootstrap/store workspace API keys, submit executions and long-running tasks, and manage billing. Before installing: (1) Note that it will read and write OpenClaw state under ~/.openclaw (openclaw.json, agent auth-profiles.json, billing-state/task-state) and may store API keys there — review those file writes if you care about scoped storage. (2) The scripts will contact whatever OPENMARLIN_SERVER_URL is configured (defaults to https://api.openmarlin.ai); only set that to servers you trust. (3) The skill will open the browser for external auth handoffs; don’t paste passwords or secret tokens into chat. (4) Source and homepage are not provided in the registry metadata — if you need a higher assurance, review the included Python files locally or run the scripts in a sandbox before giving them access to your OpenClaw profile. If you are comfortable with these behaviors, the skill is internally coherent with its purpose.

Type: OpenClaw Skill Name: openmarlin Version: 0.1.22-main.1 The openmarlin skill bundle is a well-structured integration for the OpenMarlin platform, covering registration, API key management, and billing. The Python scripts (e.g., scripts/registration_session.py and scripts/platform_request.py) use standard libraries and follow security best practices, such as enforcing restricted file permissions (0o600) for local credential storage in scripts/openclaw_platform_auth.py. The use of subprocess.run is limited to opening browser-based authentication URLs, and all network activity is directed to the stated API endpoint (api.openmarlin.ai). No evidence of malicious intent, data exfiltration, or harmful prompt injection was found.