What Just Happened
ReviewAudited by ClawScan on May 1, 2026.
Overview
The skill’s behavior matches its stated purpose, but users should notice that it installs a background watcher, reads local gateway logs, and can automatically deliver summaries through OpenClaw channels.
This skill appears purpose-aligned, not malicious: it summarizes recent gateway logs and reports what happened. Before installing, decide whether you want a persistent LaunchAgent running every 15 seconds, verify the missing plist file if you use the installer, and make sure OpenClaw delivery channels such as Telegram are appropriate for log-derived troubleshooting messages.
Findings (6)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
After installation, the skill can run in the background and trigger a notification when the gateway comes back online.
This documents a persistent background watcher that can initiate agent activity automatically. It is disclosed and has a stop command, so it is a notice rather than a concern.
The install script loads a LaunchAgent that runs every 15s. When it sees the gateway go from down up, it triggers the summary to TUI or Telegram.
Install the watcher only if you want automatic notifications, and use the documented launchctl unload command to disable it when no longer needed.
The skill can cause OpenClaw to start an agent turn and send a message through configured delivery channels.
The watcher programmatically invokes the OpenClaw agent and requests delivery. This is central to the skill’s purpose, but it is still an autonomous tool action users should be aware of.
cmd = [OPENCLAW_BIN, "agent", "--message", MESSAGE, "--deliver"]
Keep the OpenClaw CLI path trusted and review which channels OpenClaw is configured to deliver announcements to.
The watcher may act using the local OpenClaw identity and configured gateway access.
The skill relies on the local OpenClaw environment and authentication to deliver messages, while registry metadata declares no primary credential or required config paths. The artifacts do not show token logging or exfiltration.
OpenClaw with `openclaw.json` and `gateway.auth` (token or password).
Use it only in an OpenClaw environment you control, and ensure local auth files and delivery settings are appropriate for automatic status messages.
Recent gateway log lines or errors could be surfaced to the agent or user, and crafted log text could influence the wording of a summary.
The report script can include recent log snippets in JSON output, and the skill’s purpose is to summarize log-derived context. Logs are relevant evidence, but they may contain sensitive or misleading text.
out["snippets"] = snippets[-10:]
Treat log contents as untrusted troubleshooting data and avoid sharing JSON output to channels where raw log snippets should not appear.
A troubleshooting summary may appear in Telegram or another configured channel, not just the local TUI.
The skill’s output can be delivered through external or semi-external user channels such as Telegram. This is disclosed and purpose-aligned.
The OpenClaw gateway delivers that to the configured channel(s)typically the last-used channel (TUI webchat) and/or Telegram if configured.
Confirm your OpenClaw delivery channels before enabling automatic announcements, especially if gateway logs may reveal operational details.
The automatic watcher installation may not work as packaged, and the exact LaunchAgent definition is not included in the reviewed files.
The installer requires a LaunchAgent plist source file, but that file is not present in the supplied manifest. As provided, the installer would fail before loading the watcher; users should still verify any plist before installing persistence.
PLIST_SRC="$SCRIPT_DIR/com.openclaw.what-just-happened.plist"
Before running the install script, verify that the plist file is present, readable, and only launches the expected watcher script.