Agent Factory (Walter)
ReviewAudited by ClawScan on May 10, 2026.
Overview
The skill mostly matches its stated purpose, but it handles Feishu secrets and makes broad persistent OpenClaw/Feishu configuration changes that should be reviewed carefully.
Use this only if you trust it to edit your OpenClaw configuration, store a Feishu app secret, enable Feishu wiki/doc/drive tools, and restart the gateway. Back up openclaw.json, use a least-privilege Feishu app, review the generated config and role files, and avoid optional skill installation unless the target skill is reviewed and pinned.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A Feishu app secret would be persisted in the local OpenClaw configuration and could authorize bot access according to that app's Feishu scopes.
The skill asks for a Feishu app secret and writes it into OpenClaw's Feishu account configuration, while the supplied requirements list no primary credential or required environment variables.
`appId` | 飞书机器人 App ID ... `appSecret` | 飞书机器人 Secret ... `.channels.feishu.accounts[$n] = {appId: $id, appSecret: $secret, name: $name}`Use a least-privilege Feishu app, confirm the exact scopes needed, protect the OpenClaw config file, and make the credential storage requirement explicit before running.
The new or existing Feishu-connected agents may gain access to wiki/doc/drive tools, and restarting the gateway can affect other OpenClaw activity.
The workflow enables multiple Feishu tools at the channel level and restarts the OpenClaw gateway; the artifact does not show per-agent scoping or an explicit confirmation step for these broad changes.
openclaw config set channels.feishu.tools.wiki true openclaw config set channels.feishu.tools.doc true openclaw config set channels.feishu.tools.drive true ... openclaw gateway restart
Require explicit user approval, show a config diff, scope tool permissions to the intended agent/account where possible, and provide a clear rollback path.
If the selected skill is wrong, outdated, or untrusted, the newly created agent may inherit that skill's behavior.
The skill can optionally install a user-named ClawHub skill into the newly created workspace. This is purpose-aligned, but no version pin or source verification is shown.
clawhub install <skill-name> --workdir "$env:USERPROFILE\\.openclaw\\workspace-$Name"
Install only reviewed skills, prefer exact slugs and versions, and review the optional skill before adding it to the new agent.
Incorrect or overly broad instructions placed in these files can continue to influence the new agent later.
The skill writes persistent role and behavior instructions into the new agent workspace, which is expected for an agent factory but creates reusable context for future runs.
创建角色文件 ... `IDENTITY.md` — 名字、emoji、定位 ... `SOUL.md` — 行为准则 ... `AGENTS.md` — 工作手册
Review the generated identity, soul, and handbook files, and do not place secrets or untrusted instructions in persistent agent files.