Back to skill
Skillv1.1.0
ClawScan security
OpenClaw Growth Pack · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 28, 2026, 7:05 PM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The instructions and requested actions match the skill's stated purpose (bootstrapping OpenClaw runtime behavior) but the origin is unknown and it directs you to add provider keys and use a third‑party endpoint—so proceed with caution and validate endpoints and backups first.
- Guidance
- This skill appears to be what it says — an operations checklist for stabilizing an OpenClaw instance — but the package source is unknown and it directs you to insert API keys and tokens and to point a provider to https://coding.dashscope.aliyuncs.com/v1 (an external endpoint). Before applying it: 1) verify the origin of the guidance and confirm that the 'bailian' provider and the dashscope.aliyuncs.com endpoint are legitimate for your deployment; 2) make full backups of ~/.openclaw/openclaw.json and any agents/ files (the skill itself recommends this); 3) test changes in a staging environment if possible to avoid disrupting production; 4) treat API keys/tokens as secrets — use least-privilege keys and rotate them if you suspect exposure; 5) review and audit any dashboard/UI where you paste tokens to ensure it’s trusted; 6) run the restart and verification steps during a maintenance window. If you cannot verify the external provider endpoint or the skill author, be conservative: do not paste secrets, and perform the steps manually with logging and backups.
Review Dimensions
- Purpose & Capability
- okThe name/description promise (model routing, gateway tokens, anti-stall, autonomy loop, verification gates) aligns with the SKILL.md actions: editing ~/.openclaw/openclaw.json, updating AGENTS.md and HEARTBEAT.md, creating simple cron/manual jobs, and performing verification. Actions requested are relevant to operating and stabilizing an OpenClaw instance.
- Instruction Scope
- noteInstructions explicitly tell the operator to modify local OpenClaw config files (~/.openclaw/openclaw.json, agents/ files), documentation (AGENTS.md, HEARTBEAT.md, memory files), and to restart the gateway. That scope is confined to OpenClaw runtime/operation, but the skill also instructs you to place provider apiKey/token values into config and to paste tokens into a dashboard UI. These are legitimate operational tasks but involve storing/handling secrets and performing restarts that could disrupt service if done without backups or testing.
- Install Mechanism
- okThis is instruction-only (no install spec, no code files). No downloads or archive extraction are requested, so there is no installer footprint or arbitrary code fetch performed by the skill itself.
- Credentials
- noteThe skill does not declare or require environment variables or credentials, but it instructs operators to populate local config with provider API keys and gateway tokens. That is proportionate to its purpose (model routing and gatekeeping), but you should confirm the legitimacy of the referenced provider/baseUrl (https://coding.dashscope.aliyuncs.com/v1) before inserting secrets. The guidance to synchronize tokens across surfaces is reasonable operational advice.
- Persistence & Privilege
- okThe skill does not request 'always' presence, does not modify other skills or system-wide settings beyond OpenClaw config and documentation, and does not require persistent installation. It instructs file edits and gateway restarts which are standard admin actions and limited in scope.