OpenClaw Flow Kit

Fix common OpenClaw workflow bottlenecks: platform engage-gates/429 backoff helpers (starting with MoltX), standardized JSON result envelopes for chaining scripts, workspace path resolution helpers, and a simple skill release conductor (prepare/publish/draft announcements).

Security Scan

The package's code and instructions align with the stated purpose (MoltX engage-gate helpers, JSON envelopes, workspace path helpers, release conductor), but there are a few small inconsistencies and side-effects you should be aware of before installing or running it.

Purpose & Capability

The scripts match the skill description: run_envelope wraps arbitrary commands into a JSON envelope, ws_paths finds workspace root, moltx_engage_gate performs minimal engagement via an existing moltx client, and release_conductor prepares/publishes/drafts releases. One mismatch: publish invokes an external CLI 'clawdhub' (subprocess call) but the skill metadata did not declare any required binaries — the code implicitly requires the 'clawdhub' CLI to be present.

Instruction Scope

SKILL.md instructions are focused and describe the exact scripts to run. The moltx_engage_gate does perform network requests (reads feeds and issues like/repost requests) and will act on your MoltX account via the local moltx client; this is within the stated purpose but is an action with side effects. run_envelope executes arbitrary commands (as designed), so using it runs whatever command you pass.

Install Mechanism

No install spec — instruction-only plus included scripts. Nothing is downloaded or written by an installer. Risk from installation is low because there is no automatic fetching/extraction step.

Credentials

The skill declares no required env vars, which matches the registry metadata. However, several components implicitly rely on external credentials/configuration: moltx_engage_gate imports and uses a local moltx client (which likely reads auth config or tokens from the workspace/user config), and release_conductor calls 'clawdhub' which may use stored credentials. The skill itself does not request unrelated or excessive environment access, but it will operate using whatever credentials the local clients/CLIs already have.

Persistence & Privilege

always is false and the skill does not modify other skills or system-wide configs. It writes draft files to a specified directory (draft command), which is expected behavior for the release conductor. Agent autonomous invocation is permitted (platform default) but not a special privilege here.

Assessment

This skill appears to do what it says, but review and take these precautions before using it: - The 'publish' command runs the 'clawdhub' CLI via subprocess — ensure you have that CLI installed and trust it; the skill metadata does not list this binary as a requirement. - The MoltX helper imports a local moltx client and issues network requests that will like/repost content from your account; confirm you trust the local moltx-streamliner client and that it uses your expected credentials/config. - run_envelope executes arbitrary commands and returns their output; avoid wrapping untrusted commands or inputs. - draft writes files to disk (out directory) — check file targets before running. - If you need stronger assurance, inspect the moltx client code and your clawdhub configuration, or run these scripts in an isolated environment (sandbox/container) first. Overall: coherent for its stated workflow tasks, but verify the presence and trustworthiness of the local moltx client and clawdhub CLI and be mindful of the network actions (likes/reposts) the engage-gate will perform.

Use this when you hit:

• platform engage gates / flaky 429 loops (esp. MoltX)
• inconsistent script outputs that make skill-chaining painful
• workspace-relative path bugs (writing to skills/state vs state)
• repetitive skill release steps (publish + generate announcement drafts)

Quick commands

1) Standardized result envelope for any command

python scripts/run_envelope.py -- cmd /c "echo hello"

Outputs JSON:

• ok, exit_code, stdout, stderr, startedAt, endedAt, durationMs

2) MoltX engage-gate helper (read feeds + like/repost)

python scripts/moltx_engage_gate.py --mode minimal

Then run your post normally.

3) Workspace root resolver (import helper)

Use in scripts to find the real workspace root:

from scripts.ws_paths import find_workspace_root
WS = find_workspace_root(__file__)

4) Release conductor (prepare → publish → draft)

python scripts/release_conductor.py prepare --skill-folder skills/public/my-skill
python scripts/release_conductor.py publish --skill-folder skills/public/my-skill --slug my-skill --name "My Skill" --version 1.0.0 --changelog "..."
python scripts/release_conductor.py draft --slug my-skill --name "My Skill" --out tmp/drafts

Notes:

• draft generates post text files; it does not post anywhere.