OpenClaw Dual Agent
v1.0.3Run two OpenClaw agents simultaneously — a paid Anthropic agent and a free OpenRouter agent, each with its own Telegram bot. Trigger phrases: multi-agent set...
⭐ 0· 85·0 current·0 all-time
byDeonte Cooper@djc00p
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match the instructions: the SKILL.md explains how to run an Anthropic-paid agent and an OpenRouter free agent with separate Telegram bots. The only declared external requirements (Anthropic, OpenRouter, Telegram tokens and jq) make sense for this purpose. Note: registry-level 'Required env vars' is empty but SKILL.md metadata lists ANTHROPIC_API_KEY, OPENROUTER_API_KEY, TELEGRAM_BOT_TOKEN — an internal inconsistency in the skill metadata (see environment_proportionality).
Instruction Scope
Runtime instructions stay within the expected scope: creating/editing OpenClaw config files (~/.openclaw/openclaw.json, auth-profiles.json, models.json), using openclaw CLI commands, calling Telegram/OpenRouter/Anthropic APIs for verification, and using jq for JSON manipulation. There are no unexpected remote endpoints or instructions to harvest unrelated system data. The guidance to remove history entries and to set file permissions is reasonable but worth noting to users (shell-history commands vary by shell).
Install Mechanism
Instruction-only skill (no install spec, no code files). This minimizes disk-install risk. The only required binary is jq, which is appropriate for the shown JSON manipulations.
Credentials
Requested credentials (Anthropic API key, OpenRouter API key, Telegram bot token) are proportional to the stated functionality. However, the skill registry summary lists 'Required env vars: none' while the SKILL.md metadata and instructions clearly assume these environment variables or equivalent files — this inconsistency should be resolved before trusting automated enforcement that the skill will prompt for or require these secrets correctly.
Persistence & Privilege
always: false (default) and no install step means the skill does not request elevated or permanent presence. It instructs the user to create local config files under ~/.openclaw which is appropriate for configuring agents; it does not attempt to modify other skills or system-wide settings beyond those configs.
Scan Findings in Context
[NO_CODE_FILES_OR_INSTR_ONLY] expected: The regex-based scanner had no code files to analyze; this is an instruction-only skill that operates by directing the user/agent to run CLI commands and edit local config files.
Assessment
This skill appears to do what it says: it helps you run two local OpenClaw agents and configure two Telegram bots. Before installing or following the steps: (1) verify you trust the skill source (homepage is provided in SKILL.md but registry lists none); (2) ensure jq and the openclaw CLI are legitimate and installed from trusted sources; (3) do not paste API keys into public places — follow the recommended auth-profiles.json approach and set file permissions (chmod 600); (4) be aware the registry summary omitted required env vars while the SKILL.md expects them — confirm where the agent will read keys (env vs files) before handing over secrets; (5) prefer interactive onboarding over passing secrets on the CLI to avoid shell-history leakage; and (6) back up your existing ~/.openclaw configs before making changes so you can revert if something misroutes messages or overwrites settings.Like a lobster shell, security has layers — review code before you run it.
latestvk975z6rhym5ye0art8n2svr0zn83vn1p
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🤖 Clawdis
OSmacOS · Linux · Windows
Binsjq
Environment variables
ANTHROPIC_API_KEYrequiredOPENROUTER_API_KEYrequiredTELEGRAM_BOT_TOKENrequired