English Bestie

ReviewAudited by ClawScan on May 10, 2026.

Overview

English Bestie appears to be a real Telegram English tutor, but its setup can change workspace-wide agent files and it creates persistent scheduled messaging, so it should be isolated before use.

Install this only if you want a proactive tutor that messages through Telegram many times per day. Use a dedicated OpenClaw workspace and dedicated Telegram bot, back up workspace files before running install.py, review or disable the cron jobs after onboarding, and protect both the Telegram bot token and the student tracking files.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing into an existing workspace could replace the agent’s existing personality or heartbeat behavior and affect future sessions beyond English lessons.

Why it was flagged

When the skill directory is absent, the installer copies workspace-level SOUL.md and HEARTBEAT.md files without checking whether they already exist. These files can affect the whole OpenClaw workspace, not just this skill.

Skill content
if not skills_dir.exists(): ... for fname in ["SOUL.md", "HEARTBEAT.md"]: ... shutil.copy(src, workspace_dir / fname)
Recommendation

Use a dedicated new workspace for this skill, back up SOUL.md, HEARTBEAT.md, and openclaw.json before running the installer, and change the installer to skip or prompt before overwriting existing workspace files.

What this means

The student may receive many automated messages per day and the setup may continue using TTS/API resources until the cron jobs or skill are disabled.

Why it was flagged

The skill is designed to remain active and create recurring scheduled jobs. This is disclosed and purpose-aligned, but it means the agent will keep initiating Telegram contact.

Skill content
always: true ... Schedule all 12 daily cron jobs using `openclaw cron add` ... permanent standing jobs (no `--delete-after-run`)
Recommendation

Review the cron jobs after onboarding, delete any schedules you do not want, and keep the skill in a dedicated agent/workspace.

What this means

Anyone who can read or misuse the OpenClaw config may be able to control the Telegram bot or send messages as it.

Why it was flagged

The installer collects a Telegram bot token and writes it into openclaw.json with an allowed user list. This is expected for a Telegram tutor bot, but it is still a credential with messaging authority.

Skill content
bot_token = ask("Bot token") ... config.setdefault("telegram", {})[channel_key] = {"token": bot_token, "allowedUsers": [...]}
Recommendation

Use a dedicated Telegram bot token, restrict allowedUsers, protect openclaw.json file permissions, and rotate the bot token if you uninstall or suspect exposure.

What this means

Personal details, learning history, mistakes, and conversation summaries may remain in local tracking files and influence future lessons.

Why it was flagged

The skill persistently stores personal profile and learning data so it can personalize future lessons. This is expected, but it creates retained local memory.

Skill content
write them to `{baseDir}/tracking/student-profile.json` (fields: `name`, `nativeLanguage`, `job`, `hobbies`, `dream`, `interests`).
Recommendation

Inspect and delete tracking files when needed, avoid sharing sensitive personal information with the tutor, and use a dedicated workspace for the student’s data.