OpenClaw 新手训练营

PassAudited by ClawScan on May 12, 2026.

Overview

This is a coherent onboarding tutorial skill; it does ask the agent to demonstrate real searches, file writes, scheduled reminders, and OpenClaw configuration views, but those actions are disclosed and aligned with the training purpose.

This skill appears safe for onboarding if you are comfortable with it creating a practice notes.md file, setting a reminder or cron task, storing progress, and showing OpenClaw skills/channel information. Use it in a private or trusted chat and clean up any practice files, memory, or cron tasks afterward if desired.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may create a test file, perform a web search, and create a reminder task while teaching the user.

Why it was flagged

The tutorial intentionally exercises web search, file read/write, and cron tools. This is purpose-aligned, but these are real actions rather than purely simulated lessons.

Skill content
“agent 执行搜索并展示结果” / “成功完成一次文件写入和读取” / “成功创建并确认一个 cron 任务”
Recommendation

Use non-sensitive practice content, keep file writes in the workspace, and review any cron tasks created during the lesson.

What this means

A reminder or daily task may continue running until removed.

Why it was flagged

Scheduled tasks can continue after the current chat. The artifact presents them as user-requested training exercises, not hidden background behavior.

Skill content
“让用户试着创建一个简单的定时任务,比如 \"5分钟后提醒我喝水\"” and “每天早上 8 点提醒我天气,同时搜索当天AI新闻”
Recommendation

After the bootcamp, list and delete any practice cron tasks you no longer want.

What this means

People in the chat may learn which skills or channels are connected to the OpenClaw setup.

Why it was flagged

The skill needs OpenClaw environment information to teach skills and channel connections. This is aligned with the purpose, but it can expose local configuration details to the conversation.

Skill content
“requires”: { “config”: [“agents.list”] } ... “展示已安装的技能列表” ... “展示当前已连接的渠道”
Recommendation

Run the bootcamp in a trusted or private channel if your installed skills or channel connections are sensitive.

What this means

Bootcamp progress and a user identifier may persist across sessions.

Why it was flagged

The skill stores per-user bootcamp progress in memory, including a channel/user identifier. This is disclosed and limited to progress tracking.

Skill content
“每关完成后,在 memory 中记录进度” with “userId”: “<channel>:<userId>”
Recommendation

Use the provided reset option if you want to clear progress, and avoid adding unnecessary personal details during the tutorial.

What this means

The packaged metadata may be stale, but no runnable code or hidden dependency is present in the provided artifacts.

Why it was flagged

The registry metadata supplied for review says version 1.3.0, while the bundled _meta.json says 1.2.0. With no code or install script, this appears to be a low-impact metadata inconsistency.

Skill content
“version”: “1.2.0”
Recommendation

Publisher should align _meta.json with the registry version for clearer provenance.