StockLobster

Monitor StockLobster webhook alerts through OpenClaw and route screened stock signals to chat channels such as Telegram. Use when setting up, documenting, te...

Security Scan

The skill's instructions match its stated purpose (routing StockLobster webhooks into OpenClaw and delivering to Telegram); only minor metadata/documentation mismatches were found.

Purpose & Capability

Name and description align with the instructions: the SKILL.md describes hooking StockLobster webhooks into the OpenClaw hooks gateway and delivering to Telegram. All actions are consistent with that purpose.

Instruction Scope

Instructions legitimately reference the OpenClaw config (~/.openclaw/openclaw.json), hook tokens, and restarting the 'openclaw' gateway. These are within scope for wiring webhooks, but the runtime steps require editing a user config file and using a hooks token/Telegram chat ID (placeholders used). The SKILL.md does not ask for unrelated files or external endpoints beyond OpenClaw/Telegram.

Install Mechanism

Instruction-only skill with no install spec and no code files. No downloads or package installs are requested, which minimizes install-time risk.

Credentials

The skill does not declare any required environment variables or primary credential, yet runtime guidance clearly expects a hooks token and a Telegram chat id (and assumes the 'openclaw' CLI/gateway). This is reasonable for the described task, but the registry metadata should have declared the config path and expected credentials so users know what secrets/configs are needed.

Persistence & Privilege

The skill advises editing the agent's user config (~/.openclaw/openclaw.json) and restarting the gateway. Modifying the agent's own config is expected for a hooks mapping, but the metadata did not declare the config path. always:false and default autonomous invocation are appropriate.

Assessment

This skill appears to do what it says: wire StockLobster webhooks into OpenClaw and deliver to Telegram. Before using it: 1) Confirm you have the 'openclaw' CLI and know how to restart the gateway; 2) Back up ~/.openclaw/openclaw.json before editing; 3) Use a dedicated, least-privilege hooks token (do not reuse a master/shared token); 4) Verify the Telegram chat ID is correct and that the token/credentials used for Telegram are scoped appropriately; 5) Ask the publisher for a homepage/source if you need provenance—metadata currently lacks a source. The main inconsistency is missing metadata: the skill's runtime depends on editing a config path and using tokens but the registry entry did not declare those requirements. That mismatch is worth asking the author to correct but does not by itself indicate malicious behavior.

Use this skill to wire StockLobster alerts into OpenClaw through the hooks gateway and deliver them to Telegram or another supported outbound channel.

Confirmed payload shape

Read references/payload-format.md for the confirmed payload schema and examples.

Recommended OpenClaw hook mapping

Use an agent mapping, not wake, when the goal is direct Telegram delivery.

Sanitized example:

{
  "hooks": {
    "enabled": true,
    "path": "/hooks",
    "token": "<HOOKS_TOKEN>",
    "mappings": [
      {
        "id": "stocklobster-ingest",
        "name": "StockLobster ingest",
        "match": {
          "path": "/stocklobster",
          "method": "POST"
        },
        "action": "agent",
        "wakeMode": "now",
        "agentId": "main",
        "sessionKey": "hook:stocklobster",
        "messageTemplate": "{{payload.text}}",
        "deliver": true,
        "channel": "telegram",
        "to": "<TELEGRAM_CHAT_ID>"
      }
    ]
  }
}

Setup

1. Enable hooks in ~/.openclaw/openclaw.json.
2. Set a dedicated hooks token, not the shared gateway token.
3. Use hook path /hooks and mapping path /stocklobster so the endpoint becomes:
   • http://<HOST>:18789/hooks/stocklobster
4. Use messageTemplate, not textTemplate, because this flow should use action: "agent" for channel delivery.
5. Reference incoming webhook fields through payload, for example {{payload.text}}.
6. Set:
   • deliver: true
   • channel: "telegram"
   • to: "<TELEGRAM_CHAT_ID>"
7. Restart the gateway after config changes:

openclaw gateway restart

Testing with curl

curl -X POST 'http://<HOST>:18789/hooks/stocklobster' \
  -H 'Authorization: Bearer <HOOKS_TOKEN>' \
  -H 'Content-Type: application/json' \
  -d '{"text":"StockLobster alert\nSymbol: TEST\nEvent: screen_hit\nMessage: TEST hit momentum criteria\nPrice: 4.92\nChange: 3.4%\nVolume: 1234567\nStrategy: momentum\nTimestamp: 2026-04-08T02:21:00.000Z"}'

Expected response:

{"ok":true,"runId":"<RUN_ID>"}

If you only want to wake a session and not push to Telegram immediately, use action: "wake" with textTemplate, but that is a different flow.

Troubleshooting

• hook mapping requires text
  • For wake, the rendered textTemplate was empty.
  • For agent, the rendered messageTemplate was empty.
  • In this OpenClaw build, templates resolve against payload, not json.
• Hook accepted but no Telegram message arrived
  • Check that the mapping uses action: "agent".
  • Check deliver: true.
  • Check channel and to are set explicitly.
  • Restart the gateway after editing config.
• Hook returns {"ok":true,"mode":"now"}
  • That indicates a wake event, not necessarily an outbound Telegram delivery.
• Hook returns {"ok":true,"runId":"..."}
  • That indicates an agent run was created for delivery-capable handling.