Connector

Deprecated legacy connector skill. Use @launchthatbot/connect-openclaw-plugin for all new LaunchThatBot OpenClaw connect flows with configurable permissions.

Security Scan

The skill's code and runtime instructions are coherent with its stated purpose (a connector that emits canonical events to LaunchThatBot); the main issues are small documentation/metadata inconsistencies you should be aware of before installing.

Purpose & Capability

Name/description, SKILL.md, README, and the TypeScript implementation align: the package creates an auth link, posts heartbeats and event batches to LaunchThatBot, supports optional HMAC signing, and persists a local queue. However, the registry metadata declares no required environment variables while the runtime expects an ingest token (LAUNCHTHAT_INGEST_TOKEN by default or via file/prompt) and optionally a signing secret. That metadata omission is an inconsistency but not a functional mismatch.

Instruction Scope

SKILL.md promises outbound-only network calls, no shell execution, and no arbitrary filesystem reads. The code respects those boundaries: it only performs HTTPS POSTs to baseUrl-derived endpoints, does not spawn subprocesses, and only reads/writes the configured queue file and explicit secret file(s) or env vars. Minor docs inconsistency: one doc line references OPENCLAW_SIGNING_SECRET while examples and the CLI default use LAUNCHTHAT_SIGNING_SECRET.

Install Mechanism

There is no install spec (instruction-only) so nothing will be downloaded or written by an installer. Source files are present in the skill bundle, but the package relies on a normal TypeScript build (tsc) when published. No remote/external download URLs or archive extraction are present.

Credentials

The skill legitimately needs an ingest token and (optionally) a signing secret to operate and writes a local queue file in ~/.config/launchthat-openclaw/queue.json by default. Those are proportionate to the connector's purpose. The inconsistency is that required env vars were not declared in registry metadata; otherwise no unrelated credentials are requested.

Persistence & Privilege

The skill does not request permanent platform-wide presence (always:false). It persists a local queue file under the user's home config directory with restrictive modes and does not modify other skills or global agent config. Autonomous invocation (model invocation allowed) is the default platform behavior and is not a standalone concern here.

Assessment

This connector appears to do what it says: send canonical events and heartbeats to a LaunchThatBot base URL, optionally sign requests, and persist a local queue. Before installing, verify the package origin (source repo/homepage is missing here), prefer the newer recommended plugin (@launchthatbot/connect-openclaw-plugin), and confirm the ingest token and signing secret handling meets your policies. Note the metadata omission: the runtime requires an ingest token (LAUNCHTHAT_INGEST_TOKEN by default) even though the registry entry lists no required env vars. Also check and agree with the default queue path (~/.config/launchthat-openclaw/queue.json) or set --persist-queue=false if you don't want local persistence. If you need higher assurance, review the published npm package contents and signature (or verify the package from the official LaunchThatBot repo) before deploying in production.

LaunchThat OpenClaw Connector

Deprecated: this skill is being phased out. Use @launchthatbot/connect-openclaw-plugin instead.

When to use this skill

Use this skill when you need to:

• connect an existing OpenClaw VPS to LaunchThatBot,
• configure secure ingest token + request signing,
• validate heartbeat/ingest/replay behavior,
• troubleshoot connection, auth, or payload issues.

Do not use this skill for:

• deploying OpenClaw infrastructure,
• managing unrelated bot runtime logic,
• reading local secrets outside explicitly provided token/secret inputs.

Security boundaries

• Outbound-only network calls to LaunchThatBot API endpoints.
• No shell execution from connector runtime.
• No arbitrary filesystem reads (only explicit token/secret files and optional queue file).
• Canonical event schema only (agent_status_changed, agent_moved_room, task_started, task_completed, room_updated).
• Optional HMAC request signing with timestamp skew checks.

Source-of-truth policy

• Connector implementation changes must be made in this monorepo package: packages/launchthat-openclaw-connector.
• The mirrored launchthatbot/connect repo is a distribution mirror, not a primary authoring surface.
• Use the sync workflow/runbook to propagate updates and avoid multi-writer divergence.

Quick setup workflow

1. Create auth link:

lt-openclaw-connect auth-link \
  --base-url=https://app.launchthatbot.com \
  --workspace-id=default \
  --instance-name=my-openclaw

2. Open returned authUrl, capture:

   • instanceId
   • ingestToken

3. Export secrets:

export LAUNCHTHAT_INGEST_TOKEN="<token>"
export LAUNCHTHAT_SIGNING_SECRET="<shared-signing-secret>"

4. Run connector:

lt-openclaw-connect run \
  --base-url=https://app.launchthatbot.com \
  --workspace-id=default \
  --instance-id=<instanceId>

Operational checks

• Heartbeat endpoint returns 200.
• Ingest endpoint returns ok: true.
• Replay endpoint returns recent events.
• LaunchThatBot dashboard reflects active connected instance.

Common troubleshooting

• 401 Invalid token: refresh callback and rotate ingest token.
• 401 Invalid request signature: verify OPENCLAW_SIGNING_SECRET and clock skew.
• 429 Rate limit exceeded: reduce burst size/retry cadence.
• No UI updates: verify replay endpoint contains events for current instance/workspace.

Additional resources

• Setup/security details: README.md
• Security policy and disclosure: SECURITY.md
• ClawHub listing content: CLAWHUB_LISTING_TEMPLATE.md
• Publish flow: CLAWHUB_PUBLISH_RUNBOOK.md