Discord Connect Wizard

One-machine Discord bot onboarding wizard for OpenClaw. Use when setting up Discord for the first time (create bot, enable intents, invite to a guild, auto-w...

Security Scan

The skill's behavior mostly matches a Discord onboarding wizard, but there are notable mismatches and autonomy instructions that deserve caution (e.g., the code calls the local 'openclaw' binary and expects a browser automation tool but the declared requirements don't list these), so review before installing.

Purpose & Capability

The stated purpose (bootstrapping a Discord bot into OpenClaw) matches the included code and instructions. However the package metadata declares no required binaries or primary credential, yet scripts call the local 'openclaw' executable and expect a browser automation tool. The skill will also accept/persist a Discord bot token and write OpenClaw config — those are appropriate for the purpose but the missing declaration of the 'openclaw' dependency is an incoherence.

Instruction Scope

SKILL.md instructs an agent to fully drive the Discord Developer Portal via a browser tool and to 'self-recover' (restart gateway/browser) on timeouts — giving the agent broad discretion over local actions. The runtime instructions and UI code request the bot token from the user, call Discord APIs, enumerate guilds/users, write config, restart the gateway, and approve pairing. All of these are within the stated onboarding scope, but the requirement that the agent open and control the Developer Portal (do not ask the user) and auto-retry/restart is operationally broad and should be understood prior to use.

Install Mechanism

There is no external install/download; this is instruction-plus-local-scripts only. No remote binaries or extracts are fetched. That minimizes supply-chain risk. The included Node scripts have no npm dependencies and run locally.

Credentials

The skill requests no environment variables in metadata, but the implementation invokes the local 'openclaw' command (execFile) and passes process.env to it. The skill will accept and handle a Discord bot token (a sensitive secret) supplied via the local UI. Requiring a bot token and restarting OpenClaw is proportional to the stated purpose, but the missing explicit declaration that the 'openclaw' binary must be present (and that the agent needs a browser automation capability) is an incoherence and should be corrected. Note: the code claims it will not log the token, but users must trust the included scripts and agent tooling to honor that.

Persistence & Privilege

The skill is not force-included (always:false) and uses normal autonomous invocation. It performs system actions (runs 'openclaw' to set config and restart the gateway) which are appropriate to onboarding but are privileged in that they modify local service state. This is expected for the purpose but worth noting: a malicious skill with similar privileges would have a wide blast radius, so ensure you trust the source.

What to consider before installing

This skill appears to implement an on-machine Discord→OpenClaw onboarding flow, but there are a few things to check before installing: - Confirm you have the local 'openclaw' CLI available: the scripts call 'openclaw config set' and 'openclaw gateway restart' but the skill metadata did not declare this required binary. If 'openclaw' is missing, the scripts will fail. - Understand the secret flow: you will paste your Discord bot token into a local UI; the script says it won't log the token, but you should inspect the included scripts (scripts/wizard.mjs) yourself or run them in an isolated environment to verify they don't transmit the token off-machine. - The agent is instructed to drive the Discord Developer Portal via a browser automation tool and to retry/restart on failures. If you enable autonomous agents or give them browser access, they can open sites and control the local browser — only grant that to agents/tools you trust. - Owner/homepage info is minimal (source unknown, homepage none). Prefer skills from known publishers or inspect the complete scripts before use. Recommended steps: review the two JS files locally, run the wizard in a sandbox or test environment first, ensure 'openclaw' is the expected CLI and that running it with process.env is acceptable, and verify that no network calls in the scripts send the token to unexpected endpoints. If anything is unclear, ask the publisher to explicitly list required binaries (openclaw) and the need for a browser automation tool in metadata.

Discord Connect Wizard (OpenClaw)

Run a localhost setup wizard that minimizes manual Discord steps.

Non-negotiable manual steps (Discord security):

• Complete Discord login / CAPTCHA / 2FA if prompted
• Copy the Bot Token once
• Click OAuth authorize once
• If DM pairing is needed: enable DMs in server privacy settings (Discord-side)

Wizard does:

• Creates a NEW OpenClaw channels.discord.accounts.<accountId> entry (never overwrites existing bots)
• Discovers guild/user IDs
• Writes config via openclaw config set ... --json
• Restarts gateway and approves pairing for that account

Quick start

Conversation mode (recommended)

Use browser automation + chat prompts. No localhost UI required.

Hard requirement: agent opens and drives the Developer Portal via browser tool (do not ask user to open pages or click around). Resilience rule: if the browser tool times out / disconnects, the agent must self-recover (restart gateway/browser as needed) and retry. Only ask the user to click if recovery is impossible. UX rule: whenever the user must act (login/CAPTCHA/MFA/OAuth authorize), send a screenshot + ONE instruction line. If you need a deterministic step list, run:

node scripts/conversation-checklist.mjs

Then follow references/conversation-mode.md.

Localhost UI mode (optional)

cd <skill_dir>
node scripts/wizard.mjs
# open http://127.0.0.1:8787

Workflow

1) Create bot + enable intents (guided)

User steps you will see on screen:

• Welcome to the Developer Portal popup → click Log In (or Create Account)
• Complete any required login / CAPTCHA / 2FA (agent cannot bypass Discord security)

Then (agent-guided):

• Create app → Bot → enable Message Content Intent (required)
• Copy Bot Token (paste into wizard)

2) Invite bot to your server (guided)

Wizard generates an invite URL with scopes:

• bot
• applications.commands

and baseline permissions:

• View Channels, Send Messages, Read Message History, Embed Links, Attach Files (+ Add Reactions optional)

You still need to select the server and click Authorize.

3) Auto-discover IDs (automatic)

• Server ID: fetched from bot guild list after invite (if multiple, pick by name in wizard)
• Your User ID: fetched from your first DM to the bot (“hi”) (no Developer Mode copy/paste)

4) Write OpenClaw config + restart (automatic)

Wizard writes:

• channels.discord.enabled=true
• channels.discord.token=...
• channels.discord.groupPolicy="allowlist"
• channels.discord.guilds.<guildId>.requireMention=false
• channels.discord.guilds.<guildId>.users=["<yourUserId>"]

Then runs openclaw gateway restart.

5) Pairing (semi-automatic)

• You DM the bot once
• Wizard extracts the pairing code and runs openclaw pairing approve discord <CODE>

Browser automation (optional)

If an OpenClaw agent with the browser tool is available, use it to:

• open Developer Portal pages
• scroll to the right sections (Intents, Token, OAuth URL generator)
• capture screenshots of the exact UI that requires user involvement (login/CAPTCHA/2FA, OAuth Authorize)

Do not attempt to bypass CAPTCHA/2FA; pause for manual completion.

Files

• scripts/wizard.mjs: localhost wizard server + OpenClaw config writer
• references/openclaw-discord-baseline.md: official baseline config + troubleshooting pointers