PrivaClaw

Secure outbound-only relay for remote OpenClaw control — no exposed ports, no SSH, no Telegram.

Security Scan

The skill's code and declared requirements mostly match its stated purpose (an outbound-only relay), but there are several implementation and documentation mismatches and trust assumptions you should understand before installing.

Purpose & Capability

The skill's name/description line up with the code: it opens an outbound WebSocket, authenticates with a token, sends heartbeats, and forwards relay commands to the host runtime. The three required env vars (relay URL, node id, auth token) are proportional to the purpose. Minor mismatch: SKILL.md was presented as an instruction-only skill in registry metadata, but the package actually includes TypeScript source files (relayClient.ts, config.ts, etc.), so it's not purely instruction-only.

Instruction Scope

SKILL.md claims the token is sent 'during the WebSocket handshake' and that all connections use TLS; the implementation actually sends the token as a post-open message and validateConfig will happily convert an http:// URL to ws:// (non-TLS). The skill also relies on the host-provided OpenClawRuntime API to execute prompts, workflows, and restart the process — this grants remote callers the ability to run declared workflows and restart the runtime, which is expected but requires you to trust the relay operator and to ensure workflows are properly scoped. The SKILL.md also asserts the relay does not persist data — that is a policy claim by the relay operator, not something enforced locally.

Install Mechanism

There is no install script or external download; the package provides TypeScript source and tests. That keeps install risk low (no arbitrary third-party binaries), but because code ships with the skill, it will run inside your agent's environment. Review the code before enabling.

Credentials

Only three env vars are required (RELAY_URL, NODE_ID, AUTH_TOKEN) and AUTH_TOKEN is declared as the primary credential — this is proportional. Small inconsistencies: code expects lowercase keys in the config object (relay_url/node_id/auth_token) while SKILL.md and registry list uppercase env var names; your platform likely maps them, but confirm. No other credentials or paths are requested.

Persistence & Privilege

The skill is not always-enabled and does not request system-wide configuration changes. It can be invoked autonomously by the agent (default) which is normal for skills. It does not persist credentials or write to other skills' configs in the provided code.

What to consider before installing

Before installing: (1) Treat the relay operator as highly trusted — this skill transmits prompt content and streamed tokens to that remote relay. Verify the relay URL (prefer an operator you control or audited code). (2) Enforce TLS: provide a wss:// URL; note the code will accept ws:// if you give an http:// URL, and the token is sent in a post-open message (not as a WebSocket subprotocol/header). (3) Use a scoped, revocable AUTH_TOKEN and limit its lifetime/permissions on the relay side. (4) Review the shipped TypeScript (relayClient.ts, config.ts) to confirm behavior matches your expectations (especially restart and workflow semantics) and to ensure there are no hidden endpoints. (5) Run the skill in a controlled environment first (network egress rules, minimal privileges) and consider self-hosting the relay if you need stronger guarantees about persistence and data handling. If you want higher assurance, ask the maintainer for the relay server code or run your own relay implementation.

Enables secure remote communication between an OpenClaw instance and a relay server without exposing ports, requiring SSH, or relying on Telegram/Discord.

Description

The PrivaClaw skill registers your local OpenClaw instance as a managed remote node on a relay network. Once connected, the node can receive prompts, execute workflows, report health, and be restarted — all through a secure, outbound-only WebSocket channel.

This skill replaces external messaging-based control layers such as Telegram or Discord with a native, secure relay channel for OpenClaw interaction.

Node Lifecycle

When the skill is enabled, the OpenClaw instance registers as a remote-capable node with the relay and maintains an active session.

The node can be in one of three states:

State	Description
Online	Authenticated and accepting relay commands
Reconnecting	Connection lost; auto-reconnecting with exponential backoff
Offline	Skill disabled or relay unreachable after max retries

Relay commands are only accepted while the node is authenticated and online. Commands received during reconnection are discarded by the relay.

Capabilities

Capability	Description
remote_chat	Receive and execute prompts remotely, streaming tokens back in real time
remote_status	Report node health: uptime, active tasks, last error, connection state
remote_restart	Safely restart the OpenClaw process without manual intervention. Pending executions are cancelled and reported before restart occurs.
remote_trigger	Execute OpenClaw workflows/tasks triggered remotely

Remote commands are limited to declared capabilities and cannot execute arbitrary system-level operations.

Configuration

Key	Required	Description
relay_url	✅	WebSocket URL of the relay server
node_id	✅	Unique identifier for this OpenClaw node
auth_token	✅	Secret token for authenticating with the relay

Message Protocol

Incoming (Relay → Node)

type	Action
prompt	Execute via OpenClaw prompt runner, stream response tokens back
status	Return node health payload
restart	Cancel pending tasks, report them, then gracefully restart
workflow	Execute a named OpenClaw task/workflow

Outgoing (Node → Relay)

• Heartbeat (every 15s):

  { "node_id": "...", "uptime": 3600, "active_tasks": 2, "last_error": null, "connection_state": "online" }
  

• Response stream: { "type": "token", "request_id": "...", "content": "..." } per token
• Response complete: { "type": "done", "request_id": "..." }
• Status: Full heartbeat payload with request_id

External Endpoints

Endpoint	Protocol	Data Sent	Data Received
wss://<relay_url>/connect	WebSocket (TLS)	auth_token, node_id, heartbeat payloads, prompt response tokens	Relay commands: prompt, status, restart, workflow

No other external endpoints are contacted. All network activity is limited to the configured relay_url.

Security & Privacy

What leaves your machine

• auth_token — sent once during the WebSocket handshake to authenticate the node
• node_id — sent with every heartbeat and response to identify the node
• Heartbeat data — uptime (seconds), active task count, last error string, connection state
• Prompt response tokens — streamed back to the relay in response to prompt commands
• Workflow completion status — success/error for triggered workflows

What stays on your machine

• All local AI model execution and inference
• Local file system contents — never read or transmitted
• Environment variables (other than the three declared above)
• System information, IP addresses, or hardware details — never collected

Network posture

• Outbound only — the skill never opens a listening port or accepts inbound connections
• TLS encrypted — all WebSocket connections use wss:// (TLS 1.2+)
• No data persistence — the relay server does not store prompt content or response tokens; it forwards in real time

Trust Statement

By installing this skill, you are connecting your OpenClaw instance to an external relay server at the configured relay_url. Prompt content and response tokens are transmitted through this relay in real time. Only install this skill if you trust the operator of the relay server. The default relay (wss://relay.privaclaw.com) is operated by the project maintainers.

Operational Guarantees

• Local AI execution continues even if the relay disconnects
• Relay does not expose the node to inbound traffic
• Remote actions are capability-scoped — only declared capabilities can be invoked
• Pending tasks are reported before any restart occurs — no silent failures

Installation

Easiest way — use the visual setup wizard:

👉 Open your dashboard and go to /skill/privaclaw to configure everything through the UI — generate a node ID, test your connection, and export your config in one place.

Or configure manually:

1. Add the skill to your OpenClaw instance
2. Configure relay_url, node_id, and auth_token
3. Start OpenClaw — the relay connection is established automatically

Intended Use

This skill replaces external messaging-based control layers such as Telegram or Discord with a native, secure relay channel for OpenClaw interaction. It is designed for teams and individuals who need reliable remote access to their OpenClaw nodes without exposing infrastructure.