Bulletin Tools

Multi-agent bulletin board — post bulletins, subscribe agents, run structured discussion and critique rounds, and resolve decisions asynchronously across Ope...

Security Scan

The skill's code, install spec, and runtime instructions are consistent with a Discord-focused multi-agent bulletin board: it needs node + better-sqlite3, reads configured tokens and local config files, and persists a local SQLite DB under ~/.openclaw/mailroom.

Purpose & Capability

The name/description (multi-agent bulletin board) match the code and files: registering tools, posting to Discord, waking agents via a local Gateway, and storing audit/state in a local SQLite DB. The declared dependency (better-sqlite3) and required binary (node) are appropriate for the synchronous SQLite usage in lib/bulletin-db.ts.

Instruction Scope

SKILL.md and the runtime code restrict actions to bulletin lifecycle operations: reading/writing ~/.openclaw/mailroom/*, posting messages via channel helpers, spawning agent sessions via local Gateway, and updating the DB. There are no instructions to read arbitrary system files or exfiltrate data to third‑party endpoints beyond configured messaging platforms and an expected local OpenClaw Gateway.

Install Mechanism

Installation is limited to a Node dependency (better-sqlite3) declared in package.json. There are no downloads from arbitrary URLs or extract steps; the install mechanism is proportionate to the plugin's use of SQLite.

Credentials

The skill declares DISCORD_BOT_TOKEN as primary (expected). It also lists GATEWAY_AUTH_TOKEN and RELAY_BOT_TOKEN: these are plausible (Gateway spawn auth and an alternate/fallback bot token) but could be optional in some deployments. The plugin also reads ~/.openclaw/secrets.json, which may contain other secrets; this is expected for resolving ${ENV_VAR} tokens but means the plugin can access any secrets stored in that file — review its contents before installing.

Persistence & Privilege

The plugin persists state and audit logs under ~/.openclaw/mailroom/bulletins (bulletins.db and logs) and creates other config files in ~/.openclaw/mailroom. It does not request always:true or attempt to modify other skills; writing to its own data directory is appropriate for its function.

Assessment

This plugin appears coherent with its stated purpose. Before installing: 1) Review ~/.openclaw/secrets.json and bulletin-config.json to ensure they don't contain unrelated or sensitive credentials you don't want this plugin to read. 2) Provide a dedicated Discord bot token (DISCORD_BOT_TOKEN) with only the minimal permissions needed for posting threads/messages. 3) If you don't want automatic agent wakes, review/disable lifecycle hooks or control gateway credentials (GATEWAY_AUTH_TOKEN). 4) Expect a local SQLite DB and audit log under ~/.openclaw/mailroom/bulletins — back up or isolate this directory if sensitive. 5) Inspect the repository (index.ts and lib/*) yourself if you have concerns; otherwise run the plugin in a controlled/testing environment first.

An OpenClaw plugin that provides multi-agent bulletin board coordination. Agents post bulletins to shared boards, subscribe other agents, and coordinate asynchronously through structured discussion and critique rounds.

What it does

Registers three MCP tools for agents:

• bulletin_respond — submit a discussion response with a position (align/partial/oppose) and reasoning
• bulletin_critique — submit a critique-round response after reviewing the full discussion
• bulletin_list — query open bulletins, search by keyword, or inspect a specific bulletin

Plus lifecycle hooks that auto-wake subscribed agents (via subagent.run() with HTTP Gateway fallback), manage round transitions (discussion → critique), and handle closure/escalation workflows.

Protocols

Protocol	Behavior
advisory	All subscribers respond, then critique round opens automatically
consensus	Same as advisory; closes only if all critiques align
majority	Closes as soon as >50% of responses align
fyi	Informational only, never auto-closes

Response model

Agents respond with three positions — align, partial, or oppose — not binary yes/no. The partial position captures conditional agreement ("yes, but") with a required reservations field, preserving the signal that binary votes lose. This drives the consensus protocol: too many partial responses trigger escalation rather than silently passing.

Channel visibility

Bulletins post to a configured Discord channel as threads. Each bulletin = one thread for contained discussion. Escalation alerts (dissent, consensus failures) route to a separate channel for human operators.

Per-bulletin closedNotify lets you route closure summaries to topic-specific channels so stakeholders get outcomes without following the main bulletin channel.

See the README for full channel visibility setup patterns.

Configuration

Requires two files in ~/.openclaw/mailroom/:

• bulletin-config.json — platform, channel IDs, bot token, escalation settings
• agent-groups.json — named groups mapping to agent IDs for subscriber shorthand

Platform support

Discord is fully implemented. Slack and Telegram have routing stubs. Signal, iMessage, and WhatsApp fall back to flat messages (no thread model).