Colmena Manager

Manage and monitor multiple OpenClaw agents simultaneously, including status checks, messaging, logs, pausing, resuming, and workspace management.

Security Scan

The skill broadly matches its stated purpose (managing OpenClaw agents) but contains mismatches and risky practices (unsanitized shell execs, hard-coded paths, missing HEARTBEAT.md, and a few code/runtime issues) that make its behavior unclear and potentially dangerous without code review and mitigation.

Purpose & Capability

The name/description (manage/monitor OpenClaw agents) align with the APIs and operations used (agents_list, sessions_list, sessions_send, message, exec/process). However the implementation uses hard-coded local paths (/home/nvi/.openclaw/...), direct filesystem manipulation (mkdir, rm -rf), and shell commands; those are plausible for workspace management but the hard-coded user path and destructive file operations are surprising and deserve scrutiny.

Instruction Scope

SKILL.md and the code instruct the agent to run many shell commands (tail, ls, ps, awk, mkdir, rm -rf). Several commands interpolate agent IDs or user-provided workspace names directly into shell commands (possible command injection). SKILL.md also claims a HEARTBEAT.md runs automatically every 30 minutes, but that file is not present in the manifest; the docs suggest scheduling cron jobs, which would make periodic/automatic execution possible — this scheduling and the broad file-system/process checks expand scope beyond one-off management actions.

Install Mechanism

No install spec in registry (instruction-only), and install instructions are just normal clawhub/npm commands. There are no remote downloads or extract-from-URL steps. This is low installation risk, but the package contains executable JS code that will be installed with the skill (no build or validation step).

Credentials

The skill declares no required credentials (good), but it performs privileged local actions: reading logs under /home/nvi/.openclaw/sessions/*, listing and removing workspace directories, and running process inspection commands. Those operations are proportionate to agent management but require filesystem and process access; combined with unsanitized shell interpolation they create a path for command injection or accidental destructive operations. The hard-coded /home/nvi path is also brittle and unexpected.

Persistence & Privilege

always:false (ok). However SKILL.md asserts a HEARTBEAT.md will be executed every 30 minutes (and suggests cron), implying periodic autonomous execution. The repository does not include HEARTBEAT.md in the manifest, so there's an inconsistency: either the skill expects to be scheduled externally (user-added cron) or claims an automatic heartbeat that isn't present. Periodic execution plus unmanaged shell commands and rm -rf increases risk if enabled by the user.

What to consider before installing

This skill generally does what its name says (manage a group of OpenClaw agents), but I recommend NOT installing it into production without review. Key concerns: (1) Several exec() shell commands build command lines by concatenating agent IDs or workspace names directly—this can lead to command injection if those values are controlled or malformed. (2) The skill performs destructive filesystem operations (rm -rf on workspaces) and reads files under /home/nvi/.openclaw; verify the hard-coded path and ensure the process runs with least privilege. (3) SKILL.md mentions a HEARTBEAT.md that runs every 30 minutes but that file is not present—verify how periodic checks will actually be scheduled (cron vs. built-in). (4) The source has some runtime/formatting issues (TypeScript-like 'interface' in a JS file and a likely syntax error in the healthCheck repeat line), suggesting it may fail or behave unexpectedly. Before installing: review and sanitize all uses of exec/command construction, remove or protect destructive operations, confirm scheduling behavior, test in an isolated sandbox, and consider requesting a fixed, configurable workspace path instead of /home/nvi. If you lack the ability to audit the code, treat this skill as risky.

Skill para gestionar y coordinar agentes de OpenClaw como una colmena.

📋 Descripción

Colmena Manager permite monitorear, comunicar y gestionar todos los agentes de la colmena desde una única interfaz. Ideal para mantener el control de múltiples instancias de OpenClaw corriendo en diferentes workspaces o contextos.

🔧 Comandos CLI

status [agent]

Muestra el estado de todos los agentes o uno específico.

Opciones:

• agent (opcional): ID del agente específico a consultar

Ejemplo:

colmena-manager status
colmena-manager status main

broadcast <msg>

Envía un mensaje a todos los agentes de la colmena.

Ejemplo:

colmena-manager broadcast "Reunión de sincronización en 10 minutos"

logs <agent> [lines]

Muestra las últimas líneas del log de un agente.

Opciones:

• agent (requerido): ID del agente
• lines (opcional, default: 50): Número de líneas a mostrar

Ejemplo:

colmena-manager logs vision --last 100
colmena-manager logs healer 25

pause <agent>

Pausa temporalmente un agente.

Ejemplo:

colmena-manager pause nemotron

resume <agent>

Reanuda un agente previamente pausado.

Ejemplo:

colmena-manager resume vision

health-check

Realiza una verificación completa del estado de salud de todos los agentes (procesos, sesiones, memoria).

Ejemplo:

colmena-manager health-check

workspace

Comandos para gestionar workspaces de agentes:

• workspace list: Lista todos los workspaces disponibles
• workspace create <name>: Crea un nuevo workspace
• workspace remove <name>: Elimina un workspace

Ejemplo:

colmena-manager workspace list
colmena-manager workspace create project-x
colmena-manager workspace remove old-workspace

🔌 Integración con OpenClaw APIs

La skill utiliza las siguientes APIs nativas:

• agents_list(): Descubre todos los agentes registrados
• sessions_list(): Consulta sesiones activas por agente
• sessions_send(): Envía comandos/mensajes a agentes específicos
• message(): Para broadcasts externos a través de canales
• exec / process: Para health checks y diagnósticos del sistema

🔄 HEARTBEAT.md

La skill incluye un archivo HEARTBEAT.md que se ejecuta automáticamente cada 30 minutos para:

• Verificar el estado de todos los agentes
• Detectar agentes caídos
• Monitorear uso de memoria
• Generar reportes de salud

Esto permite mantener la colmena vigilada sin intervención manual.

📦 Instalación

# Instalar desde clawhub
clawhub install colmena-manager

# O desde el directorio fuente
npm install /path/to/colmena-manager

🚀 Publicación

Para publicar una nueva versión en clawhub.com:

cd colmena-manager
clawhub publish

📁 Estructura del proyecto

colmena-manager/
├── package.json
├── claws.json          # Manifiesto para clawhub
├── SKILL.md            # Documentación (este archivo)
├── README.md           # Detalles técnicos
├── src/
│   └── index.js        # Implementación principal
└── HEARTBEAT.md        # Scripts automáticos de monitoreo

🔄 Compatibilidad

• OpenClaw >= 1.0.0
• Node.js >= 18
• Linux/macOS/Windows

📝 Ejemplos de uso

1. Monitorizar toda la colmena

colmena-manager status

2. Ver logs de un agente

colmena-manager logs main 100

3. Broadcast urgente

colmena-manager broadcast "SISTEMA EN MANTENIMIENTO - PAUSA INMINENTE"

4. Health check programado

# Agregar a cron cada 30min
*/30 * * * * colmena-manager health-check >> /var/log/colmena-health.log

⚠️ Consideraciones

• Los agentes deben estar corriendo y registrados para que los comandos funcionen
• pause y resume envían señales que cada agente debe manejar individualmente
• Los workspaces son directorios locales bajo /home/nvi/.openclaw/workspace-*
• Asegurar permisos de ejecución en el script principal