Opclawtm Skill

opclawtm 让用户通过 CLI 快速构建 AI Agent 团队协作网络。一键创建团队、接入飞书群聊、编排任务工作流——管理者分配任务、执行者完成工作、审核者验收成果。内置预设资料库，开箱即用。基于 OpenClaw 平台的完整团队协作解决方案。

Security Scan

The skill's stated purpose (a CLI to set up team collaboration) is largely consistent with its instructions and npm install, but there are notable inconsistencies and a few instructions that ask the agent to read local logs and reference an undeclared binary, so proceed with caution.

Purpose & Capability

Name/description (team collaboration via opclawtm CLI) matches the declared requirement to have the opclawtm binary and an npm install of package 'opclawtm'. This is coherent. However, multiple documents reference 'openclaw' (e.g., 'openclaw gateway', ~/.openclaw/ paths), which is inconsistent with the declared binary 'opclawtm' and the install target. That mismatch could be a harmless typo or indicate the instructions expect another tool/daemon that isn't declared.

Instruction Scope

Most runtime instructions stay within the expected scope (install, version, license, list-agents, guiding user to use TUI). But the skill explicitly instructs the agent to read local logs (cat ~/.openclaw/logs/gateway.log | grep "ou_") to extract user Open IDs — this touches user-specific files and potentially sensitive identifiers. The instruction set also tells the agent to guide users through creating third-party (Feishu) apps and to have users paste App ID/App Secret into the TUI; although the skill forbids the agent from creating bots or doing TUI business actions itself, the log-reading and secret-handling steps are delicate and worth flagging. The 'openclaw' vs 'opclawtm' command discrepancy also appears inside instructions (gateway startup) and is unexplained.

Install Mechanism

Install is via npm package 'opclawtm' which is the expected way to install a CLI Node package. This is a typical install mechanism (moderate risk compared to direct downloads). There is no direct download URL or extract step. The registry/package owner is not detailed here — verify the npm package and homepage before installing.

Credentials

The skill does not declare or request environment variables or credentials in the metadata, which aligns with a CLI helper. However, instructions require reading local logs (~/.openclaw/logs/gateway.log) to extract Open IDs and instruct the user to copy App Secret values into the TUI — both involve sensitive data. No external credentials are requested by the skill itself, but the agent is asked to access user-local artifacts which may contain secrets/IDs.

Persistence & Privilege

The skill does not request always:true and has no elevated persistence. It's instruction-only and relies on an external CLI; it does not modify other skills or system-wide agent configs per the provided files.

What to consider before installing

This skill mostly does what it says: install the opclawtm CLI and guide a user through TUI-based setup of teams and Feishu bots. Before installing or using it, verify the npm package 'opclawtm' and the homepage (look up the package on the npm registry and check opclawtm.com) to ensure they are legitimate. Be aware of these issues: (1) the docs reference a different binary and paths ('openclaw' and ~/.openclaw) — ask the maintainer to clarify or confirm if that is a typo; (2) the skill's instructions tell the agent to read local logs (~/.openclaw/logs/gateway.log) to find user IDs — only allow that if you consent to exposing those local identifiers; (3) the workflow requires creation of Feishu App ID/App Secret and pasting them into the TUI — never paste secrets into chat or third-party places; perform secret entry only in the official TUI and do not let the agent transmit them elsewhere; (4) test license/activation flows and any 'test codes' (the Douyin contact) cautiously — prefer official channels. If any of these points worry you, inspect the npm package contents manually before installing and run commands yourself rather than letting the agent execute them autonomously.

opclawtm CLI 工具操作指南

此 Skill 指导你（AI Agent）如何帮助用户完成 opclawtm 相关任务。

---

⚠️ 核心原则（必须遵守）

区分两类操作：

类型 A：环境准备（你可以执行）

这些操作你可以直接帮助用户执行：

• 安装 Node.js
• 安装 opclawtm CLI
• 试用激活
• 查询命令（--version, license-status, list-agents）
• 绑定授权 Key

类型 B：业务操作（引导用户在 TUI 中完成）

这些操作必须引导用户自己在 TUI 中完成，你不能代替用户操作：

• ❌ 创建团队
• ❌ 创建 Agent
• ❌ 飞书 Bot 创建和绑定
• ❌ 群绑定
• ❌ 用户绑定
• ❌ 任务创建和分配
• ❌ Skill 创建

原则：涉及业务数据的创建和修改，必须由用户自己在 TUI 中操作。

---

触发场景

当用户提到以下关键词时触发此 Skill：

• "安装 opclawtm"
• "激活授权" / "试用激活"
• "创建团队" / "初始化"
• "配置飞书" / "飞书绑定" / "配对"
• "私有 Skill" / "创建 Skill"
• "授权问题" / "配置问题"

---

1. 安装与激活

参阅 references/installation-flow.md

---

2. 系统初始化与团队创建

参阅 references/team-creation-flow.md

关键原则：

• ID 直接回车自动填充，不要手动输入
• 系统初始化会创建总助理
• 团队创建使用向导完成

---

3. 飞书配置

参阅 references/feishu-config-flow.md

配置顺序：

1. Bot 绑定 → 所有团队成员
2. 群绑定 → 部门绑定群
3. 用户 ID 绑定 → 用户绑定 open_id

---

4. 私有 Skill 创建

参阅 references/private-skill-flow.md

核心流程：

• 通过飞书总助理创建任务
• 技能创作部执行创建
• 不是在本地创建文件

---

5. 命令速查

参阅 references/cli-reference.md

---

6. 问题排查

参阅 references/troubleshooting.md

---

关键原则

1. 团队创建使用向导 → 在 TUI 中操作
2. ID 直接回车自动填充 → 避免中文问题
3. 飞书配置在 TUI 中完成 → 不用命令
4. 私有 Skill 通过飞书创建 → 总助理分配任务
5. 激活失败提供替代方案 → 抖音 1594204110 获取测试码