Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

OpenCawl

v1.0.2

Gives your Claw a phone number. Make and manage phone calls via OpenCawl. Use this skill whenever the user asks you to call someone, make a phone call, sched...

1· 118·0 current·0 all-time
byAmmon Brown@ammbo

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ammbo/opencawl.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "OpenCawl" (ammbo/opencawl) from ClawHub.
Skill page: https://clawhub.ai/ammbo/opencawl
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: OPENCAWL_API_KEY
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install opencawl

ClawHub CLI

Package manager switcher

npx clawhub@latest install opencawl
Security Scan
Capability signals
Requires OAuth tokenRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description align with the documented API and required credential: a phone-calling service reasonably needs an OPENCAWL_API_KEY and webhooks to receive post-call results. The documented endpoints and parameters match a telephony integration using ElevenLabs/Twilio.
!
Instruction Scope
SKILL.md explicitly tells users to set the API key in ~/.openclaw/openclaw.json and to configure gateway webhooks and gateway_token. The package metadata declared no required config paths, yet the docs instruct modifying a specific local config file; that is an incoherence. Also, the skill expects users to supply arbitrary HTTPS webhook URLs and bearer tokens (gateway_token) which will receive call outcomes, transcripts, and possibly recordings—these are legitimate for operation but expand the data-exposure surface and should be handled carefully.
Install Mechanism
This is an instruction-only skill with no install spec and no code files; nothing is downloaded or executed by the registry. Lower risk from installation mechanics, but runtime behavior relies on outbound HTTPS calls to opencawl.com and any webhook URLs you configure.
Credentials
Only OPENCAWL_API_KEY is declared as required (primary credential) which is appropriate. However, SKILL.md references additional tokens (gateway_token) and saving the key in a local config file—these additional sensitive items are not declared as required env/config paths. Verify where secrets will be stored and who can access them.
Persistence & Privilege
always is false and the skill does not request system-wide privileges. Autonomous invocation is allowed by default (disable-model-invocation is false) which is expected for agent skills. There is no evidence the skill tries to modify other skills or agent-wide settings.
What to consider before installing
Before installing: 1) Verify the OpenCawl service (opencawl.com) independently and confirm you trust its privacy/security policies—call transcripts, recordings, and contact data may be stored by OpenCawl/Twilio/ElevenLabs. 2) Confirm how and where your OPENCAWL_API_KEY will be stored: the SKILL.md suggests ~/.openclaw/openclaw.json but the skill metadata declares no config paths—ensure the file is stored with appropriate file permissions and that you accept that storage. 3) Be cautious when supplying webhook URLs and gateway_token values: any webhook you set will receive call outcomes, transcripts, and recording URLs; avoid sending these to untrusted endpoints. 4) Use a scoped API key or sandbox/test account if possible (don’t reuse highly privileged or multi-service credentials). 5) If you need higher assurance, ask the publisher for a clear install/runtime flow describing exactly when and where credentials are stored and what webhooks the service will call. If those answers are satisfactory, the skill is functionally coherent; if not, do not install it.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

📞 Clawdis
EnvOPENCAWL_API_KEY
Primary envOPENCAWL_API_KEY
latestvk97avh982d6wbhkyc4n5m68ecx8560f8
118downloads
1stars
3versions
Updated 1w ago
v1.0.2
MIT-0

OpenCawl

Gives your Claw a phone number. Make and manage outbound and inbound phone calls via the OpenCawl API, with live telephony handled by ElevenLabs and Twilio.

Security: This skill only uses credentials and URLs you configure (OPENCAWL_API_KEY, optional completion or gateway webhooks). It does not read unrelated files on your machine. Outbound HTTPS requests go to your configured OpenCawl API base URL and to webhook URLs you supply.

Setup

  1. Sign up at https://opencawl.com
  2. Copy the setup command from onboarding and run it in your OpenClaw terminal: openclaw skills install opencawl --key <your OpenCawl API key>
  3. Wait for the OpenCawl dashboard to show your Claw as connected
  4. If you prefer manual config, set OPENCAWL_API_KEY in your environment or via skills.entries.opencawl.apiKey in ~/.openclaw/openclaw.json
  5. Run /opencawl setup when you want the detailed number, inbound, and webhook/tool configuration report

Call Architecture

OpenCawl is optimized around one primary mode.

Outbound and Inbound: Autonomous

OpenClaw dispatches a goal and context to OpenCawl, then moves on. ElevenLabs handles the live conversation and Twilio dialing. Post-call webhooks are the primary completion path; polling is optional fallback.

Best for: appointment setting, lead qualification, outreach, follow-ups, collections — any call with a predictable conversation tree.

OpenClaw  →  opencawl.call(to, goal, context)
                    ↓
             OpenCawl + ElevenLabs run the call
                    ↓
             post-call webhook updates status immediately
                    ↓
             OpenClaw receives structured outcome

Inbound calls run through the same shared ElevenLabs agent, with per-user prompt, voice, first-message, and task-dispatch settings supplied by OpenCawl.


Commands

call — Make an outbound call

Dispatch a goal-based outbound call. Returns a call_id immediately. The call runs async; use status to track resolution.

Parameters:

  • to (required): E.164 phone number, e.g. +15551234567
  • goal (required): What the call should accomplish in plain language
  • context (optional): Background the agent should know — lead source, prior interactions, objections to expect
  • persona (optional): Voice/personality profile slug (e.g. professional-friendly, direct-confident)
  • voice_id (optional): Override voice directly by voice library ID (e.g. rachel, thomas)
  • max_duration_seconds (optional): Hard cap on call length in seconds (default: 300, max: 1800)
  • on_completion_webhook (optional): HTTPS URL OpenCawl will POST the outcome to

Example:

{
  "skill": "opencawl",
  "command": "call",
  "to": "+15551234567",
  "goal": "Schedule a 30-minute Workmate demo. Get their name, email, and two availability windows. If they push back, mention we have a 14-day free trial.",
  "context": "Inbound lead from the enterprise landing page. Requested info 2 days ago. Has not replied to follow-up email.",
  "persona": "professional-friendly"
}

Returns: call_id, status: "ringing"


status — Check call outcome

Poll the status and result of any call.

Parameters:

  • call_id (required): The call ID returned by call

Returns:

{
  "call_id": "abc123def456",
  "direction": "outbound",
  "status": "completed",
  "outcome": "success",
  "to_number": "+15551234567",
  "goal": "Schedule a 30-minute Workmate demo",
  "persona": "professional-friendly",
  "summary": "Spoke with Jamie Chen. Scheduled demo for Thursday 2pm ET. Email: jamie@acme.com.",
  "extracted": {
    "name": "Jamie Chen",
    "email": "jamie@acme.com",
    "availability": ["Thursday 2pm ET", "Friday 10am ET"]
  },
  "duration_seconds": 187,
  "transcript": "...",
  "recording_url": "https://api.twilio.com/...",
  "created_at": "2026-03-28T14:00:00Z",
  "completed_at": "2026-03-28T14:03:07Z"
}

Possible status values: initiated, queued, ringing, in_progress, completed, failed, no_answer, voicemail, busy


calls — List recent calls

List calls with optional filtering.

Parameters:

  • status (optional): Filter by status
  • from (optional): ISO date range start
  • to (optional): ISO date range end
  • limit (optional): Max results (default: 20, max: 100)
  • cursor (optional): Pagination cursor from previous response

hangup — End a call

Terminate an in-progress call.

Parameters:

  • call_id (required): Call to end
  • reason (optional): Logged reason (e.g. "goal_achieved", "no_answer_threshold")

voicemail — Check voicemail inbox

List and read voicemails left on your OpenCawl number.

Parameters:

  • limit (optional): Max results (default: 10)
  • unread_only (optional): true to filter to unheard messages

credits — Check balance

Returns: Credit balance, plan name, estimated minutes remaining, next reset date


setup — First-time initialization

Reports your current phone number, inbound configuration, gateway config, and ElevenLabs webhook/tool endpoints. Run once after installing the skill.

/opencawl setup

Personas

Personas define how OpenCawl sounds and behaves on calls. Each persona maps to a voice from the ElevenLabs voice library.

SlugVoiceBest For
professional-friendlyEmilyB2B outreach, demos, enterprise
direct-confidentThomasExecutive outreach, follow-ups
empathetic-supportSerenaSupport, onboarding, check-ins
energetic-salesFreyaSMB sales, product promotions
neutral-informationalAdamAppointment reminders, surveys

Pass the persona slug in the call command. If omitted, your dashboard voice selection is used. You can also pass voice_id directly to use any voice from the library.

See references/personas.md for the full voice library and ElevenLabs model recommendations.


Inbound Tasks

To let the shared ElevenLabs agent perform real work during live calls, configure a per-user OpenClaw gateway webhook in OpenCawl settings. The agent uses the OpenCawl task tools to dispatch work and check status.


Configuration Reference

~/.openclaw/openclaw.json:

{
  "skills": {
    "entries": {
      "opencawl": {
        "enabled": true,
        "apiKey": "<your OpenCawl API key>",
        "env": {
          "OPENCAWL_API_URL": "https://opencawl.com",
          "OPENCAWL_DEFAULT_PERSONA": "professional-friendly",
          "OPENCAWL_MAX_DURATION": "300",
          "OPENCAWL_ANNOUNCE_CHANNEL": "telegram"
        }
      }
    }
  }
}

Reference Files

  • references/inbound.md — Inbound autonomous call setup and gateway task-dispatch pattern
  • references/personas.md — Voice/persona configuration and ElevenLabs voice mapping
  • references/api.md — Full OpenCawl REST API reference (all endpoints, request/response schemas)

Comments

Loading comments...