Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Plugin Integration Development

v1.0.1

Guide users to create, validate, and integrate custom plugins, tools, and commands into OpenClaw using templates, scripts, and examples.

0· 78·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
The skill's name/description match the included materials: templates, example plugins, and validation/init scripts. Creating and validating plugins is a coherent purpose for the included files.
Instruction Scope
SKILL.md stays within plugin-development scope (create scaffold, validate, install). The runtime instructions reference local paths and scripts only and do not instruct any network calls or reading unrelated system state. However, the scripts assume tools (jq, sed -i behavior) that are not declared, and the docs/scripts expect different manifest filenames (examples use manifest.json while validation expects openclaw.plugin.json), which is an inconsistency that can cause unexpected failures.
Install Mechanism
No install spec; this is instruction-only and ships only examples and shell scripts. There are no downloads or archive extracts, so there is no high-risk install mechanism.
Credentials
The skill declares no required environment variables or credentials, which lines up with its local-development purpose. However, the validation script depends on the external tool jq (and generally on a POSIX shell and sed), but jq is not declared in requirements — a missing dependency rather than a secret/privilege issue.
Persistence & Privilege
The skill is not always-enabled and is user-invocable only. It does not request elevated privileges or modify other skills. Running the scripts writes files into plugin directories (expected for scaffolding) but does not persist as an always-on component.
What to consider before installing
This skill looks like a helpful plugin template and validator, but review and test before running scripts. Specific things to check: 1) The validate script uses jq — install jq or edit the script; the skill did not declare this dependency. 2) Examples include manifest.json files, but the validator and CLI docs expect openclaw.plugin.json — update examples or manifests to match your OpenClaw version. 3) init-plugin.sh uses sed -i in a way that can be non-portable on macOS; test in a safe directory first. 4) Run the scripts in a non-production directory (or provide an explicit output-dir) to avoid accidental overwrites; the init script will refuse to proceed if the target directory exists, but confirm before running. 5) Inspect the generated index.js and manifest before installing any plugin into your real OpenClaw plugins directory. If you want higher assurance, open the scripts in a text editor or run them under a sandbox/container and verify behavior (no network calls are present).

Like a lobster shell, security has layers — review code before you run it.

developmentvk9732pnzh0shzd47hrjsxx6k298440w1latestvk9732pnzh0shzd47hrjsxx6k298440w1pluginsvk9732pnzh0shzd47hrjsxx6k298440w1
78downloads
0stars
2versions
Updated 2w ago
v1.0.1
MIT-0

Plugin Integration Development Skill

Overview

This skill enables users to create, develop, and integrate their own plugins, tools, and commands into OpenClaw. It provides guidelines, templates, and examples to streamline the development process.

Purpose

  • Guide users through creating OpenClaw plugins, tools, and commands.
  • Provide best practices for development, testing, and integration.
  • Offer examples and utilities to simplify the process.

Key Features

  • Plugin Templates: Predefined templates for plugins, tools, and commands.
  • Validation Scripts: Utilities to validate plugin structure and metadata.
  • Example Plugins: Ready-to-use examples for quick experimentation.
  • API Reference: Documentation for OpenClaw's plugin API.

Getting Started

1. Initialize a New Plugin

Use the init-plugin.sh script to create a new plugin scaffold:

~/.openclaw/skills/plugin-integration/scripts/init-plugin.sh <plugin-name>

2. Develop Your Plugin

Follow the structure in the examples/ directory to develop your plugin. Key files:

  • manifest.json: Metadata for the plugin (name, version, description, etc.).
  • plugin.js or command.js: Main logic for the plugin or command.
  • README.md: Documentation for the plugin.

3. Validate Your Plugin

Use the validate-plugin.sh script to ensure your plugin meets OpenClaw's requirements:

~/.openclaw/skills/plugin-integration/scripts/validate-plugin.sh <plugin-directory>

4. Integrate Your Plugin

Place your plugin in the OpenClaw plugins directory (e.g., ~/.openclaw/plugins/) and restart OpenClaw to load it.

Example Plugins

Hello World Plugin

A simple plugin that logs "Hello World" to the console.

  • Directory: examples/hello-world/
  • Files: plugin.js, manifest.json, README.md

Custom Command

A custom command that greets the user by name.

  • Directory: examples/custom-command/
  • Files: command.js, manifest.json, README.md

API Reference

Refer to references/api-reference.md for detailed documentation on OpenClaw's plugin API.

CLI Reference

Refer to references/cli-reference.md for OpenClaw CLI commands related to plugin management.

Best Practices

  • Modularity: Keep plugins small and focused on a single task.
  • Documentation: Document every plugin with a README.md file.
  • Validation: Always validate your plugin before integration.
  • Testing: Test plugins in a development environment before deploying them.

Troubleshooting

  • Plugin Not Loading: Ensure the manifest.json file is correctly formatted and the plugin is placed in the correct directory.
  • Errors in Logic: Use console.log or OpenClaw's logging utilities to debug issues.

Contributing

Contributions to this skill are welcome! Submit improvements via pull requests or issues on the OpenClaw GitHub repository.

Comments

Loading comments...