Voko Subagent
v1.0.1Creates and manages real subagents within OpenClaw Gateway to process visitor messages based on VOKO database and prompts.
⭐ 0· 79·1 current·1 all-time
bytech-fcc@tech-fcc-sys
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description say it creates subagents in OpenClaw using VOKO DB data; code reads a sqlite DB, builds a prompt, and calls openclaw.sessions_spawn to create a subagent. The declared behavior aligns with the code and README/SKILL.md.
Instruction Scope
SKILL.md instructs copying the skill into ~/.openclaw/skills and running npm install and openclaw skill run; runtime instructions and code access only the supplied DB path and create subagents. The skill will read any DB path provided (or default ./data/voko.db) and expects to run inside the Gateway. Nothing in the instructions or code tries to read unrelated environment variables or external endpoints.
Install Mechanism
There is no registry install spec in the registry entry, but SKILL.md and package.json instruct the user to run npm install (pulling sqlite3 and normal npm deps). This is expected for a Node skill but requires network access at install time and native bindings for sqlite3. No remote downloads from unknown URLs are used in the bundle.
Credentials
The skill requests no environment variables or external credentials. It does read a user-provided filesystem path to a sqlite DB (explicitly configured via --db-path), which is proportionate to a DB-driven subagent builder. Default ownerUid is hard-coded but not a credential.
Persistence & Privilege
The skill calls openclaw.sessions_spawn to create real subagents, passing cleanup: 'keep' and sandbox: 'require'. Creating subagents is the skill's purpose, so this is expected; however, created subagents may persist/run in the Gateway and may have the privileges the Gateway grants to spawned sessions. The skill itself is not always:true and is user-invocable only.
Assessment
This skill appears to do what it says: read a VOKO sqlite DB and spawn OpenClaw subagents. Before installing, verify you: (1) will run it inside a trusted OpenClaw Gateway (the skill requires the platform's openclaw API), (2) only point --db-path to databases you are willing to allow the skill to read (it will open and query the DB file), (3) are comfortable running npm install (sqlite3 has native bindings and will fetch packages), and (4) accept that created subagents use cleanup: 'keep' and sandbox: 'require' (spawned agents may persist and execute code with whatever privileges the Gateway grants). If you have sensitive data in your DB or limited trust in the Gateway environment, review the code locally and consider changing defaults (e.g., ownerUid) or adjusting cleanup/timeout behavior before deployment.Like a lobster shell, security has layers — review code before you run it.
latestvk973wdp4baw4yc6apdyypy7c1983f2yq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.