openclaw-cheatsheet

PassAudited by ClawScan on May 10, 2026.

Overview

This is an instruction-only CLI reference with no installed code, but some copy-paste examples can change OpenClaw or external services if a user runs them.

This looks safe to install as a reference-only skill. Before copying examples, especially ones that send messages, edit configuration, manage daemons/cron/hooks, delete data, run local scripts, or call external tools, confirm the exact target and inspect any local script being executed.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If copied without review, these commands could post messages or change the user's OpenClaw setup.

Why it was flagged

The cheatsheet includes copy-paste examples that can send messages or change/remove OpenClaw configuration and services. This is purpose-aligned for a CLI reference, and SKILL.md adds a confirmation rule for destructive or state-changing commands.

Skill content
openclaw message send --channel discord --target <channel_id> --message "내용"; openclaw config set <dot.path> '<json>' --json; openclaw daemon uninstall
Recommendation

Use these as reference examples only; require explicit user confirmation before running commands that send, delete, restart, install, uninstall, or change configuration.

What this means

A user or agent copying this unrelated example could create an unintended calendar event or target the wrong account.

Why it was flagged

The README includes an external calendar-creation command that is outside the stated OpenClaw CLI cheatsheet scope and would mutate a calendar if run, but it is only a documented example and not automatic behavior.

Skill content
gog calendar create iam@minhl.net --summary "퀵 호출" --from "2026-02-20T09:00:00+09:00" --to "2026-02-20T09:15:00+09:00"
Recommendation

Treat the calendar command as a stray example; replace account identifiers and confirm intent before using any external-service command.

What this means

Running the command would execute local code that was not included in this reviewed skill.

Why it was flagged

The reference documents running a local Node.js script outside this skill package. It is presented as a command example, not an automatic install or runtime action.

Skill content
node ~/.openclaw/workspace-shared/scripts/discussion/discussion_runner.js --topic "주제" --mode live --rounds 3
Recommendation

Do not run the live discussion-runner command unless the local script exists, has been inspected, and the user explicitly wants it executed; prefer dry-run mode first.