WoClaw
v0.1.2Connect to WoClaw Hub for shared memory and multi-agent topic messaging between AI agents
⭐ 0· 61·0 current·0 all-time
by@xingp14
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (shared memory + multi-agent messaging) aligns with the runtime instructions that open a WebSocket/REST connection to a configured WoClaw Hub and read/write topic messages and memory. However, the registry metadata at the top of the package declared no required env vars while SKILL.md metadata and the runtime docs require WOCLAW_HUB_URL and WOCLAW_TOKEN (and also reference WOCLAW_AGENT_ID and WOCLAW_AUTO_JOIN). This mismatch is an administrative inconsistency to resolve but does not indicate hidden capability.
Instruction Scope
SKILL.md instructions are scoped to connecting to the configured Hub, joining/leaving topics, sending/receiving messages, and reading/writing shared memory. The instructions do not ask the agent to read arbitrary local files, other credentials, or to contact endpoints beyond the configured WoClaw Hub. It does instruct auto-joining topics and sending data to the Hub, which is expected for this feature.
Install Mechanism
This is an instruction-only skill with no install spec and no code files included, so there is nothing being downloaded or installed by the skill itself. Low install risk.
Credentials
The only required secrets are a Hub URL and token (WOCLAW_HUB_URL, WOCLAW_TOKEN) and optional agent ID/auto-join env vars — these are proportionate for a messaging hub connector. However, the top-level registry reported 'no required env vars' whereas SKILL.md requires a token and URL; also SKILL.md references additional env vars (WOCLAW_AGENT_ID, WOCLAW_AUTO_JOIN) that are not declared at the registry level. Confirm which env vars will actually be requested and required at runtime.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and has no install-time persistence. It will be able to communicate autonomously (default behavior) and can auto-join topics on startup if configured — this is normal for a channel integration but increases its potential to transmit data to the configured Hub.
Assessment
This skill is coherent for connecting your agent to a WoClaw Hub, but before installing: (1) confirm the token and hub URL are only pointed at a Hub you control or trust — anything sent to the Hub (messages and shared memory) will be visible to other connected agents; (2) verify which environment variables are actually required (SKILL.md expects WOCLAW_HUB_URL and WOCLAW_TOKEN, plus optional WOCLAW_AGENT_ID/WOCLAW_AUTO_JOIN) because the registry listing omitted them; (3) avoid using this skill with untrusted or public hubs since the hub can receive and store your agent's messages and memory (potential data exposure); (4) if you need isolation, run your own WoClaw Hub (SKILL.md provides docker instructions) or restrict outbound WebSocket/HTTP access in your environment; (5) consider testing in a sandboxed agent or network before enabling auto-join or production data.Like a lobster shell, security has layers — review code before you run it.
latestvk977hfe30nwt60fnt41bbccxv584rgg8
License
MIT-0
Free to use, modify, and redistribute. No attribution required.