Loom

The plugin is internally consistent with its stated purpose: it is a thin OpenClaw integration that talks to a Loom Python backend on a configurable URL (default localhost) and exposes memory tools/commands; nothing in the code or instructions requests unrelated credentials or hidden endpoints.

This plugin appears to do what it claims: integrate OpenClaw with a Loom backend running on a configurable HTTP URL (default http://localhost:8666). Before installing, consider these points: - Run Loom locally and confirm it's listening on localhost; keep the backend behind localhost or a firewall if you don't want it exposed. The plugin talks over HTTP to the configured loomBaseUrl, so avoid pointing it at public/unknown endpoints. - Loom (the Python backend) needs an LLM API key (OpenAI/OpenRouter/etc.). Keep those keys in the Loom backend config files (configs/loom.yaml or .env) and do not paste them into third-party services. The plugin itself does not request API keys. - The SKILL.md recommends running installers (pip install -e ., and a curl | bash for OpenClaw). Inspect any remote install script before running it. Prefer installing OpenClaw from trusted package sources or via package manager if you are unsure. - The SKILL.md includes an 'AI-Assisted Setup' option that instructs an agent to fetch and run the upstream setup guide; only allow an agent to run commands if you trust it and have reviewed the commands it will execute. - The repository includes a large package-lock.json with many SDKs that are not present in package.json; treat that as a red flag to inspect (it may be an extraneous lockfile). If you run npm operations, prefer npm ci with a vetted lockfile or avoid running npm install in untrusted repos. If you want extra assurance: run the plugin in a test environment first, inspect openclaw.plugin.json and index.ts (already done here — nothing suspicious), and verify Loom backend logs while exercising slash commands (status, inspect, recall) to confirm endpoints and behavior.