Create a Botpress AI agent with the ADK using OpenClaw

ReviewAudited by ClawScan on May 1, 2026.

Overview

This is a coherent Botpress ADK guide, but users should notice that it asks them to install a CLI from the internet, authenticate to Botpress Cloud, and deploy bots.

Install this skill if you want guidance for Botpress ADK development. Before following its setup commands, verify the Botpress ADK installer source, log in only to the intended Botpress workspace, and review/test any bot before running deployment commands.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Running the installer can execute code on the user's machine.

Why it was flagged

The guide asks the user to install the ADK CLI by piping a remote latest-release installer into a shell. This is a common setup pattern and is central to the skill's purpose, but it means the user is trusting remote installer code.

Skill content

curl -fsSL https://github.com/botpress/adk/releases/latest/download/install.sh | bash

Recommendation

Use the official Botpress source, inspect the installer or use a manual download/checksum when available, and run it only if you intend to install the ADK CLI.

Medium

#ASI03: Identity and Privilege Abuse

What this means

The ADK CLI may be able to access or modify Botpress Cloud resources associated with the authenticated account or workspace.

Why it was flagged

The workflow requires authenticating with a Botpress Cloud account. This is expected for developing and deploying Botpress bots, but it grants the CLI account-level access needed for the project.

Skill content

adk login               # Authenticate with Botpress Cloud

Recommendation

Authenticate only to the intended Botpress account/workspace and avoid using unnecessarily privileged accounts for development.

Low

#ASI02: Tool Misuse and Exploitation

What this means

A mistaken deployment could affect users interacting with the Botpress bot.

Why it was flagged

The guide includes production deployment commands. This is purpose-aligned and user-directed, but deployment can change a live bot's behavior.

Skill content

adk deploy              # Deploy to production when ready

Recommendation

Test locally first, review generated code and configuration, and deploy only when you are ready for the bot to run in production.