The orchestration tool for OpenClaw, managing and coordinating all your skills seamlessly.
Security Analysis
medium confidenceThe skill claims broad orchestration and secrets/config management but provides no concrete runtime instructions or declared permissions — the described capabilities don't match what the package requests or documents.
The description promises centralized orchestration, discovery, dependency resolution, monitoring, restart of other skills, and secrets management. Those capabilities normally require access to agent internals, configuration files, and secrets. Yet the skill declares no required binaries, environment variables, config paths, or install steps — a mismatch between claimed purpose and requested capabilities.
SKILL.md is high-level marketing-style prose with no concrete runtime instructions, commands, endpoints, or data flows. It neither explains how the agent should discover or control other skills nor specifies what data to read/write. The vagueness grants broad implicit discretion (e.g., 'manage', 'unify configuration', 'secrets management') without boundaries or safeguards.
There is no install specification and no code files. That reduces the immediate surface for arbitrary code execution on install, but it also means behavior is governed entirely by the vague SKILL.md instructions.
The description explicitly mentions secrets management and unified configuration, which would normally require access to environment variables or config paths. However, requires.env and required config paths are empty. This inconsistency suggests either the skill is incomplete/sloppy or it expects implicit platform-level access that is not declared.
always is false (good) and autonomous invocation is allowed (platform default). Given the orchestration claim, autonomous invocation plus vague instructions could let the skill act broadly at runtime; consider restricting autonomous use until its exact behaviors are defined.
Guidance
This skill's description claims it will orchestrate and manage other skills, including secrets and restarts, but the package provides no concrete instructions, no code, and requests no permissions — that's a mismatch. Before installing: ask the author for specific runtime behavior (what APIs/configs it will access, which env vars or files it needs, and example commands), request the actual code or an install spec for audit, and require least-privilege operation (no autonomous invocation or access to secrets until reviewed). If you can't get clear, auditable details, avoid enabling this skill on agents that have access to sensitive configs or credentials.
Latest Release
v1.0.0
- Initial release of ClawOps, the orchestration tool for OpenClaw. - Manages and coordinates all installed skills, ensuring seamless integration. - Features skill discovery, dependency resolution, and multi-skill action scheduling. - Provides centralized monitoring, logging, and health checks for improved reliability. - Supports unified configuration, secrets management, and event handling for automated workflows.
More by @okoddcat
Published by @okoddcat on ClawHub
