Integrates OpenTangl lifecycle tools into OpenClaw, enabling task queue viewing, task proposing, workflow execution, autopilot, wiring audits, and merge pipe...
Security Analysis
medium confidenceThe plugin's behavior matches its stated purpose (wrapping an OpenTangl CLI), but it will execute code from your specified workspace and inherits the agent process environment (including any secrets), and the package/metadata omit some prerequisites — these mismatches and the ability to run untrusted workspace code are worth explicit caution before installing.
Name/description align with the implementation: the plugin invokes an OpenTangl CLI to list queues, propose tasks, run workflows, and perform merges. Requiring node/git/gh and OpenTangl in the environment (documented in SKILL.md) is coherent with this purpose.
The SKILL.md and the code instruct the agent to run the OpenTangl CLI inside a user-specified workdir. The plugin will (a) prefer to run a 'src/cli.ts' or 'dist/cli.js' found in that workdir (via 'npx tsx' or 'node'), and (b) passes the plugin process environment to the CLI (env: { ...process.env }). That means arbitrary code present in the workspace will be executed with the agent's environment available. This is expected for a workspace-integrating tool but is a high-scope operation and should only be used with trusted workspaces.
No external download/install spec is included in the registry entry — the skill is instruction/code-only and uses standard Node module files. There is no fetch-from-arbitrary-URL or archive extraction in the provided files.
The plugin itself declares no required env vars in registry metadata, but SKILL.md requires OPENAI_API_KEY or ANTHROPIC_API_KEY and the workspace may include a .env with API keys. The plugin forwards process.env to the invoked CLI, so secrets available to the agent (OpenAI/Anthropic keys, GitHub/gh auth, other tokens) will be visible to whatever CLI code runs. That is proportionate to running a local CLI but should be considered a sensitive capability and is not explicitly declared in the registry metadata.
The plugin is not always-on and requires the user to add mutating tools to the OpenClaw tools.allow list to enable writes/merges. It does not request unusual platform privileges or modify unrelated skill configs. Autonomous invocation is allowed by default for skills on this platform, and the mutating features are gated behind an allowlist—this is safer than automatic mutation.
Guidance
This plugin legitimately wraps an OpenTangl CLI, but it will execute code from the workspace you point it at and run that code with the agent's environment. Before installing or enabling mutating tools: (1) only point workdir to repositories you trust (a malicious workspace file could run arbitrary code); (2) ensure credentials in the agent environment (OPENAI_API_KEY, ANTHROPIC_API_KEY, GitHub auth used by 'gh', etc.) have minimal scope and are not overly privileged; (3) enable mutating tools (propose/autopilot/merge) only if you understand and accept automated commits and merges; (4) prefer installing plugins from a verifiable homepage or repository — this package has no homepage listed in the registry; (5) if you need stronger isolation, run OpenClaw with restricted environment or in an isolated runner/container so workspace-executed CLIs cannot access sensitive network endpoints or secrets.
Latest Release
v0.1.1
Fix shell injection vulnerability: replace execSync(string) with spawnSync(file, argsArray) to bypass the shell entirely. Add input validation for all user-controlled string parameters (project IDs, workflow paths, var keys).
More by @8co
Published by @8co on ClawHub
