BC clawpilot
Expert skill for OpenClaw (v2026.2.19) — self-hosted AI gateway connecting chat apps (WhatsApp, Telegram, Discord, Slack, iMessage, Signal, LINE, Matrix, Teams, Google Chat, BlueBubbles) to AI agents. Use when user asks about: (1) Installing, configuring, or updating OpenClaw, (2) Setting up or troubleshooting chat channels (e.g. "my WhatsApp bot isn't responding"), (3) Security hardening, auditing, or checking a local OpenClaw installation, (4) Inspecting openclaw.json config, prompts (SOUL.md/AGENTS.md), or session transcripts, (5) Multi-agent routing, session management, agent isolation, (6) Cloud deployment (AWS/GCP/Fly.io/Docker) and remote access (Tailscale/SSH), (7) Upgrading or migrating OpenClaw versions, (8) Discovering or installing OpenClaw skills from ClawHub, (9) Any mention of "openclaw", "openclaw.json", "~/.openclaw", or gateway config. Includes bundled scripts for security audit (CVE detection, OWASP/NIST mapping, supply chain scan), config inspection, prompt checking, and session scanning. Do NOT use for: general chatbot frameworks (Botpress, Rasa, etc.), non-OpenClaw AI gateways, or generic Docker/cloud questions unrelated to OpenClaw deployment.
As a process C 64/100 · Has gaps — weak spots: result and completion, running it twice
What is at stake
Medium-severity findings: the skill is probably honest, but read what alarmed the scanner.
Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.
The skill tells the agent to hide things from you: not to show errors, not to mention actions, to report differently from what was done. You lose the ability to see what the agent really did.
Transparency beats a smooth answer. If the goal is to hide technical noise, ask the agent to "summarise briefly", not to "not mention".
How to improve
- Shorten the description to 1024 characters.
- Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
- A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.
Guard findings · 6
✓ No critical or high findings
Medium and low: 6
-
medium Concealment
en-hide-from-userreferences/security.md:242Instruction to hide actions from the user (documentation of a security skill)1. **Data exfiltration** — Skills silently execute `curl` commands sending data to external C2 servers
security skill -
low Risky intent
intent-offensive-securityreferences/security.md:58Offensive-security / dual-use content (legitimate for authorised testing; review intended use)- **Scope**: Path traversal in media handling, plugin loading, and config includes; SSRF enforcement gaps; Discord moderation privilege escalation; ACP session management DoS; plugin discovery unsafe
-
low Risky intent
intent-offensive-securityreferences/security.md:83Offensive-security / dual-use content (legitimate for authorised testing; review intended use)- Discord moderation action privilege escalation prevention
-
low Risky intent
intent-offensive-securitySKILL.md:61Offensive-security / dual-use content (legitimate for authorised testing; review intended use)- **2026.2.12**: Mass security patch (40+ vulnerabilities) — path traversals, SSRF, privilege escalation
-
low Risky intent
intent-offensive-securitySKILL.md:195Offensive-security / dual-use content (legitimate for authorised testing; review intended use)Check: version/CVE status, file permissions, hardcoded credentials, network binding, DM policies, sandbox config, tool policies, log redaction, plugins, **skill supply chain** (exfiltration/reverse sh
A further 1 matches are quotations in this security skill's documentation and are not counted as findings.
Files scanned: 13. Evidence is masked. Grey chips explain why severity was lowered.
Against the Agent Skills spec
- error
description-longdescription is 1185 chars, limit 1024
Process rating: all ten parameters 64/100
- 0Result and completion. Does not say what the result is
- 30Running it twice. 8 mutating operations with no state check
- 50When it triggers. No condition that starts the skill
- 60Tools and files. Uses tools (bash, web, node) that frontmatter does not declare
- 70Inputs and preconditions. Inputs and preconditions are listed
- 85Steps. 71 steps, 1 vague phrases
- 100Failures and branches. 4 branches, has a failure section
- 100Consistency. Name and required fields are in place
- 100Execution cost. Instruction body is 3452 tokens
- 100Progress reporting. Reports progress
- medium Safety rules and hard prohibitions inside a skill: they belong in the system prompt, here they protect nothing
- low The response is described with custom markup (4 tags): a typed call is more reliable
Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.
Quality signals
- +3Description length 1184: 120–800 characters recommended
- +3Output format is not stated: the model decides each time
- -2localhost URLs: will not work for another user
- +1No license
- +2Single-language instructions
- +5Description quotes 4 example trigger phrases
- +4Description says when NOT to use the skill
- +4Structure: 24 headings
- +3Step-by-step instructions: 71 items
- +4Has examples (9 code blocks)
- +4Reference files are cited in the instructions (4 of 4)
- +3All 6 scripts are documented
Quality base 70; lint remarks subtract, signals add up to 100. Result: 70.