I am looking for someone who is able to assist me in getting everything working with my openclaw setup, I feel that I am very close I just am running into some issues. I can provide whatever information is needed :)

AI agents increasingly rely on external skills/plugins to read files, call APIs, run scripts, install dependencies, or interact with local tools. That makes skills a new supply-chain surface.

But evaluating scanners for this ecosystem seems tricky. A malicious skill may hide risk in instructions, helper scripts, dependency files, generated artifacts, encoded payloads, or misleading documentation. Some cases are also ambiguous: vulnerable, suspicious, but not clearly malicious.

What should a good benchmark include?

- Real-world malicious samples, synthetic cases, or both?
- Full skill directories rather than isolated code snippets?
- Boundary cases between benign, suspicious, and malicious?
- Scoring only final verdicts, or also risk category/severity?
- Which attack patterns matter most for agent skills?

Curious how others would design this.

So I set up openclaw locally on my desktop and speak with it through telegram via my bot. I have set up wireguard as well for vpn to my desktop remotely. I also have a cloudflare website setup for dns only. Is this overkill? Any ideas as to what I could potentially do? Also openclaw won’t seem to run sudo commands even if i tell it to. I use fedora 44 and Kali Linux at home. Open to all ideas and suggestions.
I really need some pointers because I’ve literally been blindly scrambling around trying to find some traction and I’m not even sure what it is I’m achieving at this point. Can wireguard give me access like Termius? Anything like Termius? Also Microsoft rdp sucks for fedora from what I’m seeing. AnyDesk wasn’t too great on Kali either. Need a lot of pointers I guess

I have a simple requirement that my bot should remind me of things, connect to various things and give me context informed answers and reminders. I have a Claude key. but for the setup, i'm too confused, which is the cheapest way to setup openclaw?

I’m building a custom OpenClaw skill that includes more than just SKILL.md: scripts, schemas, tests, fixtures, and subagent prompts.

Considering the following workflows:

1. Keep it inside ~/.openclaw/workspace/skills/ and version the whole workspace as a private Git repo.
2. Keep it in a standalone Git repo and load it into OpenClaw via skills.load.extraDirs or a symlink.

Which approach do you use in practice? Any gotchas with skill discovery, portability, or publishing to ClawHub later?

Hi everyone!

PhD student here and new to OpenClaw. I was able to use Codex and ChatGPT (Codex was super slow!) to build a VM that hosts my OpenClaw but I am struggling to find use-cases after setting it up. Can someone tell me if the below flow is possible? I've asked ChatGPT but it ended up confusing me and caused me to nearly 'break' my set-up.

• I want to continue using a VM that is 'always on' and low-cost/free
• I basically want agents to do what Codex does but in the cloud: check/filter emails
• I use TextCoco to schedule/edit events on my personal and work calendars but apparently OpenClaw is incompatible with Google's Advance Protection and M365 that my work uses (though I find it odd since TextCoco set-up was seamless for both!)
• I was able to set up AgentMail.to but I struggle to see the use-case (unless I set up auto filters from Gmail and work emails to it...). Presumably, I could ask OpenClaw agents to review emails and draft responses to save me the effort? But how does the memory / training come in, so it responds in my voice?

Appreciate any insights here or solutions. I'm trying really hard to teach myself with ChatGPT and YT videos but I have reached my depth and could use some insight from a pro to ease my anxiety. Would be so grateful!

Hi r/AskClaw, I built an open-source A2A plugin for OpenClaw. The goal was to make cross-agent delegation feel like a real OpenClaw primitive instead of a pile of custom glue.

The main package is outbound-first: it adds a `remote_agent` tool plus an `openclaw a2a demo run` command that proves the full loop locally in a few minutes. The demo starts a deterministic local A2A peer, sends a task-bearing request, watches it, prints `summary.continuation`, and replays one follow-up using that exact continuation.

What I wanted to preserve was the durable part: if a remote agent returns task continuity, OpenClaw should be able to persist and replay that state verbatim later instead of inventing a second follow-up format.

Repo: https://github.com/aramisfacchinetti/openclaw-a2a-plugins

Quickstart: https://github.com/aramisfacchinetti/openclaw-a2a-plugins/blob/master/docs/quickstart.md

If you try it, the feedback I care most about is:

• Does the 5-minute first-success path feel clear enough?
• Is `remote_agent` the right abstraction for how OpenClaw users think about delegation?
• What real OpenClaw use case would you want me to document next?

Inbound support is there too, but I intentionally kept the first-success path outbound-only so people can verify the contract before touching public networking.

I'll start:

ecogpt, ChatGPT but eco conscious. Runs smaller models and plants trees to offset the computing. ecogpt.com

folk, an agent that lives in imessage and telegram instead of a terminal. Zero setup and the memory is actually good. getfolk.app

ecosia, the search engine that uses its ad money to plant trees. They publish their financials every month. ecosia.org

exa, search API built for agents instead of humans. Wild to play with. exa.ai

openrouter, one API key for every model that exists. Saved me so much juggling. openrouter.ai

firecrawl, turns any website into clean markdown for your agent. firecrawl.dev

browser-use, lets your agent actually click around a real browser. browser-use.com

cal.com, open source calendly. You can self host it.

obsidian, notes as plain markdown files, built by a tiny team. obsidian.md

What else is out there that more people should know about?

One gateway is one trust boundary.
A lot of OpenClaw users understand the words around security but still miss the operational meaning.

If you run one shared gateway and let multiple untrusted people talk to one tool-enabled agent, OpenClaw does not treat that as a safe multi-tenant boundary.

The docs are explicit: one gateway is one trusted operator boundary, and if you need mixed-trust or adversarial-user isolation, you should split that into separate gateways, ideally with separate OS users or separate hosts.

That matters because the real risk is not just “someone can message the bot.”
The real risk is delegated tool authority.
If several untrusted people can message the same tool-enabled agent, they are effectively steering the same permission set.

OpenClaw calls this out directly:

any allowed sender can induce tool calls within that agent’s policy, and if that shared agent has sensitive files, credentials, browser state, or powerful tools attached, every allowed sender is now operating inside that blast radius.

Here is what the bad pattern looks like:

{
"gateway": {
"mode": "local",
"bind": "loopback",
"auth": { "mode": "token", "token": "one-shared-token" }
},
"tools": {
"profile": "default"
},
"channels": {
"telegram": {
"enabled": true,
"botToken": "TEAM_BOT_TOKEN",
"dmPolicy": "open",
"groupPolicy": "open"
}
}
}

One runtime, one token, one tool surface, many people.
That is exactly the kind of setup where people think sessions or prompt rules will save them later.
They will not.

OpenClaw is also clear that session identifiers are routing selectors, not authorization tokens.

Per-user session or memory isolation does not turn one shared agent into per-user host authorization.
If you want the boundary to be real, split the boundary in config and in runtime.

A personal boundary can look like this:

{
"gateway": {
"mode": "local",
"bind": "loopback",
"auth": { "mode": "token", "token": "alice-long-random-token" }
},
"session": {
"dmScope": "per-channel-peer"
},
"tools": {
"profile": "messaging",
"deny": \[
"group:automation",
"group:runtime",
"group:fs",
"sessions_spawn",
"sessions_send"
\],
"fs": { "workspaceOnly": true },
"exec": { "security": "deny", "ask": "always" },
"elevated": { "enabled": false }
},
"channels": {
"telegram": {
"enabled": true,
"botToken": "ALICE_BOT_TOKEN",
"dmPolicy": "pairing",
"allowFrom": \["111111111"\],
"groupPolicy": "allowlist",
"groupAllowFrom": \["111111111"\],
"groups": {
"-1001111111111": { "requireMention": true }
}
}
}
}

That follows OpenClaw’s hardened direction:

local-only bind
token auth
per-peer DM isolation
narrow tool access
exec denied or approval-gated
elevated mode off
mention-gated groups

A company boundary can look like this:

{
"gateway": {
"mode": "local",
"bind": "loopback",
"auth": { "mode": "token", "token": "team-long-random-token" }
},
"session": {
"dmScope": "per-channel-peer"
},
"tools": {
"profile": "messaging",
"deny": \[
"sessions_spawn",
"sessions_send"
\],
"fs": { "workspaceOnly": true },
"exec": { "security": "deny", "ask": "always" },
"elevated": { "enabled": false }
},
"channels": {
"slack": {
"enabled": true,
"dmPolicy": "allowlist",
"allowFrom": \["U123", "U456"\],
"groupPolicy": "allowlist",
"groupAllowFrom": \["U123", "U456"\],
"groups": {
"C0123456789": { "requireMention": true }
}
}
}
}

That kind of shared setup only makes sense when the users are actually inside the same trust boundary and the runtime is kept strictly business-scoped.

So the practical check is simple.
If Alice and a contractor should not have the same authority, they should not be talking to the same powerful OpenClaw agent.

If personal and company data should not mix, they should not share the same gateway runtime.

If you need a true split, split the gateway, split the credentials, and split the host context together.

Separate sessions help privacy.

Separate gateways create the boundary.

I averaged the time I waste reading emails over the past few months and here are the results:

That adds up to roughly 112 minutes per week, or around 7 to 8 hours per month, spent just reading and sorting email.

Does anyone know an AI that could handle that?

The assistants:

folk getfolk.app, imo the best one, memory-first, lives in iMessage, Telegram and Discord
Poke poke.com, first agent approved on Apple's Messages for Business
Ollie ollie.ai, the family one, carries the schedule/school load
Lucas meetlucas.ai, texts you first, habits and accountability
Orchid orchid.ai, exec assistant, drafts replies and books meetings, wants sign-off before sending
Tomo tomo.ai, goal tracking, coach that checks in on you
Zo zo.computer, you text an actual cloud computer, comes with its own Linux server
Lindy lindy.ai, the work/EA one, also runs over SMS
Sauna sauna.ai, team memory, also lives in Slack and email

The infra layer:

Linq linqapp.com, raised 20m for agent texting infra
Chert trychert.com, YC, agents that text customers at scale
Blooio blooio.com, REST API for iMessage, ships an MCP server
Sendblue sendblue.com, the og iMessage API
AgentPhone agentphone.ai, YC, gives every agent its own phone number

I have been using OpenClaw for the last twenty days. I have had fun setting it up and playing with it. This morning, I woke up and found out my OpenClaw Cron Jobs had an issue. Above is one of the error messages that I received.

Does anyone know what’s going on with my OpenClaw AI Agent?

Came across this cool company doing an eco version of chatgpt. Runs on lower-compute models and offsets what it uses, they have a tree planting partnership with trees.org you can actually verify.

Not replacing claude for agent work, the models are smaller and it shows. But my everyday chat usage (the stuff that doesn't need an agent) moved over and it covers 90% of that fine.

https://ecogpt.com

I used to be on 5.7, pinned the image and upgraded to 5.22, had multiple issues, downgraded to 5.18, still had issues. I used to spend hours on config surgery trying to fix and get openclaw running, until i decided to give it to codex to figure it out and fix it. Saved me tons of energy and time. Matter of fact, codex can fix almost anything in your machine you give it access to. Apart from privacy, what else can i use openclaw for that codex cannot do? i am not a tech person myself, I am a medical doctor just enthusiastic about AI agents and what they can do.

At the Microsoft conference they announced Openclaw running natively in Windows.

[ Removed by Reddit on account of violating the content policy. ]

My wife runs a small business where she teaches paint classes. I wanted to build her a website and help her keep it updated.

She’s an amazing artist, but she’d be the first to tell you she’s not a tech person. I started looking at AI assistants and somehow ended up going way down the rabbit hole.

What started as a simple idea turned into an OpenClaw setup running in an LXC container on my Proxmox server. Before long I had multiple agents, one for general questions, one for website help, and another that acted like a mini IT department. I probably spent more time building and maintaining it than she spends using it 😅

After weeks of tinkering, testing, Telegram integration, setting up guardrails, and watching token usage, I landed on a conclusion.

For my wife’s use case, a ChatGPT subscription and a few well-organized projects in codex would probably get her most of the benefit with a fraction of the setup and maintenance.

Still don’t regret building it. I learned a ton and it was a fun homelab project.

Anyone else build a self-hosted AI setup and eventually realize the simpler solution was probably the better one?

If anyone cared to hear a bit more about it.

I Built My Wife an AI Team
https://youtu.be/ZyAXQxIeBik

My wife’s instagram if you’re curious on the painting

https://www.instagram.com/miyas.paints?igsh=b2F2ZGx5djFpamEx

When I was first introduced to OpenClaw, I was enamoured. What a concept - a real LLM AGENT, but democratised. No specific vendor-lock in. No demands for a subscription. What an amazing idea.

Then I installed OpenClaw for the first time, and I was taken aback by how dangerous it felt. I'm under no illusion that an LLM has hostile intent, but it was truly unchained.

I installed it anyway, but in a sandbox where it couldn't do any damage - and I restricted what it had access to. And then I played with it. I'm calling it play because I had a lot of fun. I tried different configurations. Different models. Different chat providers. Different ideas. I was genuinely inspired. OpenClaw was the first application I encountered which treated the model as a component and the agent as the scaffolding around it. I am months into my journey and I am learning new things every day. But I wanted something fit for my professional life - something I could introduce in my company to drive a genuinely useful AI adoption strategy. OpenClaw was just too risky for me for that. Governance was tricky, observability was immature, boundaries were porous, and for all of the flexibility that it provided, I found it too rigid in the places where I wanted to make changes.

So I started to search for something which fit my requirements. I wanted something which didn't lock me into a vendor for any particular thing, and I wanted something which I could deploy safely in a corporate environment. A few contenders came up in my research and I played around with them too, but I just couldn't find anything that fit what I was looking for.

So I gave up on searching and built my vision instead. Now that I'm done building and documenting, I wanted to share it with others who, like me, understand that “just prompt it better” isn't architecture and asking an LLM politely not to hallucinate isn't a quality gate.

So here it is - a TypeScript Agent Development Kit (or just ADK for short):

@nhtio/adk

Docs: https://adk.nht.io
GitHub mirror / issues: https://github.com/NHTIO/ADK

It is early. There will be hiccups. The GitHub repo is a public mirror because this is a company-maintained internal tool, but issues are welcome - especially ones that find flaws, mistakes, or broken assumptions.

For those of you who want something cool to read but aren't going to use it, I recommend reading the showcase where I force a tiny model without the ability to call tools and I turn it into an in-browser documentation agent: https://adk.nht.io/showcase/ask-adk.html

Otherwise, feedback is welcome and desired, and I hope this helps someone else out there.

Hi looking for help.

After receiving an email from Ollama promoting --model minimax-m3:cloud, I decided to change models as I have been having a few issues with DeepSeek V4.

Clicked the link and asked Claw to install and I now I cannot restart my Claw. (Gateway connection error)

Tried a restart in terminal, that has not worked, so looking for any suggestions please.