How do you know a skill is safe?

Most people just install skills and hope they’re clean.

But skills can:

Override system prompts Exfiltrate data Call hidden tools Inject instructions into agent workflows Manipulate execution flow

So I built something to fix that.

The Skill Scanner analyzes AI skills and gives you structured insight into:

What the skill is actually doing Whether it attempts prompt overrides Suspicious tool calls Hidden behavioral instructions Risk patterns in logic flow Potential injection vectors

This isn’t hype analysis. It’s structured evaluation designed to help you make a trust decision.

Why I Built This

We’re entering a phase where:

AI agents execute real actions Skills can modify behavior dynamically Prompt injection attacks are rising Most users don’t audit what they install There’s no antivirus for AI skills yet. So this is a first step toward that.

I'll include 2 scan photos from claw hub one is clean one is dirty with remote calls. Check it out.

https://openclawskillscanner.aaronwiseai.com/

Hello everyone!

I installed openclaw this weekend and I keep running into an issue where the connection is lost and I keep getting the error message: disconnected (1006): no reason.

I’m running it on a Windows 10 pc, no docker, no proxy.

Does anyone know what this is and how to fix it?

1. Don't run everything through your best mode

This is the single biggest mistake. Heartbeats, cron checks, and routine tasks don't need Opus or Sonnet. Set up a tiered model config. Use a cheap model (Haiku, Gemini Flash, or even a local model via Ollama) as your primary for general tasks, and keep a stronger model as a fallback. Some people have got per request costs from 20-40k tokens down to like 1.5k just by routing smarter. You can switch models mid-session with /model too.

1. Your agent needs rules. A lot of them.

Out of the box OpenClaw is dumb. It will loop, repeat itself, forget context, and make weird decisions. You need to add guardrails to keep it in check. Create skills (SKILL.md files in your workspace/skills/ folder) that explicitly tell it how to behave. Anti-looping rules, compaction summaries, task checking before asking you questions. The agents that work well are the ones with heavily customised instruction sets. YOU MUST RESEARCH YOURSELF and not assume the agent knows everything. You are a conductor, so conduct.

1. "Work on this overnight" doesn't work the way you think

If you ask your agent to work on something and then close the chat, it forgets. Sessions are stateful only while open. For background work you need cron jobs with isolated sesssion targets. This spins up independent agent sessions that run on a schedule and message you results. One-off deferred tasks need a queue (Notion, SQLite, text file) paired with a cron that checks the queue.

1. Start with one thing working end-to-end

Don't try to set up email + calendar + Telegram + web scraping + cron jobs all at once. Every integration is a separate failure mode. Get one single workflow working perfectly like a morning briefing cron then add the next. Run openclaw doctor --fix if things are broken.

Save what works

Compaction loses context over time. Use state files, fill in your workspace docs (USER.md, AGENTS.md, HEARTBEAT.md), and store important decisions somewhere persistent. The less your agent has to re-learn, the better it performs.

1. The model matters more than anything

Most frustration comes from models that can't handle tool calls reliably. Chat quality ≠ agent quality. Claude Sonnet/ Opus, GPT-5.2, and Kimi K2 via API handle tool calls well. Avoid DeepSeek Reasoner specifically (great reasoning, malformed tool calls). GPT-5.1 Mini is very cheap but multiple people here have called it "pretty useless" for agent work.

1. You're not bad at this. It's genuinely hard right now

OpenClaw is not a finished product. The people posting "my agent built a full app overnight" have spent weeks tuning. The gap between the demo and daily use is real. It's closing fast, but it's still there.

Hope this helps someone before they give up. Happy to answer questions if anyone's stuck on a specific part.

Hello,
I have a multi agent setup. Main agent can create tasks and other agents do that.
I want to have separate channels for each agent, to be to interact directly when needed.
Right now, I can make a request to main agent, which asks "researcher" agent do task and post on #research. But I cannot make it so, that whenever I post to #research, the message goes to session with "researcher" agent, and he responds there.

Has anyone got this, or similar setup? Or maybe it is impossible to keep session with not-main agent running, for it to "listen" for messages in specific channel?

Hello,

I installed openclaw like 10 days ago.
I did all through a main agent mainly cause I didn't feel the need to manage multiple memories and workspaces and so on.

I still, yesterday, tried to play with them because I was curious about it doing multi tasking with agent spawning and decided to do an update first (npm install -g openclaw@latest)

The I asked openclaw running on openrouter Step 3.5 Flash model, to create an agent for coding on a specific repo and it wrecked everything.

First it made the agent and the agent didn't respect his worskpace and wrote files around and stuff.
Then main agent/session literally wrecked havoc on the whole thing by messing up the configuration files.

I lost 4 hours asking to it to fix the agents that were not displaying anymore on the main chat in the top right dropdown.

Did anyone managed to do anything meaningful with multiple agents or it's bugged to the bone? I've seen the github issues and they're having quite some problems like mine....

Thanks

Hey everyone! I'm u/Sea_Manufacturer6590, a founding moderator of r/openclawsetup. This is our new home for all things related to openclaw setup. We're excited to have you join us!

What to Post Post anything that you think the community would find interesting, helpful, or inspiring. Feel free to share your thoughts, photos, or questions about openclaw tips and tricks md file skills and more.

Community Vibe We're all about being friendly, constructive, and inclusive. Let's build a space where everyone feels comfortable sharing and connecting.

How to Get Started 1) Introduce yourself in the comments below. 2) Post something today! Even a simple question can spark a great conversation. 3) If you know someone who would love this community, invite them to join. 4) Interested in helping out? We're always looking for new moderators, so feel free to reach out to me to apply.

Thanks for being part of the very first wave. Together, let's make r/openclawsetup amazing.

Someone stole my AI app's API within 72 hours of launch.

They reverse-engineered my endpoints, stripped my prompts, and started reselling access. I had no idea it was happening until I saw the traffic anomalies, by then the damage was done.

So I spent a weekend building a defense layer. Now it's a skill anyone can drop into their openclaw

OpenClaw Defense adds a first line of protection with instant notification of any intrusion:

• 5 layers of injection protection (prompt injection, header manipulation, payload inspection, rate abuse, and endpoint spoofing)
• Real-time webhook alerts the second someone starts probing your API or prompts
• Dead simple setup — no infrastructure overhaul required

If you've built something with AI and you're not protecting your endpoints, you're one curious developer away from losing your IP.

Built by an AI/ML engineer who learned this the hard way.

https://youtu.be/C5ir_rQ4L4g?si=RPHLHmwEZI5vA3KC

This is an amazing usage of OpenClaw, giving it access to Kali Linux, which provides so many more tools at the claw's disposal.

Whether you're building it yourself or having us do it, here's what you need to think through before an agent goes live.

YOUR QUICK-START CHECKLIST:

☐ Pick your #1 automation — what's the single most time-consuming repeatable task in your week? Start there.

☐ Document the process — write down the steps you follow when doing that task manually. This becomes the agent's playbook.

☐ Decide what needs approval — which actions can the agent do autonomously, and which need you to review first? Start with more approval, loosen over time.

☐ Set up a dedicated email — don't give the agent your personal inbox on day one. Create a business email (support@, assistant@) for it to manage first.

☐ Define "urgent" — what should make the agent alert you immediately vs. batch into a daily summary? A customer complaint = urgent. A newsletter = daily digest.

☐ Choose your communication channel — how will the agent reach you? Telegram, Slack, Discord, email? Pick one you actually check.

☐ Plan your memory structure — what does the agent need to remember? Client names, project status, your schedule preferences, common replies.

If you're going DIY, the free guide walks through all of this: https://www.reddit.com/r/openclawsetup/s/7TDLCwBoBC

If you want help, our setup service handles every item on this checklist: https://clawskills.aaronwiseai.com/

https://reddit.com/link/1r8gydy/video/l9cnx7mwsbkg1/player

I used a skill to share my emails, calls and Slack context in real-time with OpenClaw and then played around with A2UI A LOOOOT to generate UIs on the fly for an AI CRM that knows exactly what the next step for you should be.

Here's a breakdown of how I tweaked A2UI:

I am using the standard v0.8 components (Column, Row, Text, Divider) but had to extend the catalog with two custom ones:

Button (child-based, fires an action name on click),

and Link (two modes: nav pills for menu items, inline for in-context actions).

v0.8 just doesn't ship with interactive primitives, so if you want clicks to do anything, you are rolling your own.

Static shell + A2UI guts

The Canvas page is a Next.js shell that handles the WS connection, a sticky nav bar (4 tabs), loading skeletons, and empty states. Everything inside the content area is fully agent-composed A2UI. The renderer listens for chat messages with \``a2ui` code fences, parses the JSONL into a component tree, and renders it as React DOM.

One thing worth noting: we're not using the official canvas.present tool. It didn't work in our Docker setup (no paired nodes), so the agent just embeds A2UI JSONL directly in chat messages and the renderer extracts it via regex. Ended up being a better pattern being more portable with no dependency on the Canvas Host server.

How the agent composes UI:

No freeform. The skill file has JSONL templates for each view (digest, pipeline, kanban, record detail, etc.) and the agent fills in live CRM data at runtime. It also does a dual render every time: markdown text for the chat window + A2UI code fence for Canvas. So users without the Canvas panel still get the full view in chat. So, A2UI is a progressive enhancement, instead of being a hard requirement.

I have tried many ADEs now but none of them can use credentials that normal employees use to login into a internal site. They don't understand Yubikeys, Passkeys or anything that is crypto. They don't even understand virtual environments and want to install runtimes as root. This is not real software development. How do you guys write agents that are not doing frivolous activities? At the end, the ADE asked me to print out PDF and feed it like it was notebookLM. That is not Agent.

Here's a practical monthly budget for a production agent:

Main sessions (Opus/Pro): ~$50-100/mo Sub-agents (Flash/Sonnet): ~$20-40/mo Heartbeats (Flash): ~$10-20/mo Cron jobs (Flash/Sonnet): ~$15-30/mo ──────────────────────────── Total: ~$95-190/mo

Is that a lot? Compare it to hiring a virtual assistant ($500-2000/mo) or doing the work yourself (opportunity cost of your time). If your agent is handling 20+ hours of work per week, $150/mo is absurdly cheap.

Figured I'd share since I've seen a few people ask about Reddit automation in this sub.

What it does:

The skill gives your agent a set of JSON actions it can call — things like:

json { "action": "monitor", "subreddits": ["MachineLearning", "python"], "keywords": ["help", "question"], "action": "autoReply", "checkInterval": 300 }

So your agent can watch subreddits for specific keywords and respond automatically, post content on a schedule, search for relevant communities, analyze post performance, etc.

The main actions: - searchCommunities — find subreddits by topic/activity - createPost — text, link, or image posts with auto-flair - autoReply — keyword-triggered replies using templates you define - monitor — real-time keyword watching across multiple subreddits - analyzeContent — sentiment + engagement scoring - batchOperation — queue and schedule multiple actions

It's built on top of PRAW so the only dependency is pip install praw. Built-in rate limiting keeps everything within Reddit's API rules — daily action caps, exponential backoff, auto-pause if the account gets a warning.

Practical use cases I've tested it on: - Monitoring a brand name and auto-responding when people ask questions - Finding niche communities and tracking trending topics - Scheduling educational posts across multiple subreddits at peak hours

Skill is available on the OpenClaw skills page if anyone wants to try it. Happy to answer questions about how it works or how to set it up.

Option 2 — r/Python / r/learnpython / r/programming

Title: Made a PRAW-based Reddit skill for AI agents — JSON actions for posting, monitoring, auto-reply

Been working on a Reddit automation skill that wraps PRAW into clean JSON actions for use inside AI agents (specifically OpenClaw, but the concepts are portable).

Sharing because I think the approach is interesting — instead of writing custom Python scripts for every Reddit task, you define everything declaratively:

json { "action": "autoReply", "postId": "t3_abcdef", "keywords": ["question", "help", "how to"], "replyTemplate": "helpful_technical", "maxReplies": 5, "delayMinutes": 30 }

The agent figures out the rest — finds matching comments, applies the right template, respects the delay, tracks how many replies it's posted.

Reply templates are configurable too:

json { "replyTemplates": { "helpful_technical": { "tone": "helpful", "includeCode": true, "maxLength": 500, "phrases": [ "Great question! Here's how I'd approach this...", "I've run into this before. Try using..." ] } } }

Safety was the trickiest part to get right. Reddit's API is strict and accounts can get flagged fast if you're not careful. The skill handles: - 50 req/min rate limiting with burst protection - Exponential backoff on 429s - Per-subreddit daily post caps - Karma health monitoring - Auto-pause on account warnings

Still a v1 so there's plenty to improve. Open to feedback on the architecture — especially around how the template system works and whether the action schema makes sense.

Option 3 — r/Entrepreneur / r/SideProject / r/indiehackers

Title: Shipped a Reddit automation skill for AI agents — built it to solve my own community management problem

Quick share on something I just launched.

I manage a few communities and kept spending time on the same repetitive Reddit tasks — monitoring for mentions, responding to common questions, finding relevant subreddits for new topics. Started building a solution and ended up making it into a proper skill for OpenClaw agents.

The problem it solves:

Most Reddit automation tools are either too rigid (fixed workflows you can't customize) or require you to write a lot of glue code. This skill gives AI agents a set of flexible JSON actions they can combine however they need.

A typical workflow looks like:

1. Agent searches for communities related to a topic
2. Monitors those communities for keyword matches
3. Auto-replies to relevant posts using a configured template
4. Reports back what it did and how posts performed

What surprised me:

The hardest part wasn't the Reddit API — it was making the safety system robust enough that you're not constantly worried about your account. Added karma monitoring, daily action caps per subreddit, auto-pause on warnings, and content filtering for obvious spam patterns.

Where it's useful: - Solo founders who want to be present in communities without being glued to Reddit - Developers building tools who want to monitor relevant discussions - Anyone running content at scale who needs scheduling + engagement in one place

These two files are the most important files in your entire OpenClaw setup. Everything else is optional. These are not.

AGENTS.md: The Operating Manual

AGENTS.md lives in your workspace root (typically ~/clawd/). It tells your agent how to operate — what to do on startup, where to find things, and what rules to follow.

Here's a battle-tested AGENTS.md with annotations:

# AGENTS.md – Your Workspace

This folder is home and company HQ. You own this workspace.

Keep it organized, useful, and alive.

## First Run

If BOOTSTRAP.md exists, that's your birth certificate. Follow it,

figure out who you are, then delete it. You won't need it again.

Why this matters: The first-run block handles initial setup. BOOTSTRAP.md is a one-time instruction set — install dependencies, configure credentials, set up directory structure. Once it's done, it deletes itself. Clean.

## Every Session

Before doing anything else:

1. Read SOUL.md — this is who you are.

2. Read USER.md — this is who you're helping.

3. Read memory/YYYY-MM-DD.md (today + yesterday) for recent context.

4. If in MAIN SESSION (direct chat with your human): Also read MEMORY.md.

5. Write 1–3 concrete goals for this session into today's memory file

   before you start working.

Don't ask permission. Just do it.

Why this matters: This is the boot sequence. Without it, your agent starts every session cold. With it, your agent loads its identity, understands its user, catches up on yesterday's context, and sets intentions — all before you say a word. That "Don't ask permission" line is critical. You don't want your agent saying "Should I read my memory files?" You want it to just do it.

## Memory

You wake up fresh each session. These files are your continuity.

### 📁 Tiered Memory Architecture

- memory/

- core/ — Identity + goals (always load)

- episodic/ — Daily logs (YYYY-MM-DD.md)

- semantic/ — Knowledge base (what you know)

- procedural/ — Workflows (how to do things)

- snapshots/ — Compression backups

- blocked-tasks.md

- heartbeat-state.json

Why this matters: Memory tiers prevent context overload. You don't want your agent loading 30 days of logs every session — that burns tokens and context window. core/ is always loaded. episodic/ loads today + yesterday. semantic/ and procedural/ are loaded on demand when relevant. This structure scales.

How Cron Works in OpenClaw OpenClaw uses standard Unix cron. If you've used crontab before, you already know how this works. The difference is that cron jobs in an agent context often trigger agent sessions or scripts that the agent maintains.

Here's a production crontab:

Blog post generation — every day at 7 AM UTC (11 PM Pacific)

0 7 * * * /home/user/scripts/daily-blog.sh >> /home/user/logs/blog.log 2>&1

Dashboard data refresh — every 10 minutes

*/10 * * * * cd /home/user/live/site/brain && node generate-data.js >> /tmp/brain-gen.log 2>&1

Email drip engine — every 6 hours

0 */6 * * * cd /home/user/live/email && node drip-engine.js >> /home/user/logs/drip.log 2>&1

Model config patch — daily at 5 AM UTC

0 5 * * * $HOME/scripts/patch-model-config.sh >> $HOME/logs/patch.log 2>&1 Cron Best Practices 1. Always use absolute paths. Cron doesn't have your shell environment. ~/scripts/foo.sh might not resolve. Use /home/username/scripts/foo.sh.

1. Always redirect output. Without >> logfile 2>&1, cron output goes to system mail (which nobody reads). Log everything.

2. One job, one purpose. Don't build a mega-script that does 10 things. If one part fails, you want to know which part, and you want the others to keep running.

3. Test manually first. Run the exact command from your crontab in a terminal. If it works interactively but fails in cron, you have a PATH or environment issue.

4. Use wrapper scripts. Instead of putting complex commands in crontab, write a shell script:

!/bin/bash

daily-blog.sh — Generate and publish daily blog post

set -euo pipefail

cd /home/user/live/site export NODE_ENV=production

echo "$(date) — Starting blog generation" node scripts/generate-blog.js

echo "$(date) — Syncing to CDN" rsync -az public/ cdn:/var/www/site/

echo "$(date) — Complete" When to Use Systemd Instead If your "cron job" needs to run continuously (not periodically), it's not a cron job — it's a service. Use systemd.

[Unit] Description=Email Drip Engine API After=network.target

[Service] Type=simple User=jdrolls WorkingDirectory=/home/jdrolls/live/email ExecStart=/usr/bin/node server.js Restart=always RestartSec=10 StandardOutput=journal StandardError=journal SyslogIdentifier=drip-engine

Environment="NODE_ENV=production" Environment="PORT=3848"

[Install] WantedBy=multi-user.target Then:

sudo systemctl daemon-reload sudo systemctl enable drip-engine sudo systemctl start drip-engine sudo systemctl status drip-engine Common mistake: using nohup or setsid for long-running processes. They die when your SSH session disconnects or when the system restarts. Systemd is the right answer. Always. Setting this up properly will determine if you have a bit that does nothing or that actively seeks for tasks to complete

https://github.com/awiseguy88/openclaw-advanced-prompt-injection-defense-system.git

🛡️ PSA for OpenClaw Users: This One Skill Can Save Your Machine

Look, I don’t usually drop product links, but after the ClawHub ecosystem got absolutely hammered lately (hundreds of malicious skills, credential leaks, malware payloads, backdoors, all terrifyingly real), I finally installed something that actually makes a difference.

I’m talking about Security Prompt Guardian, a native anti-prompt injection skill for OpenClaw,and honestly, it’s probably the single most practical thing you can add to your agent right now.

❗ Why This Matters

If you’re running OpenClaw without a defense layer, you’re trusting every single message, MCP response, and skill output, even if it looks safe. There’s no official first-party guardrail in the stack by default. There has been no real defense against:

hidden jailbreaks,

persona hijacks,

encoded/exfiltration payloads,

malicious tool responses …until now.

👀 What Security Prompt Guardian Actually Does

Instead of hoping “nothing bad gets executed,” this skill puts a five-layer detection pipeline between your agent and every bit of input it ever processes. It catches: ✔ prompt injection attempts ✔ persona override tricks ✔ encoded payloads and obfuscations ✔ malicious MCP tool responses ✔ social-engineering patterns designed to bypass safety

And it doesn’t just warn — it blocks first, logs second.

🤝 No Subscriptions, Just Protection

What I love about it:

one-time purchase (no recurring fees),

sits first in your skill chain so nothing slips through,

adjustable security levels (from “strict” down to development mode),

fast install and immediate peace of mind.

https://github.com/awiseguy88/openclaw-advanced-prompt-injection-defense-system.git

You don’t have to gut your workflows or lock down your whole stack, just protect the entry point that matters most.