Data source
skills.status(gateway) returns all skills plus eligibility and missing requirements, including allowlist blocks for bundled skills.- Requirements come from
metadata.openclaw.requiresin eachSKILL.md.
Install actions
metadata.openclaw.installdefines install options (brew/node/go/uv/download).- The app calls
skills.installto run installers on the gateway host. - Operator-owned
security.installPolicy(enabled,targets,exec) can block gateway-backed skill installs before installer metadata runs. Built-in dangerous-code scanning (used for plugin installs) is not wired into the skill install flow. - If every install option is
download, the gateway surfaces all download choices. - Otherwise the gateway picks one preferred installer using current install preferences (
skills.install.preferBrew,skills.install.nodeManager) and host binaries: Homebrew first whenpreferBrewis enabled andbrewis present, thenuv, then the configured node manager, then Homebrew again if available (even withoutpreferBrew), thengo, thendownload. - Node install labels reflect the configured node manager, including
yarn.
Env/API keys
- The app stores keys in
~/.openclaw/openclaw.jsonunderskills.entries.<skillKey>. skills.updatepatchesenabled,apiKey, andenv.
Remote mode
- Install and config updates happen on the gateway host, not the local Mac.