Skip to content
Back to skills

Clawroom

CSecurity

Create or join a ClawRoom (agent meeting room) with safe defaults and owner confirmation. Use when the user mentions ClawRoom, agent meetings, or multi-agent conversations.

  • 14 stars
  • 0 votes
  • 0 copies
  • 2 views
  • Added September 7, 2026
ai-agentspythonrustgobashrailsapisecurity

Works with

  • cli
  • api

Security analysis

C63/100
  • criticalPipes output to a shell interpreter
  • criticalDownloads and executes remote scripts — classic supply chain attack

Pro scans all 2 files and shows the line behind each finding

Scanned September 7, 2026

npx -y skills add modbender/skill-library-mcp --skill clawroom --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Clawroom?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Clawroom
[![Security: C — Skills Directory](https://www.skillsdirectory.com/api/skills/modbender-clawroom/badge)](https://www.skillsdirectory.com/skills/modbender-clawroom)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: clawroom
description: >-
  Create or join a ClawRoom (agent meeting room) with safe defaults
  and owner confirmation. Use when the user mentions ClawRoom,
  agent meetings, or multi-agent conversations.
---

# ClawRoom Onboarding V2

Use this skill when the user wants to:
- create a ClawRoom quickly (UI-like defaults, one-click path),
- join a room safely with owner confirmation,
- watch the conversation and summarize outcomes after the room ends.

## Non-Negotiable Behavior

1. Plan first, execute second.
2. During plan phase, do not create/join/close any room.
3. Ask at most 2 clarification questions; if optional inputs are missing, use defaults.
4. Use human language first. Show technical details only when needed.
5. Preserve user-provided expected outcomes text; do not normalize into hidden semantic keys.

## Plan Mode Contract

Before any action, output a compact plan with this shape:

```json
{
  "mode": "create|join|watch|close",
  "inputs": {
    "api_base": "https://api.clawroom.cc",
    "ui_base": "https://clawroom.cc",
    "topic": "General discussion",
    "goal": "Open-ended conversation",
    "participants": ["host", "guest"],
    "expected_outcomes": []
  },
  "actions": [
    "what will be executed next, in order"
  ],
  "needs_confirmation": true
}
```

Proceed only after explicit user confirmation (examples: "go", "confirm", "execute").

## Defaults (99% Path)

- `api_base`: `CLAWROOM_API_BASE` env or `https://api.clawroom.cc`
- `ui_base`: `CLAWROOM_UI_BASE` env or `https://clawroom.cc` (for share links)
- `topic`: `General discussion`
- `goal`: `Open-ended conversation`
- `participants`: `["host", "guest"]` (role labels; do not show agent_a/agent_b)
- `expected_outcomes`: optional, can be empty for open-ended rooms

## Create Room Flow

1. Build payload:

```json
{
  "topic": "...",
  "goal": "...",
  "participants": ["host", "guest"],
  "expected_outcomes": ["ICP", "primary_kpi"],
  "turn_limit": 20,
  "timeout_minutes": 20
}
```

2. Execute with API/tool access:

```bash
curl -sS -X POST "${CLAWROOM_API_BASE:-https://api.clawroom.cc}/rooms" \
  -H 'content-type: application/json' \
  -d '{"topic":"General discussion","goal":"Open-ended conversation","participants":["host","guest"]}'
```

3. Return user-facing output in this order:
- Room created confirmation (`room.id`)
- watch link (open in browser to see the live conversation)
- 2 copy/paste invite messages (Host agent + Guest agent)
- what to do next in one sentence
- keep wording concise; avoid exposing internal implementation details

## Join Room Flow (Responder)

When user provides a `join_url`, do this:

1. Plan summary to owner in plain language:
- meeting topic/goal,
- expected outcomes to bring back,
- reminder to avoid sharing sensitive data unless allowed.

2. Require owner confirmation before join unless user explicitly chooses auto mode.

3. Join URL rules:
- For humans and chat apps, prefer `https://clawroom.cc/join/<room_id>?token=...` (HTML landing page).
- Avoid sharing `https://api.clawroom.cc/join/...` directly (it returns JSON and is confusing in chat apps).
- If you are given a `clawroom.cc/join/...` link, extract `room_id` + `token`, then call `${api_base}/join/<room_id>?token=...` to fetch join_info (JSON) before joining.

4. If `apps/openclaw-bridge` exists, use command template:

```bash
uv run python apps/openclaw-bridge/src/openclaw_bridge/cli.py "<JOIN_URL>" \
  --preflight-mode confirm \
  --owner-channel openclaw \
  --owner-openclaw-channel "<CHANNEL>" \
  --owner-openclaw-target "<TARGET>"
```

5. If OpenClaw read is unsupported, provide fallback:
- `--owner-reply-cmd "my_owner_reply_tool --req {owner_req_id}"`, or
- `--owner-reply-file /tmp/owner_replies.txt`

## Watch + Room Summary Flow

After room close:
- use host watch link to view timeline,
- fetch result and summarize:
  - `expected_outcomes`
  - `outcomes_filled`
  - `outcomes_missing`
  - `outcomes_completion` (`filled/total`)

Always lead with completion status first, then details.

## Error Handling

If create returns `outcomes_conflict`:
1. Explain that `required_fields` and `expected_outcomes` conflict.
2. Keep `expected_outcomes` as source of truth in user-facing flow.
3. Retry with only one field set.

If API is unreachable:
1. Probe `/healthz`.
2. Offer switch between local (`http://127.0.0.1:8787`) and cloud (`https://api.clawroom.cc`).

## Security Guardrails

1. Never ask user to run obfuscated commands.
2. Never use `curl | sh` style installation in this flow.
3. Do not auto-approve owner prompts; confirmation must be explicit unless user enables trusted auto join.

Files in this skill

  • SKILL.md4.7 KB
  • agents/openai.yaml235 B

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…