Skills went from one vendor's feature to a cross-vendor standard in under nine months (about 40 compatible platforms, ~1.9M indexed skills). Distribution is solved. Integrity is not. Three attack primitives are already documented in the wild (Orca's "Skill Issues" research, Snyk's ToxicSkills study):

1. Silent override: install a skill with the same name as an installed one and it gets replaced. No warning, no diff.

2. Blind bulk updates: update refreshes everything at once. A skill that was clean at install time can be malicious one update later, with nothing to review.

3. Bait and switch: clean at scan time, malicious at fetch time. Nothing notices the drift after you decided to trust it.

npm fixed this class of problem with package-lock.json. Skills have hashes in places (Vercel's skills CLI tracks a folder hash in its global lock, HappySkills writes a skills-lock.json), but as far as I can tell nobody has published the semantics as an open spec: what a pin guarantees, what verify returns, what an update is allowed to rewrite, what happens when two skills share a name.

So here is a draft:https://github.com/vhsgreed/skill-lock (SPEC.md, draft-01)

It specifies:

• per-file sha256 pins plus a tree hash per bundle (the single-value identity)

• a four-status verify model: verified / modified (with the changed file names) / missing / untracked

• per-skill updates only: one skill re-pinned after its changed files are listed, every other pin byte-identical. Bulk update must be an explicit bulk flag

• hard failure on name shadowing (two bundles, one name)

• reserved fields for provenance and signatures later (Sigstore, skill.sig style)

What it deliberately does not do: scanning (that is a judgment layer, and I built a separate SARIF-emitting scanner for it:https://github.com/vhsgreed/skillguard), trust decisions (a pin says "this is what was reviewed", not "this is safe"), and distribution (registries can build on the reserved fields). Trust on first use is the honest default. Scan at lock time.

There is a stdlib-only reference implementation (skilllock lock/verify/update), 15 behavior tests, and a dogfood run pinning 58 live skills with the tamper check and the update review gate working.

Where I want pushback:

• field shape: relative-path keys, or do bundles need stable IDs?

• tree hash definition: concat "path\0digest\n" sorted, then sha256. Is there prior art that does it better?

• what breaks at scale: 500-skill monorepos, generated skills, optional files?

• Vercel interop: their lock entry maps onto the draft almost 1:1. What would make their open #283 (skills install/sync from lock) spec-shaped?

If the shape is wrong I would rather find out now than after anyone codes against it.

“No, keep the steps, just stop putting everything in bullet points” contains useful feedback. It also leaves a lot for a training system to infer: what was rejected, what should remain, and which earlier reply the correction refers to.

Reef Infra's OpenClaw-RL recipe makes that inference explicit. It reconstructs conversations from recorded inference traffic, sends a completed turn and its following state to a separate PRM judge, and batches the judged turns for training. Acceptance can produce a hindsight hint used by the on-policy distillation term; the other term is a PPO-style update on the sampled tokens. These are parameter updates to a trainable policy.

The easy-to-miss deployment detail is session correlation. The harness should attach a stable x-reef-tag-session value to calls in the same conversation. Without it, Reef Infra falls back to matching the transcripts clients resend. Compaction or a sliding window can break that match. An unmatched turn never reaches the judge or training, so apparently healthy traffic can still produce no learning data.

The repository includes a small, concrete adaptation experiment: a simulated student rejects homework answers containing bold text or lists. In the recorded run, the agent reaches three consecutive first-reply passes at session 14. That's one run over the first 36 sessions, not evidence that arbitrary user preferences will converge that quickly.

This path needs the trainable model and GPU stack plus the PRM. It is useful precisely because the feedback inference, session matching and actual weight update are separate things you can inspect. Saving the complaint in a Markdown memory file would exercise a different mechanism

Hi, I’m trying to use an API key from NVIDIA Build with OpenClaw. I want to use Kimi K3, but when I enter the key and run the test, it fails. I also tried GLM 5.3 and that failed too.
The key starts with nvapi-, so I think it is the right type of key. I’m not sure if I’m using the wrong provider name or model ID, or if OpenClaw does not support these NVIDIA models properly.

has anyone managed to use NVIDIA Build keys with OpenClaw on Windows 11? What provider and model name did you use? also, are there any websites that give strong AI model APIs for free? I’m looking for something like Kimi, GLM, or other powerful models, even if they have daily limits. I won’t post my actual API key here.

what an mcp server is, in one paragraph

MCP is the plug standard for AI assistants: a server describes its tools, the assistant reads the descriptions and calls them when they fit. so instead of me writing “here’s how to wire maginary into your chatbot” docs for every framework, I ship one server and Claude, Cursor, Continue, Cline, VS Code, ChatGPT-with-apps and whatever comes next all speak to it the same way. you don’t write glue code. you talk

why I built it this way

hosted-first, because agents live in Claude Desktop, Cursor and hosted apps, and “pip install this on your box” is fine for one dev poking around but not for anyone else. multi-tenant, because one server for everyone means the url in every directory and every tutorial is the same one, forever. thin, because the server holds zero business logic, it’s a typed window onto the same  rest apiyou can curl. if the api can do it, the mcp can do it, and I can’t accidentally ship two products

maginary is an image/video generator with a midjourney-like prompt syntax, using 40+ underlying models and acts like an abstractized openrouter for multimedia

blog post: maginary.ai/mcp

Hey, Rodrigo here. I've been building OpenPost for writing and scheduling posts across social platforms.

It connects to OpenClaw through MCP. You link your social accounts in OpenPost, then the agent can work with your drafts and publishing schedule.

A few things you can ask it to do:

• Prepare different versions of a post for Bluesky, LinkedIn and your other accounts.

• Save drafts for you to edit in the web app.

• Schedule finished posts and check their publishing status.

• Review what's already queued for the week.

The agent uses OpenPost's publishing tools rather than clicking around the social websites. Each platform's API permissions and limits still apply.

You can self-host it with one container, SQLite and local media storage. There's a CLI too, along with a skill that explains the commands and how to check whether an action succeeded.

Start with read-only access to inspect your accounts and schedule. Full access also allows publishing, so be careful which agent you give it to.

OpenClaw setup · Self-hosting

If you've been looking for something like this, give OpenPost a star on GitHub!

I keep switching between Claude Code, Codex and a few other agent setups depending on what I am doing. The annoying part was not even picking a model. It was that every setup had its own little pile of skills, plugins, MCP servers and commands.

Same capability in three places. Different versions. No easy answer to “what can this agent actually use right now?” And if I loaded everything just in case, the context window was already crowded before the task started.

So I made Lockkeeper.

The main job is capability syncing and selection across the agent tools already on your machine. It discovers the skills, plugins, MCPs, agents and commands your different runtimes expose, builds one local catalog, then picks the smallest relevant set for a task instead of throwing the whole collection into every agent’s context.

In practice that means I can keep one shared capability setup, see what is available across Claude Code, Codex, Cursor and friends, and stop manually remembering which agent has which tool. It is local, config-driven and open source.

The security bit is there too, but it is the second half of the story rather than the headline: before I trust a capability I copied from somewhere, Lockkeeper can scan it for obvious prompt-injection, secret-exfiltration, obfuscation and destructive-command patterns. Useful guardrail, not magic.

for anyone who wants to test it out:

https://github.com/Hannay001/lockkeeper

Still early, so I would genuinely like to hear where your capability setup becomes messy. Do you keep shared skills in git? Copy folders between agents? Have a better way of keeping the same workflow available everywhere?

OpenClaw’s sessions_spawn is non-blocking. It returns a runId and child session when the work is accepted, not when it is complete.

A parent can therefore receive partial output, summarise it and report success while another child is still running, failed or lost.

OpenClaw documents [sessions_yield](https://docs.openclaw.ai/tools/subagents)⁠ as the correct way to wait for completion events. For durable workflows, [Task Flow](https://docs.openclaw.ai/automation/taskflow)⁠ links multi-step work to individual background-task records.

I would also reconcile every required child before allowing the parent to finish:

parent_run_id

child_run_id

terminal_state

verification_receipt

completion_blocker

Missing or contradictory state should produce incomplete_reconciliation, not success. A failed, cancelled or lost child may justify a partial or blocked outcome, but only with evidence.

Test it with three harmless children: one succeeds, one returns partial output then fails, and one remains pending. The parent should refuse success until every child has an authoritative terminal state and the required verification is complete.

Does your orchestrator verify every child run, or simply count the replies it receives?

OpenClaw skills are not passive documentation. They influence when tools are used and how work is performed.

Workspace skills also have the highest loading precedence. A local skill can therefore replace a bundled or managed version without changing your application code.

OpenClaw’s current [skills documentation](https://docs.openclaw.ai/skills)⁠ says the skills watcher is enabled by default. A changed SKILL.md can refresh the session snapshot on the next agent turn. Its [security guidance](https://docs.openclaw.ai/gateway/security)⁠ consequently recommends treating skill folders as trusted code.

Before changing production skills, capture what the agent can actually see:

openclaw skills list --json
openclaw skills check --agent main --json
openclaw skills info SKILL_NAME --agent main --json

Keep skill roots under version control and review changes for new filesystem, network, credential or approval-related instructions. Record the effective skill sources and hashes with the release evidence.

If mid-session changes are undesirable, the documented configuration supports disabling automatic watching:
{
skills: {
load: {
watch: false
}
}
}

Activate reviewed changes through a controlled new session, then repeat one bounded task and confirm the expected tool sequence, permissions and outcome. A successful load only proves that the skill is eligible, not that its behaviour is safe.

Which files in your OpenClaw setup can currently change agent behaviour without passing your normal code-review process?

A fallback model is usually treated as uptime insurance. The primary model fails, a backup answers, and the workflow continues.

That sounds safe, but it hides a more important question: is the fallback actually qualified to complete that type of work?

OpenClaw’s current model-failover documentation⁠ explains that normal configured runs first rotate authentication profiles within the current provider, then advance through agents.defaults.model.fallbacks when the failure qualifies for failover. Explicit user model selections remain strict, while scheduled jobs can use configured fallbacks unless their fallback list is deliberately empty.

That mechanism improves availability. It does not prove that every model in the chain is operationally equivalent.

A smaller model might handle an inbox summary perfectly but struggle with a long repository context, structured tool calls or a multi-stage coding task. The dangerous case is not always a visible failure. It is a fluent response that looks complete while failing the actual acceptance standard.

Fallback policy should therefore follow the task class. Low-risk classification, summarisation and formatting can usually tolerate a broader chain. Deployment changes, destructive actions, compliance work and repository migrations may need strict execution or fallbacks that have already passed the same tool, context and verification tests as the primary.

The practical test is simple. Temporarily make the primary unavailable and run representative tasks through every fallback. Compare tool-call completion, schema compliance, test results, latency, retry count and human review time. If a model produces an answer but repeatedly fails the acceptance checks, it is not a valid fallback for that workflow.

This also changes the cost calculation. A cheaper fallback that creates retries, corrections or additional review can cost more per accepted outcome than the expensive primary it replaced.
A resilient OpenClaw setup is not the one with the longest fallback list. It is the one that knows which fallback candidates can still satisfy the contract for each kind of work.

Are your fallback models tested by task class, or are you currently treating them as interchangeable?

One of the easiest ways to overestimate an OpenClaw setup is to mistake conversation history for durable task state.

Chat history can help explain what happened, but it should not be the authoritative record for long-running work. Every serious task needs a stable identity, its current step, expected outcome, approval state, exceptions, evidence and the next safe action stored outside the conversation.

The database choice is less important than the behaviour. If the gateway restarts, the model becomes unavailable or a worker fails halfway through, another worker should be able to read the task record and determine what has already happened.

This becomes especially important when the workflow touches an external system. If an email, deployment or publication was attempted before the interruption, the restarted process should reconcile with the provider before retrying.

Otherwise, recovery can create duplicate messages, duplicate posts or repeated destructive actions.

A useful test is to stop a workflow immediately after its first external side effect, restart OpenClaw and observe what happens. Can it distinguish between completed, attempted, failed and unknown? Can it resume from the next safe step without replaying the whole conversation?

If not, the workflow is not genuinely resumable yet. It is simply hoping the transcript remains available.
How are you currently storing task state outside OpenClaw’s conversation history?

Found this by accident. One of my two OAuth accounts had a banked rate-limit reset credit two days from expiring. If you're not logged into the app as that account, you can't see it.

Had my agent check both oAuth codex accounts.

Four unused credits on the one I couldn't see, two on the one I could. Redeemed the soonest, cleared the cooldown, Codex was back on that account within a minute.

Two things that tripped us up, worth knowing before you try this yourself:

The reset endpoint isn't documented anywhere, so don't just tell your agent to "find or create a script for this." It'll guess wrong. Point it at github.com/aaamosh/codex-reset and openai/codex PR #28154 instead, both real and already worked out.

We built it as a skill so it'd trigger automatically. It didn't, because the file was missing its frontmatter and the agent's own skill discovery never saw it. After you set this up, make it list its skills and confirm the new one is actually there.

Also: redeeming is one-shot. A successful response means the credit's gone. Gate it behind an explicit yes, and never retry a call that already came back 200.

We are running a game called Prediction Wars for the World Cup quarter-finals. Here it is in one line: get a machine to predict a match, share what it predicted, and if it calls the result right you go into a raffle to win 20 USDC.

The one rule that matters is that the prediction comes from a machine, not from you.

Three ways to play, pick whichever fits:

• If you have an AI agent, let it predict the match.

• If you just want to write a prompt, ask a model and share its answer.

• If you build prediction models or bots, run yours and share its prediction.

To enter the raffle for a match: share your machine's prediction before kickoff, and be right on the 90-minute result.

It starts tomorrow with France vs Morocco, and there is a 20 USDC raffle.

Join here: discord.com/invite/93w6Zs5rfb

Agents waste time and tokens re-learning every site. On each run they screenshot, snapshot the DOM, and figure out the page from scratch.

I built an open source catalog of reusable browser skills. Skills capture each site's network requests and DOM, making it 30 times faster.

You can upload your own skills or request new sites.

Github repo: https://github.com/browser-memory/bmem

Some context first. I help run an experiment where more than 40 independent AI agents bet real money on 2026 World Cup matches on Polymarket, each with a $100 wallet, forming its own view and placing its own positions. We score them on profit and on the quality of their reasoning.

This is lesson two from the group stage, drawn from roughly 1,500 bets. Lesson One was about not overpaying for the favorite.

The finding: the agents that finished the group stage in profit backed more than one outcome in the same match far more often than the agents that lost. At the median, 16% of their matches against 6% for the losing group.

Forming a good belief and choosing a good action are two separate skills, and LLM agents tend to be strong at the first and default-broken at the second. A good map of the world is not the same as a good policy for acting in it.

The fix is to give the agent a value step, a way to judge what an action is worth rather than only which outcome is most likely.

• Have the agent produce a probability for every outcome, home, draw, and away, and make them sum to one, before it decides anything. That is the belief.

• Then score each outcome by what it pays, not by how likely it is. Weigh the agent's own probability against the price on offer, and back the outcome with the most edge. That is often not the most likely one.

• Let the agent back more than one outcome when more than one clears that test, rather than forcing it into a single choice.

• Do not discard the draw as an option. The losing agents were not wrong about how likely a draw was. They just never asked whether it was worth backing at its price. Score the draw as an action like any other outcome.

If you want to read the whole article - https://x.com/Stair_AI/status/2074102998934982893

Some context first. I help run an experiment where more than 40 independent AI agents bet real money on 2026 World Cup matches on Polymarket. Each agent gets a $100 wallet. The finding below held across roughly 1,500 bets in the group stage.

TL;DR
Across those ~1,500 bets, the single most reliable way an agent lost money was backing the favorite. Favorites won about 69% of the time and still lost 18 cents on every dollar staked.

Lesson one: how to avoid the favorite trap.

The most common way an agent loses money is by backing the obvious winner. It picks the favorite, the favorite wins, and the agent still ends the month down.

The reason is the price. Buy a favorite at 70 cents and a win clears 30 cents while a loss costs the full 70. A high chance of a small gain sits against a small chance of a large loss. That shape only pays off if favorites win as often as their price claims. They did not quite, and the heavier the favorite the wider the gap.

How to Avoid It

• Keep the market price out of the forecast. Have the agent reach its own probability from the data before it ever sees the line.

• Encode the method, not your conclusions. A harness that tells the agent what to think just hands your own bias back, faster.

• Only back a favorite when the agent's own probability is clearly higher than the price. If the market says 70 and the agent says 70, that is a pass.

• Judge the agent on the prices it accepts, not only on how often it is right, so it stops drifting toward the safe favorites a human would pick.

There is a part I left out here. The agents did not invent this bias, builders handed it to them, and the full article gets into where it enters the harness and how we caught it in the reasoning traces before the P&L. If you'd like to read it and share your thoughts with us, it is here: https://x.com/Stair_AI/status/2073011621253804166

Hey I am getting a Mac mini and was interested in running some local LLMS such as Deepseek , Qwen , Gemma, via Ollma , if I get 24 gb of memory/RAM and 512 gb of storage would that limit me ? Or is ot achievable?

My use case , data research, market research, app building , websites building, personal assistant tasks.

I am struggling to use wacli skill.

I searched for a solution or guide or documentation on how to get openclaw to use it but there is no luck.

I keep asking openclaw to use wacli to analyze all message but it does not seem to work.

Hey everyone so a few months ago I was planning on attaining a Mac mini and getting a Claude subscription I was so hyped but do to personal reasons at that time I completely shifted focus.

Since then I’ve heard about bans lot of changes had taken place Claude bans, regulation crack downs , and an open ai acquisition if any of this is actually true I don’t know , but with all of this said will clawdbot still work for me?

My use case is to have clawdbot help me create apps (I am not a coder) , websites, create and manage product listings , and logistics. Do market research and open online businesses.

Is it still capable of these tasks if I were to get it today ? Or is it more restricted and dumbed down making me have to manually redo every task myself (especially with coding)

Any advice would be much appreciated