Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/stakpak/agent/claw.v1git clone --depth 1 https://github.com/stakpak/agentWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00014 | $0.11909 |
| Opus 5 | $0.00007 | $0.05955 |
| Sonnet 5 | $0.00003 | $0.02382 |
| Haiku 4.5 | $0.00001 | $0.01191 |
Grade F, and why
claw.v1 scanned grade F with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
* **Service management**: `sudo systemctl {start|stop|status} openclaw-gateway` Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -sSL https://stakpak.dev/install.sh | sh Cloud metadata endpointhighServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
'TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"); curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/instance-id') Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
> - Validate API: `curl -s "https://api.telegram.org/bot<TOKEN>/getMe" | jq .ok` must return `true` How it starts
The opening of the file, as written. The whole thing — 1,041 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Deploy & Monitor OpenClaw Gateway with AWS Lightsail Blueprint + Stakpak Autopilot
Goals
- Deploy a fully functional OpenClaw AI gateway using the AWS Lightsail OpenClaw blueprint (one-click)
- Connect a messaging channel (Telegram, WhatsApp, Discord, or Slack) with security hardening
- Harden the deployment for production beyond Lightsail defaults
- Configure Stakpak Autopilot for continuous health monitoring with Telegram or Discord alerts
Core Principles
- Collect ALL tokens and API keys before starting — every phase has blocking dependencies
- The Lightsail blueprint handles Docker, Node.js, systemd, HTTPS, and gateway token generation — do NOT manually install these
- Never share a Telegram bot token between OpenClaw and Stakpak — causes 409 Conflict polling errors (only applies if both use Telegram)
- The blueprint uses Amazon Bedrock (not
auth-profiles.json) — only writeauth-profiles.jsonif you want a non-Bedrock provider - Use
openclawCLI directly via SSH (notdocker exec) — the Lightsail blueprint runs OpenClaw as a native systemd service, not Docker - Always verify with
openclaw channels status --probeandopenclaw models statusafter configuration changes - Write scripts locally and SCP to remote hosts — never create scripts via SSH heredoc (shell escaping breaks)
- The blueprint locks SSH to browser-only (
lightsail-connect) by default — you MUST open port 22 to your IP before any CLI-based SSH access (Phase 1.4) - Channel plugins (telegram, discord, slack, whatsapp, etc.) are disabled by default — you MUST run
openclaw plugins enable <channel>and restart the gateway beforeopenclaw channels addwill recognize the channel. Without this,channels add --channel telegramreturnsUnknown channel: telegram. - The Bedrock IAM role name must match
LightsailRoleFor-<EC2-instance-id>(get via instance metadata), and the trust policy must allow Lightsail's managed account (002204026182)
Prerequisites
Mandatory User Prompt: Deployment Target
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 1,041 lines · 14 tokens per session scan F 2a2c0f94731a
claw.v1 is a command published in the GitHub repository stakpak/agent (1,766 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 14 tokens to every session and 11,909 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it F with 4 findings (asks for root, downloads and executes remote code, cloud metadata endpoint). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
update-branch-name
Follow these steps to update the current branch name.
create-pr
Create a new branch, commit changes, and submit a pull request.
MIGRATE_DESIGN
Design doc for the migration tool PR. Author: Sol ([email protected]). Co-authored-by: wakesync.
agentlas-cloud
Staff a task only from the signed-in owner's Agent Cloud agents.
commit
智能生成 Git 提交信息并提交.
tasks
Command "tasks" from thrashr888/agentkernel, covering durable tasks, use up to four task workers (the default) and bound active tasks explicitly.