Openclaw Config

**Verdict:** A focused, high-value skill for anyone running the OpenClaw Gateway who needs to edit `openclaw.json` (JSON5) safely. It is narrowly scoped to OpenClaw configs but offers strong guidance for schema-correct, security-conscious changes. **What it does well** - Enforces a **schema-first** workflow: fetches the real JSON Schema (or zod schema) instead of inventing keys, which greatly reduces "gateway won’t start" issues. - Leans on official tools: `openclaw config get/set/unset`, `openclaw doctor`, and RPCs like `config.schema`, `config.patch`, `config.apply` for validated, minimal edits. - Understands advanced features like `$include` (modular configs, deep-merge behavior, circular-include limits) and special structures (`channels`, `env`, strict vs passthrough objects). - Emphasizes **security hygiene**: recommends environment variables / credential files for secrets, and calls out risky patterns (e.g., open DM policies, broad `allowFrom`, long-lived tokens in config). **Key risks / limitations** - **OpenClaw-specific**: provides little value outside managing OpenClaw Gateway config; compatibility is inherently limited to that ecosystem. - **Version/schema drift**: if the assistant doesn’t actually retrieve the current schema or repo sources as instructed, it may propose keys/types that are outdated or slightly incorrect. - **Operational risk if misused**: using `config.apply` carelessly, or editing without running `openclaw doctor`, can still break startup or silently change security posture. - **Security misconfiguration risk**: it can help open up channels (e.g., Telegram/Discord DM policies) just as easily as it can lock them down; the human operator must understand the implications. **Best use scenarios** - You actively run an OpenClaw Gateway and need a **co-pilot for configuration changes** (adding agents, tools, channels, or plugins) without breaking the instance. - You’re troubleshooting **validation errors** from `openclaw doctor` and want step-by-step, path-specific fixes rather than rewriting the entire config. - You’re organizing a **complex or multi-environment setup** and want to design a robust `$include`-based config layout that respects merge rules and avoids circular includes. - You’re tightening **security posture** (DM rules, web search providers, workspace defaults, env handling) and want schema-aware guidance to avoid accidental exposure. Use this skill whenever a change touches `gateway.*`, `agents.*`, `channels.*`, `tools.*`, `skills.*`, `plugins.*`, or `$include` and there’s any chance a mistake could prevent the Gateway from starting or weaken its security policies.