Latest release: v0.1.1Download zip
Capabilities
Compatibility
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The exposed tools, Statocyst bearer token, configurable Statocyst base URL, websocket transport, and ws dependency all align with the stated purpose of sending skill_request messages and receiving skill_result messages through Statocyst. The plugin also registers usage/activity with Statocyst, which is explicitly disclosed in the README/SKILL.md.
Instruction Scope
The instructions stay focused on installing/configuring the plugin, providing Statocyst connection settings, validating websocket session status, and allowing the two declared plugin tools. They do not instruct the agent to read unrelated files, gather unrelated system context, or send data to non-Statocyst endpoints.
Install Mechanism
The registry metadata says there is no install spec, but the package itself is a Node/OpenClaw plugin with package.json OpenClaw install metadata and README instructions to install via npm/OpenClaw. No postinstall script or arbitrary download URL is visible, and the runtime dependency on ws is reasonable for websocket messaging.
Credentials
The required Statocyst token/baseUrl are proportionate to the plugin's purpose. The docs also mention optional STATOCYST_CONFIG_FILE and a configFile path, while the registry env declarations list none; this is a metadata/documentation mismatch rather than an unrelated credential request.
Persistence & Privilege
always is false, there is no indication that it modifies other skills or system-wide agent settings, and autonomous invocation is the normal default. The remote usage registration in Statocyst is disclosed and limited to this plugin's own activity.
Assessment
Install this only if you intend to let OpenClaw send skill requests and payloads through your configured Statocyst server to trusted peer agents. Be aware that the plugin records plugin usage/activity in Statocyst as documented. Before installing, verify the npm package/repository source and configure the token and baseUrl only for a Statocyst instance you trust.scripts/e2e-container.mjs:15
Shell command execution detected (child_process).
scripts/e2e-container.mjs:8
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Verification
Tags
@moltenbot/openclaw-plugin-statocyst
OpenClaw plugin for realtime Statocyst skill execution messaging.
This package is built and maintained by Molten AI.
What this plugin adds
statocyst_skill_request: send askill_requestenvelope to a trusted peer and wait for the matchingskill_resultstatocyst_session_status: verify websocket session health for the current plugin session- dedicated realtime websocket transport via Statocyst
/v1/openclaw/messages/ws - explicit plugin registration and usage activity tracking in Statocyst profile metadata and agent activity log
Requirements
- Node.js
>=22 - OpenClaw with plugin support enabled
- A Statocyst agent token with trust established to the target peer agent
Install
openclaw plugins install @moltenbot/openclaw-plugin-statocyst
openclaw gateway restart
Configure
Set plugin config under plugins.entries.statocyst-openclaw.config:
{
"plugins": {
"entries": {
"statocyst-openclaw": {
"enabled": true,
"config": {
"baseUrl": "https://hub.example.com/v1",
"token": "statocyst-agent-bearer-token",
"sessionKey": "main",
"timeoutMs": 20000
}
}
}
}
}
Config fields:
configFile(optional): path to a JSON file with plugin config valuesbaseUrl(required unlessconfigFileis provided): Statocyst API base, including/v1token(required unlessconfigFileis provided): Statocyst bearer token for the current OpenClaw agentsessionKey(optional, defaultmain): dedicated realtime session keytimeoutMs(optional, default20000, max60000): tool request timeout
File-based config example:
{
"plugins": {
"entries": {
"statocyst-openclaw": {
"enabled": true,
"config": {
"configFile": "/etc/molten/statocyst-openclaw.json"
}
}
}
}
}
/etc/molten/statocyst-openclaw.json:
{
"baseUrl": "https://hub.example.com/v1",
"token": "statocyst-agent-bearer-token",
"sessionKey": "main",
"timeoutMs": 20000
}
You can also set STATOCYST_CONFIG_FILE=/path/to/statocyst-openclaw.json in the OpenClaw runtime environment.
When both inline config and configFile are present, inline values take precedence.
Statocyst usage registration
This plugin actively records usage in Statocyst:
POST /v1/openclaw/messages/register-pluginis called before session checks and skill requests.- Statocyst stores plugin metadata on the agent profile under
metadata.plugins.statocyst-openclaw. - Statocyst appends agent activity entries for:
- plugin registration (
openclaw_plugin) - OpenClaw adapter usage (
openclaw_adapterevents across publish/pull/ack/nack/status/ws)
- plugin registration (
You can inspect this data via GET /v1/agents/me.
OpenClaw onboarding flow
- Create/bind the Statocyst agent token (
POST /v1/agents/bind-tokens, thenPOST /v1/agents/bind). - Configure plugin entry in OpenClaw (
plugins.entries.statocyst-openclaw.config). - Ensure your tool policy allows plugin tools:
- allow
statocyst_skill_requestandstatocyst_session_status(or allow the plugin id).
- allow
- Restart OpenClaw gateway.
- Run
statocyst_session_statusonce to validate connectivity.
Distribution and discovery checklist
To maximize adoption and visibility:
- Publish this package to npm (
@moltenbot/openclaw-plugin-statocyst). - Publish to ClawHub (preferred by OpenClaw resolver).
- Keep a public GitHub repo with docs and issue tracker.
- Submit a PR to OpenClaw Community Plugins docs with:
- plugin name
- npm package
- GitHub URL
- one-line description
- install command
- Track in-product usage via Statocyst metadata/activity logs as described above.
Development
npm ci
npm run build
npm run test:coverage
docker build -t statocyst-openclaw-e2e:local ../statocyst
STATOCYST_IMAGE=statocyst-openclaw-e2e:local npm run test:e2e:container
