Code Pluginsource linked

ClawLinkv0.3.6

Connect 1,000+ apps (Gmail, Slack, GitHub, Calendar, Notion, and more) to OpenClaw via ClawLink. One skill, 39,000+ tools, managed OAuth.

clawlink-plugin·runtime clawlink-plugin·by @hith3sh

Community code plugin. Review compatibility and verification before install.

openclaw plugins install clawhub:clawlink-plugin

Latest release: v0.3.6Download zip

Compatibility

Built With Open Claw Version

2026.4.5

Min Gateway Version

2026.3.13

Plugin Api Range

>=2026.3.13

Plugin Sdk Version

2026.4.5

Security Scan

VirusTotal

Benign

View report →

OpenClaw

Suspicious

high confidence

Credentials

The runtime only directly calls https://claw-link.dev and does not itself read arbitrary local files, but the skill instructs the agent to run an exact curl command returned in an error message to upload local file bytes. That is a remote-controlled shell-command handoff for local file upload and is not sufficiently constrained in the artifact.

ℹ

Install Mechanism

Installation uses OpenClaw plugin commands, enables the specific plugin allow entry, and restarts the gateway. The npm fallback is described as unverified, while the preferred ClawHub install is clearly disclosed.

Instruction Scope

The skill broadly says to use ClawLink whenever an external app or service is mentioned and to always check ClawLink first. It includes safety steps such as previewing writes and asking confirmation for destructive or broad writes, but the routing scope is very wide.

Persistence & Privilege

Browser pairing stores a local ClawLink device credential in OpenClaw config and provider OAuth tokens/API keys are stored server-side by ClawLink. This persistence is disclosed and removable via logout, but it grants ongoing access to connected accounts.

Purpose & Capability

The stated purpose matches the artifact: a third-party hosted bridge for Gmail, Slack, Notion, calendars, CRMs, storage, posting, and other app actions. That purpose is high-impact because connected provider credentials live on ClawLink servers and the plugin can read from and write to many external services.

Scan Findings in Context

[SDI-2] unexpected: Accepted as a material review concern: local file upload is purpose-related, but the SKILL.md tells the agent to run an exact curl command supplied by ClawLink error output without validation or explicit user confirmation.

[SQP-1] expected: Partly accepted: broad app coverage is inherent to this integration hub, but the artifact's 'always check ClawLink first' routing and proactive integration suggestions are overbroad for a tool with cross-app read/write authority.

What to consider before installing

Install only if you trust ClawLink with access to the external accounts you connect. Review connected app scopes carefully, use previews and explicit confirmation for writes, avoid connecting unnecessary sensitive apps, and be cautious with local file uploads because the skill directs the agent to run a service-provided curl command.

Verification

Tier

source linked

Scope

artifact only

Summary

Validated package structure and linked the release to source metadata.

Source

github.com/ClawLink-HQ/clawlink

Commit

69d625887af3

Tag

openclaw-plugin-v0.3.6

Provenance

Scan status

suspicious

ClawLink OpenClaw Plugin

Connect 1,000+ apps (Gmail, Slack, GitHub, Calendar, Notion, and more) to OpenClaw via ClawLink.

One skill, 39,000+ tools, managed OAuth.

Use when the user asks to send emails, create issues, post messages, manage calendars, search documents, and more.

Not affiliated with OpenClaw. ClawLink is an independent service. This package is published by the ClawLink team under the npm scope @useclawlink. The published tarball is the source: run npm pack @useclawlink/openclaw-plugin and read package/index.js, which is plain unminified JavaScript. License: AGPL-3.0.

Setup in 3 Steps

Step 1: Install	Step 2: Pair Account	Step 3: Connect Any App

Run the install command in OpenClaw	Sign in and approve the device	Open the dashboard and connect an app

How It Works

┌─────────────────┐     ┌──────────────┐     ┌──────────────────┐
│   OpenClaw      │────▶│   ClawLink   │────▶│ 1,000+ SaaS Apps │
│   (User Chat)   │     │   (OAuth)    │     │ (Gmail, Slack...)│
└─────────────────┘     └──────────────┘     └──────────────────┘
         │                       │                       │
         │  1. Install Plugin    │                       │
         │  2. Pair Device       │                       │
         │  3. Connect Any App   │                       │
         │                       │  4. Secure Token      │
         │                       │  5. Proxy Requests    │
         │                       │                       │
         ▼                       ▼                       ▼
   ┌──────────┐           ┌──────────┐           ┌──────────┐
   │  Plugin  │           │ Dashboard│           │ Provider │
   │  README  │           │ Auth     │           │  Data    │
   └──────────┘           └──────────┘           └──────────┘

What it does

ClawLink stores provider OAuth tokens and API credentials on ClawLink servers, encrypted at rest, for a growing catalog of business apps on your behalf. It then exposes a uniform set of tools so OpenClaw can read from and write to those apps without per-provider setup. Today that includes integrations like Google Docs, Google Sheets, Google Calendar, Google Drive, Twilio, and Google Search Console. Setup is browser pairing: OpenClaw opens a ClawLink approval page, you approve the device once, then return to chat and send done so the plugin can store its local ClawLink device credential safely.

Install

openclaw plugins install clawhub:clawlink-plugin

Or directly from npm:

openclaw plugins install @useclawlink/openclaw-plugin

Configure

In OpenClaw, start browser pairing:
- let the assistant call clawlink_begin_pairing
- if the tools are not visible yet, restart the OpenClaw gateway and retry pairing; on a hosted setup where you cannot restart it, start a fresh chat and retry there
- if the tools still do not show, contact your OpenClaw admin, or email hello@claw-link.dev
Open the returned ClawLink pairing URL in your browser and approve the device.
Go back to OpenClaw and send done.
Let the assistant call clawlink_get_pairing_status to finish storing the local credential.

The resulting device credential is stored locally in ~/.openclaw/openclaw.json under plugins.entries.clawlink-plugin.config.apiKey and is only sent to claw-link.dev.

Full setup walkthrough: https://docs.claw-link.dev/openclaw

Tools

The plugin registers ten tools. OpenClaw's assistant discovers available integrations dynamically — you don't need to configure individual apps here.

clawlink_begin_pairing — start or resume browser pairing for this OpenClaw install
clawlink_get_pairing_status — finish pairing after the user returns from the browser and says done
clawlink_start_connection — start a hosted OAuth/connect session for a new app
clawlink_get_connection_status — poll an in-progress connect session
clawlink_list_integrations — list apps already connected
clawlink_list_tools — list callable tools for one connected app
clawlink_search_tools — search connected tools by capability or keyword
clawlink_describe_tool — fetch schema and usage guidance for one tool
clawlink_preview_tool — preview a tool call before execution, especially for writes
clawlink_call_tool — execute a tool against a connected app
clawlink_get_result — read a large stored result in slices (path / fields / offset / limit / count)

Support Commands

Normal onboarding should happen through tools and browser pairing. These commands remain as support/debug escape hatches:

/clawlink pair [deviceLabel] — start or resume browser pairing from the plugin fast path
/clawlink pair-status — check whether browser pairing has been approved yet and finish setup after browser approval
/clawlink status — show whether the plugin is paired
/clawlink logout — remove the saved credential

Security

ClawHub package: clawlink-plugin
npm package: @useclawlink/openclaw-plugin
ClawHub publishes are source-linked to the public GitHub repository and the latest ClawHub security scan is clean.
The published tarball is the source: npm pack @useclawlink/openclaw-plugin and read package/index.js.
ClawHub verification includes source-linked release metadata for the published artifact.
The plugin only makes outbound HTTPS requests to https://claw-link.dev.
Browser pairing stores only a local ClawLink device credential under ~/.openclaw/openclaw.json.
Provider tokens and API keys are not written to OpenClaw config or shown to the assistant; they stay on ClawLink servers encrypted at rest.
The local device credential is sent only as the X-ClawLink-API-Key header to ClawLink.
Report security issues to security@claw-link.dev.