Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix Feature Request: Persistent Skill/.md configuration support for commercial use [5 pull requests, 1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#73549•Fetched 2026-04-29 06:18:25
View on GitHub
Comments
1
Participants
2
Timeline
6
Reactions
0
Author
MarkMa84MarkMa84
Participants
clawsweeper[bot]clawsweeper[bot]MarkMa84MarkMa84
Timeline (top)
cross-referenced ×5commented ×1

Error Message

  1. Skills get lost or ignored: After installation, skills can be forgotten or ignored by the agent over time or after resets. This is not user error - it is a system-level issue with how skills are persisted in agent memory.

Fix Action

Fixed

PR fix notes

PR #73686: fix #73549: Feature Request: Persistent Skill/.md configuration support for commercial use

Description (problem / solution / changelog)

Summary

Fixes #73549

Issue

Feature Request: Persistent Skill/.md configuration support for commercial use

Solution

<!-- Describe the changes made -->

Testing

<!-- Describe how the fix was tested -->

Changed files

  • src/agents/skills/config.test.ts (added, +100/-0)
  • src/agents/skills/config.ts (modified, +2/-1)
  • src/agents/skills/frontmatter.test.ts (modified, +23/-0)
  • src/agents/skills/frontmatter.ts (modified, +1/-0)
  • src/agents/skills/types.ts (modified, +2/-0)
  • src/config/types.skills.ts (modified, +15/-0)
  • src/config/zod-schema.ts (modified, +13/-0)
  • src/security/audit-extra.async.test.ts (modified, +36/-2)
  • src/security/audit-extra.async.ts (modified, +13/-1)

PR #73707: feat(skills): add persist flag and trustedSources config for commercial use

Description (problem / solution / changelog)

Summary

Fixes #73549

Adds two features for commercial skill usage:

flag

Keeps a skill active even when its checks (bins/env/config) are not met, allowing commercial environments to rely on installed skills regardless of runtime conditions.

config

Allows operators to designate trusted skill source types (e.g. , ) that skip code safety scanning during OpenClaw security audit Summary: 0 critical · 3 warn · 1 info Run deeper: openclaw security audit --deep

WARN gateway.trusted_proxies_missing Reverse proxy headers are not trusted gateway.bind is loopback and gateway.trustedProxies is empty. If you expose the Control UI through a reverse proxy, configure trusted proxies so local-client checks cannot be spoofed. Fix: Set gateway.trustedProxies to your proxy IPs or keep the Control UI local-only. plugins.extensions_no_allowlist Extensions exist but plugins.allow is not set Found 1 extension(s) under /home/0668001030/.openclaw/extensions. Without plugins.allow, any discovered plugin id may load (depending on config and plugin behavior). Fix: Set plugins.allow to an explicit list of plugin ids you trust. plugins.tools_reachable_permissive_policy Extension plugin tools may be reachable under permissive tool policy Enabled extension plugins: memory-flex. Permissive tool policy contexts:

  • default Fix: Use restrictive profiles (minimal/coding) or explicit tool allowlists that exclude plugin tools for agents handling untrusted input.

INFO summary.attack_surface Attack surface summary groups: open=0, allowlist=0 tools.elevated: enabled hooks.webhooks: disabled hooks.internal: disabled browser control: enabled trust model: personal assistant (one trusted operator boundary), not hostile multi-tenant on one shared gateway. Skipped skills are logged as audit findings for visibility.

Changes

  • 9 files, +205/-4 lines
  • Proper type usage
  • Audit trail for skipped scans

Changed files

  • src/agents/skills/config.test.ts (added, +100/-0)
  • src/agents/skills/config.ts (modified, +2/-1)
  • src/agents/skills/frontmatter.test.ts (modified, +23/-0)
  • src/agents/skills/frontmatter.ts (modified, +1/-0)
  • src/agents/skills/types.ts (modified, +2/-0)
  • src/config/types.skills.ts (modified, +15/-0)
  • src/config/zod-schema.ts (modified, +13/-0)
  • src/security/audit-extra.async.test.ts (modified, +36/-2)
  • src/security/audit-extra.async.ts (modified, +17/-1)

PR #73999: feat(skills): add persist flag and trustedSources config for commercial use

Description (problem / solution / changelog)

Summary

Fixes #73549

Changes

  • Add persist flag that keeps a skill active even when runtime eligibility checks are unmet
  • Add trustedSources config allowing operators to skip code safety scanning for designated skill sources
  • Clean checkId naming convention (dot-separated)
  • Proper scannedSkillDirs deduplication for trusted-source skills

History

  • #73707 (initial, 2 P2: checkId naming + scannedSkillDirs dedup) — closed, both P2 resolved in this PR

Changed files

  • src/agents/skills/config.test.ts (added, +100/-0)
  • src/agents/skills/config.ts (modified, +2/-1)
  • src/agents/skills/frontmatter.test.ts (modified, +23/-0)
  • src/agents/skills/frontmatter.ts (modified, +1/-0)
  • src/agents/skills/types.ts (modified, +2/-0)
  • src/config/types.skills.ts (modified, +15/-0)
  • src/config/zod-schema.ts (modified, +13/-0)
  • src/security/audit-extra.async.test.ts (modified, +36/-2)
  • src/security/audit-extra.async.ts (modified, +17/-1)

PR #74022: feat(skills): add persist flag and trustedSources config for commercial use

Description (problem / solution / changelog)

Summary

Fixes #73549

Changes

  • Add persist flag that keeps a skill active even when runtime eligibility checks are unmet
  • Add trustedSources config allowing operators to skip code safety scanning for designated skill sources

Fixes applied since last review

RoundPRIssues
v1#737072 P2: checkId naming, scannedSkillDirs dedup
v2#739991 P1: test assertion fail, 3 P2: mock leak, dedup comment, dead enum
v3ThisAll resolved

Changed files

  • src/agents/skills/config.test.ts (added, +100/-0)
  • src/agents/skills/config.ts (modified, +2/-1)
  • src/agents/skills/frontmatter.test.ts (modified, +23/-0)
  • src/agents/skills/frontmatter.ts (modified, +1/-0)
  • src/agents/skills/types.ts (modified, +2/-0)
  • src/config/types.skills.ts (modified, +15/-0)
  • src/config/zod-schema.ts (modified, +13/-0)
  • src/security/audit-extra.async.test.ts (modified, +36/-2)
  • src/security/audit-extra.async.ts (modified, +18/-2)

PR #74035: feat(skills): add persist flag and trustedSources config for commercial use

Description (problem / solution / changelog)

Summary

Fixes #73549

Changes

  • Add persist flag that keeps a skill active even when bin/env/config checks are unmet (OS-platform checks still enforced)
  • Add trustedSources config allowing operators to skip code safety scanning for designated skill sources

Testing

  • Unit tests added for persist flag behavior including OS-mismatch exclusion
  • Unit tests added for trustedSources code safety scan bypass

Changed files

  • src/agents/skills/config.test.ts (added, +100/-0)
  • src/agents/skills/config.ts (modified, +2/-1)
  • src/agents/skills/frontmatter.test.ts (modified, +23/-0)
  • src/agents/skills/frontmatter.ts (modified, +1/-0)
  • src/agents/skills/types.ts (modified, +2/-0)
  • src/config/types.skills.ts (modified, +15/-0)
  • src/config/zod-schema.ts (modified, +13/-0)
  • src/security/audit-extra.async.test.ts (modified, +36/-2)
  • src/security/audit-extra.async.ts (modified, +18/-2)
RAW_BUFFERClick to expand / collapse

Problem Description

When using skills with OpenClaw in commercial scenarios, we face two issues:

  1. Skills get lost or ignored: After installation, skills can be forgotten or ignored by the agent over time or after resets. This is not user error - it is a system-level issue with how skills are persisted in agent memory.

  2. Commercial use blocked by security review: The current security review mechanism blocks all commercial usage, including legitimate commercial use cases. This is overly restrictive.

Proposed Solution

We suggest a .md file wrapper/shell service as an official paid feature:

  • Core product: Remain MIT licensed and free
  • Commercial wrapper service: Provide verified, signed .md file wrapping for a fee
  • Similar to Red Hat model: Linux is free, but RHEL + support is paid

User Choice

Let users decide:

  • Plain text (free): Users who want open source and community sharing
  • Wrapped/encrypted (paid): Users who want to protect their intellectual property

Why This Helps OpenClaw

  • Opens a new revenue stream without changing the open source model
  • Official security verification has more credibility than third-party solutions
  • Removes friction for commercial users who would otherwise be blocked

Additional Context

We believe this is not an isolated need - many commercial users likely face the same restrictions. Solving this would help grow the OpenClaw ecosystem and attract more professional users.

extent analysis

TL;DR

Implement a paid, official wrapper service for commercial users to address skill persistence and security review issues.

Guidance

  • Introduce a dual-mode system: free, open-source core product and a paid, commercial wrapper service for verified, signed .md files.
  • Offer users a choice between plain text (free) and wrapped/encrypted (paid) options to protect intellectual property.
  • Develop a security verification process for the commercial wrapper service to increase credibility and trust.
  • Consider the Red Hat model (Linux + RHEL) as a reference for the dual-licensing approach.

Example

No code snippet is provided as the issue focuses on the conceptual solution rather than specific implementation details.

Notes

The proposed solution aims to balance the need for open-source community sharing with the requirements of commercial users. However, the technical implementation details, such as the wrapper service and security verification process, are not specified.

Recommendation

Apply a workaround by introducing the proposed dual-mode system, as it addresses the skill persistence and security review issues while maintaining the open-source core product. This approach allows for a new revenue stream without altering the existing open-source model.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#installation#model loading#dependency error#configuration error#environment variable

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix Feature Request: Persistent Skill/.md configuration support for commercial use [5 pull requests, 1 comments, 2 participants]