my-openclaw-init

name	my-openclaw-init
description	Initialize a production-ready OpenClaw environment with stable auto-updates, mandatory skill discovery, and LAN CORS access. Use when: setting up a new OpenClaw instance, configuring auto-update policies, ensuring all agents can discover skills, or troubleshooting LAN access / CORS issues. Triggers: openclaw setup, openclaw init, openclaw cors, openclaw update config, find-skills setup.

My OpenClaw Init Skill

Bootstrap a stable, auto-updating OpenClaw deployment with three key configurations:

1. Stable auto-update — automatic updates with a safety delay
2. Mandatory find-skills — every agent can discover and install new skills
3. LAN CORS access — control UI accessible from any device on the local network

Prerequisites

• OpenClaw installed (npm install -g openclaw)
• Gateway running (openclaw gateway start or systemd service)
• Config file at ~/.openclaw/openclaw.json

Workflow

Step 1: Add stable auto-update config

Merge the following into ~/.openclaw/openclaw.json under the top-level "update" key:

{
  "update": {
    "channel": "stable",
    "checkOnStart": true,
    "auto": {
      "enabled": true,
      "stableDelayHours": 24,
      "stableJitterHours": 12
    }
  }
}

What this does:

• channel: "stable" — only stable releases, never beta/dev
• checkOnStart — check for updates when gateway starts
• stableDelayHours: 24 — wait 24h after a stable release before auto-updating (avoids day-0 bugs)
• stableJitterHours: 12 — add up to 12h random delay to spread load

Do NOT change any other keys in openclaw.json. Only add/merge the update block.

Step 2: Install find-skills skill

clawhub install find-skills-skill

This installs to ~/.openclaw/workspace/skills/find-skills-skill/.

Step 3: Add find-skills to every agent

For each agent in agents.list, prepend "find-skills" to its skills array. Do NOT remove any existing skills.

Example — before:

"skills": ["github", "gh-issues"]

After:

"skills": ["find-skills", "github", "gh-issues"]

Check list:

• Read ~/.openclaw/openclaw.json
• Find agents.list (array of agent objects)
• For each agent that has a skills array, ensure "find-skills" is present
• If agents.defaults.skills exists, add "find-skills" there too
• Validate JSON after editing

Verification: After config change, restart the gateway and spawn a sub-agent to confirm it can see find-skills in its <available_skills>.

Step 4: Configure LAN CORS access

Merge into gateway.controlUi:

{
  "gateway": {
    "controlUi": {
      "allowedOrigins": ["*"],
      "dangerouslyAllowHostHeaderOriginFallback": true,
      "allowInsecureAuth": true,
      "dangerouslyDisableDeviceAuth": true
    }
  }
}

What this does:

• allowedOrigins: ["*"] — allows browser requests from any origin (LAN devices)
• dangerouslyAllowHostHeaderOriginFallback — fallback for clients that only send Host header
• allowInsecureAuth — allows non-HTTPS auth (fine for LAN, not for public internet)
• dangerouslyDisableDeviceAuth — skips device pairing for control UI on trusted networks

⚠️ Security note: This is safe for a private LAN behind a router/firewall. Do NOT expose this to the public internet without additional hardening (reverse proxy, TLS, firewall rules).

Step 5: Restart and verify

# Restart gateway to pick up config changes
systemctl --user restart openclaw-gateway.service

# Verify it's running
systemctl --user status openclaw-gateway.service

# Check version
openclaw --version

Step 6: Create lightweight backup

Before any config change, create a backup of critical config only:

mkdir -p ~/.openclaw/backups
tar czf ~/.openclaw/backups/lightweight-$(date +%Y%m%d-%H%M%S).tar.gz \
  --exclude='workspace' \
  --exclude='sessions' \
  --exclude='backups' \
  --exclude='browser-state' \
  -C ~/.openclaw \
  openclaw.json agents/ .credentials/ .state/

Backup scope: config + agent definitions + credentials only. Workspace and sessions are excluded (workspace should have Git hosting).

Troubleshooting

Symptom	Cause	Fix
openclaw doctor gets SIGKILL	Low RAM (e.g. J1900 with 4GB)	Not critical; gateway still runs fine
Sub-agent can't see skills	Config not reloaded	Restart gateway
CORS blocked from browser	controlUi not configured	Apply Step 4 and restart
find-skills not in available_skills	Skill not installed or not in agent's skills list	Run Step 2 + Step 3
Double service management	Both systemd and manual process	Only use one; prefer systemd

Notes

• Sub-agent visibility: Sub-agents inherit the same <available_skills> as the main agent, even with lightContext: true. No additional configuration needed.
• Low-memory hosts: CLI tools (openclaw doctor, openclaw health) may OOM on machines with ≤4GB RAM. The gateway itself handles this fine.
• Backup frequency: Create a backup before each config change or version update. Backups are tiny (<10KB).