⚠
High Risk:This skill has significant security concerns. Review the findings below before installing.

bloom

⚠Caution·Scanned 2/18/2026

Dangerous skill: installs and executes code that clones https://github.com/unicornbloom/bloom-identity-skill.git, runs npm/npx, reads ~/.openclaw/agents/main/sessions/*.jsonl, and writes "$BLOOM_SKILL_DIR/.env". It transmits analysis results to api.bloomprotocol.ai and requires JWT_SECRET/OPENCLAW_USER_ID configuration.

from clawhub.ai·v1bc0961·16.7 KB·0 installs
Scanned from 2.0.1 at 1bc0961 · Transparency log ↗
$ vett add clawhub.ai/unicornbloom/bloomReview security findings before installing

Bloom Identity - OpenClaw Bot Wrapper

This directory contains the OpenClaw skill wrapper for Bloom Identity analysis.

Purpose

Allows OpenClaw bot to analyze conversations directly from context, without needing to read session files or external APIs.

Architecture

User: /bloom-identity
       ↓
OpenClaw Bot (has conversation in context)
       ↓
execute.sh (this wrapper)
       ↓
Collects conversation context
       ↓
Pipes to scripts/run-from-context.ts
       ↓
Bloom analyzer (direct text analysis)
       ↓
Returns identity card + recommendations

Installation

1. Install Bloom Identity Skill

cd ~/.openclaw/workspace
git clone https://github.com/unicornbloom/bloom-identity-skill.git
cd bloom-identity-skill
npm install

2. Copy Wrapper to OpenClaw Skills

cp -r openclaw-wrapper ~/.openclaw/skills/bloom-identity-openclaw

3. Test

In OpenClaw:

/bloom-identity

Or from command line:

echo "User: I love AI tools
Assistant: Great! What kind of AI tools?
User: Mostly coding assistants and LLMs" | bash ~/.openclaw/skills/bloom-identity-openclaw/execute.sh telegram:123

Files

  • SKILL.md - OpenClaw skill definition
  • execute.sh - Wrapper script that pipes conversation to analyzer
  • README.md - This file

How It Works

  1. OpenClaw bot invokes this skill via /bloom-identity
  2. Bot collects current conversation context (automatically)
  3. Context is piped to execute.sh
  4. execute.sh calls ../scripts/run-from-context.ts
  5. TypeScript script analyzes conversation directly
  6. Returns formatted identity card

Key Differences vs. Original Skill

FeatureOriginalOpenClaw Wrapper
Data SourceSession filesConversation context
User IDRequiredProvided by bot
TwitterOptionalSkipped (default)
WalletCreates newCreates new
Min Messages33
ExecutionExternal processBot context

Troubleshooting

Error: "Bloom Identity Skill not found"

# Install the main skill first
cd ~/.openclaw/workspace
git clone https://github.com/unicornbloom/bloom-identity-skill.git
cd bloom-identity-skill
npm install

Error: "Insufficient conversation data"

  • Need at least 3 messages in conversation
  • Continue chatting with the bot

Error: "npx command not found"

  • Install Node.js 18+
  • Ensure npx is in PATH

Development

To modify the wrapper:

  1. Edit execute.sh for shell logic
  2. Edit ../scripts/run-from-context.ts for analysis logic
  3. Edit SKILL.md for skill documentation

To test locally:

echo "test conversation" | bash execute.sh test-user-123

Environment Variables

  • OPENCLAW_USER_ID - Auto-provided by OpenClaw bot
  • JWT_SECRET - For dashboard token generation
  • DASHBOARD_URL - Dashboard URL (default: https://preview.bloomprotocol.ai)
  • NETWORK - Blockchain network (default: base-mainnet)

License

MIT - See main repository LICENSE file