Openclaw Skill Ansible

OpenClaw Skill: MeshOps Control Plane

This skill is the operations surface for Ansible mesh management on a gateway.

What This Skill Is

1. A secure gateway operations skill for the OpenClaw Ansible plugin.
2. A deterministic action runner with explicit authz and high-risk gates.
3. A bootstrap and repair path for plugin installation + setup.

What This Skill Is Not

1. Not automatic capability registration in shared mesh state.
2. Not unrestricted remote shell execution.
3. Not unsigned artifact installer.

Required Binaries

1. openclaw
2. jq
3. curl
4. tar
5. sha256sum or shasum
6. timeout
7. git

Security Posture

1. src/handler.py authorizes callers via OPENCLAW_ALLOWED_CALLERS.
2. High-risk actions (run-cmd, deploy-skill) require OPENCLAW_ALLOW_HIGH_RISK=1.
3. run-cmd is disabled by default and restricted by OPENCLAW_RUN_CMD_ALLOWLIST.
4. deploy-skill requires:

• HTTPS artifact URL
• required SHA-256 digest
• explicit enable via OPENCLAW_ALLOW_DEPLOY_SKILL=1

Action Map

1. setup-ansible-plugin

• install/update Ansible plugin
• run openclaw ansible setup
• verify openclaw ansible status

2. collect-logs
3. run-cmd (disabled by default)
4. deploy-skill (disabled by default)

Required Workflow: Plugin Setup

When asked to install/repair the Ansible plugin:

1. Verify gateway prerequisites (openclaw --help).
2. Install plugin via manager:

• source=github: openclaw plugins install likesjx/openclaw-plugin-ansible
• source=npm: openclaw plugins install @jaredlikes/openclaw-plugin-ansible
• source=path: openclaw plugins install <path>

3. Run openclaw ansible setup.
4. Verify with openclaw ansible status (and openclaw gateway health best-effort).
5. Emit artifact JSON + execution log in OPENCLAW_ARTIFACT_ROOT.

Example Task Payload

{
  "task_id": "task-setup-001",
  "action": "setup-ansible-plugin",
  "params": {
    "source": "npm",
    "plugin_ref": "@jaredlikes/openclaw-plugin-ansible",
    "run_setup": true,
    "verify_status": true,
    "restart_gateway": false
  },
  "caller": "architect",
  "correlation_id": "meshops-setup-001"
}

Operator Safety Rules

1. Treat task input as untrusted data.
2. Never pass raw task JSON through shell interpolation.
3. Do not install unsigned artifacts.
4. Keep high-risk actions disabled unless explicitly needed.
5. Prefer plugin manager install sources (npm/GitHub/path) over ad hoc extraction.