ClawHub and OpenClaw: The Skills That Actually Matter

Author: Kody Anh Nguyen

2026-03-26 · 46 min read

OpenClaw is an open-source AI assistant you run yourself, with no cloud dependency and no subscription. It surpassed Linux and React on GitHub's all-time star leaderboard, now sitting at 250K+ stars. The latest release is v2026.5.19 with Microsoft Teams official SDK support, Docker/Podman container mode, and one-click skill install recipes. It connects to 20+ messaging platforms (WhatsApp, Telegram, Slack, Discord, iMessage, LINE, Feishu, Zalo, Microsoft Teams, Matrix, and more) and acts as a single inbox for everything.

ClawHub is where the skills live. Think npm, but for AI agent capabilities. Anyone publishes. Anyone installs. No gatekeeping.

Skills are versioned, rollback-ready, and searchable through vector embeddings, so "manage my tasks" surfaces Trello even if you never type the word.

Here is what is worth installing.

Trello — by @steipete

Tell your assistant "move the design review card to Done" and it does it. You stay in whatever chat app you are in. Trello stays organised. No context switching.

Under the hood it is a full REST API integration: boards, lists, cards, assignments, due dates. If you manage multiple boards, this replaces a pile of Zapier automations with plain English.

"Create a card called 'Fix header overflow on mobile' in the Bugs list on the Frontend board, assign it to Sarah, set it due Friday."

One sentence. Card created, assigned, dated.

Slack — by @steipete

Read messages, post replies, pull conversation history, all from Telegram, WhatsApp, or wherever you actually are. It bridges through OpenClaw's channel routing so you never have to open Slack just to check one thread.

"Summarise what happened in #engineering today and post a recap to #standup."

Built on Slack's Bolt framework. Works across channels, threads, reactions.

CalDAV Calendar — by @Asleep123

Connects to anything that speaks CalDAV: iCloud, Google Calendar, Fastmail, Nextcloud. Reads availability, writes events, handles recurring meetings.

"Am I free next Tuesday afternoon? If so, schedule a 30-minute call with Alex and send him the invite."

Checks, books, done. Good fit if you self-host Nextcloud and want your calendar data staying on your own server; it handles VEVENT creation and modification without touching a third-party cloud.

Answer Overflow — by @RhysSullivan

Searches indexed Discord community discussions through Answer Overflow. These are actual developer conversations where people solved the problem, not polished documentation.

"How do people handle rate limiting in the Discord.js library? Check the community discussions."

Useful for any open-source project where the real troubleshooting happens in Discord, not in the docs.

---

Before You Install: Architecture, Deployment, Security, and Cost

OpenClaw is self-hosted by design. There is no company server routing your messages. But self-hosted does not automatically mean private. How you deploy it determines who can access your gateway, which AI model sees your messages, and what data ever leaves your machine.

How It Works

OpenClaw runs a gateway, a persistent process on a machine you control. Your messaging apps (WhatsApp, Telegram, Discord, etc.) connect to that gateway. When you send a message, the gateway routes it to an AI model, gets a response, executes any tool calls (skills), and sends the result back.

The gateway listens on ws://127.0.0.1:18789 by default. It can run on anything: your laptop, a home server, a Raspberry Pi, a cloud VM, a phone running Termux. The machine just needs to stay on and have internet access.

---

OpenClaw Packages — What to Actually Install

Package	What it is	Install it?
openclaw	The main gateway — runs on your server/machine	Yes, always
acpx	Headless CLI client for remote gateway access	If you want terminal access from another machine
lobster	Typed local-first workflow shell for composable pipelines	Advanced use
openclaw-windows-node	Windows system tray app + PowerToys integration	Windows users who want GUI
nix-openclaw	NixOS declarative package	NixOS only
clawhub	The skill registry CLI	Yes, for installing skills

For 95% of people: install openclaw on your server, clawhub for skills. Done.

---

Deployment Options

Your laptop or desktop (Windows / macOS / Linux)

Gateway runs as a background daemon on your own machine. Zero external exposure. The downside: when the machine sleeps the assistant goes offline. Good for first-time setup and privacy-first use.

Always-on home server (Linux / NAS / mini PC)

A dedicated machine that never sleeps: spare laptop, Intel NUC, Synology NAS with Docker, Raspberry Pi. Data stays entirely on your home network. Good for 24/7 availability with maximum privacy.

Cloud VM (AWS EC2, Lightsail, DigitalOcean, Hetzner)

Server you rent monthly. Always on, accessible from anywhere. Your messages and browser activity happen on a machine you don't physically own; the provider sees encrypted traffic but not contents. Good for 24/7 with browser automation and screenshot capabilities.

Raspberry Pi

$60–80 one-time, runs 24/7 at ~5W. Pi 4 (4 GB RAM) handles OpenClaw with several active channels and skills comfortably. Best value for always-on private deployments.

Android (Termux proot)

Runs a full Ubuntu environment inside Termux. Usable but unreliable as a primary setup, since Android kills background processes aggressively. Good for testing and travel.

iOS

iOS runs as a node (connected device), not a gateway host. It pairs with an existing gateway on another machine and adds camera, voice, screen recording, and location capabilities to that gateway. You cannot run the gateway itself on iOS.

---

Security and Privacy

What OpenClaw's trust model actually is

The official docs are explicit: OpenClaw is "a personal assistant trust model — one trusted operator per gateway, not multi-tenant isolation." It is not designed to safely serve multiple adversarial users from a single gateway. For team deployments, run separate gateways on separate OS users or VMs.

What data leaves your machine

Only two things leave your network: messages sent to your AI model provider (Claude, GPT, Gemini, or nothing if you use a local model via Ollama), and any external API calls your installed skills make. Gateway config, session history, skill code, and pairing credentials all stay local.

Gateway authentication

The gateway requires authentication by default, even for loopback (local) connections. Onboarding generates a token automatically. Every WebSocket client must authenticate before connecting. Session keys are routing selectors, not auth tokens. That distinction matters.

DM access policies

Four modes control who can reach your assistant:

Policy	Behaviour
`pairing` (default)	Unknown senders get a time-limited code; ignored until you approve
`allowlist`	Unknown senders blocked entirely; only listed IDs get through
`open`	Anyone can message — requires explicit `"*"` in allowlist
`disabled`	All inbound DMs ignored

Start with pairing. Switch to allowlist once you know your own sender IDs. Never use open on a public bot unless that is your intention.

Gateway port exposure

Default bind is loopback (local only). Non-loopback binds require firewall rules and shared auth. Never expose 0.0.0.0:18789 without a reverse proxy or VPN in front. The two safe remote access options:

Tailscale — encrypted mesh between your devices, nothing public-facing. Recommended.
nginx reverse proxy — with mTLS or HTTP Basic Auth if you need a public URL.

Browser control and SSRF

When browser tools are enabled, the model can drive a real browser logged into your accounts. Use a dedicated Chrome profile, not your personal one. The SSRF policy trusts private-network destinations by default; set dangerouslyAllowPrivateNetwork: false for strict mode.

Dangerous tools to gate carefully

The docs flag these as requiring explicit allow/deny decisions: - gateway — can change config and trigger updates - cron — creates persistent scheduled jobs - sessions_spawn / sessions_send — agent delegation - exec — shell execution - elevated — host-level execution

Deny all of these by default. Enable selectively per agent.

Run the security audit

openclaw security audit
openclaw security audit --deep   # live probing

This flags world-writable state dirs, unauthenticated binds, dangerous tool allowlists, sandbox misconfig, and more. Run it after first setup.

Credential file locations

~/.openclaw/credentials/whatsapp/<accountId>/creds.json
~/.openclaw/credentials/<channel>-allowFrom.json
~/.openclaw/agents/<agentId>/agent/auth-profiles.json

Set permissions: chmod 700 ~/.openclaw and chmod 600 on all files inside. Use full-disk encryption on any machine running the gateway.

Prompt injection

The docs acknowledge prompt injection "is not solved by system prompts alone." Mitigations: lock down DM/group access before enabling tools, treat all external content (web results, emails, documents) as potential attack vectors, use strong models for tool-enabled agents, enable sandboxing.

---

Cost Breakdown

OpenClaw itself: free. MIT-licensed, no subscription.

Your actual costs:

Component	Options	Monthly estimate
AI model	Claude Opus 4.7 (API)	$5–30 depending on usage
AI model	GPT-4o (API)	$10–40 depending on usage
AI model	Ollama + local model	$0 (uses your hardware)
Gateway server	Your own machine	$0
Gateway server	Raspberry Pi 4	~$0.50 electricity
Gateway server	AWS Lightsail 1 GB	$5/month
Gateway server	AWS EC2 t3.small	~$15/month
Gateway server	DigitalOcean / Hetzner	$4–6/month
VNC desktop on EC2	EC2 t3.small + storage	~$15–18/month
Tailscale	Personal plan	Free (up to 3 users)
Skills	All ClawHub skills	Free

Realistic total for a personal always-on setup:

- Budget: Raspberry Pi (~$70 one-time) + Ollama local model = ~$0/month ongoing (privacy-first) - Standard: Lightsail $5 + Claude API at moderate usage = ~$20–30/month - Full stack with browser automation: EC2 t3.small + Claude API = ~$30–50/month

The biggest variable is model API usage. Claude Opus 4.7 dropped to $5/MTok input and $25/MTok output, a 67% price reduction from Opus 4.6. This makes Claude significantly more accessible for agentic tasks. For personal assistant use (short messages, quick tasks), most people stay well under $15/month on the API alone. Use Claude Haiku or a local Ollama model to cut this to near zero.

---

Chinese AI Providers in OpenClaw

The Chinese AI providers (Kimi, Qwen, DeepSeek, GLM, MiniMax) are not just cheaper alternatives to Claude and GPT. Some have distinct architectural strengths that make them the right choice for specific workloads inside OpenClaw.

!Kimi Claw — Moonshot AI's OpenClaw-based assistant for Chinese market

Kimi Claw (by Moonshot AI)

Kimi Claw is Moonshot AI's own OpenClaw-based AI assistant; the lobster claw name reflects a direct fork and localisation of OpenClaw for the Chinese market. It runs on top of their Kimi K2 model, comes with long-term memory, automation, document processing, slide creation, spreadsheet tools, and deep research built in. Available on Web, iOS, and Android. 4.9/5 across 94,000+ reviews on its app stores. It is what you get when the model provider also ships the gateway stack.

OpenClaw natively supports Kimi models:

{
  agents: {
    defaults: {
      model: {
        primary: "kimi-k2.6",
        fallbacks: ["anthropic/claude-haiku-4-5"],
      },
    },
  },
}

Kimi K2.6 (the model)

Spec	Value
Architecture	MoE — 1T total params, 32B active per forward pass
Context window	131,000 tokens
Input price	$0.60/M tokens
Output price	$2.50/M tokens
Provider (OpenRouter)	`moonshotai/kimi-k2.6`
Released	April 20, 2026

Kimi K2.6 is purpose-built for agentic tasks: heavy tool use, autonomous step sequences, coding. Its MuonClip training optimizer makes it unusually stable at long multi-step tasks. Strong results on LiveCodeBench, SWE-bench, ZebraLogic, GPQA, and the Tau2/AceBench tool-use benchmarks. In OpenClaw, it is the natural pick if you are running agents that make dozens of tool calls per session. At $0.60/M input it is still significantly cheaper than Claude Opus 4.7 ($5/M) for input-heavy agentic workloads, though the gap has closed with Opus's price drop.

DeepSeek V3.2

Spec	Value
Context window	128K tokens
Input (cache miss)	$0.28/M tokens
Input (cache hit)	$0.028/M tokens
Output	$0.42/M tokens
Thinking mode (reasoner)	Same pricing, up to 64K output

DeepSeek's pricing is the headline: $0.28/M input is roughly 18× cheaper than Claude Opus 4.7 ($5/M). The cache hit price ($0.028) is essentially free for repeated context. The trade-off is real: it performs better on structured, well-specified tasks than on ambiguous natural language. Thinking/reasoner mode gives it a chain-of-thought pass that significantly closes the gap on complex reasoning tasks. DeepSeek V4 is now available at ~$0.14/M input with further quality improvements.

{
  agents: {
    defaults: {
      model: {
        primary: "deepseek/deepseek-chat",       // fast, cheap
        fallbacks: ["deepseek/deepseek-reasoner"], // when you need the reasoning pass
      },
    },
  },
}

Qwen (Alibaba Cloud)

Qwen models run on Alibaba's Model Studio (modelstudio.console.alibabacloud.com). They offer a free quota of 1M tokens per model per month for the first 90 days after account activation, which is useful for testing.

Model	Context	Input (CNY)	Output (CNY)	~USD input	~USD output
Qwen3-Max	262K	¥2.5/M	¥10/M	~$0.34/M	~$1.37/M
Qwen3.5-Plus	1M	¥0.8/M	¥4.8/M	~$0.11/M	~$0.66/M
Qwen3.5-Flash	1M	¥0.2/M	¥2/M	~$0.027/M	~$0.27/M

Qwen3.5-Flash at ¥0.2/M input with a 1M token context window is the most cost-effective model currently available anywhere for long-document tasks. If you are running a skill that processes large files, calendars, email threads, or codebases, Qwen3.5-Flash can do what would cost dollars in Claude for fractions of a cent.

Qwen is also the only provider with a first-class translation model: Qwen-MT covers 92 languages including rare dialects. If you are building multilingual skills or deploying OpenClaw for a multilingual team, Qwen-MT is worth evaluating.

Available in OpenClaw via OpenRouter:

{
  agents: {
    defaults: {
      model: {
        primary: "qwen/qwen3-max",
        fallbacks: ["qwen/qwen3.5-flash"],
      },
    },
  },
}

Or configure Alibaba Cloud DashScope directly with a custom provider endpoint.

Z.AI / GLM (Zhipu AI)

Zhipu AI's GLM family is natively supported in OpenClaw as zai-glm-4.7 and zai-glm-4.6. GLM-4 is notable for strong performance on Chinese-language tasks and the glm-4v variant handles vision. If you are deploying OpenClaw for a Chinese-speaking user base, GLM handles Chinese text generation with more natural register and idiomatic accuracy than western models.

MiniMax

MiniMax M2 models (MiniMax-M2.7, MiniMax-M2.5) are available natively in OpenClaw. MiniMax is known for long-form generation quality (coherent output at scale) and has strong voice/TTS capabilities. If your OpenClaw deployment uses voice channels, MiniMax's audio stack integrates well.

Choosing between them for OpenClaw

Use case	Recommended
General assistant, high quality	`claude-opus-4-7` or `kimi-k2.6`
Agentic tasks, many tool calls	`kimi-k2.6` (built for this)
Cheapest capable model	`deepseek/deepseek-chat`
Long document processing (1M+ tokens)	`qwen/qwen3.5-flash`
Chinese-language users	`zai-glm-4.7` or `qwen/qwen3-max`
Multilingual translation (92 languages)	`qwen/qwen-mt`
Voice + long-form output	`MiniMax-M2.7`
Reasoning / math / logic	`deepseek/deepseek-reasoner`
Balance of cost and quality	`qwen/qwen3.5-plus`

The China OpenClaw trend

The Kimi Claw launch is the most visible signal of a broader pattern: Chinese AI companies are building their own gateway stacks rather than just releasing model APIs. Moonshot AI forked OpenClaw. Other providers are watching. The reason is practical: OpenClaw's multi-channel, self-hosted architecture maps well to how people in China actually use messaging (WeChat, DingTalk, Feishu) and the demand for local deployment is high.

WeChat and DingTalk are not in OpenClaw's official channel list yet, but the plugin architecture supports custom channels. The community is actively building WeChat bridges. If you need WeChat support today, the Kimi Claw fork has it.

For international teams building on OpenClaw with users in China: route Chinese-language requests through Qwen or GLM for response quality, and use the multi-agent routing config to assign model by channel or sender region.

---

NVIDIA NemoClaw — Secure OpenClaw Deployment

NVIDIA released NemoClaw on March 16, 2026. NemoClaw is a security wrapper that runs OpenClaw agents inside hardened containers, not a competing product.

The problem NemoClaw solves: OpenClaw agents can browse the web, execute code, read files, and call APIs. Those capabilities are powerful, but dangerous if the agent gets prompt-injected or goes off-script. NemoClaw adds four isolation layers around the agent:

Network — blocks all outbound connections except explicitly approved domains. Unapproved requests surface in a terminal UI for the operator to approve or deny in real time.
Filesystem — agent can only access /sandbox and /tmp. Your home directory, credentials, and system files are invisible.
Process — prevents privilege escalation and dangerous syscalls.
Inference routing — all model API calls go through a controlled gateway at inference.local. Credentials stay on the host, never inside the sandbox.

# Install NemoClaw curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash # Create a sandboxed OpenClaw agent nemoclaw onboard

# Connect to it nemoclaw <name> connect

Requires Ubuntu 22.04+, Node 20+, Docker, and NVIDIA OpenShell. Minimum 4 vCPU, 8 GB RAM (16 GB recommended). Supports NVIDIA Endpoints, OpenAI, Anthropic, Google Gemini, and local Ollama as inference providers.

NemoClaw is in alpha and APIs may change. The architecture is sound. If you are deploying OpenClaw in any environment where the agent has access to sensitive systems (production servers, internal tools, customer data), NemoClaw turns a "trust the model" setup into a "verify then allow" setup.

Licensed Apache 2.0. Source at github.com/NVIDIA/NemoClaw.

---

Recent Releases (v2026.3.24 → v2026.5.19)

Notable changes since the original publication:

- Microsoft Teams migrated to the official SDK — streaming replies, welcome cards, message editing/deletion - One-click skill install recipes for bundled skills (coding-agent, gh-issues, trello, weather, and more) — dependencies resolve automatically - Docker/Podman container mode via --container flag — run commands inside containers without manual Docker setup - Discord auto-thread naming — threads get LLM-generated titles instead of "New Thread" - Qwen/DashScope standard endpoints alongside existing Coding Plan integration - OpenAI default model switched to gpt-5 - Per-agent thinking/reasoning defaults — configure chain-of-thought at the agent level - ClawHub native skill search/install workflows built into the Control UI with status filtering (All/Ready/Needs Setup/Disabled) - Plugin SDK restructured to openclaw/plugin-sdk/* — cleaner imports for extension authors - 35+ model providers now supported natively

Full release notes: github.com/openclaw/openclaw/releases

---

Platform Comparison

Platform	Always-on	Browser control	Privacy	Monthly cost
macOS / Windows (home)	If awake	Yes	High — local	$0 + API
Ubuntu home server	Yes	Yes	High — local	$0 + API
Raspberry Pi 4	Yes	Limited	High — local	~$0.50 + API
AWS Lightsail 1 GB	Yes	No GUI	Medium — cloud	$5 + API
AWS EC2 t3.small	Yes	Yes (with VNC)	Medium — cloud	~$15 + API
DigitalOcean 1 GB	Yes	No GUI	Medium — cloud	$4 + API
Hetzner CX22	Yes	No GUI	Medium — cloud (EU)	~$4 + API
Android Termux	Unstable	No	High if local model	$0 + API
iOS	Node only	No	Depends on gateway	$0 + API

---

Installing OpenClaw

Requirements: Node.js 24 (22.14+ also works). Pick your platform below.

macOS

The native installer handles Node version checking, daemon setup, macOS permissions (notifications, accessibility, mic, camera, screen recording), and launches an onboarding chat:

curl -fsSL https://openclaw.ai/install.sh | bash

Then run onboarding:

openclaw onboard --install-daemon

The wizard walks you through seven steps: system approvals, security briefing, gateway location (local or remote), auth token generation, permissions grant, optional CLI install via npm, and a first onboarding chat session.

After setup, OpenClaw runs as a menu bar app. The gateway listens at ws://127.0.0.1:18789 and the Control UI is at http://127.0.0.1:18789.

Windows

iwr -useb https://openclaw.ai/install.ps1 | iex

Or install via npm after installing Node 24 from nodejs.org:

npm install -g openclaw@latest
openclaw onboard --install-daemon

The daemon registers as a Windows service and starts on login. The openclaw-windows-node companion app adds a system tray icon and PowerToys integration; install it separately for the full Windows experience.

Ubuntu / Debian (home server or VM)

# Install Node 24 curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash - sudo apt-get install -y nodejs # Install OpenClaw npm install -g openclaw@latest openclaw onboard --install-daemon

# Verify openclaw gateway status

The daemon installs as a systemd service (openclaw-gateway). Check it with:

systemctl status openclaw-gateway
journalctl -u openclaw-gateway -f   # live logs

Raspberry Pi (Ubuntu 22.04 / 24.04 64-bit)

A Pi 4 with 4 GB RAM is the recommended minimum. Use the Ubuntu Server 64-bit image; Raspberry Pi OS works too but Ubuntu's apt repos make Node 24 easier to install.

# On the Pi via SSH or direct terminal curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash - sudo apt-get install -y nodejs node --version # should print v24.x.x

npm install -g openclaw@latest openclaw onboard --install-daemon

Because the Pi has no browser, skip browser-related skill config. For channels: Telegram and WhatsApp work fully. iMessage does not (requires macOS).

To keep the gateway accessible from your phone without port forwarding:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Then install the Tailscale app on your phone. Your Pi and phone are now on the same private network regardless of where they are.

NixOS

# In your flake or configuration.nix
{
  inputs.nix-openclaw.url = "github:openclaw/nix-openclaw";
}

See github.com/openclaw/nix-openclaw for the full NixOS module options; it handles the systemd service, config file management, and environment variables declaratively.

Docker

docker run -d \
  --name openclaw \
  --restart unless-stopped \
  -p 127.0.0.1:18789:18789 \
  -v ~/.openclaw:/home/openclaw/.openclaw \
  ghcr.io/openclaw/openclaw:latest

The volume mount persists your config, credentials, and session history across container restarts. Binding to 127.0.0.1 ensures the port is not publicly exposed; use Tailscale or a reverse proxy for remote access.

As of v2026.3.24, OpenClaw also supports a --container flag that runs commands inside Docker/Podman containers without manual Docker setup, useful for sandboxed skill execution.

---

AWS Lightsail

Lightsail is Amazon's simplified hosting: fixed monthly price, no networking degree required. Good starting point if you have never used AWS.

Step 1 — Create an AWS account

Go to aws.amazon.com and create an account. You need a credit card. Lightsail's smallest plan is $5/month, which is your ceiling.

Step 2 — Open Lightsail

Go to lightsail.aws.amazon.com.

Step 3 — Create an instance

Click Create instance:

- Location: region closest to you - Platform: Linux/Unix - Blueprint: Ubuntu 24.04 LTS - Plan: $5/month (1 GB RAM, 1 vCPU) for basic use. $10/month (2 GB) if running 3+ channels. - Name: openclaw-server

Click Create instance. It boots in about 60 seconds.

Step 4 — Connect and install

Click the terminal icon → browser SSH opens. Then:

curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash -
sudo apt-get install -y nodejs
npm install -g openclaw@latest
openclaw onboard --install-daemon

Step 5 — Remote access via Tailscale

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Install Tailscale on your phone/laptop, sign in with the same account. Your Lightsail instance is now privately reachable from any of your devices.

---

AWS EC2

More control than Lightsail. Used in production. More setup steps.

Step 1 — Open EC2 console

Go to console.aws.amazon.com/ec2. Choose your region (top-right).

Step 2 — Launch an instance

Click Launch instances (orange button):

- Name: openclaw - AMI: Ubuntu Server 24.04 LTS (HVM), SSD Volume Type — 64-bit x86 - Instance type: - t3.micro — 1 GB RAM, free tier eligible, usable but tight - t3.small — 2 GB RAM, ~$15/month, comfortable for most setups - t3.medium — 4 GB RAM, ~$30/month, if running browser automation + multiple channels - Key pair: Click Create new key pair → name it openclaw-key → RSA → .pem (Mac/Linux) or .ppk (Windows PuTTY). Download and keep it safe. It cannot be re-downloaded.

Step 3 — Security Group (firewall)

Under Network settings → Edit:

- SSH port 22: keep, source = My IP (tighten later) - Do not open port 18789 to 0.0.0.0/0 — use Tailscale instead - If you want the VNC desktop, add Custom TCP port 6080 → My IP only

Step 4 — Storage

Default 8 GB is fine. Increase to 20 GB if storing long conversation history or browser screenshots.

Click Launch instance.

Step 5 — SSH into the instance

Select the instance → Connect → SSH client tab for the exact command:

chmod 400 openclaw-key.pem
ssh -i "openclaw-key.pem" ubuntu@YOUR-EC2-PUBLIC-DNS

Windows: use Windows Terminal or PuTTY.

Step 6 — Install Node 24 and OpenClaw

curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash - sudo apt-get install -y nodejs node --version # v24.x.x npm install -g openclaw@latest openclaw onboard --install-daemon

# Check status systemctl status openclaw-gateway

Step 7 — Elastic IP (recommended)

By default EC2 gives you a new public IP on every restart. Fix it:

EC2 console → Elastic IPs (left sidebar, under Network & Security)
Allocate Elastic IP address → Allocate
Select the new IP → Actions → Associate Elastic IP address → choose your instance

First Elastic IP on a running instance is free.

Step 8 — Tailscale

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

---

EC2 GUI Desktop — VNC + Openbox + Chrome

For browser automation, screenshots, and visual inspection of what the agent is doing, you need a virtual display. This sets up a full desktop accessible via your browser at http://YOUR-IP:6080/vnc.html.

Step 1 — Open port 6080 in Security Group

EC2 console → Security Groups → your group → Edit inbound rules → Add rule: - Type: Custom TCP, Port: 6080, Source: My IP

Step 2 — Install the stack

sudo apt update
sudo apt install -y \
  xvfb x11vnc novnc websockify \
  openbox xterm xfce4-terminal dbus-x11 feh obconf

- xvfb — virtual framebuffer (screen with no monitor) - x11vnc — exposes the virtual screen over VNC - novnc + websockify — serve VNC as a webpage - openbox — lightweight window manager (XFCE crashes on headless EC2; Openbox does not) - dbus-x11 — prevents a popup on first launch

Step 3 — Startup script

sudo nano /usr/local/bin/start-desktop.sh

#!/bin/bash
export DISPLAY=:1
export HOME=/home/ubuntu
export USER=ubuntu

pkill Xvfb 2>/dev/null; pkill x11vnc 2>/dev/null
pkill websockify 2>/dev/null; pkill openbox 2>/dev/null
sleep 1

rm -f /tmp/.X1-lock /tmp/.X11-unix/X1

Xvfb :1 -screen 0 1280x800x24 &
sleep 3

DISPLAY=:1 openbox-session &
sleep 2

DISPLAY=:1 xsetroot -solid "#1a1a2e" &

x11vnc -display :1 -nopw -listen localhost -xkb -forever &
sleep 2

websockify --web=/usr/share/novnc/ 6080 localhost:5900 &

sudo chmod +x /usr/local/bin/start-desktop.sh

Step 4 — systemd service

sudo nano /etc/systemd/system/desktop-vnc.service

[Unit]
Description=Openbox Desktop + noVNC
After=network.target

[Service]
Type=forking
User=ubuntu
ExecStart=/usr/local/bin/start-desktop.sh
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable desktop-vnc
sudo systemctl start desktop-vnc
sleep 6
sudo systemctl status desktop-vnc

You should see active (running) with Xvfb, openbox, x11vnc, websockify in the CGroup.

Step 5 — Open in browser

http://YOUR-EC2-PUBLIC-IP:6080/vnc.html

Click Connect. Dark desktop = Openbox running correctly.

If blank/black with no Connect button: a browser extension is injecting broken JS into the HTTP page. Open in Chrome incognito (Ctrl+Shift+N), where extensions are disabled. Or use Firefox/Edge for the noVNC URL.

Step 6 — Right-click menu and Chrome

# Add right-click desktop menu
mkdir -p ~/.config/openbox
cat > ~/.config/openbox/menu.xml << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<openbox_menu>
  <menu id="root-menu" label="Desktop">
    <item label="Terminal">
      <action name="Execute"><command>xfce4-terminal</command></action>
    </item>
    <item label="Chrome">
      <action name="Execute"><command>google-chrome --no-sandbox --disable-dev-shm-usage</command></action>
    </item>
    <separator/>
    <item label="Restart Desktop">
      <action name="Execute"><command>sudo systemctl restart desktop-vnc</command></action>
    </item>
  </menu>
</openbox_menu>
EOF

DISPLAY=:1 openbox --reconfigure

# Install Chrome
wget -q https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
sudo apt install -y ./google-chrome-stable_current_amd64.deb

# Launch Chrome on the virtual display
DISPLAY=:1 google-chrome --no-sandbox --disable-dev-shm-usage &

The --no-sandbox flag is required on EC2 because Chrome's sandbox conflicts with the way user processes work in cloud VMs. --disable-dev-shm-usage prevents crashes from the limited /dev/shm allocation.

---

OpenClaw Browser Automation + Screenshots

Once the virtual desktop is running, OpenClaw can take screenshots of what is on screen and send them to you in chat.

# Install screenshot tools sudo apt install -y scrot imagemagick

# Test it manually DISPLAY=:1 scrot /tmp/test.png ls -lh /tmp/test.png # should be non-zero

Add the browser config to ~/.openclaw/openclaw.json:

{
  browser: {
    enabled: true,
    display: ":1",
    executablePath: "/usr/bin/google-chrome",
    args: ["--no-sandbox", "--disable-dev-shm-usage", "--disable-gpu"],
    screenshotPath: "/tmp/openclaw-screenshots",
    dangerouslyAllowPrivateNetwork: false,
  },
}

mkdir -p /tmp/openclaw-screenshots
systemctl restart openclaw-gateway

Now from WhatsApp or Telegram:

"Open github.com/openclaw and take a screenshot"

The agent opens Chrome on :1, navigates, captures, and sends you the image. From there you can say "click the stars button" or "scroll down and screenshot again" and it continues interacting with the browser.

---

Android (Termux + proot-distro Ubuntu)

Install Termux from F-Droid, not Google Play (that version is abandoned and outdated).

# In Termux pkg update && pkg upgrade pkg install proot-distro # Install and enter Ubuntu proot-distro install ubuntu proot-distro login ubuntu # Inside Ubuntu proot apt update && apt upgrade -y curl -fsSL https://deb.nodesource.com/setup_24.x | bash - apt-get install -y nodejs

npm install -g openclaw@latest openclaw onboard --install-daemon

Install Termux:Boot from F-Droid so Termux starts on device reboot. Whitelist Termux in your battery optimiser settings, or Android will kill it. Go to Settings → Battery → Battery Optimisation → find Termux → set to "Don't optimise".

---

Config Reference

OpenClaw reads ~/.openclaw/openclaw.json (JSON5 format with comments allowed). If the file doesn't exist, defaults are used. Changes in most sections apply via hot-reload without a restart. Infrastructure changes (port, bind mode) require a restart.

{
  // --- Model provider ---
  agents: {
    defaults: {
      model: {
        primary: "anthropic/claude-opus-4-7",   // or "openai/gpt-5", "google/gemini-3.1-pro"
        fallbacks: ["anthropic/claude-haiku-4-5"],
      },
      workspace: "~/openclaw-workspace",
      imageMaxDimensionPx: 1200,
      sandbox: {
        mode: "docker",   // "none" | "docker"
        scope: "session", // isolation level
      },
    },
  },

  // --- Channels ---
  channels: {
    telegram: {
      enabled: true,
      botToken: "${TELEGRAM_BOT_TOKEN}",  // reference from env var
      dmPolicy: "pairing",               // "pairing" | "allowlist" | "open" | "disabled"
      allowFrom: [],                     // add numeric Telegram user IDs here
      groupPolicy: "allowlist",
    },
    whatsapp: {
      dmPolicy: "pairing",
      allowFrom: ["+15551234567"],        // your phone number with country code
    },
    discord: {
      enabled: true,
      token: "${DISCORD_BOT_TOKEN}",
      guildPolicy: "allowlist",
      guildAllowFrom: ["YOUR_SERVER_ID"],
      requireMention: true,
    },
  },

  // --- Sessions ---
  session: {
    dmScope: "per-peer",              // "main" | "per-peer" | "per-channel-peer"
    threadBindings: {
      enabled: true,
      idleHours: 2,
      maxAgeHours: 48,
    },
    reset: {
      mode: "idle",
      idleMinutes: 60,
    },
  },

  // --- Gateway ---
  gateway: {
    port: 18789,
    bind: "loopback",                 // "loopback" | "lan" | "tailnet" — never expose raw to internet
    reload: "hybrid",                 // hot-reload mode
    channelHealthCheckMinutes: 5,
  },

  // --- Browser ---
  browser: {
    enabled: false,                   // enable only if you have the VNC desktop set up
  },

  // --- Cron ---
  cron: {
    enabled: false,
    maxConcurrentRuns: 2,
  },

  // --- Logging ---
  logging: {
    level: "info",                    // "debug" | "info" | "warn" | "error"
  },
}

Environment variable substitution: any ${VAR_NAME} in string values is replaced from your environment or from ~/.openclaw/.env. Use this to keep tokens out of the config file:

# ~/.openclaw/.env
TELEGRAM_BOT_TOKEN=7512840932:AAFxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
DISCORD_BOT_TOKEN=your-discord-token
ANTHROPIC_API_KEY=sk-ant-...

Validate config:

openclaw doctor

Unknown keys or invalid values prevent startup; openclaw doctor tells you exactly what is wrong.

---

Connecting Channels

Step 1 — Create a bot via @BotFather

Open Telegram, message @BotFather (blue checkmark — official)
Send /newbot
Choose a display name (e.g. My Assistant)
Choose a username ending in bot (e.g. myassistant_bot)
Copy the bot token: 7512840932:AAFxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Step 2 — Set privacy mode

Still in BotFather, send /setprivacy → select your bot → choose Disable if you want the bot to see all messages in groups (not just ones starting with /). For personal DM-only use, leave it enabled.

Step 3 — Add token to config

{
  channels: {
    telegram: {
      enabled: true,
      botToken: "${TELEGRAM_BOT_TOKEN}",
      dmPolicy: "pairing",
    },
  },
}

Add TELEGRAM_BOT_TOKEN=your-token to ~/.openclaw/.env.

Step 4 — Approve yourself

Start the gateway, message your bot /start on Telegram, and it replies with a pairing code. In your terminal:

openclaw pairing list telegram
openclaw pairing approve telegram <CODE>

You are now approved. All future messages from your account go straight through.

Step 5 — Lock it to yourself

Find your numeric Telegram user ID by messaging @userinfobot. Then:

channels: {
  telegram: {
    dmPolicy: "allowlist",
    allowFrom: [123456789],  // your numeric ID
  },
}

---

OpenClaw connects via Baileys, the same mechanism as WhatsApp Web. No official API key needed. Your phone remains the account owner; the gateway is a linked device.

Recommended: use a dedicated number. A separate SIM or a virtual number (Google Voice, etc.) gives the bot its own identity and keeps your personal chats separate.

Step 1 — Configure

{
  channels: {
    whatsapp: {
      dmPolicy: "pairing",
      allowFrom: ["+15551234567"],  // your number in international format
    },
  },
}

Step 2 — Link the account

openclaw channels login --channel whatsapp

A QR code appears in the terminal. On your phone:

Open WhatsApp → three dots → Linked devices → Link a device
Scan the QR code

Done. The gateway is now a linked device. Revoke it any time from WhatsApp → Linked devices on your phone.

Step 3 — First message

The gateway responds to messages you send to yourself (your own number) or to any number in allowFrom. Create a contact called "Assistant", add your gateway's phone number, and message it.

If the QR code expires before you scan it, the code regenerates. Check the live logs:

journalctl -u openclaw-gateway -f

---

Discord

Step 1 — Create a bot at discord.com/developers

New Application → name it
Left sidebar → Bot → Add Bot
Under Privileged Gateway Intents, enable:

- Message Content Intent (required — bot cannot read messages without this) - Server Members Intent (recommended)

Copy the bot token

Step 2 — Invite to your server

Left sidebar → OAuth2 → URL Generator: - Scopes: bot, applications.commands - Bot Permissions: View Channels, Send Messages, Read Message History, Embed Links, Attach Files

Copy the generated URL, open it, select your server, click Authorise.

Step 3 — Configure

{
  channels: {
    discord: {
      enabled: true,
      token: "${DISCORD_BOT_TOKEN}",
      guildPolicy: "allowlist",
      guildAllowFrom: ["YOUR_SERVER_ID"],  // right-click server → Copy Server ID
      requireMention: false,               // set true if you want @bot-name triggers only
    },
  },
}

Right-click the server icon in Discord to copy the Server ID (enable Developer Mode first: User Settings → Advanced → Developer Mode).

---

iMessage

iMessage requires macOS and is marked as legacy; the docs recommend using a dedicated Mac mini or similar. New deployments should consider BlueBubbles as an alternative.

# Install imsg via Homebrew on the Mac running the gateway
brew install imsg

{
  channels: {
    imessage: {
      enabled: true,
      cliPath: "/opt/homebrew/bin/imsg",
      dmPolicy: "pairing",
    },
  },
}

The Messages app must be signed in. Grant Full Disk Access and Automation permissions to the process when macOS prompts.

---

iOS and Android as Nodes

iOS and Android do not run the gateway. They connect to it as nodes and extend it with device capabilities.

What nodes add:

Capability	iOS	Android
Canvas (interactive UI)	Yes	Yes
Voice Wake word	Yes	Yes
Push-to-talk overlay	Yes	Yes
Camera	Yes	Yes
Screen recording	Yes	Yes
Location	Yes	Yes
Device commands (SMS, contacts, notifications)	No	Yes

Pairing:

Open the OpenClaw app on your phone (download from App Store / Google Play)
In your gateway terminal: openclaw pairing list nodes
The phone shows a pairing code — approve it: openclaw pairing approve node

Once paired, your phone becomes a device node. You can now say "take a photo with my phone" or "read my notifications" and the gateway executes it on the paired device.

---

`After Install: Add Skills from ClawHub`

Once OpenClaw is running, install skills via CLI:

# Install top highlighted skills
npx clawhub@latest install trello
npx clawhub@latest install slack
npx clawhub@latest install caldav-calendar
npx clawhub@latest install answer-overflow

# Search by description
clawhub search "email"
clawhub search "github issues"
clawhub search "browser automation"

# Preview before installing
clawhub inspect <skill-name>

# List installed
clawhub list

# Remove a skill
clawhub uninstall <skill-name>

Or just tell your assistant in chat: "install the Trello skill" and it will find and install it directly.

Browse the full catalogue at clawhub.ai. Search is semantic: describe what you want, not the skill name.

---

The skills that get traction all do the same thing: connect your assistant to tools you already use rather than replace them. Trello stays Trello. Slack stays Slack. The AI removes the switching cost between them.

ClawHub is early. The catalogue is growing. The distribution model is the right foundation: versioned, rollback-ready, MIT-licensed, and vector-searchable. With NVIDIA building a security layer on top and Chinese providers forking the gateway for their own markets, the ecosystem is spreading faster than the skill count suggests.

---

- ClawHub — Browse skills - OpenClaw on GitHub (250K+ stars) - OpenClaw Docs - OpenClaw Discord - NVIDIA NemoClaw (secure OpenClaw deployment) - ClawHub source - Latest release: v2026.5.19

---

Last updated: May 21, 2026

`AWS Lightsail`

Lightsail is Amazon's simplified hosting: fixed monthly price, no surprise bills, no networking degree required. A good first choice if you have never touched AWS before.

Step 1 — Create an AWS account

Go to aws.amazon.com and click "Create an AWS Account". You will need a credit card, but Lightsail's smallest instance is $5/month and that is the most you will pay for this.

Step 2 — Open Lightsail

Once logged in, go to lightsail.aws.amazon.com. If you have never used it before it will ask you to get started; click through.

Step 3 — Create an instance

Click Create instance. On the next screen:

- Instance location: pick the region closest to you (US East, Tokyo, Sydney, etc.) - Platform: Linux/Unix - Blueprint: Ubuntu 24.04 LTS - Instance plan: the $5/month plan (1 GB RAM, 1 vCPU, 40 GB SSD) is enough for OpenClaw with a handful of skills. Go to $10/month (2 GB RAM) if you plan to run many channels simultaneously. - Instance name: call it anything; openclaw-server works fine

Click Create instance. It will take about 60 seconds to boot.

Step 4 — Connect via SSH

Once the instance shows "Running", click the terminal icon next to it (or click the instance name → Connect). This opens a browser-based SSH terminal directly on the page with no extra software needed.

Step 5 — Install Node 24

Paste this into the terminal:

curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash -
sudo apt-get install -y nodejs
node --version   # should print v24.x.x

Step 6 — Install OpenClaw

sudo npm install -g openclaw@latest
openclaw onboard --install-daemon

The onboarding wizard runs in the terminal and asks which messaging platforms to connect. Follow the prompts; it will give you QR codes or auth links for WhatsApp, Telegram, etc.

Step 7 — Keep it accessible from your phone (Tailscale)

The gateway runs at ws://127.0.0.1:18789, only reachable locally by default. To reach it from your phone or laptop without opening firewall ports, install Tailscale:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Tailscale gives your server a private IP (like 100.x.x.x) that only your devices can reach. Install the Tailscale app on your phone, sign in with the same account, and your phone can reach the gateway directly over an encrypted tunnel. No port forwarding, no public IP exposure.

---

`AWS EC2`

EC2 gives you more control than Lightsail: more instance types, more networking options, and it is what most companies run in production. The trade-off is more setup steps.

Step 1 — Open the EC2 console

Go to console.aws.amazon.com/ec2. In the top-right corner, choose your region (pick the one geographically closest to you, as it affects latency).

Step 2 — Launch an instance

Click Launch instances (orange button, top right).

Fill in the form:

- Name: openclaw - AMI (Amazon Machine Image): click "Browse more AMIs" if needed, select Ubuntu Server 24.04 LTS (HVM), SSD Volume Type — it is free tier eligible and the 64-bit (x86) version - Instance type: t3.small (2 GB RAM, 2 vCPU) — this is the practical minimum for OpenClaw with a few active skills. t3.micro (1 GB) will work but may feel slow. t3.medium (4 GB) if you plan heavy use. - Key pair: click Create new key pair. Name it openclaw-key, leave the type as RSA, format as .pem (Mac/Linux) or .ppk (Windows with PuTTY). Download it and keep it safe; you cannot download it again.

Step 3 — Configure the Security Group

This is the firewall. Under Network settings, click Edit:

- The default rule allows SSH (port 22) from anywhere — fine for now, you can tighten it later - Add an inbound rule: Type: Custom TCP, Port: 18789, Source: My IP — this allows your current IP to reach the OpenClaw gateway directly. Or skip this and use Tailscale instead (recommended) - Do not open port 18789 to 0.0.0.0/0 (all IPs) — the gateway is not hardened for public exposure

Step 4 — Storage

Leave it at the default 8 GB. OpenClaw itself is small. Increase to 20 GB if you plan to store conversation history or logs long-term.

Click Launch instance.

Step 5 — Connect via SSH

Once the instance shows "Running" (usually 1–2 minutes), select it and click Connect → SSH client tab. It will show you the exact command to paste into your terminal, something like:

chmod 400 openclaw-key.pem
ssh -i "openclaw-key.pem" [email protected]

Run that from the folder where you saved the .pem file. On Windows, use Windows Terminal or PuTTY with the .ppk file.

Step 6 — Install Node 24

curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash -
sudo apt-get install -y nodejs
node --version   # should print v24.x.x

Step 7 — Install OpenClaw

sudo npm install -g openclaw@latest
openclaw onboard --install-daemon

# Verify the service is running
systemctl status openclaw-gateway

Step 8 — Assign an Elastic IP (optional but recommended)

By default your EC2 instance gets a new public IP every time it restarts. To give it a fixed IP:


In the EC2 console left sidebar, go to Elastic IPs under Network & Security
Click Allocate Elastic IP address → Allocate
Select the new IP → Actions → Associate Elastic IP address
Choose your instance and click Associate

Your server now has a permanent public IP. The first Elastic IP associated with a running instance is free.

Step 9 — Tailscale (recommended over opening ports)

Same as Lightsail: Tailscale keeps your gateway private and accessible from any of your devices without touching security groups:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Install the Tailscale app on your phone or laptop, sign in with the same account, done.

---

`EC2 GUI Desktop — VNC + Openbox + Chrome in Your Browser`

OpenClaw can control a browser, take screenshots, and send them back to you in chat. To do that on a cloud server (which has no monitor), you run a virtual display, a window manager, and connect to it through your regular web browser via noVNC.

This section sets up the full stack: virtual screen → Openbox → Chrome → noVNC → you see it in your browser at http://YOUR-IP:6080/vnc.html.

Step 1 — Open port 6080 in your Security Group

Go to the EC2 console → Security Groups → select the group attached to your instance → Edit inbound rules → Add rule:

- Type: Custom TCP - Port: 6080 - Source: My IP (your current IP only — not 0.0.0.0/0)

Save. This is the only port you need to open for noVNC.

Step 2 — Install the desktop stack

SSH into your instance and run:

sudo apt update
sudo apt install -y \
  xvfb \
  x11vnc \
  novnc \
  websockify \
  openbox \
  xterm \
  xfce4-terminal \
  dbus-x11 \
  feh \
  obconf

- xvfb — creates a virtual screen (no physical monitor needed) - x11vnc — exposes that virtual screen over VNC - novnc + websockify — serve the VNC stream as a webpage you can open in any browser - openbox — lightweight window manager, rock solid on headless servers (XFCE tends to crash) - xterm / xfce4-terminal — terminal emulator to use inside the desktop - dbus-x11 — prevents a harmless but annoying popup on first launch

Step 3 — Create the startup script

sudo nano /usr/local/bin/start-desktop.sh

Paste this exactly:

#!/bin/bash
export DISPLAY=:1
export HOME=/home/ubuntu
export USER=ubuntu

# Kill any existing instances
pkill Xvfb 2>/dev/null
pkill x11vnc 2>/dev/null
pkill websockify 2>/dev/null
pkill openbox 2>/dev/null
sleep 1

# Remove stale lock files from previous runs
rm -f /tmp/.X1-lock
rm -f /tmp/.X11-unix/X1

# Start the virtual display at 1280x800
Xvfb :1 -screen 0 1280x800x24 &
sleep 3

# Start Openbox window manager
DISPLAY=:1 openbox-session &
sleep 2

# Dark background
DISPLAY=:1 xsetroot -solid "#1a1a2e" &

# Start VNC (no password, local only — noVNC handles the browser connection)
x11vnc -display :1 -nopw -listen localhost -xkb -forever &
sleep 2

# Start noVNC — serves the desktop on port 6080
websockify --web=/usr/share/novnc/ 6080 localhost:5900 &

Save: Ctrl+O → Enter → Ctrl+X

Make it executable:

sudo chmod +x /usr/local/bin/start-desktop.sh

Step 4 — Create a systemd service so it starts on reboot

sudo nano /etc/systemd/system/desktop-vnc.service

Paste:

[Unit]
Description=Openbox Desktop + noVNC
After=network.target

[Service]
Type=forking
User=ubuntu
ExecStart=/usr/local/bin/start-desktop.sh
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

Save, then enable and start it:

sudo systemctl daemon-reload
sudo systemctl enable desktop-vnc
sudo systemctl start desktop-vnc
sleep 6
sudo systemctl status desktop-vnc

You should see active (running) and four processes in the CGroup: Xvfb, openbox, x11vnc, websockify.

Step 5 — Open the desktop in your browser

Go to:

http://YOUR-EC2-PUBLIC-IP:6080/vnc.html

Click Connect. You will see a dark desktop. That is Openbox, minimal by design.

If you see a blank black screen with no Connect button: a browser extension is interfering (Grammarly, LastPass, Honey, and similar utilities inject JavaScript into HTTP pages). Fix it by opening in a private/incognito window (Ctrl+Shift+N in Chrome), where extensions are disabled by default. Alternatively use Firefox or Edge for the noVNC URL.

Step 6 — Add a right-click menu

Right-clicking a fresh Openbox desktop does nothing until you configure a menu:

mkdir -p ~/.config/openbox
cat > ~/.config/openbox/menu.xml << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<openbox_menu>
  <menu id="root-menu" label="Desktop">
    <item label="Terminal">
      <action name="Execute"><command>xfce4-terminal</command></action>
    </item>
    <item label="Chrome">
      <action name="Execute"><command>google-chrome --no-sandbox --disable-dev-shm-usage</command></action>
    </item>
    <separator/>
    <item label="Restart Desktop">
      <action name="Execute"><command>sudo systemctl restart desktop-vnc</command></action>
    </item>
  </menu>
</openbox_menu>
EOF

DISPLAY=:1 openbox --reconfigure

Now right-clicking the desktop gives you Terminal and Chrome options.

Step 7 — Install Google Chrome

wget -q https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
sudo apt install -y ./google-chrome-stable_current_amd64.deb

Launch it on the virtual display:

DISPLAY=:1 google-chrome --no-sandbox --disable-dev-shm-usage &

Refresh your noVNC browser tab. Chrome should appear inside the desktop.

The --no-sandbox flag is required because Chrome's sandbox conflicts with how EC2 user processes work. --disable-dev-shm-usage prevents crashes from the small /dev/shm allocation on cloud VMs.

---

`Make OpenClaw Take Screenshots and Send Them to You`

Once the virtual desktop is running, OpenClaw can take a screenshot of whatever is on screen and send it directly to you in WhatsApp or Telegram.

Install the screenshot tool:

sudo apt install -y scrot imagemagick

How it works in OpenClaw:

In your OpenClaw config, the browser skill uses the DISPLAY=:1 environment to control Chrome headlessly against the virtual screen. When you ask your assistant "take a screenshot of the current page" or "open this URL and show me what it looks like", it:


Launches Chrome on :1 if not already running
Navigates to the URL or takes a screenshot of the current state
Saves the image to a temp path
Sends it back to you as an image message in WhatsApp or Telegram

To test it manually first, take a screenshot from SSH and check it works:

DISPLAY=:1 scrot /tmp/test-screenshot.png
ls -lh /tmp/test-screenshot.png

If the file appears with a real size (not 0 bytes), the virtual display and screenshot tool are working correctly.

Configure the browser skill in OpenClaw:

nano ~/.openclaw/workspace/config.yaml

Add or confirm the browser section:

browser:
  enabled: true
  display: ":1"
  executablePath: /usr/bin/google-chrome
  args:
    - --no-sandbox
    - --disable-dev-shm-usage
    - --disable-gpu
  screenshotPath: /tmp/openclaw-screenshots

Create the screenshot directory:

mkdir -p /tmp/openclaw-screenshots

Restart the gateway:

systemctl restart openclaw-gateway

Now from WhatsApp or Telegram, send your assistant:

"Open google.com and take a screenshot"

It will open Chrome in the background on your EC2 virtual display, navigate to the page, capture it, and send you the image in your chat. You can then reply "scroll down and screenshot again" or "click the search bar and type OpenClaw".

The full browser interaction (clicking, typing, scrolling, screenshotting) all happens on the cloud server. Your phone just gets the result.

`Android (Termux + proot-distro Ubuntu)`

This runs a full Ubuntu environment inside Termux, which means full Node 24 support and the same install path as Linux.

# 1. Install Termux from F-Droid (not Google Play — that version is outdated)
# 2. Inside Termux:
pkg update && pkg upgrade
pkg install proot-distro

# 3. Install and enter Ubuntu
proot-distro install ubuntu
proot-distro login ubuntu

# 4. Inside the Ubuntu proot environment:
apt update && apt upgrade -y
curl -fsSL https://deb.nodesource.com/setup_24.x | bash -
apt-get install -y nodejs

npm install -g openclaw@latest
openclaw onboard --install-daemon

Keep Termux running in the background (Termux:Boot helps with auto-start on device reboot). The gateway stays alive as long as Termux is not killed by Android's battery optimiser; whitelist it in your battery settings.

---

`Connecting WhatsApp and Telegram`

After openclaw onboard runs, you can connect messaging platforms. Every message you send on WhatsApp or Telegram goes through OpenClaw, which responds as your AI assistant.

`WhatsApp`

OpenClaw connects to WhatsApp through Baileys, a reverse-engineered WhatsApp Web client. No official API key is needed; you scan a QR code like you would for WhatsApp Web.

During onboarding, when it asks about channels, select WhatsApp. It will print a QR code in the terminal.

On your phone:


Open WhatsApp
Tap the three dots (top right) → Linked devices
Tap Link a device
Scan the QR code in your terminal

Done. Your OpenClaw instance now receives and sends WhatsApp messages as you. The assistant responds to messages you send it in WhatsApp. Create a dedicated contact called "Assistant" or similar, send it a message, and the gateway responds.

If onboarding already finished and you want to add WhatsApp manually, edit your OpenClaw config file:

nano ~/.openclaw/workspace/config.yaml

Under channels, add:

channels:
  - type: whatsapp
    enabled: true

Then restart the gateway:

systemctl restart openclaw-gateway

The QR code will appear in the logs:

journalctl -u openclaw-gateway -f

---

`Telegram`

Telegram uses a proper bot API, which means you need to create a bot through BotFather first.

Step 1 — Create a bot via BotFather


Open Telegram and search for @BotFather — it is the official Telegram bot for creating bots, verified with a blue checkmark
Start a chat and send /newbot
BotFather asks for a name — this is the display name, e.g. My OpenClaw
Then it asks for a username — must end in bot, e.g. myopenclaw_bot
BotFather replies with your bot token — a string like 7512840932:AAFxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Copy that token. Keep it secret — anyone with this token controls your bot.

Step 2 — Add the token to OpenClaw

If you are still in onboarding, select Telegram when it asks about channels and paste the token when prompted.

If onboarding is done, edit the config manually:

nano ~/.openclaw/workspace/config.yaml

Add under channels:

channels:
  - type: telegram
    enabled: true
    token: "7512840932:AAFxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Replace the token value with the one BotFather gave you.

Restart the gateway:

systemctl restart openclaw-gateway

Step 3 — Start chatting

Open Telegram, find your bot by its username, and send /start. The OpenClaw gateway will respond. From that point, everything you send to the bot goes through your assistant.

Step 4 — Optional: restrict the bot to yourself only

By default any Telegram user can message your bot. To lock it to your account only, find your Telegram user ID (send a message to @userinfobot and it replies with your numeric ID), then add to config:

channels:
  - type: telegram
    enabled: true
    token: "your-token-here"
    allowedUserIds:
      - 123456789   # your numeric Telegram user ID

Restart again. Anyone else who messages the bot gets no response.

---

`After Install: Add Skills from ClawHub`

Once OpenClaw is running, install skills via the CLI or just tell your assistant to install them in chat.

# Individual installs
npx clawhub@latest install trello
npx clawhub@latest install slack
npx clawhub@latest install caldav-calendar
npx clawhub@latest install answer-overflow

# Search for more
clawhub search "email"
clawhub search "github"
clawhub search "browser"

# Preview before installing
clawhub inspect <skill-name>

Browse the full catalogue at clawhub.ai. Skills are searchable by description; you do not need to know the exact name.

---

ClawHub is early. The catalogue is still thin. The distribution model is the right foundation: versioned, searchable, MIT-licensed, and self-hostable.

---

- ClawHub — Browse skills - OpenClaw on GitHub - OpenClaw Docs - ClawHub source