Now liveThe Skillselion MCP - thousands of ranked skills, loaded into your agent mid-task. No install.Get it →
agents-store avatar

Config Validation

  • 1 installs
  • Updated August 3, 2026
  • agents-store/claude-plugins

config-validation is a Claude Code skill that audits an openclaw.json agent configuration against official OpenClaw docs for correctness, deprecated settings, and security issues.

About

config-validation is a Claude Code skill that validates an openclaw.json agent configuration against the official OpenClaw documentation. It runs a nine-section checklist covering agents, channels, tools, plugins, and session settings, flags each finding by severity, checks for deprecated or missing fields, and cross-validates the config against workspace files like USER.md and AGENTS.md. It produces a structured validation report grouping issues from CRITICAL to LOW.

  • Validates openclaw.json against official OpenClaw docs for correctness, deprecations, and security
  • 9-section validation checklist with per-field severity (CRITICAL to LOW)
  • Cross-validates config against workspace files (USER.md, TOOLS.md, AGENTS.md, HEARTBEAT.md)

Config Validation by the numbers

  • 1 all-time installs (skills.sh)
  • Ranked #14,102 of 16,546 AI & Agent Building skills by installs in the Skillselion catalog
  • Data as of Aug 4, 2026 (Skillselion catalog sync)
At a glance

config-validation capabilities & compatibility

Capabilities
config validation · config audit · security check
Use cases
security audit · code review
From the docs

What config-validation says it does

Validate `openclaw.json` against the official OpenClaw documentation and check for latest features, deprecated settings, and optimal configurations.
SKILL.md
Always verify against official docs before recommending changes. OpenClaw evolves — features may be added or deprecated.
SKILL.md
npx skills add https://github.com/agents-store/claude-plugins --skill config-validation

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

Listed on Skillselion
Installs1
Last updatedAugust 3, 2026
Repositoryagents-store/claude-plugins

What it does

Auditing an openclaw.json agent config for correctness, deprecated settings, and security issues.

Who is it for?

Auditing an OpenClaw agent config against docs before trusting it in production

Skip if: Configuring tools or platforms other than OpenClaw / openclaw.json

When should I use this skill?

The user wants to verify their openclaw.json is correct, check for latest features, or audit it for problems ('is my config OK', 'check my OpenClaw configuration').

What you get

A severity-ranked validation report of config issues with recommendations.

  • A validation report grouping config issues by severity with recommendations

By the numbers

  • 9-section validation checklist
  • 4 severity levels: CRITICAL, HIGH, MEDIUM, LOW

Files

SKILL.mdMarkdownGitHub ↗

openclaw.json Configuration Validation

Validate openclaw.json against the official OpenClaw documentation and check for latest features, deprecated settings, and optimal configurations.

Official Documentation Sources

When validating configuration, fetch the latest information using the docs-research skill — it holds the tool-priority ladder (Firecrawl → Exa → Perplexity → Jina → context7 → WebFetch) and the canonical OpenClaw documentation URL map (docs site, source/changelog, skills examples).

Always verify against official docs before recommending changes. OpenClaw evolves — features may be added or deprecated.

Validation Checklist

1. Structure Validation

Verify top-level sections exist and are well-formed:

{
  "agents": { ... },        // Required
  "channels": { ... },      // At least one channel needed
  "tools": { ... },         // Recommended
  "plugins": { ... },       // Optional
  "session": { ... }        // Optional
}

2. agents.defaults

FieldCheckSeverity
modelIs it set? Is the model name valid and current?HIGH
workspaceDefaults to ./workspace — verify path existsMEDIUM
bootstrapMaxCharsDefault 20000. Warn if > 50000 (token cost)LOW
bootstrapTotalMaxCharsDefault 150000. Warn if > 300000LOW
userTimezoneIs it set? Valid IANA timezone?MEDIUM
timeoutSecondsDefault 600. Warn if > 1800LOW
maxConcurrentDefault 3. Check based on usageLOW
contextTokensShould match model's context windowMEDIUM
thinkingDefaultValid values: off/minimal/low/medium/high/adaptiveLOW

3. agents.defaults.heartbeat

FieldCheckSeverity
everyIs interval reasonable? (5m-1h typical)MEDIUM
modelUsing a cheap model? (gpt-4o-mini, haiku recommended)MEDIUM
lightContextShould be true for token efficiencyLOW
isolatedSessionRecommended true to avoid session pollutionLOW

4. agents.defaults.compaction

FieldCheckSeverity
memoryFlushShould be true for agents with memoryMEDIUM
reserveTokensFloor8000 is recommended minimumLOW

5. agents.list[]

FieldCheckSeverity
idEach agent has a unique ID?HIGH
defaultExactly one agent is default?HIGH
identityName, emoji set?LOW
sandbox.modeSet for untrusted environments?MEDIUM

6. channels.*

For each configured channel (telegram, discord, whatsapp):

FieldCheckSeverity
enabledIs it intentionally enabled/disabled?MEDIUM
botToken / tokenUses SecretRef pattern? (see security-audit skill)CRITICAL
dmPolicyNot "open" in production? Prefer "allowlist"HIGH
allowFromMatches USER.md profiles?MEDIUM
groups / guildsPer-group config set for each group?LOW
historyLimitReasonable value? (20-100)LOW

7. tools

FieldCheckSeverity
profileAppropriate for use case? full needs justificationMEDIUM
denyDangerous tools blocked?MEDIUM
exec.timeoutSecNot too high (< 3600 recommended)LOW
loopDetection.enabledtrue for productionHIGH

8. plugins

FieldCheckSeverity
enabledPlugin system active?LOW
entriesEach plugin has valid config?MEDIUM
entries.*.envUses env vars for secrets?HIGH

9. session

FieldCheckSeverity
dmScopeAppropriate? Options: main/per-peer/per-channel-peer/per-account-channel-peerLOW
reset.modeSet to "daily"? (only valid value)LOW
reset.atHourReasonable reset hour? (default 4)LOW
reset.idleMinutesReasonable idle timeout?LOW
resetTriggersIncludes /new or /reset?LOW
maintenance.mode"warn" or "enforce"?LOW

Cross-Validation with Workspace Files

openclaw.jsonWorkspace FileCheck
channels.*.allowFrom IDsUSER.mdEvery ID in allowFrom has a profile in USER.md
agents.defaults.modelTOOLS.mdModel-specific tool notes exist
channels.telegram.groupsAGENTS.mdGroup chat rules exist for each group
agents.defaults.heartbeatHEARTBEAT.mdHeartbeat config aligns with HEARTBEAT.md tasks
agents.defaults.userTimezoneUSER.mdTimezone matches user profile
plugins.entriesAGENTS.mdPlugin-specific behavior rules exist

Feature Freshness Check

After fetching latest docs, check for:

1. New config fields not present in current config 2. Deprecated fields that should be migrated 3. New channel types available but not configured 4. New tool profiles or options 5. New compaction strategies or memory features 6. Model updates — newer models available

Validation Report Template

# openclaw.json Validation Report

## Config Summary
- Model: [primary model]
- Channels: [list of enabled channels]
- Tools profile: [profile]
- Heartbeat: [interval] with [model]

## Validation Results

### CRITICAL
- [ ] [Issue + recommendation]

### HIGH
- [ ] [Issue + recommendation]

### MEDIUM
- [ ] [Issue + recommendation]

### LOW / Suggestions
- [ ] [Optional improvement]

## Cross-Validation
- [ ] USER.md ↔ allowFrom: [match/mismatch]
- [ ] HEARTBEAT.md ↔ heartbeat config: [aligned/misaligned]
- [ ] AGENTS.md ↔ group configs: [covered/missing]

## Feature Freshness
- [ ] Current version features: [all used / N missing]
- [ ] Deprecated settings: [none / list]
- [ ] Recommended additions: [list]

Best Practices

1. Always validate after editing openclaw.json 2. Run openclaw doctor --fix after changes (Docker multi-instance: openclaw-{name} doctor --fix) 3. Check official docs for latest features quarterly 4. Keep model names current — use provider/model format (e.g. anthropic/claude-sonnet-4-20250514) 5. Use allowlist dmPolicy in production 6. Enable loopDetection for stability 7. Set heartbeat to a cheap model, configure heartbeat.target 8. Match userTimezone to primary user's location 9. Verify agent.skipBootstrap path (singular agent, NOT agents.defaults.skipBootstrap) 10. Cron jobs are managed via CLI, config only has cron.enabled

Related skills

AI & Agent Buildingagentsautomation

This week in AI coding

Five minutes, every Monday - the tools, releases and tactics for developers.

unsubscribe anytime.