OpenClaw Prague Meetup #1

ClawBuddy Journey

Moving towards the agent-to-agent mentoring

Vladimír Orany · March 26, 2026

About me
Vladimír Oraný

Vladimír Oraný

Principal Software Engineer at

Agorapulse
The Telegraphic Developer QR telegraphic.substack.com

telegraphic.substack.com

Outline

What we'll cover

  1. 1 My OpenClaw journey — Jean & Zoidy
  2. 2 The aha moment — agents helping agents
  3. 3 Building ClawBuddy — skills, security, ClawHub
  4. 4 The Hermit — and why dumber models are less secure
  5. 5 Takeaways
The spark

How it started

Alex Finn video
Meet Jean
Jean

Jean

My personal assistant

My personal truly fullstack developer

Lives in Helsinki, Finland on Hetzner server

How Jean helps me

Schedules and calendar

Jean managing calendar
How Jean helps me

Even the grocery shopping

Jean doing grocery shopping
Jean at work

Any idea, any time

Jean at work
Elevator tracker

The elevator rumbles? There's an app for that.

Projects list
OpenClaw at Hetzner

Letting everyone set up their claw

Elevator tracker app
Blog rebrand

Full rebrand of my old blog from the early 10s

Blog rebrand
Fair voting

An app for fair voting with memory

Fair voting app
DevOps

PR reviews and deployment orchestration

PR reviews and deploys
Full-stack agent

Jean maintains everything

Coolify dashboard
Reality check

Jean won't boost me in skills I don't have

Still can't do marketing

Still can't make awesome YouTube or TikTok videos

Meet Zoidy
Zoidy

Zoidy

My day-job agent at Agorapulse

Docker on MacBook

Limited access: GitHub, Shortcut, Slite, Sentry.

Zoidy's wins

~100 tests migrated in weeks

  • Mastered fighting our technical debt
  • Migrated ~100 tests from old framework to new one
  • The bottleneck? Humans doing code reviews.
The aha moment

"Why am I the messenger between two agents?"

ClawBuddy idea

And that's how ClawBuddy was born

The architecture

OpenClaw endpoints

  • Chat completions /v1/chat/completions — like regular ChatGPT endpoint
  • Responses /v1/responses — can execute allowed tools
  • Both include memory, but security guides say: don't expose them
  • Solution: local relay polls ClawBuddy for requests
  • Packaged as skills, distributed via ClawHub
The architecture

How it connects

Hatchling
any agent / Claude Code
asks questions
gets answers
HTTPS
ClawBuddy
server
routes requests
queues responses
polls
Relay
skill
asks
OpenClaw
buddy's local
relay polls server, forwards to local OpenClaw
ClawHub

The security gauntlet

ClawHub

Skills can be very harmful. Security is extremely brutal.

Early submissions

Failed.

Rejection 1
Early submissions

Failed again.

Rejection 2
Early submissions

Failed. Again.

Rejection 3
Finally

Green checkmarks

Approved 1
Finally

Don't. Touch. Anything.

Approved 2

The scans are so brutal I don't want to risk any minor change

Living documentation
The Hermit

Meet The Hermit

Why write docs for humans to copy-paste to agents?

The Hermit is the living documentation and onboarding agent at once.

Safe house
The Hermitage

The Hermitage

Docker image that bootstraps a safe, isolated ClawBuddy buddy.

github.com/clawbuddy-help/hermitage

Security

Dumber model = less secure

Pen test results

Zoidy ran full penetration tests on The Hermit

Pen test results

AGENTS.md dumps

Pen test — AGENTS.md leak

Some results are serious — like dumping the complete AGENTS.md

Pen test results

Hallucinated stacks

Pen test — hallucinated stack

Some are funny — tells you the full stack, but it's mostly hallucinated

The safe path

Virtual Buddies

Virtual Buddies

Upload your pearls. No security concerns. Works with any agent — even Claude Code.

Takeaways

Five things to remember

  1. OpenClaw boosts skills you already have
  2. It won't magically give you skills you don't
  3. ClawHub checks are brutal — green means safe
  4. Dumber model = way less secure
  5. It's OK to test your OpenClaw security with your OpenClaw

Thank you!

Questions?

The Telegraphic Developer telegraphic.substack.com QR

telegraphic.substack.com

Substack · LinkedIn · X/Twitter