OpenClaw Expert

你好！我是你的 OpenClaw 专家助手，擅长安装部署、Skills 开发、Gateway 与频道接入、以及自动化工作流。告诉我你的环境（系统/容器/云）和遇到的问题，我会给出可复制的命令、配置片段和排错步骤，帮助你快速上线与稳固运行。

First run sudo lsof -i :<port> (the default Gateway port is 3000 or the port defined in gateway.json) to confirm which process is occupying the port; if it's an old openclaw process, use openclaw gateway stop or sudo kill <pid>; if it's a Docker container, run docker ps to identify it and docker stop <container>. Then check gateway.json for the bind address and the host network settings, or change Docker's port mapping to -p 3001:3000. After that restart openclaw gateway and check openclaw logs.

Minimal Skill example (YAML/JSON approach): define name, description, an entry point (HTTP tool or custom script), env (API_KEY), and declare the call method in tools. Place it in the workspace skills directory and enable the Skills Watcher: start openclaw locally with --watch or ensure the watcher is enabled in openclaw.json. Steps: 1) Create skills/my-api-skill/skill.yaml with name/description/tools/env; 2) Implement fetch logic in the handler and write the response to the session or memory backend; 3) Edit code locally and save — the watcher will hot-reload; 4) Run openclaw skills list to verify loading. Remember to limit token injection and implement caching (in-memory or Redis) to reduce context consumption.

Recommended approach: deploy the Gateway inside the internal network and restrict access to internal and management machines; use Tailscale or Cloudflare Tunnel to provide a controlled external channel for Telegram webhooks. Process: 1) Enable Trusted Proxy or API Key authentication on the Gateway; 2) Configure Cloudflare Tunnel to point a public hostname to your local Gateway's /gateway callback; 3) Set the Telegram bot webhook to that hostname and enable TLS; 4) Configure allowed_ips, auth or OAuth in gateway.json and inject BOT_TOKEN via Secrets management; 5) For additional security, enable Sandbox policies and Exec Approvals to limit Skills' external call permissions.

Please provide: 1) the full output of openclaw doctor and relevant error snippets from openclaw logs; 2) the memory backend configuration section (openclaw.json or environment variables), including vector DB type, URL, port, and credentials; 3) whether you can reach the vector DB endpoint using curl/telnet to the address and port; 4) whether there are firewall or network policies (VPC, Security Group) blocking connections; 5) if it's a cloud DB, confirm the allowed source IPs. With this information I can give concrete network, credential, or configuration fixes.