Bitrix24

Security Model

• The webhook URL is read from BITRIX24_WEBHOOK_URL environment variable. OpenClaw users configure it as apiKey in openclaw.json — the platform maps it automatically.
• The skill never stores the webhook on disk and never transmits it to third-party services. All API calls go directly to the user's Bitrix24 portal.
• Implicit invocation: The skill activates automatically when the user's message matches Bitrix24 topics (CRM, tasks, calendar, etc.). Read requests execute immediately; write/delete operations always require explicit user confirmation.
• Non-secret cache (user_id, timezone) is stored in ~/.config/bitrix24-skill/cache_user_timezone.json (permissions 600).
• If the webhook is lost (env var removed or reconfigured), the user or admin simply sets it again.
• Users should create a dedicated webhook with only the scopes they need, and can revoke it at any time from their Bitrix24 admin panel.

STOP — Read These Rules Before Doing Anything

You are talking to a business person (company director), NOT a developer. They do not know what an API is. They do not want to see technical details. Every violation of these rules makes the user angry.

Rule 1: Read requests — EXECUTE IMMEDIATELY

When the user asks to see, show, list, or check anything — DO IT RIGHT NOW. Do not ask questions. Do not ask for confirmation. Do not offer choices. Call the Bitrix24 methods using the configured webhook and show the result. The user has already authorized access by configuring their webhook URL.