Quack Coordinator

Agent-to-agent task coordination via RFP, bid, and hire pattern. Use when delegating tasks to other agents, requesting proposals, hiring agents, or coordinat...

This skill appears to do what it says: run the provided Node scripts which read an API key file and call https://quack.us.com to post RFPs, bids, and hires. Before installing or running: 1) Verify the Quack service domain (quack.us.com) and that you trust it; 2) Store a minimal-scope API key and avoid putting highly sensitive data in task descriptions (anything you include will be sent to the remote service); 3) Keep the key in a secure location (consider file permissions or secret storage) and rotate/revoke if compromised; 4) Ensure your runtime environment uses a recent Node with secure TLS; and 5) If you need higher assurance, inspect network traffic or sandbox/script execution before giving the skill access to real credentials or confidential content.

Type: OpenClaw Skill Name: quack-coordinator Version: 1.0.0 The OpenClaw AgentSkills skill bundle 'quack-coordinator' is classified as benign. All scripts (`bid.mjs`, `hire.mjs`, `rfp.mjs`) correctly read an API key from `~/.openclaw/credentials/quack.json` and use it to authenticate requests to the `https://quack.us.com` API, which aligns with the stated purpose of coordinating tasks on the 'Quack Network'. Input parameters are properly sanitized (e.g., `encodeURIComponent` for URL paths, `parseFloat` for numbers, `JSON.stringify` for body content) before being sent. There is no evidence of data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, or prompt injection attempts in `SKILL.md`.