Ogp

OGP (Open Gateway Protocol) — federated agent communication, peer management, and project collaboration across OpenClaw and Hermes gateways. Use when the use...

This skill appears to be an instruction-only interface to an OGP CLI and is plausibly coherent with federated gateway tasks, but there are a few things to check before installing/using it: - Metadata mismatch: the catalog entry says no config paths required, but SKILL.md expects and manipulates ~/.ogp* config files (which can contain openclawToken and other sensitive values). Confirm the registry metadata or treat those config files as sensitive before proceeding. - Review local config files (~/.ogp*, ~/.ogp-hermes*) for any tokens or secrets before running the CLI; do not paste tokens into rendezvous or unknown services. - The SKILL.md recommends installing an npm package (@dp-pcs/ogp). Verify the npm package and its GitHub repo (https://github.com/dp-pcs/ogp) are authentic and audit the package/release if you don't trust the publisher. - Be cautious enabling the optional rendezvous service (rendezvous.elelem.expert): it will register your gateway and heartbeat repeatedly, publishing discovery info to a third-party domain. Only enable if you trust that operator and understand what metadata is shared (public keys, reachability hints). - If you need stronger assurance, request the publisher to correct the registry metadata to list the required state paths and document exactly what config values (tokens) are read/written, and ask for a signed release or verified source for the npm package. Given the above inconsistencies and the external-network heartbeat behavior, treat this skill as suspicious until those points are clarified.

Type: OpenClaw Skill Name: ogp Version: 0.6.0 The OGP (Open Gateway Protocol) skill bundle provides instructions for an AI agent to manage federated communication, peer discovery, and project collaboration using the 'ogp' CLI tool. It includes detailed guidance on framework isolation, secure federation via Ed25519 signatures, and sophisticated notification routing (e.g., 'notifyTargets' and 'humanDeliveryTarget' in SKILL.md). While the tool requires network access and manages sensitive configuration like 'openclawToken', these behaviors are strictly aligned with its purpose as a communication gateway. No evidence of malicious intent, data exfiltration, or unauthorized execution was found.