← Back to Skills Marketplace
luoqianchenguni-max

a2a-Market-UCP-Broadcast

by luoqianchenguni-max · GitHub ↗ · v0.2.0 · MIT-0
cross-platform ⚠ suspicious
232
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install a2a-market-ucp-broadcast
Description
Implement UCP broadcast of buyer intents to eligible nodes, including message signing, routing, and ack handling. Use when building universal commerce protoc...
README (SKILL.md)

\r \r

a2a-Market UCP Broadcast\r

\r Define the transport and protocol shell for intent broadcast in UCP.\r \r Current status: framework release for registration. Prioritize interoperability contracts over optimization.\r \r

Scope\r

  • Build intent payload schema and canonical signing routine.\r
  • Broadcast to eligible nodes and track delivery acknowledgements.\r
  • Feed response stream into quote intake service.\r \r

Suggested Project Layout\r

  • app/protocol/ucp/intent_message.py\r
  • app/protocol/ucp/signer.py\r
  • app/application/services/broadcast_service.py\r
  • app/infrastructure/ws/ucp_gateway.py\r \r

Minimum Contracts (MVP P0)\r

  1. build_intent(payload) normalizes and version-tags message.\r
  2. sign_intent(intent, private_key) returns detached signature object.\r
  3. broadcast(intent_id, target_nodes) returns dispatch receipt ids.\r
  4. collect_acks(intent_id, timeout_ms) returns per-node ack status.\r \r

Event Mapping\r

  • Emit INTENT_CREATED before dispatch.\r
  • Emit INTENT_BROADCASTED after fan-out completes.\r
  • Emit NODE_RESPONDED when quote/ack arrives.\r \r

Guardrails\r

  • Keep canonical JSON serialization deterministic for signing.\r
  • Record per-node retry counters and stop after configured threshold.\r
  • Attach protocol version in every envelope.\r \r

Implementation Backlog\r

  • Add adaptive node selection based on reputation percentile.\r
  • Add dead-letter handling for nodes with repeated timeouts.\r \r

Runtime Implementation\r

  • Status: implemented in local runtime package.\r
  • Primary code paths:\r
  • runtime/src/protocol/ucp-client.js\r
  • runtime/src/application/market-agent.js\r
  • Validation: covered by runtime/tests and npm test in runtime/.\r
Usage Guidance
Proceed cautiously. The SKILL.md describes message signing and references a local runtime implementation and tests, but this package contains no code or declared secrets/env vars for private keys. Before installing: (1) ask the publisher to provide the referenced runtime code or a clear install spec; (2) require an explicit, minimal method for providing signing keys (for example, a single declared env var or secret-store path) and documentation for key management; (3) verify the provenance of any external runtime package and review its tests; (4) avoid supplying private keys to the agent directly — prefer a secret store or scoped key with limited privileges; and (5) if you still want to try it, run the implementation and tests in an isolated environment and inspect network behavior to ensure broadcasts go only to intended endpoints. These inconsistencies (missing code and undeclared key handling) are the main reason this is flagged as suspicious.
Capability Analysis
Type: OpenClaw Skill Name: a2a-market-ucp-broadcast Version: 0.2.0 The skill bundle defines a framework for implementing a Universal Commerce Protocol (UCP) broadcast system. The instructions in SKILL.md are focused on standard architectural patterns such as message signing, deterministic JSON serialization, and acknowledgement tracking, with no evidence of malicious intent, data exfiltration, or prompt injection.
Capability Assessment
ℹ Purpose & Capability
Name, description, and SKILL.md goals (intent payloads, signing, broadcast, ack collection) are consistent with a UCP broadcast helper. However the SKILL.md asserts a local 'runtime' implementation and test paths (runtime/src/..., npm test) while this published bundle contains no code or install spec — suggesting either missing artifacts or that the skill depends on out-of-band code.
⚠ Instruction Scope
The instructions specify signing (sign_intent(intent, private_key)) and runtime behavior but do not describe how private keys are stored/obtained, nor do they constrain where the agent should look for code or run tests. That leaves scope for the agent or integrator to locate sensitive keys or external code at runtime without guidance.
✓ Install Mechanism
This is an instruction-only skill with no install spec and no binaries to download or extract — low installation risk. The lack of an install step is coherent with the absence of code, but exacerbates the issue that expected runtime artifacts are missing.
⚠ Credentials
No environment variables, credentials, or config paths are declared, yet core functionality requires signing with a private_key. The skill should declare how signing keys are provided (env var, secret store, config path). The omission is disproportionate and could lead to ad-hoc handling of sensitive keys.
✓ Persistence & Privilege
The skill is not marked always:true and has no install-time persistence; it cannot force inclusion on every agent run. There is no evidence it modifies other skills or system-wide settings.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install a2a-market-ucp-broadcast
  3. After installation, invoke the skill by name or use /a2a-market-ucp-broadcast
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.2.0
sync runtime implementation and validation coverage
v0.1.0
initial scaffold for early registration
Metadata
Slug a2a-market-ucp-broadcast
Version 0.2.0
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 2
Frequently Asked Questions

What is a2a-Market-UCP-Broadcast?

Implement UCP broadcast of buyer intents to eligible nodes, including message signing, routing, and ack handling. Use when building universal commerce protoc... It is an AI Agent Skill for Claude Code / OpenClaw, with 232 downloads so far.

How do I install a2a-Market-UCP-Broadcast?

Run "/install a2a-market-ucp-broadcast" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is a2a-Market-UCP-Broadcast free?

Yes, a2a-Market-UCP-Broadcast is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does a2a-Market-UCP-Broadcast support?

a2a-Market-UCP-Broadcast is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created a2a-Market-UCP-Broadcast?

It is built and maintained by luoqianchenguni-max (@luoqianchenguni-max); the current version is v0.2.0.

More Skills
self-improving agent
Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau...
⬇ 463815 · by pskoett
Skill Vetter
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
⬇ 259802 · by spclaudehome
Polymarket
Query Polymarket prediction markets. Check odds, find trending markets, search events, track price movements.
⬇ 232503 · by joelchance
Self-Improving + Proactive Agent
Self-reflection + Self-criticism + Self-learning + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when...
⬇ 200680 · by ivangdavila
Github
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
⬇ 191345 · by steipete
ontology
Typed knowledge graph for structured agent memory and composable skills. Use when creating/querying entities (Person, Project, Task, Event, Document), linkin...
⬇ 190333 · by oswalpalash

💬 Comments