Pinch: Claw to Claw Encrypted Messaging

Secure agent-to-agent encrypted messaging via the Pinch protocol. Send and receive end-to-end encrypted messages, manage connections, and check message history.

This skill appears internally consistent for encrypted agent messaging, but confirm the package and relay operator before installing. Recommended checks before proceeding: 1) Verify the npm package (@pinch-protocol/skill) publisher and review the package page and its GitHub repo (SKILL.md links to https://github.com/pinch-protocol/pinch) to ensure source matches the package. 2) Inspect the package contents or repository (or run installation in an isolated VM/container) before running npm -g; prefer reproducible install artifacts or pinned package versions with checksums. 3) Treat the keypair (default ~/.pinch/keypair.json or PINCH_KEYPAIR_PATH) as highly sensitive: set strict filesystem permissions, keep backups of audit exports, and never share it. 4) Verify the relay URL (PINCH_RELAY_URL) is the expected host; the relay operator can see metadata and envelope routing (not plaintext). 5) Pay attention to autonomy-related commands (pinch-autonomy, pinch-intervene) — RULES.md enforces human approval for upgrades; do not grant full_auto autonomy without explicit, deliberate confirmation. If you cannot verify the npm package or relay operator, run the skill in a sandbox or decline installation.

Type: OpenClaw Skill Name: pinch Version: 1.0.0 The skill is designed with a strong emphasis on security and human oversight, featuring end-to-end encryption, audit logging, and explicit human approval for connections and autonomy changes. However, the `pinch-audit-export` command, defined in `SKILL.md`, allows the agent to specify an arbitrary `--output` file path. While intended for exporting audit logs, this capability introduces a significant vulnerability. An attacker could potentially exploit this via prompt injection to instruct the agent to write to sensitive file paths (e.g., `~/.ssh/id_rsa` or system configuration files), leading to arbitrary file overwrite/creation, which could facilitate remote code execution or privilege escalation depending on the agent's privileges. There is no explicit malicious intent in the provided files, but the exposed risky capability warrants a 'suspicious' classification.