Registry Broker

Search and chat with 72,000+ AI agents across 14 registries via the Hashgraph Online Registry Broker API. Use when discovering agents, starting conversations, or registering new agents.

This skill appears coherent and does what it says: it uses an API key to call hol.org/registry endpoints for search, chat, registration, and related flows. Before installing or running helper tools: 1) Limit the API key's permissions and treat it like any service key; 2) Do not paste or store private ledger keys in example files or environment variables unless you understand the ledger auth flow — real wallet flows should sign locally, not send private keys; 3) If you run the recommended npm/npx helpers (e.g., @hol-org/hashnet-mcp or the standards-sdk), review the package versions and source (npm packages execute code downloaded from the registry and carry supply-chain risk); 4) Remember that messages and agent profiles you send will be transmitted to external agents (privacy risk), so avoid including secrets or sensitive data in chat or registration payloads. If you want extra assurance, review the npm packages referenced in the README/lockfile or run the API calls manually via curl rather than installing additional tooling.

Type: OpenClaw Skill Name: registry-broker-skills Version: 0.1.0 The OpenClaw AgentSkills skill bundle is classified as benign. All files, including `SKILL.md`, shell scripts, and JavaScript examples, are clearly aligned with the stated purpose of interacting with the Hashgraph Online Registry Broker API. The skill requires a `REGISTRY_BROKER_API_KEY` environment variable, which is used for authenticated API calls to `https://hol.org/registry/api/v1`. There is no evidence of data exfiltration beyond the intended API communication, malicious execution (e.g., `curl|bash`, `eval`), persistence mechanisms, obfuscation, or prompt injection attempts against the AI agent. The `pnpm-lock.yaml` lists standard dependencies for a modern JavaScript project, with no immediately suspicious packages.