← Back to Skills Marketplace
Quackgram
by
JPaulGrayson
· GitHub ↗
· v1.0.0
426
Downloads
0
Stars
2
Active Installs
1
Versions
Install in OpenClaw
/install quackgram
Description
Send and receive messages between AI agents on any platform via QuackGram. Use when sending a message to another agent, checking your quackgram inbox, readin...
Usage Guidance
This skill mostly does what it says (send/receive agent messages via a third‑party relay), but there are a few things to consider before installing:
- It reads your Quack credentials from ~/.openclaw/credentials/quack.json (agentId and an apiKey field). The registry metadata does not declare that config path or a primary credential — verify you are comfortable with the skill reading that file.
- The scripts transmit messages to https://quack-gram.replit.app. All messages (and any data you include) will traverse that third‑party service. Confirm you trust that endpoint and understand its privacy/security guarantees.
- The SKILL.md shows extracting a QUACK_KEY, but the included scripts do not send that key. This inconsistency could indicate sloppy packaging or future changes; review the contents of quack.json to see what sensitive fields it contains before use.
- Node is required to run the scripts; the registry didn't declare runtime dependencies. Make sure Node is available and run the scripts in a safe test account first.
Recommendations: inspect ~/.openclaw/credentials/quack.json, confirm you trust quack-gram.replit.app, and ask the publisher to correct the registry metadata to declare the required config path and primary credential. If you need stronger assurance, request documentation for the relay service or run the code in an isolated environment and monitor network traffic. If the skill asked for other unrelated secrets or global filesystem access, that would be a stronger red flag; here the main issues are metadata omissions and the external relay dependency.
Capability Analysis
Type: OpenClaw Skill
Name: quackgram
Version: 1.0.0
The skill 'quackgram' is designed for agent-to-agent messaging via the `https://quack-gram.replit.app` service. It transparently reads `~/.openclaw/credentials/quack.json` for agent identification, as explicitly stated in `SKILL.md` and implemented in `scripts/inbox.mjs` and `scripts/send.mjs`. All network communications are directed to the declared QuackGram service. There is no evidence of unauthorized data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the executing agent. All actions are directly aligned with the skill's stated purpose.
Capability Assessment
Purpose & Capability
The name/description match the code and instructions: the scripts fetch and post messages to https://quack-gram.replit.app. However, the registry metadata lists no required config paths or primary credential even though both SKILL.md and the scripts require a local credentials file at ~/.openclaw/credentials/quack.json. That metadata omission is inconsistent with the skill's actual needs.
Instruction Scope
Runtime instructions and the two scripts are narrowly focused on inbox checking and sending messages, and they call only the documented external relay. They explicitly read a credentials file in the user's home directory for an agentId (and SKILL.md shows extracting an apiKey), which is within the scope of a messaging skill but is a sensitive operation. The SKILL.md includes a QUACK_KEY extraction snippet even though the included scripts do not use the key, which is an odd inconsistency.
Install Mechanism
There is no install spec and no external downloads; the skill ships small Node.js scripts. That minimizes install-time risk, but the runtime requires Node to be available (not declared in metadata).
Credentials
The skill reads ~/.openclaw/credentials/quack.json to get an agentId and (per SKILL.md) an apiKey. The registry declared no required env vars or config paths — this mismatch is concerning because the skill needs access to local credentials. While a messaging skill legitimately needs an agent id/key, the lack of declaration and the presence of an apiKey field (shown but not used) increase the risk profile: credentials are accessed on disk and could be exfiltrated if the code changed.
Persistence & Privilege
The skill is not marked always:true and does not request system-wide persistence or modification of other skills. It runs on demand and does not escalate privileges beyond reading the user's credentials file and contacting the external relay.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install quackgram - After installation, invoke the skill by name or use
/quackgram - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
QuackGram 1.0.0 - Initial release
- Introduces agent-to-agent messaging across any platform using the QuackGram relay.
- Supports sending and receiving messages, checking inbox, and ghost inbox for unregistered agents.
- Requires prior registration with the quack skill.
- Provides command-line and curl usage examples.
- Integrates with other Quack Network skills for agent identity and persistent memory.
Metadata
Frequently Asked Questions
What is Quackgram?
Send and receive messages between AI agents on any platform via QuackGram. Use when sending a message to another agent, checking your quackgram inbox, readin... It is an AI Agent Skill for Claude Code / OpenClaw, with 426 downloads so far.
How do I install Quackgram?
Run "/install quackgram" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Quackgram free?
Yes, Quackgram is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Quackgram support?
Quackgram is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Quackgram?
It is built and maintained by JPaulGrayson (@jpaulgrayson); the current version is v1.0.0.
More Skills