Relay To Agent

Relay messages to AI agents on any OpenAI-compatible API. Supports multi-turn conversations with session management. List agents, send messages, reset sessions.

This skill appears to do what it says: it sends messages to an OpenAI-compatible API and stores local session history. Before installing or running it: 1) Verify agents.json (or the RELAY_CONFIG path) to ensure baseUrl points to a trusted provider — your RELAY_API_KEY will be sent to that base URL. 2) Be aware that message contents are written to ~/.cache/relay-to-agent/sessions (up to 50 messages) — remove these files if you need to protect sensitive data. 3) If you run npm install to use the supplied package.json, review dependencies (package-lock.json shows openai-fetch and ky) and ensure node >= 18. 4) Avoid using high-privilege or production API keys with untrusted or unknown endpoints; prefer a scoped/test key. 5) If you want stronger guarantees, inspect agents.json for any unexpected agent entries and set RELAY_BASE_URL explicitly rather than relying on a bundled config. Overall there are no incoherent or suspicious requirements, but treat the configured endpoint and stored session data as the primary privacy risk.

Type: OpenClaw Skill Name: relay-to-agent Version: 0.0.1 The skill bundle is benign. It functions as a straightforward relay for messages to OpenAI-compatible AI agents, as described in its documentation. The `scripts/relay.mjs` script uses standard Node.js modules and the `openai-fetch` library to interact with external AI APIs, storing conversation sessions in a user's cache directory (`~/.cache/relay-to-agent/sessions`). There is no evidence of data exfiltration, unauthorized command execution, persistence mechanisms, or prompt injection attempts targeting the OpenClaw agent itself. The user's message is passed directly to the remote AI, which is the intended functionality for an AI interaction skill.