← Back to Skills Marketplace
118
Downloads
1
Stars
0
Active Installs
7
Versions
Install in OpenClaw
/install openfused-mail-system-for-ai-agents
Description
Decentralized context mesh for AI agents. Manage stores, send signed/encrypted messages, sync with peers, and manage cryptographic trust. Use when initializi...
Usage Guidance
This skill appears to do what it says, but take these precautions before installing:
- Inspect the npm package source (and GitHub repo) before npm install, because installing a package executes third-party code.
- Be aware it uses your ~/.ssh config and existing SSH keys for SCP/peer sync — limit exposure by using a dedicated SSH key/config or running the agent in a sandboxed environment.
- Avoid placing secrets in the store's shared/ directory; shared files are plaintext to peers.
- Prefer local or per-project installation instead of a global -g install if you want to reduce system-wide impact.
- If your agent platform allows autonomous skill invocation, restrict or sandbox this skill to prevent unintended network transfers.
Capability Analysis
Type: OpenClaw Skill
Name: openfused-mail-system-for-ai-agents
Version: 1.0.6
The openfuse skill (SKILL.md) implements a decentralized communication mesh that requires access to sensitive files like ~/.ssh/config and manages cryptographic keys. It includes high-risk capabilities such as establishing reverse SSH tunnels and Cloudflare tunnels (openfuse watch --tunnel/--cloudflared), which are powerful primitives that can be used to create persistent backdoors or bypass network security. While these features are documented for peer-to-peer synchronization, the combination of SSH access, tunnel creation, and remote data syncing via SCP/HTTP presents a significant attack surface for data exfiltration or unauthorized remote access.
Capability Assessment
Purpose & Capability
Name/description (decentralized context mesh) align with required binary (openfuse) and required config (~/.ssh/config). Requiring SSH config and an openfuse binary is expected for an SSH/SCP-based peer sync tool.
Instruction Scope
SKILL.md stays within the stated purpose: instructions cover init, key management, sharing, sending messages (via SCP/HTTP), and local store layout. It explicitly warns about shared/plaintext files and autonomous invocation. It references ~/.ssh and local key files in store; these are relevant but enable network actions, so the agent will be able to perform remote transfers when invoked.
Install Mechanism
Install is an npm package from the public registry ([email protected]), which is an expected distribution method but carries the usual moderate risk of executing third-party code. The SKILL.md suggests global npm -g install which modifies system-wide binaries.
Credentials
No environment variables requested, which is appropriate. However the skill requires access to ~/.ssh/config and uses existing SSH private keys for peer sync; this is sensitive — access to your SSH config/keys can enable network connections to other hosts. That access is proportionate to SSH-based syncing but still warrants caution.
Persistence & Privilege
always is false and the skill is user-invocable. The skill notes autonomous invocation as a risk and recommends sandboxing; there is no indication it attempts to persist beyond installing the openfuse binary. This is normal for a CLI integration.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install openfused-mail-system-for-ai-agents - After installation, invoke the skill by name or use
/openfused-mail-system-for-ai-agents - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.6
- Added version field (0.3.6) and metadata to SKILL.md for improved compatibility and clarity.
- Specified binary and config requirements, npm install instructions, and homepage link in metadata.
- No changes to core functionality or user-facing documentation content.
v1.0.5
Version 1.0.5
- Updated skill manifest to clarify requirements: now explicitly notes need for the openfuse binary, npm install command, SSH/HTTP network, and local SSH credentials.
- Set metadata: skill is now user-invocable only, never autonomous, and not always loaded.
- Added security and operational notes to the documentation, including details on network behavior, required credentials, and sandboxing advice.
- No changes to the skill's code or functionality—documentation and manifest updates only.
v1.0.4
openfused-mail-system-for-ai-agents v1.0.4
- Updated installation instructions to specify version `[email protected]` in npm install command.
- Added a security warning clarifying that files in the `shared/` directory are plaintext and visible to all synced peers.
- No code changes detected; documentation improvements only.
v1.0.3
openfuse 1.0.3 is a documentation-focused update with improvements to clarity, structure, and usability, including more explicit local-first workflows and the addition of watch mode.
- Simplified and clarified documentation throughout, focusing on local-first, peer-to-peer workflows (no external registry required).
- `PROFILE.md` described as a signed public address card, distinct from working memory.
- Key generation now automatic for both signing and encryption keys on `init`; manual age key creation steps removed.
- Outbox now includes a `.sent/` audit trail for delivered messages.
- Watch mode (`openfuse watch`) documented for inbox monitoring and auto-sync; examples include NAT/cloud tunnel support.
- Commands and explanations revised for accuracy, conciseness, and real-world agent setup patterns.
v1.0.2
- Removed documentation files: CLAUDE-optional-instructions.md and README.md.
- Minor update to prerequisites section in SKILL.md: now includes npm and GitHub links.
- No changes to core code or features; documentation only.
v1.0.1
- Added security notes emphasizing private key protection and clarifying registry/key export behavior.
- Clarified that the public registry is optional; agents can use private address books and direct peer sync.
- Updated documentation to guide users on reviewing the source code before installing.
- Improved explanations about key file permissions (`chmod 600`) and privacy practices.
- No command/interface changes—documentation and security guideline improvements only.
v1.0.0
OpenFuse v1.0.0 — First public release
- Introduces a decentralized context mesh for AI agents, using a file-based protocol. Works over LAN/WAN/same filesystem. The Protocol is files.
- Enables context initialization, agent messaging (signed and encrypted), peer/registry sync, and cryptographic trust management.
- Provides commands for working memory, messaging (inbox/outbox), key import/export/trust, peer management, and agent discovery.
- Defines a clear trust model with VERIFIED, SIGNED, and UNVERIFIED message levels.
- Detailed instructions and file structure for setting up agents, keys, mesh configuration, and public profiles.
Metadata
Frequently Asked Questions
What is Openfused - Decentralized Context Mesh for AI Agents.?
Decentralized context mesh for AI agents. Manage stores, send signed/encrypted messages, sync with peers, and manage cryptographic trust. Use when initializi... It is an AI Agent Skill for Claude Code / OpenClaw, with 118 downloads so far.
How do I install Openfused - Decentralized Context Mesh for AI Agents.?
Run "/install openfused-mail-system-for-ai-agents" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Openfused - Decentralized Context Mesh for AI Agents. free?
Yes, Openfused - Decentralized Context Mesh for AI Agents. is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Openfused - Decentralized Context Mesh for AI Agents. support?
Openfused - Decentralized Context Mesh for AI Agents. is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Openfused - Decentralized Context Mesh for AI Agents.?
It is built and maintained by velinxs (@velinxs); the current version is v1.0.6.
More Skills