← Back to Skills Marketplace
274
Downloads
1
Stars
0
Active Installs
15
Versions
Install in OpenClaw
/install ranchimall-messenger
Description
Use this skill whenever you are asked to send or receive messages, manage contacts, read or send mail, manage groups, look up public keys, check FLO balance,...
Usage Guidance
This skill largely does what it claims (a FLO messenger) but you should be aware of a few points before installing:
- Credential handling: the skill requires FLO_PRIVATE_KEY in the environment. Do NOT paste your private key into chat. Prefer a dedicated key with minimal funds for testing. The documentation incorrectly states that the 'my-pubkey' action doesn't need a key, but the shipped code actually tries to read FLO_PRIVATE_KEY — expect to set it.
- Network endpoints are discovered at runtime: the code reads a supernode list from the FLO blockchain and will connect (wss/https) to whichever URIs are listed there. Those endpoints are dynamic and outside the registry metadata; they could log metadata such as sender/receiver IDs and message vector clocks. If you are concerned about contacting arbitrary hosts, review the floCloudAPI implementation in the bundled scripts before running.
- Local files: the skill writes contacts.json and groups_cache.json to the skill directory. Inspect those files and their permissions if you care about local data leakage.
- Execution model: the SKILL.md directs the agent to run local Node commands (and to wait for user approval). Running the commands will surface decrypted message content to stdout if you use decrypt flags — that output may be captured by the agent. Ensure you approve only actions you intend.
- Package installation: run `npm install` in a controlled environment and inspect package.json (only 'ws' is declared). There is no external download URL in the registry install spec.
If you decide to proceed, test with read-only actions (balance for a specified address, list contacts) and a throwaway private key first. If you need more assurance, request the floCloudAPI and floBlockchainAPI source review or run the code in an isolated environment (sandbox) before giving it access to any sensitive private key.
Capability Analysis
Type: OpenClaw Skill
Name: ranchimall-messenger
Version: 1.0.14
The skill bundle provides a comprehensive Node.js implementation of the decentralized FLO messenger and blockchain interface. It handles sensitive operations such as message encryption/decryption and token transfers using the FLO_PRIVATE_KEY environment variable. Security analysis shows that the private key is used strictly for local cryptographic operations (signing and derivation) and is not exfiltrated to external endpoints. The SKILL.md file includes proactive security instructions for the AI agent, explicitly forbidding it from asking users to paste private keys into the chat. Network activity is limited to authorized FLO supernodes and blockbook APIs (e.g., blockbook.ranchimall.net) required for the protocol's decentralized functionality.
Capability Tags
Capability Assessment
Purpose & Capability
The skill's name/description match the included code: it implements sending/receiving messages, groups, mail, and FLO transactions. However the registry metadata omits the SKILL.md-declared requirement for the 'node' binary (SKILL.md lists node under required binaries while the registry top-level requirements show none), which is an inconsistency. Otherwise the required FLO_PRIVATE_KEY env var is coherent with the stated purpose (signing/decrypting and sending transactions).
Instruction Scope
SKILL.md instructs the agent to run local Node scripts and to never ask the user to paste their private key (instead use environment variables). However SKILL.md claims pubkey_node.js --action my-pubkey doesn't need the private key, but the shipped pubkey_node.js calls getPrivateKey() unconditionally — in practice the private key is required. The scripts perform network operations (fetching supernode lists from the blockchain and opening wss/https connections to discovered supernodes), read/write local files (contacts.json, groups_cache.json), and may print decrypted messages to stdout (which an executing agent will capture). Those behaviors are consistent with a messenger but the misleading documentation around 'my-pubkey' and the potential for decrypted data to appear in command output are notable scope issues.
Install Mechanism
No install spec was provided to the registry (instruction-only), but package.json exists and SKILL.md instructs running `npm install` to obtain the 'ws' dependency. There are no downloads from untrusted URLs or archives in the manifest; code is bundled in the skill. This is low/moderate risk but relies on the user/agent to run npm install.
Credentials
The skill requests a single credential: FLO_PRIVATE_KEY, which is appropriate for a blockchain messenger. However SKILL.md's claim that some actions don't need the key (contacts_node.js and pubkey_node.js --action my-pubkey) is incorrect in the shipped code — many entry points call getPrivateKey() and will throw if the env var is missing. That discrepancy could lead the agent to prompt for a private key or to fail unexpectedly. No other unrelated secrets are requested.
Persistence & Privilege
The skill does not request always: true and does not modify other skills or system-wide agent settings. It writes limited local files (contacts.json, groups_cache.json) within its project directory. Autonomous invocation is allowed (platform default) but not elevated by this skill.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install ranchimall-messenger - After installation, invoke the skill by name or use
/ranchimall-messenger - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.14
- Added new direct FLO blockchain support via the `flo_node.js` script for balance checking, sending FLO tokens, and viewing transaction history.
- Updated documentation to describe FLO token operations, including command examples for sending FLO, checking balances, and listing transaction history.
- Clarified runtime file loading: messaging scripts and `flo_node.js` now load only required crypto and blockchain libraries.
- Skill description expanded to include FLO balance, sending FLO, and history functions.
- Quick Reference Table and usage instructions updated with new FLO transaction commands.
v1.0.13
Version 1.0.13 — No file changes detected.
- No modifications have been made to files in this release.
- Documentation, features, and behavior remain unchanged.
v1.0.12
- Clarified network activity expectations and rephrased for accuracy.
- Added detailed runtime transparency: listed exactly which libraries Node scripts load and how (`vm.runInThisContext`), and explicitly stated that no remote code is executed.
- Explicitly noted that `scripts/blockchainAddresses.js` is not used by any Node script (it is browser-only).
- Improved documentation of local files written for contacts and group cache.
- General improvements to language clarity and section organization.
v1.0.11
**Expanded messenger functionality: contacts, groups, mail, and public key tools added.**
- Added new scripts for contacts, mail, groups, and public key management.
- Users can now manage contacts, send/read mail, join/send group messages, and look up public keys.
- SKILL.md extensively updated with step-by-step usage for each new feature and script.
- Security, network activity, and blockchain fee notices clarified.
- Includes a quick reference command table for all supported messenger functions.
v1.0.10
No changes detected in this version.
- No file changes or updates were made in version 1.0.10.
v1.0.9
- Clarified the required transaction fee for sending messages as exactly 0.0002 FLO (was previously "e.g., 0.001 FLO").
- No other major changes or additions detected.
v1.0.8
- Added stricter security guidance: users must never paste their private key in chat and should set it via system environment variables only.
- Expanded documentation on blockchain activity and fees: sending messages incurs a standard blockchain transaction fee, and describes the use of a protocol sink address.
- No changes to command usage or core functionality.
v1.0.7
- Added support for receiving messages using the new receive_node.js script.
- Skill now covers both sending and receiving on the FLO blockchain messenger.
- Updated documentation with usage and argument details for both send_node.js and receive_node.js.
- Enhanced description and renamed skill for broader messenger functionality.
- Included new options for message filtering, decryption, and live message watching.
v1.0.6
- Updated environment requirements: explicitly lists `FLO_PRIVATE_KEY` as required.
- Refined security instructions: the script now mandates `FLO_PRIVATE_KEY`, with guidance to check and update it if provided by the user.
- Updated dependency note: assumes `ws` is installed, and only `node` binary is required.
- Clarified execution examples and instructions, including PowerShell usage.
v1.0.5
Version 1.0.5
- Updated instructions to clarify this is the primary skill for sending messages programmatically with FLO.
- Simplified environment setup: now assume dependencies are installed; only run npm install on error.
- Enhanced security section: clarified you must not ask for or access environment variables and do not need elevated privileges.
- Revised execution guidance: run the script directly using provided arguments without additional checks.
- Improved description for broader and more explicit applicability.
v1.0.4
- No functional or documentation changes in this release.
- All files remain the same as the previous version.
v1.0.3
- Updated security requirements: only environment variable is allowed for providing the private key; removed support for credentials files and CLI arguments.
- Updated requirements formatting for binaries and environment variable in metadata.
- Revised instructions for private key handling to align with stricter security practices.
v1.0.2
- Enhanced security: private keys must now be provided via environment variable (FLO_PRIVATE_KEY) or credentials.json file—never on the command line or in chat.
- Updated documentation to include setup steps, dependency installation, and a new security section.
- Added warning about network activity: script fetches supernode list and establishes network connections during execution.
v1.0.1
Changelog - Version 1.0.1
- SKILL.md revised for improved clarity and guidance.
- Clear command usage instructions added for programmatic message sending.
- Explicit user prompt instructions outlined for collecting inputs (private key, receiver ID, message).
- Emphasized private key security in handling and responses.
- Previous detailed technical explanations and requirements section removed for conciseness.
v1.0.0
Initial release of Messenger Send Node for FLO blockchain:
- Enables sending messages via the FLO blockchain messenger system directly from Node.js.
- No browser interface required; designed for backend or CLI environments.
- Authenticates sender using private key and supports optional message encryption.
- FLO ID of sender is auto-derived from the provided key.
- Includes usage instructions, input details, and security notes for safe key handling.
Metadata
Frequently Asked Questions
What is RanchiMall Messenger?
Use this skill whenever you are asked to send or receive messages, manage contacts, read or send mail, manage groups, look up public keys, check FLO balance,... It is an AI Agent Skill for Claude Code / OpenClaw, with 274 downloads so far.
How do I install RanchiMall Messenger?
Run "/install ranchimall-messenger" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is RanchiMall Messenger free?
Yes, RanchiMall Messenger is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does RanchiMall Messenger support?
RanchiMall Messenger is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created RanchiMall Messenger?
It is built and maintained by Aniruddha (@void-57); the current version is v1.0.14.
More Skills