← Back to Skills Marketplace
OmniWire
by
VoidChecksum
· GitHub ↗
· v3.5.0
· MIT-0
143
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install omniwire
Description
Infrastructure layer for AI agent swarms — 88 MCP tools for mesh control, A2A protocol, OmniMesh VPN, CyberSync, web scraping, firewall management, browser a...
Usage Guidance
Do not let the agent automatically run the 'npm install -g' command or supply private SSH keys without review. Before installing: (1) inspect the omniwire npm package contents or the GitHub source and release signatures; (2) prefer installing manually under your control instead of letting the agent exec installation; (3) do not reuse personal SSH keys — create limited, purpose-built deploy keys on each target host and reference those; (4) confirm which native tools (aria2c, netcat, lz4) are required and install them deliberately; (5) verify how CyberSync/Postgres credentials are provided and where network ports will be exposed; (6) consider running the tool inside an isolated environment (VM/container) first and remove ~/.omniwire and any keys if you uninstall. If you want, share the npm package tarball or the GitHub release contents and I can point out specific lines that need special attention.
Capability Analysis
Type: OpenClaw Skill
Name: omniwire
Version: 3.5.0
The 'omniwire' skill provides an exceptionally broad and high-risk feature set, including remote SSH execution across a mesh, VPN management, and browser automation. Most concerning are the 'CyberSync' tools, which specifically target and sync sensitive configuration and memory files from other AI agents (e.g., Claude Code, OpenClaw), and tools for extracting browser cookies (`omniwire_cookies`) and managing TOTP codes (`omniwire_2fa`). While these capabilities are framed as infrastructure management, the concentration of access to credentials, secrets, and remote systems across multiple nodes creates a massive attack surface and potential for abuse.
Capability Assessment
Purpose & Capability
Name/description (mesh control, SSH-based management) aligns with requiring node and ssh. However, the skill's examples and setup expect access to users' private SSH identity files (~/.ssh/*), file-transfer tools (netcat, aria2c, lz4), and a PostgreSQL CyberSync backend — none of which are declared in metadata (no env creds, no extra required binaries). Asking for SSH identityFile entries implies the skill will read private keys, which is a sensitive capability that should be explicitly declared and justified.
Instruction Scope
SKILL.md explicitly tells the agent to run 'npm install -g omniwire@latest' via exec and to collect server details including SSH key filenames; it then instructs operations that read/write files across nodes, open local HTTP/WebSocket ports, and use transfers (SFTP, netcat, aria2c). The instructions do not clearly limit what the agent may read on disk (private keys) or transmit, and they assert 'No data leaves your network' while exposing REST/SSE/WebSocket transports — a possible contradiction and scope creep.
Install Mechanism
Install is via npm package 'omniwire@latest' (global install), which is a moderate-risk mechanism: packages come from the public registry and will drop executables on the host. The SKILL.md uses a live 'latest' install via agent exec (autonomous install). Additional native tools referenced (aria2c, netcat, lz4) are not included in the declared install spec, creating potential for implicit installs or runtime failures.
Credentials
No environment variables or primary credentials are declared, but the skill requires access to sensitive local artifacts (SSH private keys in ~/.ssh, an encrypted secret.key in ~/.omniwire, and a CyberSync Postgres host). The absence of declared DB credentials or other env setup is inconsistent with the runtime requirements; asking the user to point to private key files is a high-privilege request that should be explicitly called out and minimized (e.g., use dedicated deploy keys).
Persistence & Privilege
The skill creates persistent state (~/.omniwire), stores encrypted secrets and a mesh config, and exposes local network endpoints (REST/SSE/WebSocket). It does not set always:true, but autonomous invocation combined with stored credentials and SSH control increases blast radius — consider this high-impact persistence even if it's not flagged as always-enabled.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install omniwire - After installation, invoke the skill by name or use
/omniwire - Provide required inputs per the skill's parameter spec and get structured output
Version History
v3.5.0
Full OpenClaw + PaperClip integration. 88 MCP tools (was 30). Agent setup instructions. OmniMesh VPN, A2A, CyberSync, scraping, firewall, CDP browser, 2FA, COC sync.
v2.1.0
Initial release: 30 MCP tools, SSH2 mesh control, encrypted config sync, 1Password secrets, self-update. All architectures (x64, ARM, Apple Silicon).
Metadata
Frequently Asked Questions
What is OmniWire?
Infrastructure layer for AI agent swarms — 88 MCP tools for mesh control, A2A protocol, OmniMesh VPN, CyberSync, web scraping, firewall management, browser a... It is an AI Agent Skill for Claude Code / OpenClaw, with 143 downloads so far.
How do I install OmniWire?
Run "/install omniwire" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is OmniWire free?
Yes, OmniWire is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does OmniWire support?
OmniWire is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created OmniWire?
It is built and maintained by VoidChecksum (@voidchecksum); the current version is v3.5.0.
More Skills