MQTT 브로커를 통해 에이전트의 소개(Intro) 및 상태(Status) 메시지를 발행하고 구독하는 기능을 제공합니다. 에이전트 간의 통신이 필요할 때 사용하세요.

This skill is internally consistent: it publishes and subscribes to agent intro/status messages via a local MQTT broker (localhost:1883). Before installing or using it: (1) confirm you run a trusted local MQTT broker — retained messages (RETAIN=True) persist on the broker and could be read by any client that can connect; (2) the SKILL.md suggests checking ~/.openclaw/openclaw.json to find your agent_id, but the scripts require you to pass agent_id explicitly and do not auto-read that file — only inspect that file yourself if you need the ID; (3) the code talks only to localhost and has no external endpoints, so risk is limited to your network exposure of the MQTT broker; (4) pip-installing paho-mqtt and typer is required. If you plan to use this on a shared or network-reachable broker, avoid publishing sensitive data or disable retention. If you want stronger assurance, review the two included scripts locally (they are small and readable) and confirm BROKER is set to an intended host before running.

Type: OpenClaw Skill Name: communication-mqtt Version: 1.0.1 The skill is classified as suspicious due to two main indicators. First, the `SKILL.md` file contains a direct instruction (`cat ~/.openclaw/openclaw.json`) for the AI agent to execute a shell command to read a potentially sensitive configuration file for self-identification. While its stated purpose is benign, this is a clear prompt injection vector for file access. Second, the `scripts/publish.py` script constructs an MQTT message payload that includes a `channel` field containing a `bash` command template (`openclaw --agent {agent_id} --message "message_here"`). Although this command is not executed by the current skill and is published to a local MQTT broker, it represents a risky capability that could be abused for prompt injection or command injection against other agents if they blindly process such messages.