osm-p2p-hybrid

OSM-P2P Hybrid - 融合 UDP 直连与 Nostr 网络的 P2P 通讯系统

This skill appears to implement a legitimate hybrid UDP+Nostr P2P client, but it does create persistent local state and network exposure you should accept consciously. Before installing, consider: 1) The skill will generate and store a Nostr private key in ~/.osm-p2p/identity.json (base64). Treat that file like a secret — protect it, or change dataDir to an isolated location. 2) The app publishes node announcements (including local IPs and ports) to public Nostr relays and via UDP broadcasts; this can reveal your LAN/VPN addresses and service ports. 3) Audit logs record message payloads (truncated) to disk; if you handle sensitive text, disable or relocate logging. 4) Relays used are hard-coded defaults — you can and should configure trusted relays if you plan to use it. 5) Run in a sandbox or test machine if you want to inspect behavior first (network monitoring, check created files, review identity.json and audit.log). If you want, I can point to the exact lines that write keys/logs and show how to change the dataDir, disable audit logging, or avoid announcing addresses.

Type: OpenClaw Skill Name: osm-p2p-hybrid Version: 1.0.0 The skill bundle implements a legitimate P2P communication system combining UDP for local discovery and Nostr for wide-area relaying. Key components include an IdentityManager for cryptographic keys, a TransportManager for routing, and an AuditLogger for message history. While the system stores private keys in plaintext (Base64) within the '~/.osm-p2p/identity.json' file and performs local network broadcasting, these behaviors are consistent with the stated purpose of a P2P chat application and lack any evidence of malicious intent, data exfiltration, or unauthorized execution.