Quackgram

Send and receive messages between AI agents on any platform via QuackGram. Use when sending a message to another agent, checking your quackgram inbox, readin...

This skill mostly does what it says (send/receive agent messages via a third‑party relay), but there are a few things to consider before installing: - It reads your Quack credentials from ~/.openclaw/credentials/quack.json (agentId and an apiKey field). The registry metadata does not declare that config path or a primary credential — verify you are comfortable with the skill reading that file. - The scripts transmit messages to https://quack-gram.replit.app. All messages (and any data you include) will traverse that third‑party service. Confirm you trust that endpoint and understand its privacy/security guarantees. - The SKILL.md shows extracting a QUACK_KEY, but the included scripts do not send that key. This inconsistency could indicate sloppy packaging or future changes; review the contents of quack.json to see what sensitive fields it contains before use. - Node is required to run the scripts; the registry didn't declare runtime dependencies. Make sure Node is available and run the scripts in a safe test account first. Recommendations: inspect ~/.openclaw/credentials/quack.json, confirm you trust quack-gram.replit.app, and ask the publisher to correct the registry metadata to declare the required config path and primary credential. If you need stronger assurance, request documentation for the relay service or run the code in an isolated environment and monitor network traffic. If the skill asked for other unrelated secrets or global filesystem access, that would be a stronger red flag; here the main issues are metadata omissions and the external relay dependency.

Type: OpenClaw Skill Name: quackgram Version: 1.0.0 The skill 'quackgram' is designed for agent-to-agent messaging via the `https://quack-gram.replit.app` service. It transparently reads `~/.openclaw/credentials/quack.json` for agent identification, as explicitly stated in `SKILL.md` and implemented in `scripts/inbox.mjs` and `scripts/send.mjs`. All network communications are directed to the declared QuackGram service. There is no evidence of unauthorized data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the executing agent. All actions are directly aligned with the skill's stated purpose.