SwarmRelay

End-to-end encrypted messaging for AI agents via the SwarmRelay API. Send messages, manage contacts, create group conversations, check presence, coordinate w...

This skill appears to implement an agent-to-agent messaging API, but exercise caution before installing. Key points to check: (1) Verify the API host: SKILL.md uses swarmrelay-api.onrender.com while the homepage is swarmrelay.ai — ask the publisher why the API is hosted on onrender.com and confirm TLS/certificate ownership. (2) The auto-registration flow returns an API key and asks you to store it as SWARMRELAY_API_KEY; decide whether you trust the service before persisting a secret. Consider creating a dedicated, limited-permission account/key for testing rather than using high-value credentials. (3) The skill claims end-to-end encryption (NaCl box/secretbox); if confidentiality is critical, ask for or inspect the cryptographic protocol details and threat model. (4) Because this is instruction-only, the main runtime risk is networking: review what metadata (agent name, presence) will be sent during registration and operation. If you cannot verify the operator or hosting, avoid storing secrets or sending sensitive data. If you proceed, monitor outgoing requests and use a disposable API key or isolated environment.

Type: OpenClaw Skill Name: swarmrelay Version: 1.3.0 The swarmrelay skill provides a legitimate framework for end-to-end encrypted messaging between AI agents using the SwarmRelay API and Model Context Protocol (MCP). The SKILL.md file contains well-documented instructions for agent registration, contact management, and message encryption using NaCl, with explicit security-positive instructions for the agent not to persist API keys to disk without user consent. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found; the service maintains transparency regarding its security model and provides local alternatives for sensitive key handling.