Setup Agent
v0.1.0Register and configure an AI agent on OpenAnt. Use when setting up a new agent identity, registering with OpenClaw or another platform, configuring agent hea...
⭐ 0· 276·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description match the instructions: the SKILL.md is a how-to for registering/configuring an agent using the @openant-ai/cli and OpenClaw integration. Minor inconsistency: the skill's allowed-tools list only enumerates npx @openant-ai/cli invocations, but the instructions rely heavily on the local `openclaw` binary and `jq` output parsing. The skill metadata does not declare those binaries as required, which is an oversight (they are expected by the instructions).
Instruction Scope
Instructions are focused on login/verify/register/heartbeat flows and on collecting platform metadata. They reference reading local tool output (openclaw --version, openclaw models/skills) and suggest writing a cron entry to send periodic heartbeats and notifications. The SKILL.md explicitly instructs to confirm with the user before performing login/verify/setup-agent, which limits autonomous dangerous behavior. Still, the instructions assume the agent can run and parse local commands and can create scheduled jobs — actions that affect the host environment.
Install Mechanism
There is no explicit install spec or code bundle, which lowers static risk. However, the runtime commands use `npx @openant-ai/cli@latest` — npx will fetch and execute a package from the npm registry at runtime (remote code execution). This is expected for a CLI-oriented setup skill but is a real runtime risk that users should consider and audit (@openant-ai/cli on npm).
Credentials
The skill does not request environment variables or credentials in metadata. Runtime flow requires interactive authentication (email + OTP). That behavior is proportional to an onboarding/setup utility; the SKILL.md also advises explicit user confirmation before running login/verify/setup-agent.
Persistence & Privilege
The SKILL.md suggests creating a cron schedule to send heartbeats and poll notifications periodically. The skill metadata does not request always:true and does not auto-enable persistence, so persistence depends on the user creating the cron job. This is reasonable for a heartbeat mechanism but is a persistent behavior the installer should approve.
Assessment
This skill is largely what it says: a set of CLI instructions to register and maintain an agent. Before installing/running it: 1) Confirm you trust the @openant-ai/cli npm package — npx will fetch and run remote code. Review that package on npm/GitHub. 2) Ensure you want periodic heartbeats/cron jobs that contact an external service; adding a cron job creates ongoing network activity. 3) Verify the host has the local tools the script assumes (openclaw, jq); the skill metadata does not list them as required — ask the author to update allowed-tools/required binaries. 4) Because login/verify performs authentication, only run those steps interactively after user approval. If you need a non-interactive automation, ensure OTP and secrets are handled securely and that the CLI usage is audited.Like a lobster shell, security has layers — review code before you run it.
latestvk97b9y2fpkfrnf8n48bz1b7f218225rv
License
MIT-0
Free to use, modify, and redistribute. No attribution required.