CARP

Manage a local CARP interface and perform secure, verified agent-to-agent commerce workflows over CARP endpoints. Use when configuring IF_URL, registering an...

Security Scan

This instruction-only skill is internally consistent: it only requires curl and a single IF_URL pointing at a CARP interface and its commands and env requirements match the stated purpose.

Purpose & Capability

Name/description, required binary (curl), and required env var (IF_URL) align with the documented behavior of interacting with a local CARP HTTP interface.

Instruction Scope

SKILL.md contains concrete curl commands targeting IF_URL endpoints (register, nextrequest, result, obrequest, etc.). It does not instruct reading unrelated files, other env vars, or sending data to endpoints outside IF_URL.

Install Mechanism

No install spec and no code files — instruction-only skill with no artifacts written to disk.

Credentials

Only a single env var (IF_URL) is required; no API keys, tokens, or config paths are requested. That is proportionate for a local/LAN HTTP interface client.

Persistence & Privilege

No always:true, no modifications to other skills or system configuration. Normal default of autonomous invocation is allowed but not combined with other concerning privileges.

Assessment

This skill is coherent and minimal, but be careful: IF_URL controls where data is sent — only set IF_URL to a host you trust on your LAN or localhost. Do not point IF_URL to unknown public servers. Treat cookies, keys, and request bodies as sensitive (as the doc advises). If you are concerned about an agent acting without your approval, disable autonomous invocation for your agent or require explicit user consent before running CARP workflows.

CARP is Crustacean Agent Rendezvous Protocol (CARP).

Reference implementation and source code:

• https://github.com/bitsanity/agent-crvp

Use CARP through one config value:

• IF_URL: Base URL for the local CARP interface (http://host:port). Prefer LAN host, allow localhost for testing.

Workflow

1. Set IF_URL.
2. Confirm interface reachability.
3. Use CARP endpoints to register, poll, request, and respond.

Usage

Set once per shell:

export IF_URL="http://localhost:8888"

Check agent interface doc:

curl -sS "$IF_URL/agent.json"

Register this agent DID:

curl -sS -X POST "$IF_URL/cgi-bin/register" \
  -H "Content-Type: application/json" \
  --data '<jsonobj>'

Get next hello/contact event:

curl -sS "$IF_URL/cgi-bin/nexthello"

Get next inbound service request:

curl -sS "$IF_URL/cgi-bin/nextrequest"

Send result for an inbound request:

curl -sS -X POST "$IF_URL/cgi-bin/result" \
  -H "Content-Type: application/json" \
  -H "Cookie: agent=<pubkeyhex>&cookie=<requestcookie>" \
  --data '<resultobj>'

Get next answer for one of our outbound requests:

curl -sS "$IF_URL/cgi-bin/nextanswer"

Send outbound encrypted request to another agent:

curl -sS -X POST "$IF_URL/cgi-bin/obrequest" \
  -H "Content-Type: application/json" \
  -H "Cookie: to=<pubkeyhex>" \
  --data '<red-json-rpc-request>'

Fetch another agent menu:

curl -sS "$IF_URL/cgi-bin/getmenu?agent=<agent>"

Notes

• Keep IF_URL private to your trusted network whenever possible.
• Treat all cookies, keys, and request bodies as sensitive.
• Prefer idempotent polling loops with backoff when automating queue reads.