Echo AI

Connect to Echo AI — the customer interaction platform. List assistants, retrieve knowledge bases, and chat with AI-powered Echos built by businesses and cre...

Security Scan

The skill's behavior (it requires and uses an ECHO_API_KEY) matches its description, but the registry metadata omits the required credential and primary credential declaration — an inconsistency you should verify before installing.

Purpose & Capability

Name/description match the instructions: listing assistants, retrieving knowledge bases, and chatting with Echo AI via auth.echoai.so. Requiring an API key is appropriate for this purpose, but the registry metadata does not declare the API key or any primary credential — an inconsistency between declared requirements and the actual instructions.

Instruction Scope

SKILL.md limits actions to GET/POST calls to the Echo API (listing assistants, retrieving assistant details, posting chat messages). It instructs to prefer local FAQs (zero-cost) and ask user confirmation before chat calls. It does not direct the agent to read unrelated files or reach out to other endpoints.

Install Mechanism

This is an instruction-only skill with no install spec or code to download — low install risk. README suggests copying files into the user skills folder and toggling openclaw.json, which is a normal local configuration step.

Credentials

The runtime instructions require setting ECHO_API_KEY, but the skill metadata lists no required environment variables or primary credential. That mismatch can lead to confusing permission/secret handling. The single API key request itself is proportionate to the service, but the omission from metadata is a red flag to verify.

Persistence & Privilege

The skill does not request always-on presence and does not declare system-wide privileges. The README asks users to enable the skill in OpenClaw config (normal). The only persistence-like behavior is advising to save session_id between chat calls, which is expected for conversational continuity.

What to consider before installing

This skill appears to do only what it claims (call Echo AI endpoints), but the package metadata failed to declare the API key the instructions require. Before installing: (1) confirm you are comfortable setting ECHO_API_KEY in your environment and that you will use an assistant-scoped or least-privilege key rather than a broad workspace key; (2) verify the endpoint host (auth.echoai.so) is legitimate for the service you expect; (3) test with a low-privilege or throwaway API key to observe behavior; (4) be aware chat calls consume the Echo owner's credits and the skill asks for explicit confirmation — keep that behavior; (5) if you need guarantees, ask the publisher to update the registry metadata to list ECHO_API_KEY as a required/primary credential so the platform can surface the permission request properly.

Connect your agent to Echo AI — a platform where businesses and creators build AI-powered assistants (called Echos) for sales, support, and customer engagement.

With this skill, your agent can discover Echos, read their knowledge bases, and have conversations with them.

Get started

1. Sign up at echoai.so (free tier available)
2. Create your first Echo or browse existing ones
3. Go to Settings → API Keys and generate a key
4. Set the environment variable ECHO_API_KEY to your key

What this skill can do

1. List available Echos (free, no credits)

Discover which AI assistants are available under your API key.

GET https://auth.echoai.so/functions/v1/api/assistants
Header: X-API-Key: $ECHO_API_KEY

Response:

{
  "assistants": [
    {
      "id": "uuid",
      "name": "Sales Assistant",
      "bio": "I help qualify leads and answer product questions",
      "slug": "sales-assistant",
      "avatar_url": "https://...",
      "tone": "professional",
      "style": "concise",
      "topics": ["pricing", "features", "onboarding"]
    }
  ]
}

2. Get Echo details and knowledge base (free, no credits)

Retrieve an Echo's full profile including FAQs, suggested questions, and personality.

GET https://auth.echoai.so/functions/v1/api/assistant/{id}
Header: X-API-Key: $ECHO_API_KEY

Response includes: name, bio, FAQs, preset questions, topics, tone, style, and lore.

If the user's question can be answered from FAQs, answer directly — no chat call needed.

3. Chat with an Echo (costs credits)

Send a message and get a response from the Echo's AI.

POST https://auth.echoai.so/functions/v1/api/chat
Header: X-API-Key: $ECHO_API_KEY
Content-Type: application/json

Request:

{
  "message": "What pricing plans do you offer?",
  "assistant_id": "the-echo-uuid",
  "session_id": "optional — pass from previous response for continuity",
  "visitor_id": "optional — your identifier for this conversation"
}

Response:

{
  "response": "We offer three plans: Starter at $29/mo, Pro at $79/mo...",
  "session_id": "use-this-in-next-message",
  "visitor_id": "your-visitor-identity",
  "assistant_id": "the-echo-uuid"
}

Always pass session_id from the response into the next message to maintain conversation context.

Workflow

When asked to find or list Echos:

1. Call GET /api/assistants
2. Present the results with name, bio, and topics
3. Ask if the user wants details on a specific one

When asked about a specific Echo:

1. Call GET /api/assistant/{id}
2. Present the Echo's profile, FAQs, and suggested questions
3. If the question can be answered from FAQs, answer directly (zero cost)

When the user wants to chat with an Echo:

1. Warn the user: "This will send a message to the Echo and consume the Echo owner's credits. Proceed?"
2. If confirmed, call POST /api/chat
3. Return the response and save the session_id for follow-ups

Error handling

Status	Meaning	Action
401	API key missing or invalid	Check ECHO_API_KEY is set correctly
402	Echo owner out of credits	Inform the user, cannot proceed
403	Key doesn't have access to this Echo	Use correct key or request access
429	Rate limit exceeded	Wait and retry (default: 60 req/min)
404	Echo or endpoint not found	Verify the Echo ID or endpoint path

Important rules

• Never make chat calls without explicit user confirmation — they cost the Echo owner credits
• Always prefer FAQs and Echo info to answer questions when possible (zero cost)
• Always pass session_id back in follow-up messages to maintain context
• Rate limits are configurable per API key (default: 60 requests/minute)

About Echo AI

Echo is a platform where anyone can create AI-powered assistants for their business. Echos can be deployed on websites, WhatsApp, Instagram, Telegram, Discord, Slack, and more. They handle sales conversations, customer support, lead qualification, and appointment booking.

Learn more: echoai.so