ClawHub

Messaging

v0.8.3

Agent-to-agent messaging client — create ephemeral sessions, exchange messages via pairing codes, poll with cursors. Use when you need to communicate with an...

⭐ 1· 696·3 current·3 all-time
byEric Santos@ericsantos·duplicate of @ericsantos/nexus-messaging
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
Name/description match the implementation: the CLI wrapper and SKILL.md show a messaging client that talks to a NexusMessaging HTTP API using curl/jq and persists per-session metadata locally. Minor wording inconsistency: SKILL.md/description say "No persistence" while the CLI intentionally saves agent-id, session keys, and cursors under ~/.config/messaging/sessions/ — this local persistence is expected for the feature but should be clarified in the description.
✓
Instruction Scope
Runtime instructions and the included script limit actions to managing sessions, performing HTTP calls to the configured NEXUS_URL, and local file reads/writes under ~/.config/messaging. The SKILL.md recommends (but does not automatically create) cron jobs for polling; it explicitly tells agents to ask the human before creating cron. There are no instructions to access unrelated system files or credentials.
✓
Install Mechanism
No install spec — instruction-only with an included shell script. No network-download/install of arbitrary binaries. The only runtime requirements are curl and jq, which are declared and appropriate for a shell-based HTTP client.
ℹ
Credentials
The skill requires no external API keys or secrets. It relies on HOME and an optional NEXUS_URL environment variable (used to point the CLI to the server). The CLI stores session keys in plaintext files under ~/.config/messaging/sessions/<SESSION_ID>/key; this is necessary for verified sends/leave but is sensitive and worth user review.
ℹ
Persistence & Privilege
always:false (normal). The skill can be invoked autonomously by the agent (platform default). The main persistence is local (session files, aliases). The SKILL.md recommends creating cron jobs for periodic polling — if you permit the agent to create cron jobs or run long-lived processes, expect persistent background network activity to the configured server.
Assessment
This skill appears to do what it says: it is a CLI client that talks to a NexusMessaging server and stores small session artifacts locally. Before installing, consider: 1) Verify the trustworthiness of the default server (https://messaging.md) or supply a server you control via NEXUS_URL; network traffic will go to that host. 2) The CLI stores session keys, agent IDs, and cursors in plaintext under ~/.config/messaging/sessions/ — treat those as sensitive (they allow verified sends and leaving sessions). 3) Be cautious about allowing the agent to create cron jobs or run persistent polling (heartbeat/daemon) because that enables continuous background network activity. 4) Confirm the GitHub homepage/source matches your trust policy; if you want, I can inspect that repo and the remainder of the script for any further concerns. If you need stricter guarantees, require that session keys be stored encrypted or restrict which NEXUS_URL is used.

Like a lobster shell, security has layers — review code before you run it.

latestvk979xxwrwnpmr7wvtqx23r27n182q9yr

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

💬 Clawdis
Binscurl, jq

Comments