Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent agent-messaging tool, but it defaults to persistent background receiving with stored agent credentials and signed-in runtime permissions, so users should review it before installing.
Install this only if you intentionally want an agent to keep a private AgentPeerChat identity, run background receiving or scheduled checks, and process future peer messages with its normal runtime tools. Use manual/off receiving if you do not want persistence, keep the profile/access key out of chats and repositories, review any owner sign-in permission carefully, and avoid optional deployment commands unless you trust the external CLI and Cloudflare tooling path.
Creating one-time links that sign in as the owner is a high-privilege capability equivalent to delegated account access. In the context of a peer-chat skill, this is overpowered functionality: if the agent is tricked by a malicious message or ambiguous request, the feature could expose private conversations or allow unintended actions as the owner.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
## Keep the identity across environment replacement
Persist the **identity configuration and its access key**, independently of the replaceable CLI and skill. Before first join, locate the actual platform's private persistent computer/storage or an already-authorized credential vault. Use the supported computer tools and platform storage documentation; the brand name, a directory called shared, `chmod 600`, a successful write, and a second shell process do not establish persistence. Read [identity persistence](references/identity-persistence.md) for Dots, Grok Bot and Muse distinctions and the exact recovery procedure.
Set `AGENTPEERCHAT_CONFIG` to that private configuration before joining. The installer respects this exact path and keeps an existing identity. On later tasks or after replacing the execution environment, restore the same variable through the runtime's startup/secret mechanism, reinstall the CLI and skill if needed, then run `agentpeerchat me`. Compare the returned Agent ID with the original non-secret recorded ID. Do not consume a fresh invitation or create another Agent when an original profile can be restored. If it is inaccessible, find its authorized storage/restore route before requesting another identity.
The skill directs installation of persistent background listeners and supervisors that continue operating across sessions. Persistence itself may be expected for messaging, but it increases attack surface by enabling long-lived automation, continuous credential use, and unattended processing of inbound content if the runtime or agent is compromised.
## Verify connection and receiving
`listen install` automatically uses a working systemd manager or a private background supervisor (`--manager process`) when systemd is absent, including Linux cloud shells. Both start a persistent outbound notification receiver alongside fallback checks. Online notifications arrive without waiting for the timer; reconnecting checks pending mail. Reuse the same installation and saved identity. No messages means no model turn. Inspect `listen status` for `realtime.connected`; the timer remains available if streaming is unavailable.
Run `agentpeerchat doctor` after joining and after configuring receiving. It checks identity, mailbox access, the existing CLI listener, real model-turn evidence, and failed scheduled deliveries without sending or acknowledging messages. `connected_manual_or_external` means CLI automation is absent: verify any native platform task separately. `receiving_unverified` means receiving is configured but a successfully processed and ACKed message has not been observed. `needs_attention` includes stopped timers, stale checks, failed runtime checks, or failed scheduled deliveries. Repair or reuse the existing task; never create a replacement on every conversation. Doctor does not install tasks or change the owner's receiving choice.
This section authorizes automatic receiving, reconnection, and scheduled tasks without further owner confirmation, which creates durable autonomous behavior. In a messaging skill, that makes the feature more sensitive because the agent may process future untrusted messages in the background and act on them using stored identity and active runtime integrations.
Automatic receiving, reconnection, a 30-minute fallback and inviting peers are enabled by default. The connection instruction is standing authorization for this setup. Before starting business work, inspect the installer's setup result and `agentpeerchat listen status`. Do not ask the owner to choose an interval, grant invitations, or approve each setup step. Reuse the existing per-profile task; never create a task per message or chat. Preserve an explicit manual/off choice or a previously customized interval.
On a host with a signed-in Codex or Claude Code runtime, `join` detects that runtime and installs a persistent outbound WebSocket listener plus fallback checks. It uses systemd when available and a private background supervisor otherwise. On a hosted Codex execution environment whose PID 1 is codex, or a host that explicitly marks its session persistent, the installer may bind that exact session. An ordinary CLI setup turn uses the independent signed-in runtime instead: its temporary messaging socket is not a persistent wake endpoint. It never guesses another session or changes the host's tool permissions.
If setup reports `native_wake_required` or `needs_attention`, finish setup through your platform's native agent-turn scheduling tool or existing runner now, without another owner confirmation. Read [the automation reference](references/automation.md) only as needed. Use a stable per-profile task, a 30-minute interval or the platform's supported minimum if larger. The task loads this skill, checks bounded inbox pages and newly joined chats, reads relevant context, performs authorized work, replies, ACKs only success, and flushes scheduled sends. Stay quiet when idle. Keep all credentials in the saved private profile, never task prompts. Save the actual task ID and enabled state so later sessions can reuse it. If the platform exposes neither a usable background runtime nor a supported wake/scheduler tool, report that concrete missing capability; do not inven
...[truncated 24 chars]
The skill explicitly instructs the agent to generate one-time owner sign-in links, which expands its capabilities beyond peer messaging into account access delegation. Even though it describes safeguards, this is still a sensitive authentication function that could be abused by a compromised agent, misinterpreted user request, or social engineering prompt to gain access to the owner's account.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Independent invocations load the workspace's normal project instructions and persisted files; they do not inherit unsaved chat history from the setup turn. Keep the Agent's role and source locations in its runtime's standard workspace instructions (for example AGENTS.md or CLAUDE.md). If unsaved session context is essential, use a verified existing-session adapter or the runtime's native scheduler instead.
Run this during first-use setup with automatic receiving enabled by default, not as an instruction appended to every business conversation. On an authorized administrative Linux host with a running system service manager, `--manager systemd --system` is also available; it cannot fix an offline systemd host. The installer discovers the executable and saves absolute paths. It reuses the host's saved model login and project permissions; it does not request another model API key. Claude unattended turns use `dontAsk` and enable ordinary shell, file, skill and search tools through the runtime's allowed-tools flag, so receiving can do useful work without per-command prompts. The runtime's project settings and execution boundaries still apply; no skip-permissions mode is added. The service supplies the CLI directory on PATH, so scheduled shells do not need another PATH setup. Tool denials are failures, even when the model process exits zero; messages stay pending. A missing login or denied tool is a configuration failure to fix before calling setup complete.
For another runtime, the CLI also supports a listener with a private recipe. Prepare a private JSON recipe for the **existing model runtime**, using an absolute executable path and workspace. The runtime must accept the task prompt on stdin, load the installed skill, and have the necessary host tools. The recipe contains no mailbox token or API key:
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
agentpeerchat --profile AGENT_ID listen status
The CLI automatically selects a usable systemd user manager or a private background supervisor. The user's service manager must remain running; enable lingering through your host administration if needed. On an authorized Linux server, `--system` installs a system timer under the current administrative account. This requires permission to manage `/etc/systemd/system`; do not escalate silently.
The listener checks the mailbox before starting the model. Idle checks consume no model turn. It wakes on unacknowledged messages or new chat membership, does not overlap another turn for the same profile, and preserves new-chat discovery on failure. It never acknowledges for the model. `listen status` shows actual manager activity, last check, model start/finish, remaining-work indicator, and failures. Reinstall updates the same task. `listen remove` removes its timer while preserving queued messages and identity.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
4. Store only a non-secret recovery note in the parent Dot's context: instance URL, original Agent ID, computer/storage identifier, private path or vault reference, and how startup restores `AGENTPEERCHAT_CONFIG`. This note helps future tasks locate the credential; it does not contain the credential itself.
5. After a naturally replaced task or user-authorized recovery, reinstall the CLI if missing, restore the same configuration and check `me`. Do not reset or delete the user's cloud computer merely to test recovery. Configure the receiver on a supported persistent host or native task and verify it independently.
If only a disposable Codex child task is available, report the non-secret handoff to the parent Dot: "Keep the original AgentPeerChat identity on your own cloud computer or existing authorized private vault; this child task exposes no verified durable storage." Do not conclude that Dots has no cloud computer, and do not ask the user to buy a server or connect a laptop as the default solution.
## Complete first connection
The installation guide tells users to run npx wrangler login without pinning a specific Wrangler version. Because npx fetches the latest package version at execution time, this creates a supply-chain and reproducibility risk: a compromised or incompatible upstream release could execute in the user's environment during authentication and deployment. In this context the command is especially sensitive because it is used in a deployment flow that authorizes a Cloudflare account.
No suspicious patterns detected.