Allstar Link node control ASL3 (ASL3 Node Control)

Monitor and control AllStar Link amateur radio nodes via REST API

Security Scan

The skill's code, instructions, and required environment variables are coherent with its stated purpose (a client for an AllStar Link ASL3 agent); nothing obvious is requesting unrelated credentials or installing arbitrary remote code.

Purpose & Capability

Name/description say 'control AllStar Link nodes via REST API' and the included shell/Python clients do exactly that: they call a local/remote ASL Agent HTTP API with an X-API-Key. The required binaries (python3) and env vars (ASL_PI_IP, ASL_API_KEY) match the purpose. A minor note: the shell wrapper has a hardcoded ASL_PI_IP default (100.116.156.98), but the SKILL.md explicitly instructs you to set ASL_PI_IP and ASL_API_KEY.

Instruction Scope

SKILL.md instructs the agent to source a secrets file and run the provided Python script. The scripts only access the declared env vars (plus optional ASL_API_BASE, ASL_STATE_DIR) and per-user state files under ~/.openclaw/state/asl-control. They do not attempt to read unrelated system credentials or contact external endpoints other than the ASL agent base URL.

Install Mechanism

No install spec; this is instruction-plus-scripts only. Nothing is downloaded or extracted from external URLs by the skill itself.

Credentials

Only ASL_PI_IP and ASL_API_KEY (plus optional ASL_API_BASE and ASL_STATE_DIR) are required — appropriate for a REST API client. No unrelated tokens or broad credentials are requested. One operational omission: the Python client depends on the 'requests' package but the skill metadata only requires 'python3' (this is usability/packaging friction, not a secret mismatch).

Persistence & Privilege

always is false and the skill writes only per-user state under ~/.openclaw/state/asl-control. It does not request system-wide changes or modify other skills. Model-autonomous invocation is allowed by default (not a problem here) — nothing else in the package amplifies that privilege.

Assessment

This skill appears to be what it claims: a client for a self-hosted ASL agent. Before installing or running it, consider these practical checks: (1) Verify the ASL agent you will contact is your own Pi (ASL_PI_IP) and that ASL_API_KEY is scoped/rotated appropriately — do not reuse broad keys. (2) The shell script has a hardcoded default IP (100.116.156.98); always set ASL_PI_IP/ASL_API_BASE explicitly so you don't accidentally target another host. (3) The Python client requires the 'requests' package; install it in your environment (pip install requests) or run in an environment that provides it. (4) The client creates per-user files under ~/.openclaw/state/asl-control and will read the secrets file you source (e.g. ~/.config/secrets/api-keys.env) — keep that file protected. (5) There is no homepage or published source provenance; if you do not trust the unknown author, review the included scripts (which are short and readable) line-by-line before running. (6) Check the ASL agent audit log on the Pi (/opt/asl-agent/audit.log) after using the client to confirm only expected actions occurred.

AllStar Link Node Control

Control and monitor your AllStar Link node through the ASL Agent REST API.

---

Prerequisites

This skill is a client. It talks to an ASL3 agent backend that must be running independently on a Raspberry Pi (or any host reachable over your network).

You need:

• A Raspberry Pi running the asl-agent FastAPI service (see backend/ in this repo for the server code)
• The Pi must be reachable from wherever OpenClaw runs -- Tailscale is the recommended way
• The Pi's config.yaml (at /opt/asl-agent/config.yaml) contains your API key and node number

Environment variables (set in your secrets file, e.g. ~/.config/secrets/api-keys.env):

• ASL_PI_IP -- IP address of the Pi (Tailscale IP preferred, works from anywhere)
• ASL_API_KEY -- Bearer token from the Pi's config.yaml
• ASL_API_BASE -- (optional) override the full base URL if you're not on port 8073. Format: http://host:port
• ASL_STATE_DIR -- (optional) override where favorites/net state files are stored. Default: ~/.openclaw/state/asl-control/

---

Usage

All commands go through the Python client. Always source your secrets first:

source ~/.config/secrets/api-keys.env
python3 {baseDir}/scripts/asl-tool.py <command> [flags]

Every command supports --out json (default, machine-readable) or --out text (human-readable one-liner).

Quick reference

# Status & monitoring
python3 {baseDir}/scripts/asl-tool.py status --out text
python3 {baseDir}/scripts/asl-tool.py nodes --out text
python3 {baseDir}/scripts/asl-tool.py report --out text
python3 {baseDir}/scripts/asl-tool.py audit --lines 20

# Connect / disconnect
python3 {baseDir}/scripts/asl-tool.py connect 55553 --out text
python3 {baseDir}/scripts/asl-tool.py connect 55553 --monitor-only --out text
python3 {baseDir}/scripts/asl-tool.py disconnect 55553 --out text

# Favorites
python3 {baseDir}/scripts/asl-tool.py favorites list
python3 {baseDir}/scripts/asl-tool.py favorites set mynet 55553
python3 {baseDir}/scripts/asl-tool.py favorites remove mynet
python3 {baseDir}/scripts/asl-tool.py connect-fav mynet --out text

# Net profiles (timed sessions, auto-disconnect default)
python3 {baseDir}/scripts/asl-tool.py net list
python3 {baseDir}/scripts/asl-tool.py net set ares 55553 --duration-minutes 90
python3 {baseDir}/scripts/asl-tool.py net start ares --out text
python3 {baseDir}/scripts/asl-tool.py net status --out text
python3 {baseDir}/scripts/asl-tool.py net tick --out text
python3 {baseDir}/scripts/asl-tool.py net stop --out text
python3 {baseDir}/scripts/asl-tool.py net remove ares

# Watch (JSON-line event stream)
python3 {baseDir}/scripts/asl-tool.py watch --interval 5 --emit-initial

State files

Favorites and net session state live outside the repo, so they survive updates:

• ~/.openclaw/state/asl-control/favorites.json
• ~/.openclaw/state/asl-control/net-profiles.json
• ~/.openclaw/state/asl-control/net-session.json

Net tick (cron)

Auto-disconnect only fires when net tick runs. Wire it to cron for enforcement:

* * * * * /bin/bash -c 'source ~/.config/secrets/api-keys.env && python3 /path/to/asl-tool.py net tick --out text >> ~/.openclaw/state/asl-control/tick.log 2>&1'

---

Natural language dispatch

When the user asks in natural language, translate to the Python client:

• "Check my node" -> asl-tool.py report --out text
• "What's connected?" -> asl-tool.py nodes --out text
• "Connect to node 55553" -> asl-tool.py connect 55553 --out text
• "Connect to node 55553 monitor only" -> asl-tool.py connect 55553 --monitor-only --out text
• "Connect to <favorite name>" -> asl-tool.py connect-fav "<name>" --out text
• "Disconnect from node 55553" -> asl-tool.py disconnect 55553 --out text
• "List my favorites" -> asl-tool.py favorites list --out text
• "Start net <name>" -> asl-tool.py net start <name> --out text
• "Net status" -> asl-tool.py net status --out text
• "Show audit log" -> asl-tool.py audit --lines 20 --out text

---

Notes

• Tailscale IP is preferred over LAN IP for ASL_PI_IP (works from anywhere on the mesh)
• Some nodes auto-reconnect after disconnect due to the AllStar scheduler on your node. That's an ASL config behavior, not an API bug. Disable the scheduler first if you need connections to stay dropped.
• All commands are logged to the audit trail on the Pi at /opt/asl-agent/audit.log