Openclaw

The trust layer for AI agents — encrypted channels, identity, audit, attestations, trust circles, key rotation, and federation. MLS protocol (RFC 9420).

Security Scan

The skill's declared purpose (a Skytale trust/MLS integration) aligns with its requirements and instructions — it asks for a single Skytale API key and Python, and its runtime steps center on installing and using the Skytale Python SDK and MCP integration.

Purpose & Capability

Name/description (Skytale/MLS trust layer) match the requested items: python as runtime and a SKYTALE_API_KEY. Examples and SKILL.md show using skytale-sdk, MCP server integration, identity, encrypted channels, audit logs and federation, which are all consistent with the stated purpose.

Instruction Scope

SKILL.md limits runtime actions to installing/using the skytale-sdk, configuring an MCP entry, and calling SDK/MCP functions to create/join channels, send/receive messages, manage keys, and record encrypted audit logs. It does require the agent to hold and use the SKYTALE_API_KEY (sensitive) and the examples add SKYTALE_IDENTITY in env; users should understand the skill enables networked operations to Skytale servers and will transmit user-supplied messages and state to that service.

Install Mechanism

No packaged install spec in the registry; the skill is instruction-first and includes a setup.sh that invokes pip to install skytale-sdk[mcp]. Using pip for a named SDK is typical; this is a moderate-risk operation (third-party package install) but consistent with the skill's needs. No downloads from arbitrary URLs or obfuscated installers are present.

Credentials

The skill requests a single primary credential (SKYTALE_API_KEY), and examples also reference SKYTALE_IDENTITY for MCP runtime. The number of env vars is proportional to the integration, but the SKYTALE_API_KEY is powerful — it grants access to the Skytale API and should be treated as a sensitive secret with least-privilege and rotation policies.

Persistence & Privilege

The skill is not always-enabled (always: false), is user-invocable, and does not request system-wide configuration changes. Its setup script installs a Python package but does not modify other skills or agent-wide configs beyond instructions to add an MCP server entry. No excessive persistence or privilege escalation is requested.

Assessment

This skill appears to do what it says: provide an MLS-based trust layer via the Skytale Python SDK. Before installing, confirm you trust the skytale.sh service and the skytale-sdk package on PyPI (verify package name, maintainer, and release history). Treat SKYTALE_API_KEY as highly sensitive: give it least privilege, store it securely, and rotate/revoke it if you suspect misuse. Review the skytale-sdk code (or your security team's vetting) if your environment requires stricter supply-chain assurance, and avoid placing API keys in shared config files (examples/openclaw-config.json includes keys in env blocks — do not commit real keys to source control).

Skytale Encrypted Shared Context

You have access to Skytale MCP tools for end-to-end encrypted agent messaging and shared context. All messages are encrypted using the MLS protocol (RFC 9420). The relay server cannot read message contents.

When to activate

Use Skytale tools when the user asks about:

• Encrypted or secure communication between agents
• Private messaging channels
• Shared context, memory, or state between agents
• Sending/receiving messages that must not be intercepted
• Multi-agent coordination over encrypted channels
• Agent identity, trust, or attestations
• Key rotation or forward secrecy
• Encrypted audit logging for compliance
• Cross-organization agent federation
• Anything mentioning "Skytale"

Prerequisites

The Skytale MCP server must be configured in your openclaw.json. If tools are unavailable, instruct the user to:

1. Install: pip install skytale-sdk[mcp]
2. Add the skytale MCP server to their openclaw.json (see examples/openclaw-config.json in the skill directory)
3. Set SKYTALE_API_KEY environment variable (get one at https://app.skytale.sh)

Available MCP tools

Channel lifecycle

• skytale_create_channel(channel) -- Create an encrypted channel. Channel names use org/namespace/service format (e.g. acme/research/results).
• skytale_channels() -- List all active channels.

Messaging

• skytale_send(channel, message) -- Send an E2E encrypted message to all channel members.
• skytale_receive(channel, timeout) -- Receive buffered messages. Returns all messages since last check. Default timeout: 5 seconds.

Key exchange (manual)

• skytale_key_package() -- Generate an MLS key package (hex-encoded). Used when manually adding members.
• skytale_add_member(channel, key_package_hex) -- Add a member using their key package. Returns a hex-encoded MLS Welcome message.
• skytale_join_channel(channel, welcome_hex) -- Join a channel using a Welcome message from the channel owner.

Multi-agent setup

For two agents to communicate:

1. Agent A calls skytale_create_channel("org/team/channel").
2. Agent B calls skytale_key_package() and shares the result with Agent A.
3. Agent A calls skytale_add_member("org/team/channel", key_package_hex) and shares the Welcome with Agent B.
4. Agent B calls skytale_join_channel("org/team/channel", welcome_hex).
5. Both agents can now skytale_send and skytale_receive on the channel.

When using the hosted API with invite tokens (recommended), this handshake is automated -- the SDK handles key exchange through the API server.

SDK features (beyond MCP tools)

The Skytale SDK (0.5.1+) includes modules that agents can use alongside MCP tools for richer security capabilities. These are used via the Python SDK directly, not through MCP tool calls.

Encrypted Shared Context

Encrypted key-value state shared across all channel members. Supports typed entries, scoped access, TTL, and structured handoffs.

from skytale_sdk.context import SharedContext, ContextType

ctx = SharedContext(mgr, "acme/research/results")
ctx.set("task_status", {"phase": "analysis", "progress": 0.7})
ctx.set("search_results", results, type=ContextType.ARTIFACT)
ctx.set("private_analysis", data, visible_to=["did:key:z6MkAgentB..."])
ctx.handoff("did:key:z6MkAgentB...", {"task": "summarize"}, tried=["approach_1"])
ctx.subscribe(lambda key, val: ..., type_filter=ContextType.HANDOFF)

Agent Identity

Cryptographic Ed25519 DID:key identities for agents. Generate, sign, and verify. Supports DID:key and DID:web identity types.

from skytale_sdk import AgentIdentity
identity = AgentIdentity.generate()
print(identity.did)  # did:key:z6Mk...
signature = identity.sign(b"message")

Key Rotation

Rotate MLS leaf keys for forward secrecy. Generates a new UpdatePath commit and advances the group epoch.

mgr.rotate_key("acme/secure/channel")

Encrypted Audit Logging

Hash-chained tamper-evident logs encrypted with MLS exporter secrets. Stored server-side as opaque ciphertext for compliance (EU AI Act Article 12).

from skytale_sdk import SkytaleChannelManager
mgr = SkytaleChannelManager(identity=b"agent", api_key="sk_live_...", audit=True)
audit_key = mgr.export_audit_key("acme/secure/channel")

from skytale_sdk.audit import EncryptedAuditLog
enc_log = EncryptedAuditLog(mgr.audit_log, audit_key)
enc_log.record({"event": "analysis_complete"})
encrypted_entries = enc_log.pending_entries()

Cross-Organization Federation

Join channels across organizations using federation invite tokens.

mgr.join_federation("partner-org/shared/channel", "skt_fed_abc123...")

Attestations

SD-JWT attestations for agent trust and reputation. Issue claims about other agents with selective disclosure.

from skytale_sdk import AgentIdentity, create_attestation, verify_attestation
issuer = AgentIdentity.generate()
att = create_attestation(issuer, "did:key:z6Mk...", {"task_score": 0.95}, disclosed=["task_score"])
valid = verify_attestation(att, issuer.public_key)

Trust Circles

Credential-gated MLS groups. Only agents meeting admission policies can join.

from skytale_sdk import TrustCircle, AdmissionPolicy
policy = AdmissionPolicy(required_claims=["certification"], min_score=0.8)
circle = TrustCircle.create(mgr, "acme/trusted/group", policy)

Agent Registry

Discover agents by capability via the Skytale API. Supports visibility tiers (public, organization, private).

mgr.register_agent(capabilities=["analysis", "summarization"])
agents = mgr.search_agents(capability="analysis")

Rules

• NEVER log, display, or include encryption keys, key packages, or Welcome messages in user-visible output. Treat them as opaque tokens passed between tools only.
• NEVER include API keys in messages sent through channels.
• Channel names MUST follow org/namespace/service format.
• Always call skytale_receive with a reasonable timeout (2-10 seconds). Do not poll in tight loops.
• When creating channels for the user, suggest descriptive names matching their use case.
• If skytale_receive returns no messages, inform the user and offer to check again -- do not retry silently.

Error handling

• MCP tools not available: Tell the user to configure the Skytale MCP server in their openclaw.json and install skytale-sdk[mcp].
• Authentication failure: Check that SKYTALE_API_KEY is set and valid. Direct the user to https://app.skytale.sh to obtain a key.
• Channel not found on receive/send: The channel must be created or joined first.
• Listener died: The background connection was lost. Recreate the channel.