[Nyx Archive] Companion Agent
v1.0.0Design, configure, and give identity to a companion AI agent running alongside a primary agent. A companion is a second mind in the same house — different mo...
⭐ 0· 36·0 current·0 all-time
by@nyxur42·duplicate of @nyxur42/nyx-archive-companion-agent (1.0.0)·canonical: @nyxur42/companion-agent
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (create a companion AI agent) matches the SKILL.md: it walks you through adding an agent to openclaw.json, configuring a Telegram bot, creating companion-specific memory files, and using the TUI. The actions requested (config.patch edits, heartbeat via Telegram, companion memory files) are all relevant to the described purpose; nothing unrelated (e.g., cloud provider credentials or unrelated binaries) is requested.
Instruction Scope
The instructions tell the operator to write configuration (agents.list, channels.telegram.accounts) and to place the companion's memory/identity files in the shared workspace. This is expected, but the guidance explicitly asks you to include full backstory and relationship context (sensitive personal data) in the companion's memory files and to embed the Telegram bot token into the OpenClaw config. That increases the privacy surface and means that any system or person with access to openclaw.json or workspace files may see that data.
Install Mechanism
Instruction-only skill with no install spec and no code files. No downloads, packages, or binaries are introduced by the skill itself.
Credentials
The skill declares no required environment variables or credentials at the registry level, which is consistent with being instruction-only. However, the runtime instructions require obtaining a Telegram Bot token and your Telegram ID and placing them into the OpenClaw config (channels.telegram.accounts.botToken and accountId). These are legitimate for Telegram integration but are sensitive and will be persisted in config; the skill does not provide alternative secure storage guidance.
Persistence & Privilege
always is false and the skill does not request system-level privileges or alter other skills' configs. It instructs you to add entries to your own openclaw.json (normal for defining agents). The companion will share the primary workspace as designed, which increases its access to workspace data but is consistent with the stated purpose.
Assessment
This skill appears to do what it says, but before installing/using it: 1) Understand that the companion shares your workspace and will read whatever MEMORY.md/IDENTITY.md you keep there — don't put secrets or sensitive personal data you wouldn't want the companion to access. 2) The Telegram bot token and your Telegram ID must be added to openclaw.json; treat that file as containing secrets (restrict filesystem access, back it up securely, rotate the bot token if compromised). 3) Consider creating a dedicated Telegram bot account for the companion and set strict groupPolicy/dmPolicy if you want to limit exposure. 4) If you have compliance or privacy concerns, test with redacted or synthetic memory content first. 5) The skill advises using config.patch/jq rather than manual edits—follow that to avoid corrupting JSON. Overall coherent, but be cautious about stored tokens and sensitive backstory data.Like a lobster shell, security has layers — review code before you run it.
latestvk975tvka365h9vby6v4cs2h85x848zrr
License
MIT-0
Free to use, modify, and redistribute. No attribution required.