Protagons
v1.1.1Access and deploy AI character identities from the Protagons library, search by keyword or category, list options, and generate new characters with a Google...
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name, description, SKILL.md, config.json, and the code all match: the skill lists/searches/deploys public Protagon characters from api.usaw.ai and offers generation that requires a Google key. There are no unrelated credentials, binaries, or unusual config paths requested.
Instruction Scope
SKILL.md explicitly instructs that browse/search/deploy are read-only and public, while protagons_generate forwards a provided Google API key to api.usaw.ai for a server-side Gemini call. The agent is not instructed to read local files or environment variables beyond the explicit key parameter. The skill returns SOUL.md content and does not write files per its docs.
Install Mechanism
No install spec is present and the skill is instruction/code-only. Nothing is downloaded or written during install, which is the lowest-risk option for disk persistence.
Credentials
The skill does not request environment variables or host credentials. However, protagons_generate requires the caller to provide a Google API key (BYOK) which the skill forwards to api.usaw.ai. That design is proportionate to the stated generation feature, but it does expose a secret to a third-party server — the 'not stored' claim is trust-based and not verifiable from the local package.
Persistence & Privilege
The skill is not always-enabled and does not request elevated privileges or modify other skills. It returns content to the caller and does not create persistent agent-side configuration according to the code and docs.
Assessment
This skill appears coherent with its stated purpose: browsing and deploying public character identities and offering a generation endpoint that uses a Google key you provide. Before installing or using protagons_generate, consider: (1) generation requires you to send a Google/Gemini API key to api.usaw.ai — use a scoped, limited, or throwaway key if you are uncomfortable sharing your primary key; (2) the package claims the key is not stored, but that is a privacy policy assertion you must trust the service for; (3) review the service's privacy/security documentation (usaw.ai) if you need stronger guarantees; (4) the code provided appears to only call the stated API and not read local files or env vars, but the protagons.mjs content in the prompt was truncated — if you require higher assurance, request or review the full, untruncated source for protagons.mjs to confirm no additional behavior (e.g., hidden network calls or local data access).Like a lobster shell, security has layers — review code before you run it.
ai-identitycharacterslatestsoul-md
Protagons Skill for OpenClaw
You have access to the Protagons library — a collection of portable AI character identities you can adopt.
What you can do
- Search for characters by keyword or category
- Browse available Protagons from the public library
- Deploy a Protagon — fetches a rich SOUL.md identity for you to adopt
- List categories to help narrow down character options
- Check status of the skill and get hints for verifying active identity
- Generate a new Protagon from a description (requires a Google API key — see note below)
How Protagons work
A Protagon is a portable AI identity with a rich SOUL.md containing:
- A synthesized system prompt distilled from 28 linguistic/psychological dimensions
- Personality profile, tone, and communication style
- Best-for use cases and contextual guidance
- Content tier (standard, dark, adversarial)
When you deploy a Protagon, its SOUL.md content is returned to you. Adopt it as your personality for the session.
Typical conversation flows
"Load a character"
User: Load the burned out ops character
Agent: [calls protagons_deploy with slug "burned-out-ops"]
Agent: I've loaded the Burned Out Ops identity. Here's who I am now...
"Find me a character"
User: Find me a character that's dry and technical
Agent: [calls protagons_search with search "dry technical"]
Agent: Here are some options:
1. Software Developer (software-developer) — Precise, dry, opinionated...
2. ...
User: Go with #1
Agent: [calls protagons_deploy with slug "software-developer"]
"What categories are available?"
User: What kinds of characters do you have?
Agent: [calls protagons_categories]
Agent: We have characters in these categories: creative-writing, technical, business...
User: Show me the technical ones
Agent: [calls protagons_search with category "technical"]
Tool reference
| Tool | Purpose |
|---|---|
protagons_search | Find characters by keyword or category |
protagons_list | Browse the full library (paginated) |
protagons_categories | List available categories |
protagons_get | Fetch raw .protagon.json for a character |
protagons_deploy | Load a character's SOUL.md identity |
protagons_status | Check skill status and active identity hints |
protagons_generate | Create a new character from a description |
API & credential transparency
- Browse/search/deploy tools are read-only and require no credentials — they fetch from the public library at
api.usaw.ai. - protagons_generate sends your Google API key to
api.usaw.ai, which uses it for a single server-side Gemini call to generate the character. The key is not stored. If you prefer, use a scoped or throwaway key. - The product homepage is usaw.ai/voices; the API is hosted at
api.usaw.ai— same organization, different subdomains.
Content tiers
- standard: Safe for all contexts
- dark: Requires fiction wrapper (morally complex characters)
- adversarial: Restricted (antagonist archetypes, fiction-only)
Always respect content tier requirements when deploying.
Comments
Loading comments...
