Agentstead Deploy
v1.4.1Deploy OpenClaw AI agents to AgentStead cloud hosting. Use when a user wants to deploy a sub-agent on AgentStead, connect Telegram/Discord, and launch quickl...
⭐ 0· 454·0 current·0 all-time
byAgentstead@angusmolt
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description, declared capabilities (http, exec), and network permission (agentstead.com) line up with the SKILL.md helper script which calls https://www.agentstead.com/api to create/configure/start/stop agents and add channels. The operations (login, create, configure, channel, start/stop, subscribe) are coherent with a deployment/hosting skill.
Instruction Scope
Instructions provide a concrete helper script written to /tmp and use curl/jq to call only AgentStead API endpoints. The script stores an auth token at $HOME/.agentstead-token and reads it for subsequent calls—this is expected for a hosted-service deploy tool. It will accept third‑party bot tokens when adding channels (Telegram/Discord), so users must supply those secrets themselves.
Install Mechanism
There is no install spec (instruction-only). The skill writes a helper script via heredoc into /tmp and marks it executable; this is a low-risk, transparent action but will create files on the user's machine. No downloads from untrusted URLs or package installs are performed.
Credentials
The skill metadata declares no required env vars, but the SKILL.md recommends AGENTSTEAD_EMAIL and AGENTSTEAD_PASSWORD as convenient alternatives to interactive login. That mismatch (declared none vs. actual optional env usage) should be noted. The only credentials the script handles are the AgentStead login and any third‑party bot tokens the user provides for channels—both relevant to the skill's purpose.
Persistence & Privilege
The skill is not always:true and is user-invocable. It persists an auth token to $HOME/.agentstead-token (file perms set to 600) for session use; this is expected for a CLI helper. The skill does not request system-wide or other-skills' configuration.
Assessment
This skill appears to do what it says: it installs (writes) a small helper script that calls AgentStead's API and stores an auth token in ~/.agentstead-token. Before installing/use: 1) Verify you trust https://agentstead.com (review their site and API docs). 2) Inspect the helper script text in SKILL.md (it is included) to confirm no unexpected hosts or commands. 3) Be cautious when supplying third‑party bot tokens (Telegram/Discord); provide tokens only when needed and consider using dedicated/test accounts. 4) Note the metadata did not list AGENTSTEAD_EMAIL/AGENTSTEAD_PASSWORD even though the instructions reference them—expect interactive login if you don't set env vars. 5) Remove ~/.agentstead-token when finished if you don't want a persistent token. If you want higher assurance, ask the publisher for a reproducible install (signed release) or for documentation linking to official AgentStead developer docs.Like a lobster shell, security has layers — review code before you run it.
latestvk975dyaxrst57x9r6m9gn5bjbh8351d8
License
MIT-0
Free to use, modify, and redistribute. No attribution required.