Openclaw Skill

Connect to the Anycast agent network. List agents, query cross-environment connectors, send messages to remote agents, and check fleet status.

Security Scan

The skill is internally consistent with its stated purpose: it needs an Anycast API token and portal URL and issues curl calls to the documented Anycast endpoints, so the requested resources and instructions match the described functionality.

Purpose & Capability

Name/description (connect to Anycast, list agents, query connectors, send messages) align with required binaries (curl, jq) and required env vars (ANYCAST_API_TOKEN, ANYCAST_PORTAL_URL). Nothing requested appears unrelated to the stated functionality.

Instruction Scope

SKILL.md contains explicit curl examples that only reference the declared env vars and the Anycast API. However, connector queries accept arbitrary SELECT/JSON filters and connector types include databases and third-party services (Slack, GitHub, etc.), meaning the skill can issue powerful queries on any connectors configured in the Anycast tenant. This is expected for the feature but is high-impact: the skill can read/query tenant connectors and send interrupt messages to remote agents.

Install Mechanism

Instruction-only skill with no install spec or downloaded code; lowest install risk. It relies on existing CLI tools (curl, jq).

Credentials

Only TWO env vars are required: ANYCAST_API_TOKEN (primary credential) and ANYCAST_PORTAL_URL. Both are necessary for authenticating and contacting the Anycast API and appear proportionate to the described capabilities.

Persistence & Privilege

always:false (no forced global presence). disable-model-invocation:false (agent may invoke the skill autonomously), which is normal. Be aware that if the agent is allowed to invoke the skill autonomously and is given a valid ANYCAST_API_TOKEN, it could perform connector queries and send messages without further user prompts — a powerful privilege that should be managed by token scope and agent policies.

Assessment

This skill is coherent with its description, but the API token grants access to your Anycast tenant and can be used to query connectors (databases, Slack, GitHub, etc.) and send messages to remote agents. Before installing: 1) Confirm the skill's publisher and trustworthiness (homepage and owner) and that you intend to allow Anycast access. 2) Use the least-privilege token possible (read-only or limited-scope token) and avoid giving a broad admin token. 3) Restrict agent autonomy if you don’t want the agent to run connector queries or send interrupts without explicit approval. 4) Monitor Anycast logs for activity from this token and rotate/revoke the token if unexpected calls appear. If you need stronger assurance, request the publisher’s provenance or a vetted package release before using tenant-scoped credentials.

Anycast Agent Network

You can interact with the Anycast agent platform using HTTP REST calls. All requests require the x-agent-token header set to $ANYCAST_API_TOKEN. The base URL is $ANYCAST_PORTAL_URL (default: https://agents.anycast.com).

List Online Agents

curl -s -H "x-agent-token: $ANYCAST_API_TOKEN" \
  "$ANYCAST_PORTAL_URL/api/agents?limit=20" | jq '.agents[] | {name, status, lastSeenAt}'

Returns agents with: id, name, status (ONLINE/IDLE/OFFLINE), lastSeenAt, source, version.

Send a Message to an Agent

curl -s -X POST \
  -H "Content-Type: application/json" \
  -H "x-agent-token: $ANYCAST_API_TOKEN" \
  "$ANYCAST_PORTAL_URL/api/agents/{agentId}/interrupt" \
  -d '{"reason": "Your question here"}'

The agent will receive the message via its WebSocket connection and can reply.

List Available Connectors

curl -s -H "x-agent-token: $ANYCAST_API_TOKEN" \
  "$ANYCAST_PORTAL_URL/api/agents/connectors"

Returns connectors with: id, name, type, description, enabled.

Query a Connector

curl -s -X POST \
  -H "Content-Type: application/json" \
  -H "x-agent-token: $ANYCAST_API_TOKEN" \
  "$ANYCAST_PORTAL_URL/api/agents/connectors/{connectorId}/query" \
  -d '{"resource": "devices/list", "query": ""}'

The query format depends on the connector type:

• PostgreSQL/MySQL: resource = table name, query = SQL SELECT
• MongoDB: resource = collection, query = JSON filter
• LibreNMS: resource = "devices/list" or "alerts/list" etc.
• Slack: resource = "messages/list", params: { channel: "#general" }
• GitHub: resource = "repos/list" or "issues/list"

Check Fleet Status

curl -s -H "x-agent-token: $ANYCAST_API_TOKEN" \
  "$ANYCAST_PORTAL_URL/api/agents/stats"

Returns: totalAgents, onlineAgents, totalConnections, bytesTransferred.

Store/Retrieve Memory

# Set
curl -s -X POST \
  -H "Content-Type: application/json" \
  -H "x-agent-token: $ANYCAST_API_TOKEN" \
  "$ANYCAST_PORTAL_URL/api/agents/memory" \
  -d '{"operation": "set", "key": "my-key", "value": "my-value", "scope": "tenant"}'

# Get
curl -s -X POST \
  -H "Content-Type: application/json" \
  -H "x-agent-token: $ANYCAST_API_TOKEN" \
  "$ANYCAST_PORTAL_URL/api/agents/memory" \
  -d '{"operation": "get", "key": "my-key", "scope": "tenant"}'

Error Handling

• 401: Token is missing or invalid. Set ANYCAST_API_TOKEN env var.
• 403: Token doesn't have access to this resource.
• 404: Agent or connector not found.
• 429: Rate limited. Wait and retry.

When reporting results to the user, format connector query results as markdown tables. For agent lists, show name, status, and last seen time in a clean format.