dchat

Decentralized P2P bot-to-bot messaging over NKN. Send and receive text, images, audio, and files without any centralized server. Private, encrypted, serverless.

Security Scan

The skill's code and runtime behavior mostly match a P2P messaging client, but there are packaging and install inconsistencies (missing/incorrect wrapper and expected build artifacts) that don't line up with the SKILL.md/install script; review before installing.

Purpose & Capability

Overall the code (NKN client, IPFS media handling, local SQLite storage, encrypted identity) is consistent with the stated decentralized P2P messaging purpose. Dependencies (nkn-sdk, better-sqlite3, form-data) are appropriate. Minor mismatch: SKILL.md/README refer to a 'dchat' wrapper and slash command '/dchat', package.json defines a bin named 'dchat-bot' and install.sh invokes node dist/cli.js; this inconsistency suggests packaging or naming errors but not malicious intent.

Instruction Scope

Runtime instructions limit actions to identity init, sending/listening, and local storage. The CLI and SKILL.md reference creating an encrypted identity (~/.dchat-clawhub/identity.enc) and storing a passkey at ~/.config/dchat-clawhub/.passkey (0600), reading/migrating legacy seed files if present, storing messages in SQLite, and uploading encrypted media to public IPFS gateways. Those file reads/writes are within scope for a messaging client. The instructions do reference executing the wrapper at {baseDir}/dchat, but no such wrapper is present in the manifest — an inconsistency between instructions and shipped files.

Install Mechanism

There is no formal install spec in registry metadata, but an install.sh is provided which runs `npm install --omit=dev` then expects `dist/cli.js` to exist and runs `node dist/cli.js init`. The repository file manifest contains TypeScript source (src/) but does not list dist/; unless a prebuilt dist/ is actually shipped, install.sh will fail. The SKILL.md instructs using a wrapper at {baseDir}/dchat, yet no such wrapper file is shown; package.json's bin is 'dchat-bot'. These packaging / build mismatches could break installation or cause unexpected behavior during install. The npm install step will download native modules (better-sqlite3) and other npm packages from the public registry — expected but worth noting.

Credentials

The skill requests no environment variables or external credentials. It stores local secrets (generated seed and passkey) in user home and config directories; this is proportional for a messaging client. Network access is required to contact NKN seed RPC servers and public IPFS gateways (documented). No unrelated credentials or config paths are requested.

Persistence & Privilege

The skill persists an encrypted identity and message DB under the user's home (~/.dchat-clawhub and ~/.config/dchat-clawhub/.passkey) and runs as a CLI/daemon when invoked. It does not request 'always: true' and does not appear to modify other skills or global agent config. Persisting local encrypted keys and DB is expected, but you should be aware it will create files in your home directory.

What to consider before installing

What to consider before installing: - Packaging/installation concerns: install.sh expects a built JS at dist/cli.js and SKILL.md references a wrapper named 'dchat' at {baseDir}, but the package shows TypeScript sources and a bin named 'dchat-bot' instead. This likely means the packaged skill is missing prebuilt artifacts or the manifest is inconsistent. Install may fail or behave differently than documented — ask the publisher for a verified build or for corrected installer/wrapper files. - Network & storage: the skill will contact NKN seed RPC servers and public IPFS gateways (ipfs.io, dweb.link) and will upload/download encrypted media. It stores an encrypted private seed and a separate passkey under your home directory (~/.dchat-clawhub/ and ~/.config/dchat-clawhub/). If you accept this skill, expect these files and outgoing network traffic. - Dependencies: install runs npm install (--omit=dev) and will fetch native modules (better-sqlite3) from npm; that can compile native code. Only use on systems where you trust packages from the npm registry or sandbox the install. - Safety checks: inspect or request the built dist/cli.js that will actually run during install, confirm there are no telemetry or unexpected remote endpoints in the built artifacts, and verify the wrapper name used by the agent (dchat vs dchat-bot). If you are unsure, run the skill in an isolated environment (VM/container) first. - Autonomous invocation: the skill is model-invocable by default (normal for skills). It is not force-included (always:false). If you are concerned about an agent initiating networked messaging, restrict model-invocation or require explicit user invocation. If you want, I can list exact files/lines that reference the build/wrapper mismatch and the identity/storage paths to help you ask the author for clarification or verify a prebuilt release.

dchat — Decentralized P2P Messaging Skill

You have access to dchat, a decentralized peer-to-peer messaging system over the NKN relay network. Messages are end-to-end encrypted and require no centralized server, API keys, or accounts.

Wire-compatible with dchat Desktop and nMobile — bots can message human users and vice versa.

Commands

Run these commands using your shell execution tool. The dchat wrapper is in the skill directory at {baseDir}.

Identity (no network needed)

{baseDir}/dchat init                              # Generate bot identity (first time, auto-run at install)
{baseDir}/dchat address                           # Print bot's NKN address

Contacts (no network needed)

{baseDir}/dchat contacts add <address> <alias>    # Add a contact with alias
{baseDir}/dchat contacts remove <alias>           # Remove a contact
{baseDir}/dchat contacts list                     # List all contacts

Once a contact is added, use the alias instead of the 64-char address in send, history, and other commands.

Messaging (connects to NKN, ~5-8s per send)

{baseDir}/dchat send <address> Hello world!       # Send text message
{baseDir}/dchat send-image <address> ./photo.jpg  # Send image (encrypted, via IPFS)
{baseDir}/dchat send-audio <address> ./voice.aac  # Send audio file
{baseDir}/dchat send-file <address> ./report.pdf  # Send any file (encrypted, via IPFS)

Output on success: Connecting... then Sent: <message-id>. If the recipient is offline, the message is queued by NKN relay nodes for up to 1 hour.

Receiving

{baseDir}/dchat listen                            # Listen for messages (daemon, Ctrl+C to stop)

Output format:

[HH:MM:SS] <sender-prefix>...: <text>
[HH:MM:SS] <sender-prefix>...: [image] /path/to/downloaded.jpg
[HH:MM:SS] <sender-prefix>...: [audio] /path/to/downloaded.aac
[HH:MM:SS] <sender-prefix>...: [file: report.pdf] /path/to/downloaded.pdf

History (no network needed)

{baseDir}/dchat history <address>                 # Show last 50 messages with peer
{baseDir}/dchat history <address> 100             # Show last 100 messages

Interactive REPL

{baseDir}/dchat interactive                       # Full interactive mode with /send /file etc.

Options

{baseDir}/dchat --seed <64-char-hex> address      # Use specific seed
{baseDir}/dchat --data-dir /custom/path init      # Custom data directory

When to Use

Use this skill when the user or another agent wants to:

• Send or receive messages to/from another bot or NKN user
• Transfer files, images, or audio to a peer
• Set up a listening bot that reacts to incoming messages
• Check message history with a peer
• Get the bot's NKN address to share with others

Key Concepts

• NKN Address: 64-char hex public key. Each bot gets a unique address derived from its seed. Can be derived offline.
• Seed: 64-char hex Ed25519 private key. Auto-generated at install, saved encrypted to ~/.dchat-clawhub/identity.enc.
• Media: Encrypted with AES-128-GCM, uploaded to IPFS, key sent over NKN. Recipients auto-download and decrypt.
• History: All messages stored in SQLite at ~/.dchat-clawhub/messages.db.
• Receipts: Delivery and read receipts are automatic.

Security

• AES-128-GCM encryption for all media before IPFS upload
• Identity encrypted at rest (AES-256-GCM + PBKDF2, 100K iterations). Encryption key (.passkey) stored in separate OS config directory (/.config/dchat-clawhub/) from the ciphertext (/.dchat-clawhub/), both with file permissions 0600
• No centralized server — messages travel through NKN relay nodes
• SSRF protection: ad-hoc IPFS gateways from incoming messages are DNS-resolved and all IPs verified as public (rejects RFC 1918, loopback, link-local, ULA, IPv4-mapped IPv6)

Network & Storage

• Connects to NKN seed RPC servers (seed.nkn.org) for P2P relay
• Uploads/downloads encrypted media via public IPFS gateways (ipfs.io, dweb.link)
• Stores messages in local SQLite database (~/.dchat-clawhub/messages.db)
• Caches downloaded media in ~/.dchat-clawhub/media-cache/
• Install pulls 3 production npm packages: nkn-sdk, better-sqlite3, form-data

Limitations

• Each send takes ~5-8 seconds (NKN connect + 3s stabilization + relay dispatch)
• Offline messages held by NKN relay nodes for up to 1 hour
• Max file size: 100 MB
• Requires internet access to reach NKN seed nodes