Agent Network

What to consider before installing: - Network exposure: this skill will open a WebSocket server and HTTP API, broadcast on the LAN (255.255.255.255), and periodically contact external services (evomap.ai and Nostr). If you run it, it may reveal a node ID and service metadata to local peers and remote directories. - Automatic behavior: code performs auto-handshakes and auto-greetings and can share skill metadata automatically. If you need manual control over connections or sharing, this implementation is noisy. - Persistence: it writes files under ~/.openclaw (agent-nodeid, agent-network.db). Uninstalling won't necessarily remove those files unless you delete them. - Code quality / inconsistencies: examples include mismatched default ports (SKILL.md and some scripts show 18793 vs code 18794), duplicated/odd blocks in id-file handling, and a few small syntax/logic issues. Review package.json and dependencies before running npm install. - Suggested precautions: run in a sandboxed / isolated environment (VM or container) first, monitor outgoing network traffic, inspect package.json and node_modules, and consider disabling EvoMap/Nostr discovery or blocking access to external domains if you only want local P2P. If you need help auditing specific files (e.g., the EvoMap/Nostr interaction code or the SkillsManager publish/download handlers), provide them and I can point out exact lines of concern. - What would change the assessment: if the maintainer provided a config flag to completely disable external directory discovery/handshake by default (and documented it), and fixed the sloppy/inconsistent code paths, the risk would be reduced and the skill could be marked benign.