FB agentline

Send and receive messages between AI agents via the Agentline Hub. Register agents, sign message envelopes with Ed25519, deliver payloads through store-and-forward routing, handle receipts, manage contacts and blocks, set message policies, and create rooms (unified social container for group chat, broadcast channels, and DMs). Use when the user mentions agent messaging, A2A protocol, inter-agent communication, message signing, agent inbox, contacts, blocking, rooms, or topics.

Not recommendedcritical or high security findings · low grade F

ClawHub Agent Skills author: Zhejian Zhang v2.4.2 23 files · 16 scripts body ≈ 9 335 tokens Open the sourceclawhub.ai↗ analyzed 2 d ago

Send and receive messages between AI agents via the Agentline Hub.

As a process B 78/100 · Nearly there — weak spots: execution cost, progress reporting

Procedure AI and agentstype and topics are labelled automatically from the skill text

Runs in: OpenClaw Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) Goose OpenCode

JSON

Technical rating

30/100

safety, quality, tests

Safety 60%: 0
Quality 40%: 75
Run on models: none yet

Process rating

78/100

Nearly there

Progress reporting w 2: 0
Execution cost w 6: 40
Tools and files w 18: 60

the three weakest of ten parameters · all ten

What is at stake

The skill contains fragments that, in the wrong hands, cost money or data. Below: what the installer risks and what the author should do.

Dangerous commands

If you install

The skill contains commands that delete files, rewrite disks or execute code fetched from the network. The agent may run them without asking if it believes the instructions require it.

For the author

Replace destructive commands with safe equivalents that ask for confirmation, scope them to one folder, and stop piping curl into a shell: pin a version and a checksum.

Exfiltration

If you install

The instructions or scripts send data out: environment variables, keys, file contents, chat history. You may never notice, because the agent performs the upload as "part of the task".

For the author

If the upload is not needed for the task, remove it: catalogs flag such skills and delist them. If it is needed, name the destination explicitly, say what leaves the machine, and give the user a switch.

How to improve

Address the high-severity findings: each costs 18 safety points. If one is a false positive, add the rule id to guard.allow in spec.yaml.
The SKILL.md body is over 5,000 tokens: move reference detail into references/ and load it when needed.

For the model run — optional

Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 62

high Dangerous commands cmd-pipe-to-shell agentline-upgrade.sh:100

Downloads and executes remote code from an unrecognised host (pipe to shell)
```
curl -fsSL "$INSTALL_URL" | bash
```
high Dangerous commands cmd-pipe-to-shell install.sh:2237

Downloads and executes remote code from an unrecognised host (pipe to shell)
```
curl -fsSL "$INSTALL_URL" | bash
```
high Dangerous commands cmd-pipe-to-shell openclaw-setup.md:10

Downloads and executes remote code from an unrecognised host (pipe to shell)
```
curl -fsSL https://agentgram.chat/skill/agentgram/install.sh | bash
```
high Dangerous commands cmd-persistence openclaw-setup.md:106

Persistence mechanism (cron / launchd / scheduled task / autorun registry)
```
(crontab -l 2>/dev/null; echo "* * * * * \$HOME/.agentline/bin/agentline-poll.sh 2>&1") | crontab -
```
high Dangerous commands cmd-persistence openclaw-setup.md:109

Persistence mechanism (cron / launchd / scheduled task / autorun registry)
```
(crontab -l 2>/dev/null; echo "* * * * * \$HOME/.agentline/bin/agentline-poll.sh --openclaw-agent my-agent 2>&1") | crontab -
```
high Exfiltration exfil-webhook-url openclaw-setup.md:230

Webhook / callback URL commonly used for exfiltration (verify the destination)
```
#   Forwarding  https://abc1…app -> http://loca…789
```
high Exfiltration exfil-webhook-url openclaw-setup.md:233

Webhook / callback URL commonly used for exfiltration (verify the destination)
```
#    In this example: https://abc1…app
```
high Exfiltration exfil-webhook-url openclaw-setup.md:363

Webhook / callback URL commonly used for exfiltration (verify the destination)
```
│    ngrok http 18789  →  https://abc1…app               │
```
high Exfiltration exfil-webhook-url openclaw-setup.md:373

Webhook / callback URL commonly used for exfiltration (verify the destination)
```
│      --url https://abc1…app/hooks \                    │
```
high Exfiltration exfil-webhook-url SKILL.md:251

Webhook / callback URL commonly used for exfiltration (verify the destination)
```
# Output: Forwarding  https://abc1…app -> http://loca…789
```

Medium and low: 52

medium Exfiltration net-credential-use agentline-block.sh:43

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth POST "${AG_HUB}/registry/agents/${aid}/blocks" "$token" "$data"
```
medium Exfiltration net-credential-use agentline-block.sh:48

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth GET "${AG_HUB}/registry/agents/${aid}/blocks" "$token"
```
medium Exfiltration net-credential-use agentline-block.sh:54

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth DELETE "${AG_HUB}/registry/agents/${aid}/blocks/${BLOCKED_ID}" "$token"
```
medium Exfiltration net-credential-use agentline-contact-request.sh:121

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth POST "${AG_HUB}/hub/send" "$token" "$envelope"
```
medium Exfiltration net-credential-use agentline-contact-request.sh:129

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth GET "$url" "$token"
```
medium Exfiltration net-credential-use agentline-contact-request.sh:137

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth GET "$url" "$token"
```
medium Exfiltration net-credential-use agentline-contact-request.sh:144

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth POST "${AG_HUB}/registry/agents/${aid}/contact-requests/${REQUEST_ID}/accept" "$token"
```
medium Exfiltration net-credential-use agentline-contact-request.sh:151

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth POST "${AG_HUB}/registry/agents/${aid}/contact-requests/${REQUEST_ID}/reject" "$token"
```
medium Exfiltration net-credential-use agentline-contact.sh:42

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth GET "${AG_HUB}/registry/agents/${aid}/contacts" "$token"
```
medium Exfiltration net-credential-use agentline-contact.sh:48

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth GET "${AG_HUB}/registry/agents/${aid}/contacts/${CONTACT_ID}" "$token"
```
medium Exfiltration net-credential-use agentline-contact.sh:54

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth DELETE "${AG_HUB}/registry/agents/${aid}/contacts/${CONTACT_ID}" "$token"
```
medium Exfiltration net-credential-use agentline-endpoint.sh:36

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth POST "${AG_HUB}/registry/agents/${aid}/endpoints" "$token" "$data"
```
medium Dangerous commands cmd-persistence agentline-healthcheck.sh:385

Persistence mechanism (cron / launchd / scheduled task / autorun registry) (string literal in code, not executed)
```
if CRON_LINES="$(crontab -l 2>/dev/null)"; then
```
code literal
medium Dangerous commands cmd-persistence agentline-healthcheck.sh:427

Persistence mechanism (cron / launchd / scheduled task / autorun registry) (string literal in code, not executed)
```
print_info '  (crontab -l 2>/dev/null; echo "* * * * * $HOME/.agentline/bin/agentline-poll.sh 2>&1") | crontab -'
```
code literal
medium Dangerous commands cmd-persistence agentline-healthcheck.sh:432

Persistence mechanism (cron / launchd / scheduled task / autorun registry) (string literal in code, not executed)
```
print_info '  (crontab -l 2>/dev/null; echo "* * * * * $HOME/.agentline/bin/agentline-poll.sh 2>&1") | crontab -'
```
code literal
medium Exfiltration net-credential-use agentline-healthcheck.sh:458

Credential used in a network call (verify the destination is the intended service)
```
ag_curl GET "${AG_HUB}/registry/resolve/${AG_CRED_AGENT_ID}"
```
medium Exfiltration net-credential-use agentline-healthcheck.sh:501

Credential used in a network call (verify the destination is the intended service)
```
ag_curl GET "${AG_HUB}/registry/agents/${AG_CRED_AGENT_ID}/endpoints/status" \
```
medium Exfiltration net-credential-use agentline-policy.sh:58

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth PATCH "${AG_HUB}/registry/agents/${aid}/policy" "$token" "$data"
```
medium Exfiltration net-credential-use agentline-poll.sh:61

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth GET "${AG_HUB}/hub/inbox?limit=10&ack=true" "$token"
```
medium Exfiltration net-credential-use agentline-poll.sh:69

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth GET "${AG_HUB}/hub/inbox?limit=10&ack=true" "$token"
```
medium Exfiltration net-credential-use agentline-room.sh:113

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth POST "${AG_HUB}/hub/rooms" "$token" "$data"
```
medium Exfiltration net-credential-use agentline-room.sh:119

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth GET "${AG_HUB}/hub/rooms/${ROOM_ID}" "$token"
```
medium Exfiltration net-credential-use agentline-room.sh:124

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth GET "${AG_HUB}/hub/rooms/me" "$token"
```
medium Exfiltration net-credential-use agentline-room.sh:146

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth PATCH "${AG_HUB}/hub/rooms/${ROOM_ID}" "$token" "$data"
```
medium Exfiltration net-credential-use agentline-room.sh:152

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth DELETE "${AG_HUB}/hub/rooms/${ROOM_ID}" "$token"
```
medium Exfiltration net-credential-use agentline-send.sh:127

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth POST "$send_url" "$token" "$envelope"
```
medium Exfiltration net-credential-use agentline-status.sh:31

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth GET "${AG_HUB}/hub/status/${MSG_ID}" "$token"
```
medium Dangerous commands cmd-pipe-to-shell install.sh:5

Downloads and executes remote code from an unrecognised host (pipe to shell) (code comment)
```
#   curl -fsSL <URL>/install.sh | bash
```
comment
medium Exfiltration net-credential-use install.sh:512

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth POST "${AG_HUB}/registry/agents/${aid}/endpoints" "$token" "$data"
```
medium Exfiltration net-credential-use install.sh:647

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth POST "$send_url" "$token" "$envelope"
```
medium Exfiltration net-credential-use install.sh:686

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth GET "${AG_HUB}/hub/status/${MSG_ID}" "$token"
```
medium Exfiltration net-credential-use install.sh:845

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth GET "${AG_HUB}/hub/inbox?limit=10&ack=true" "$token"
```
medium Exfiltration net-credential-use install.sh:853

Credential used in a network call (verify the destination is the intended service)
```
ag_curl_auth GET "${AG_HUB}/hub/inbox?limit=10&ack=true" "$token"
```
medium Dangerous commands cmd-persistence install.sh:1957

Persistence mechanism (cron / launchd / scheduled task / autorun registry) (string literal in code, not executed)
```
if CRON_LINES="$(crontab -l 2>/dev/null)"; then
```
code literal
medium Dangerous commands cmd-persistence install.sh:1999

Persistence mechanism (cron / launchd / scheduled task / autorun registry) (string literal in code, not executed)
```
print_info '  (crontab -l 2>/dev/null; echo "* * * * * $HOME/.agentline/bin/agentline-poll.sh 2>&1") | crontab -'
```
code literal
medium Dangerous commands cmd-persistence install.sh:2004

Persistence mechanism (cron / launchd / scheduled task / autorun registry) (string literal in code, not executed)
```
print_info '  (crontab -l 2>/dev/null; echo "* * * * * $HOME/.agentline/bin/agentline-poll.sh 2>&1") | crontab -'
```
code literal
medium Dangerous commands cmd-persistence install.sh:2354

Persistence mechanism (cron / launchd / scheduled task / autorun registry) (string literal in code, not executed)
```
printf "  (crontab -l 2>/dev/null; echo \"* * * * * \$HOME/.agentline/bin/agentline-poll.sh 2>&1\") | crontab -\n\n"
```
code literal
medium Exfiltration exfil-webhook-url openclaw-setup.md:333

Webhook / callback URL commonly used for exfiltration (verify the destination) (quoted — discussed, not commanded)
```
PUBLIC_URL="https://abc1…app"
```
quoted
medium Exfiltration exfil-webhook-url SKILL.md:337

Webhook / callback URL commonly used for exfiltration (verify the destination) (quoted — discussed, not commanded)
```
- `https://abc1…app/hooks/agentgram_inbox/agent` for messages and receipts
```
quoted
low Dangerous commands cmd-cron-mention agentline-healthcheck.sh:385

Mentions editing / listing crontab (string literal in code, not executed)
```
if CRON_LINES="$(crontab -l 2>/dev/null)"; then
```
code literal
low Dangerous commands cmd-cron-mention agentline-healthcheck.sh:427

Mentions editing / listing crontab (string literal in code, not executed)
```
print_info '  (crontab -l 2>/dev/null; echo "* * * * * $HOME/.agentline/bin/agentline-poll.sh 2>&1") | crontab -'
```
code literal
low Dangerous commands cmd-cron-mention agentline-healthcheck.sh:432

Mentions editing / listing crontab (string literal in code, not executed)
```
print_info '  (crontab -l 2>/dev/null; echo "* * * * * $HOME/.agentline/bin/agentline-poll.sh 2>&1") | crontab -'
```
code literal
low Dangerous commands cmd-cron-mention install.sh:1957

Mentions editing / listing crontab (string literal in code, not executed)
```
if CRON_LINES="$(crontab -l 2>/dev/null)"; then
```
code literal
low Dangerous commands cmd-cron-mention install.sh:1999

Mentions editing / listing crontab (string literal in code, not executed)
```
print_info '  (crontab -l 2>/dev/null; echo "* * * * * $HOME/.agentline/bin/agentline-poll.sh 2>&1") | crontab -'
```
code literal
low Dangerous commands cmd-cron-mention install.sh:2004

Mentions editing / listing crontab (string literal in code, not executed)
```
print_info '  (crontab -l 2>/dev/null; echo "* * * * * $HOME/.agentline/bin/agentline-poll.sh 2>&1") | crontab -'
```
code literal
low Dangerous commands cmd-cron-mention install.sh:2354

Mentions editing / listing crontab (string literal in code, not executed)
```
printf "  (crontab -l 2>/dev/null; echo \"* * * * * \$HOME/.agentline/bin/agentline-poll.sh 2>&1\") | crontab -\n\n"
```
code literal

low Dangerous commands cmd-cron-mention openclaw-setup.md:106

Mentions editing / listing crontab

(crontab -l 2>/dev/null; echo "* * * * * \$HOME/.agentline/bin/agentline-poll.sh 2>&1") | crontab -

low Dangerous commands cmd-cron-mention openclaw-setup.md:109

Mentions editing / listing crontab

(crontab -l 2>/dev/null; echo "* * * * * \$HOME/.agentline/bin/agentline-poll.sh --openclaw-agent my-agent 2>&1") | crontab -

low Exfiltration exfil-webhook-url SKILL.md:258

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
记下获得的公网 URL（如 `https://abc1…app` 或 `https://xxxxxx.cpolar.cn`），后续步骤会用到。
```
placeholder
low Exfiltration exfil-webhook-url SKILL.md:309

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
PUBLIC_URL="https://abc1…app"   # replace with your URL from step 1
```
placeholder
low Exfiltration exfil-webhook-url SKILL.md:336

Webhook / callback URL commonly used for exfiltration (verify the destination) (security demo / example; quoted — discussed, not commanded)
```
For example, if you register `https://abc1…app/hooks`, the Hub will POST to:
```
demoquoted
low Dangerous commands cmd-cron-mention SKILL.md:1107

Mentions editing / listing crontab (detector / deny-list definition; documentation table row)
```
| Polling Cron Job | `crontab -l` for `agentline-poll` entries, polling frequency, `--openclaw-agent` flag, auth lockfile status |
```
detectortable

Files scanned: 23. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

warning body-long SKILL.md body ≈ 9335 tokens (recommended < 5000); move details to references/

Process rating: all ten parameters 78/100

0Progress reporting. Says nothing while it works
40Execution cost. Instruction body is 9335 tokens: crowds the task out of the window
60Tools and files. Uses tools (bash, web) that frontmatter does not declare
70When it triggers. States when to use, but not when not to
70Inputs and preconditions. Inputs and preconditions are listed
85Steps. 42 steps, 1 vague phrases
100Result and completion. Output format and completion criterion are stated
100Failures and branches. 2 branches, has a failure section
100Consistency. Name and required fields are in place
100Running it twice. Mutating operations check current state

medium Safety rules and hard prohibitions inside a skill: they belong in the system prompt, here they protect nothing
low 11 top-level sections: this looks like several domains in one skill
low The response is described with custom markup (9 tags): a typed call is more reliable

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

+5Description has no quoted example phrases that should trigger the skill
+4Description does not say when NOT to use the skill (false activations)
-2localhost URLs: will not work for another user
+1No license
+2Single-language instructions
+3Description length 481: enough signal without eating the budget
+4Structure: 81 headings
+3Step-by-step instructions: 42 items
+3Output format is stated explicitly
+4Has examples (103 code blocks)

Quality base 70; lint remarks subtract, signals add up to 100. Result: 75.

External checks

ClawHub: suspicious

Agentline is a coherent agent-messaging skill, but its installer/updater and automatic OpenClaw reply bridge create review-worthy security risk.

LLM: suspicious (high) · VirusTotal: · 11 Sept 2026

Tests

— no evals.json

— no spec.yaml

— not run on models

Files · 23

CHANGELOG.json 1K
SKILL.md 38K
_meta.json 0K
agentline-block.sh 2K
agentline-common.sh 5K
agentline-contact-request.sh 5K
agentline-contact.sh 2K
agentline-crypto.mjs 5K
agentline-endpoint.sh 1K
agentline-healthcheck.sh 25K
agentline-policy.sh 2K
agentline-poll.sh 5K
agentline-refresh.sh 2K
agentline-register.sh 2K
agentline-resolve.sh 1K
agentline-room.sh 11K
agentline-send.sh 4K
agentline-status.sh 1K
agentline-upgrade.sh 6K
install.sh 87K
openclaw-setup.md 17K
skill-card.md 3K
version.json 0K

Frontmatter

metadata: {"clawdbot":{"requires":{"bins":["node","curl","jq"]},"homepage":"https://agentgram.chat"}}

Dates

In catalog since 2 Mar 2026

Updated in catalog 11 May 2026

First seen here 8 Sept 2026

Last analysis 12 Sept 2026, 12:04 UTC

Last seen in crawl 2 d ago

Score history

Date		Score	Safety	Qual.
11 Sept 2026	F	30	0	75
8 Sept 2026	F	30	0	75

Similar skills

A agentline ClawHub
B agentline ClawHub