技能详情（站内镜像，无评论）
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v1.0.0
统计：⭐ 0 · 248 · 0 current installs · 0 all-time installs
⭐ 0
安装量（当前） 0
🛡 VirusTotal ：可疑 · OpenClaw ：良性
Package：ai-headhunter/pinch
安全扫描（ClawHub）
- VirusTotal ：可疑
- OpenClaw ：良性
OpenClaw 评估
The skill's requirements, runtime instructions, and install behavior are coherent with its advertised purpose (agent-to-agent encrypted messaging), but the package/source provenance is not fully proven and the skill will create locally stored private keys and global CLI binaries — verify the publisher before installing.
目的
The skill name/description (encrypted agent messaging) matches the declared requirements: node runtime, a relay URL, and a keypair path. The listed CLI tools and features in SKILL.md (connect, send, accept, audit-verify, intervene, autonomy, etc.) align with the npm package that the install spec provides. There are no unrelated cloud credentials or unexpected services requested. Minor inconsistency: registry metadata shows no homepage/source, …
说明范围
SKILL.md only instructs the agent/operator to install the npm package, set relay and keypath environment variables (with sensible defaults), generate and store an Ed25519 keypair under ~/.pinch (or PINCH_KEYPAIR_PATH), register with the relay via a claim page, and run the provided CLI tools. The instructions reference local storage (keypair and a SQLite data directory) and the relay URL; they do not direct the agent to read arbitrary system fi…
安装机制
The install uses a namespaced npm package (@pinch-protocol/skill) which will install multiple global CLI binaries. NPM installs are a common delivery method for CLI tools and are proportionate for this use case, but they carry moderate risk compared to instruction-only skills because they write code/binaries to disk. The registry metadata lacked an authoritative homepage/source entry in the provided manifest (though SKILL.md references a GitHu…
证书
Only PINCH_RELAY_URL (primary) and PINCH_KEYPAIR_PATH are declared as required; SKILL.md additionally documents PINCH_DATA_DIR and PINCH_RELAY_HOST as optional with defaults. These environment variables are directly relevant: one points at the relay server, another controls where the agent's private key is stored, and the data dir is for the local SQLite store. No unrelated secrets (AWS, GitHub tokens, etc.) are requested. Important: the keypa…
持久
always is false and the skill does not request system-wide privileges. The install will create global CLI binaries (npm -g) which adds executables to PATH — normal for a CLI-based skill but something to be aware of. The skill does not claim to modify other skills or system-wide agent settings beyond installing its own binaries and writing data to the specified data/key directories.
综合结论
This skill appears internally consistent for encrypted agent messaging, but confirm the package and relay operator before installing. Recommended checks before proceeding: 1) Verify the npm package (@pinch-protocol/skill) publisher and review the package page and its GitHub repo (SKILL.md links to https://github.com/pinch-protocol/pinch) to ensure source matches the package. 2) Inspect the package contents or repository (or run installation in…
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「Pinch: Claw to Claw Encrypted Messaging」。简介：Secure agent-to-agent encrypted messaging via the Pinch protocol. Send and rece…。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/ai-headhunter/pinch/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
暂无本地缓存内容，可在后台执行详情同步。