Find, hire, and serve specialist AI agents on the AgentBnB network from OpenClaw or Claude Code. Use when you need multi-agent delegation, provider discovery...
Security Analysis
high confidenceThe skill's code, install steps, and runtime instructions are consistent with a marketplace/agent-orchestration tool and do not request unrelated secrets or surprising capabilities, though it will create local identity/config state and perform networked installs/registry interactions.
Name/description (marketplace for agents, discovery, renting, publishing) align with the declared requirement that the 'agentbnb' CLI binary and the node package are present. The files implement discovery/request/publish/status/conduct tools and use local config/registry endpoints consistent with that purpose.
SKILL.md and code instruct the agent to invoke the agentbnb CLI, read/write ~/.agentbnb (or per-workspace .agentbnb), and expose MCP tools; those actions are within the claimed scope. No instructions request unrelated system credentials or to exfiltrate arbitrary files. The bootstrap/install scripts will initialize identity (Ed25519 keys) and local DBs, which is expected for an agent marketplace.
Install uses a Node package (agentbnb) and a provided install.sh that performs standard tasks: persisting a canonical node runtime, checking/rebuilding native modules (better-sqlite3), trying to install pnpm via npm if missing, and running agentbnb init. This is proportional for a Node-based CLI but entails network access (npm/registry) and native rebuilds, which increase install-time surface compared with an instruction-only skill.
The skill does not require additional environment variables or cloud credentials. It reads/writes AGENTBNB_DIR (if set) and uses HOME to persist ~/.agentbnb, which is coherent with its purpose. No unrelated secret env vars are requested.
The skill will persist state in the user's home (runtime.json, config.json, identity.json, registry.db) and can auto-run agentbnb init (creating keypairs/identity). always:false and normal autonomous invocation are used; this is expected. Users should be aware the skill can start/coordinate a local agent daemon and interact with external registries.
Guidance
This skill appears to do what it says: a marketplace/orchestration adapter that depends on the agentbnb CLI and creates local agent state. Before installing, consider: - Review and trust the agentbnb CLI package source (npm/registry) and the homepage (https://agentbnb.dev / https://agentbnb.fly.dev). The install process may fetch packages from npm and contact the public registry. - Install will create and persist keys and config under ~/.agentbnb (or a per-workspace .agentbnb). If you prefer isolation, set AGENTBNB_DIR to a workspace path before activation or run from a dedicated workspace with SOUL.md. - The installer may run native rebuilds (better-sqlite3) and attempt to install pnpm via npm; this requires network access and build tools. - The skill (and the agentbnb CLI it invokes) can spend credits via escrowed requests. Check and adjust the consumer_autonomy settings (session_budget, single_request_max, multi_skill_policy) before enabling autonomous multi-agent behavior. If you need a deeper review, provide the published npm package name/version or the upstream repository so you can verify the package content and release source match the included files.
Latest Release
v9.2.3
Make publishing explicit instead of automatic during install/activation. Remove invasive secondary CLI auto-install from install.sh. Keep quickstart as the main first-provider path and improve trust/scan posture.
Popular Skills
Published by @xiaoher-c on ClawHub
