Call Fetch.ai Agentverse agents by address. Search the Agentverse marketplace, browse a curated catalog of top agents (Tavily Search, ASI1-Mini, DALL-E 3, Te...
Security Analysis
high confidenceThe skill's code, declared requirements, and runtime instructions are coherent with its stated purpose of calling Fetch.ai Agentverse agents; required env/binaries and installs are proportional, though it writes local state and spawns background processes which you should be aware of.
Name/description match the actual behavior: the scripts call Agentverse endpoints, send ChatMessages to agents, and return responses. The declared requirements (python3, AGENTVERSE_API_KEY) and install of uagents/uagents-core are appropriate for this purpose.
SKILL.md instructs the agent to run bundled scripts (catalog.py, search.py, call.py, fire.sh, result.sh). Those scripts perform network requests to agentverse.ai, create a local mailbox, and read/write local files (.seed in the skill directory; /tmp/fetch-agents-<user>-response.txt). This is expected for the skill but does expand scope to local file I/O and background process management.
Install specifies uagents and uagents-core packages (uv/pip). No arbitrary URL downloads or extract-from-unknown-host steps are present. This is consistent with the Python-based implementation.
Only AGENTVERSE_API_KEY is required and declared as the primary credential, which is reasonable. The code also optionally reads FETCH_AGENT_SEED (not declared) and persists/uses a local .seed file; this is functional for mailbox/identity persistence but worth noting because it creates a persistent local identity and can be overridden by an env var.
The skill does not request always:true and does not modify other skills. It does persist a seed file (./scripts/.seed path) and writes response files to /tmp, and fire.sh launches a background Python process (nohup + disown). These behaviors are normal for this kind of caller but mean the skill will leave local artifacts and background processes while waiting for agent responses.
Guidance
This skill appears to do exactly what it says: it needs AGENTVERSE_API_KEY, will install uagents and uagents-core, call agentverse.ai endpoints, and run bundled Python scripts. Before installing, consider: (1) Provide a scoped Agentverse API key you trust for mailbox registration; (2) the skill will create a .seed file in its directory (persistent agent identity) and a /tmp/fetch-agents-<youruser>-response.txt file for results; (3) when you call agents the skill spawns a background Python process (via nohup/disown) that will run for the call duration; (4) if you want to limit persistence or network exposure, inspect or run the scripts in an isolated environment or container, or supply a dedicated seed via the FETCH_AGENT_SEED env var. If any of these behaviors are unacceptable, do not install or run the skill until you review/modify the scripts.
Latest Release
v0.3.0
Stronger rules for natural-language UX: agent never shows bash commands to users
Popular Skills
Published by @steve-dusty on ClawHub
