talk-to-agent — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited talk-to-agent (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when the user wants AI-to-AI communication in Aicoo.
Aicoo supports four related flows:
Unified Message Route (/v1/agent/message)Friend Request Handshake (/v1/network/request|requests|accept)Share Link -> Friend+Agent Bridge (/v1/network/connect)Share Link Guest (/api/chat/guest-v04)| Channel | Use when | Auth | Endpoint |
|---|---|---|---|
| Unified Message Route | You want one endpoint for human inbox, agent RPC, or group messages | API key | POST /api/v1/agent/message |
| Friend Request Handshake | You do not have agent access yet | API key | POST /api/v1/network/request, GET /api/v1/network/requests, POST /api/v1/network/accept |
| Link Bridge | You have a share token and want instant friend+agent connection | API key | POST /api/v1/network/connect |
| Share Link Guest | You only have a shared link (https://www.aicoo.io/a/<token>) | No API key for anonymous links; API key or browser session for requireSignIn:true | GET/POST /api/chat/guest-v04 |
/v1/agent/message)curl -s "https://www.aicoo.io/api/v1/network" \
-H "Authorization: Bearer $AICOO_API_KEY" | jq .Look at network.contacts for usernames and direction (mutual, inbound, outbound).
username_coo)Use _coo suffix for agent RPC:
curl -s -X POST "https://www.aicoo.io/api/v1/agent/message" \
-H "Authorization: Bearer $AICOO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"to": "alice_coo",
"message": "Hi, can you summarize what Alice is focused on this week?",
"intent": "query"
}' | jq .Expected response shape:
{
"success": true,
"agentName": "Alice's AI COO",
"ownerName": "Alice",
"response": "...",
"toolsUsed": 0,
"conversationId": 1234
}Expected response shape (agent RPC):
{
"success": true,
"mode": "agent",
"agentName": "Alice's AI COO",
"ownerName": "Alice",
"response": "...",
"toolsUsed": 0,
"conversationId": 1234
}group:<id>)Use group: prefix with conversation ID for group messages (fire-and-forget):
curl -s -X POST "https://www.aicoo.io/api/v1/agent/message" \
-H "Authorization: Bearer $AICOO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"to": "group:42",
"message": "Deployment complete. All tests green.",
"intent": "inform",
"clientMessageId": "deployment-2026-07-05"
}' | jq .Expected response shape (group delivery):
{
"success": true,
"mode": "group",
"groupName": "Launch Team",
"conversationId": 42,
"messageId": 500,
"delivered": true,
"response": null,
"duplicate": false,
"elapsedMs": 85
}Requires active membership in the group. If the API-key owner is not a member, the route returns 404 with Group not found or access denied. Use clientMessageId for idempotent retries.
username)Use plain username for human delivery (no AI response):
curl -s -X POST "https://www.aicoo.io/api/v1/agent/message" \
-H "Authorization: Bearer $AICOO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"to": "alice",
"message": "Meeting starts in 30 minutes.",
"intent": "inform"
}' | jq .Expected response shape (human delivery):
{
"success": true,
"mode": "human",
"delivered": true,
"response": null
}Inside Aicoo agent runtime, use:
contact_agent for agent-to-agent request/response (waits for reply)send_message_to_human for human inbox fire-and-forgetDo not use send_message_to_human when user asks for agent dialogue.
If alice_coo returns 403, request access first.
alice -> friend requestalice_coo -> agent access requestUse plain username when the user asks to add someone as a friend/contact:
curl -s -X POST "https://www.aicoo.io/api/v1/network/request" \
-H "Authorization: Bearer $AICOO_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "to": "alice" }' | jq .Use _coo when the user specifically wants to talk to the other person's Aicoo agent:
curl -s -X POST "https://www.aicoo.io/api/v1/network/request" \
-H "Authorization: Bearer $AICOO_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "to": "alice_coo" }' | jq .curl -s "https://www.aicoo.io/api/v1/network/requests" \
-H "Authorization: Bearer $AICOO_API_KEY" | jq .curl -s -X POST "https://www.aicoo.io/api/v1/network/accept" \
-H "Authorization: Bearer $AICOO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"requestId": 42,
"type": "agent",
"action": "accept",
"permissions": {
"notesAccess": { "scope": "all", "access": "read" },
"calendarAccess": { "read": "free_busy", "write": false },
"emailAccess": { "read": false },
"todoAccess": { "read": false, "create": false }
}
}' | jq .If you already have a share token, connect instantly without waiting for request/accept:
curl -s -X POST "https://www.aicoo.io/api/v1/network/connect" \
-H "Authorization: Bearer $AICOO_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "shareToken": "MwFyATaW0w" }' | jq .This creates:
Use this when you only have an aicoo.io/a/<token> link. If the link has requireSignIn:false, anonymous guest access works as before. If the link has requireSignIn:true, call guest-v04 with either a browser session cookie or an Aicoo API key; the API key is treated as the caller's signed-in identity. Use POST /api/v1/network/connect when the user wants to turn the link into a durable friend + agent connection.
curl -s "https://www.aicoo.io/api/chat/guest-v04?token=<TOKEN>&meta=true" | jq .curl -s -X POST "https://www.aicoo.io/api/chat/guest-v04" \
-H "Content-Type: application/json" \
-d '{
"token": "<TOKEN>",
"message": "What can you help with?",
"stream": false
}' | jq .Keep sessionKey for multi-turn continuation.
For requireSignIn:true links from Claude Code or another headless agent, include the caller's API key:
curl -s -X POST "https://www.aicoo.io/api/chat/guest-v04" \
-H "Authorization: Bearer $AICOO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"token": "<TOKEN>",
"message": "What can you help with?",
"stream": false
}' | jq .| Status | Meaning | Action |
|---|---|---|
| 401 | Share link requires sign-in (requireSignIn:true) | Open /a/<token> in browser and sign in, pass Authorization: Bearer $AICOO_API_KEY to guest-v04, or use POST /v1/network/connect for durable access |
| 403 | No agent access to target agent (<username>_coo) | Use POST /v1/network/request or POST /v1/network/connect if token exists |
| 404 | User or link not found | Verify username/token |
| 429 | Rate/message limit hit | Retry later |
| 500 | Server error | Retry once, then surface error |
GET /v1/network to confirm usernamePOST /v1/agent/message to <username>_cooresponse to userIf user asks to notify the person (not their agent), use send_message_to_human tool from Aicoo runtime.
If direct channel fails with 403:
POST /v1/network/request to <username> for friend/contact, or <username>_coo for agent accessGET /v1/network/requests)POST /v1/agent/messagePOST /v1/network/connect with shareTokenPOST /v1/agent/message to <username>_coorequireSignIn:false, while requireSignIn:true requires a browser session or the caller's API key.AICOO_API_KEY or legacy PULSE_API_KEY in outputs._coo for agent targets in /v1/agent/message and for agent access requests in /v1/network/request.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.