ashp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ashp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Inter-agent communication protocol for the Appie family
ASHP is a lightweight secure communication protocol that allows Appie instances to:
┌─────────────────────────────────────────────────────────────┐
│ Appie Family Network │
├─────────────────────────────────────────────────────────────┤
│ │
│ ┌─────────┐ ASHP Handshake ┌─────────┐ │
│ │ Appie-1 │ ◄──────────────────► │ Appie-2 │ │
│ │ (Mac) │ API Key Exchange │ (DO) │ │
│ └─────────┘ └─────────┘ │
│ │ │ │
│ └───────────── ASHP ──────────────┘ │
│ Tunnel │
└─────────────────────────────────────────────────────────────┘Each Appie instance has a unique API key configured in ~/.openclaw/openclaw.json:
{
"ashp": {
"api_key": "<agent-api-key>",
"allowed_keys": [
"<peer-api-key-1>",
"<peer-api-key-2>"
],
"timeout_ms": 30000
}
}Step 1: Appie-1 initiates
→ POST /api/ashp/handshake
→ { "to": "appie-2", "from": "appie-1", "key_id": "<key-id>" }
Step 2: Appie-2 validates and responds
→ Returns: { "status": "accepted", "session_id": "sess_abc123" }
Step 3: Appie-1 confirms
→ POST /api/ashp/confirm
→ { "session_id": "sess_abc123", "signature": "sha256(...)" }
Step 4: Secure tunnel established
→ All subsequent messages include session_idInitiate secure handshake with another Appie.
Request:
{
"to": "appie-2",
"from": "appie-1",
"key_id": "<key-id>"
}Response:
{
"status": "accepted" | "denied",
"session_id": "sess_xyz789",
"expires_at": "2026-02-15T08:00:00Z"
}Confirm handshake and establish session.
Request:
{
"session_id": "sess_xyz789",
"signature": "sha256(session_id + <api-key>)"
}Send encrypted message through established session.
Request:
{
"session_id": "sess_xyz789",
"to": "appie-2",
"message": "base64_encrypted_message",
"timestamp": "2026-02-15T01:00:00Z"
}Close active session.
Request:
{
"session_id": "sess_xyz789"
}# Initiate handshake
curl -X POST "http://localhost:8080/api/ashp/handshake" \
-H "Content-Type: application/json" \
-d '{"to":"appie-2","from":"appie-1","key_id":"appie-1-abc123"}'
# Send secure message
curl -X POST "http://localhost:8080/api/ashp/message" \
-H "Content-Type: application/json" \
-d '{"session_id":"sess_xyz789","to":"appie-2","message":"SGVsbG8gQXBwaWUh"}'Add to ~/.openclaw/openclaw.json:
{
"ashp": {
"api_key": "your-appie-key-here",
"allowed_keys": ["list", "of", "allowed", "keys"],
"timeout_ms": 30000,
"log_file": "/Users/seyed/.openclaw/logs/ashp.log"
}
}This protocol is available as a OpenClaw skill:
# Enable ASHP skill
openclaw skill enable ashp
# View handshake status
openclaw ashp status
# List active sessions
openclaw ashp sessions| Issue | Solution |
|---|---|
| Handshake rejected | Verify API key is in allowed_keys of recipient |
| Session expired | Re-initiate handshake |
| Message failed | Check session is still active |
/Users/seyed/clawd/skills/ashp/~/.openclaw/openclaw.json → ashp section~/.openclaw/logs/ashp.log~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.