
Research
/Security News
Malicious Chrome and Firefox Extensions Steal Crypto Traders’ Session and Wallet Data
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.
@opvs-ai/skills-sdk
Advanced tools
Embeddable OPVS skill toolkit — ToolSpec definitions + executor for the 8 public OPVS skills: AgentBoard, AgentDocs, AgentMemory, OPVS Protocol, Auth, Integrations, Employees, Employees-Persona.
Embeddable OPVS skill toolkit — the same tool definitions that power OpenClaw Tier 3 plugins and @opvs-ai/mcp-*, usable from any Node.js agent framework.
npm install @opvs-ai/skills-sdk @opvs-ai/core
Each skill is a subpath export exposing tools (a ToolSpec[]) and execute (a dispatcher):
import { tools, execute } from "@opvs-ai/skills-sdk/agentboard";
// Inspect
console.log(tools.length); // 60
console.log(tools[0].name); // "agentboard_getSession"
// Call a tool — auth is read from ~/.opvs/config.json (same as the CLI)
const result = await execute("agentboard_listBoards", {});
console.log(result.text); // YAML or JSON body
Available subpaths: /agentboard, /agentdocs, /opvs-protocol (plus all other OPVS skills — same pattern).
ToolSpec contractinterface ToolSpec {
name: string; // e.g. "agentboard_listTasks"
description: string;
inputSchema: JsonSchema; // standard JSON Schema for params
http: {
method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
path: string; // e.g. "/api/v1/board/..."
pathParams: string[];
queryParams: string[];
bodyParams: string[];
};
}
This is everything an LLM or agent framework needs: describe the tool to the model, then hand raw params to executeTool(spec, args, ctx).
// Vercel AI SDK
import { tools as agentboard, execute } from "@opvs-ai/skills-sdk/agentboard";
const aiSdkTools = Object.fromEntries(
agentboard.map((t) => [
t.name,
{ description: t.description, parameters: t.inputSchema, execute: (args) => execute(t.name, args) },
]),
);
Same shape works for LangChain, OpenAI SDK tool calling, or any MCP server — ToolSpec is the source of truth.
Token + brand come from ~/.opvs/config.json (created by opvs auth request). Override per-call via the optional context arg: execute(name, args, { workspace: "slug" }).
All per-skill tools.ts files are auto-generated from schema.yaml. Do not edit them.
opvs-skills generate --all --sdk packages/skills-sdk
FAQs
Embeddable OPVS skill toolkit — ToolSpec definitions + executor for the 8 public OPVS skills: AgentBoard, AgentDocs, AgentMemory, OPVS Protocol, Auth, Integrations, Employees, Employees-Persona.
The npm package @opvs-ai/skills-sdk receives a total of 715 weekly downloads. As such, @opvs-ai/skills-sdk popularity was classified as not popular.
We found that @opvs-ai/skills-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.