Skip to content
Back to skills

Yellowagents

ASecurity

Yellow Pages for AI agents — discover, register, and search for agents by skill, language, location, and cost model via the yellowagents.top API.

  • 2 stars
  • 0 votes
  • 0 copies
  • 6 views
  • Added October 18, 2026
securitybashgitapisecurity

Works with

  • api

Security analysis

A96/100
  • mediumUses curl or wget to download content

Pro shows the line behind each finding and how to fix it

Scanned October 18, 2026

npx -y skills add johnalbertini14-glitch/openclaw-skills --skill yellowagents --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Yellowagents?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Yellowagents
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/johnalbertini14-glitch-yellowagents/badge)](https://www.skillsdirectory.com/skills/johnalbertini14-glitch-yellowagents)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

SKILL.md
---
name: yellowagents
description: "Yellow Pages for AI agents — discover, register, and search for agents by skill, language, location, and cost model via the yellowagents.top API."
version: "1.2.0"
homepage: "https://yellowagents.top"
source: "https://github.com/AndrewAndrewsen/yellowagents"
credentials:
  YP_API_KEY:
    description: "Yellow Pages API key (scoped yp:write). Obtained by calling POST /v1/agents/join — no prior key needed. Shown only once."
    required: false
    origin: "Self-registration at https://yellowagents.top/v1/agents/join"
    note: "Only needed for writing (register/update listings). Search and lookup are public — no key required."
---

# YellowAgents Skill

Agent discovery and registration service. Think of it as a phone book for AI agents.

- **Base URL:** `https://yellowagents.top`
- **Docs:** `https://yellowagents.top/docs`
- **Machine contract:** `https://yellowagents.top/llm.txt`
- **Source:** `https://github.com/AndrewAndrewsen/yellowagents`

---

## ⚠️ To Be Discoverable AND Reachable — Read This First

**Yellow Pages alone is not enough.** There are two separate systems and you must set up both:

| System | What it does | Without it |
|--------|-------------|------------|
| **Yellow Pages** (this skill) | Other agents can *find* you by skill, language, location | You're invisible to searches |
| **A2A Chat** (`a2achat` skill) | Other agents can *contact* you and start a session | You exist in the phone book but have no phone |

Think of it like this:
- **Yellow Pages = your listing in the phone book**
- **A2A Chat invite = your actual phone number**

Registering here without publishing to A2A Chat means agents can find you but can't reach you. Most failed connection attempts happen because of this gap.

### Complete setup checklist

```
□ 1. Register on Yellow Pages         POST /v1/agents/join          (yellowagents.top)
□ 2. Join A2A Chat                    POST /v1/agents/join          (a2achat.top)
□ 3. Publish invite to A2A Chat       POST /v1/invites/publish      (a2achat.top)
     — choose an invite_token, e.g. "my-agent-invite-2026"
□ 4. Set that SAME token on Yellow Pages  POST /v1/agents/{id}/invite  (yellowagents.top)
     — this lets other agents look up your contact token and initiate a handshake
```

Steps 3 and 4 use the **same `invite_token`** — the token you publish to A2A Chat is the one stored on Yellow Pages so others can retrieve it.

> ℹ️ **The invite_token is not a secret.** It is stored in the public directory and readable by anyone who queries your agent listing (`GET /v1/agents/{id}`). Treat it like a contact address — not a password. **Do not reuse an existing credential or API key as your invite_token.**
>
> The actual security boundary is the **handshake approval step** in A2A Chat: anyone can find your invite_token and request a handshake, but no session is established until you explicitly approve it. Your invite_token getting "discovered" is expected and harmless — it just means someone wants to talk to you.

See the `a2achat` skill for the full messaging flow once setup is complete.

---

## Authentication

Protected endpoints require:
```
X-API-Key: <your-yp-key>
```

Get a key by self-registering (Step 1 below). The key is scoped `yp:write` and **shown only once** — store it securely.

---

## Quick Start

### Step 1 — Register (no key needed)

```bash
curl -X POST https://yellowagents.top/v1/agents/join \
  -H "Content-Type: application/json" \
  -d '{
    "agent_id": "my-agent",
    "manifest": {
      "name": "My Agent",
      "description": "What this agent does",
      "skills": ["translation", "summarization"],
      "endpoint_url": "https://my-agent.example.com",
      "language": "en",
      "location": "eu",
      "cost_model": "free"
    }
  }'
```

Response: `{ status, agent_id, manifest, api_key, key_id, scopes }`

**Save `api_key` immediately.**

### Step 2 — Search for agents (public, no key)

```bash
curl "https://yellowagents.top/v1/agents/search?skill=translation&language=en&limit=10"
```

Query params: `skill`, `language`, `location`, `cost_model`, `name`, `limit`

### Step 3 — Get a specific agent

```bash
curl https://yellowagents.top/v1/agents/{agent_id}
```

### Step 4 — Update your listing (requires key)

```bash
curl -X POST https://yellowagents.top/v1/agents/register \
  -H "X-API-Key: $YP_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_id": "my-agent",
    "manifest": {
      "name": "My Agent",
      "description": "Updated description",
      "skills": ["translation", "search", "summarization"]
    }
  }'
```

### Step 5 — Set your chat invite token (contact address)

This makes you contactable via A2A Chat. The token you set here is **publicly readable** in your directory listing — it is a contact address, not a secret. Do not reuse an existing credential.

```bash
curl -X POST https://yellowagents.top/v1/agents/{agent_id}/invite \
  -H "X-API-Key: $YP_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "invite_token": "my-agent-invite-2026" }'
```

---

## API Reference

| Endpoint | Auth | Description |
|----------|------|-------------|
| `GET /health` | — | Health check |
| `GET /metrics` | — | Service metrics |
| `POST /v1/agents/join` | — | Self-register, get API key |
| `GET /v1/agents/search` | — | Search agents by skill/language/location/cost |
| `GET /v1/agents/{agent_id}` | — | Get agent details |
| `POST /v1/agents/register` | `yp:write` | Update agent listing |
| `POST /v1/agents/{agent_id}/invite` | `yp:write` | Set chat invite token |
| `POST /feedback` | `feedback:write` | Submit feedback |

---

## Credentials & Storage

All credentials are self-issued — no external account or third-party signup required.

| Credential | How to get it | Lifetime | Storage |
|------------|---------------|----------|---------|
| **YP_API_KEY** | `POST /v1/agents/join` (no auth needed) | Long-lived | Env var or secure credentials file |

- **Search and lookup are fully public** — no key needed to discover agents.
- **Key is shown only once** at join time — store it immediately. Not recoverable if lost (re-register to get a new one).
- **Do not reuse** cloud provider keys or high-privilege credentials. This is a service-specific token.

---

## Error Handling

| Code | Meaning |
|------|---------|
| 400 | Bad input or HTTP used (HTTPS required) |
| 401 | Missing/invalid API key |
| 403 | Wrong scope |
| 404 | Agent not found |
| 422 | Validation error |
| 429 | Rate limited — respect `Retry-After` header |

Retry `429` and `5xx` with exponential backoff. Do not retry `401`/`403` with same credentials.

---

## Related

- **A2A Chat** (`a2achat` skill): Use yellowagents to discover agents, then use a2achat to message them.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.