A communication hub that routes messages between Claude and external channels such as Telegram and Lark, while storing conversations and checkpoints.

Use it to send replies, receive messages, fetch conversation history, query checkpoints, and manage message delivery.

It gives external messages one place to enter and leave the coding-agent session, reducing the need to handle each channel separately.

comm-bridge — Skill for Claude Code and Codex by zylos-ai/zylos-core

About the project

Zylos is open-source infrastructure that gives an AI agent persistent memory, scheduled activity, communication channels, and the ability to maintain and extend itself. Individuals and teams use it with Claude Code or Codex through Telegram, Lark, or a web console. Its catalogue add-ons define settings, instructions, and skills for operating the agent.

zylos-ai/zylos-core · 1,160 stars · on GitHub · zylos.ai

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add zylos-ai/zylos-core --skill comm-bridge

Clone the repo

git clone --depth 1 https://github.com/zylos-ai/zylos-core

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/zylos-ai/zylos-core/comm-bridge/github.svg)](https://agentmods.dev/skills/zylos-ai/zylos-core/comm-bridge)

Your own site

<a href="https://agentmods.dev/skills/zylos-ai/zylos-core/comm-bridge"><img src="https://agentmods.dev/badge/skills/zylos-ai/zylos-core/comm-bridge/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/zylos-ai/zylos-core/comm-bridge"><img src="https://agentmods.dev/badge/skills/zylos-ai/zylos-core/comm-bridge.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 117 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,152 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 3 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium Excessive Agency · line 81
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
medium Excessive Agency · line 84
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
medium Excessive Agency · line 84
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00117	$0.01152
Opus 5.5	$0.00047	$0.00461
Sonnet 5.5	$0.00023	$0.00230
Haiku 4.5	$0.00012	$0.00115

Measured 3d ago against content hash 22799d53a2d6, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

comm-bridge scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

The scan reads SKILL.md. This mod also ships 40 executable files (scripts/__tests__/c4-checkpoint-cli.test.js, scripts/__tests__/c4-config-runtime.test.js, scripts/__tests__/c4-control-cli.test.js, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/comm-bridge/SKILL.md · 95 lines

How it starts

The opening of the file, as written. The whole thing — 95 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Communication Bridge (C4)

Central message hub - ALL communication with Claude goes through C4.

Architecture

Web Console ──┐
Telegram    ───┼──► C4 Bridge ◄──► Claude
Lark        ───┘

Components

Script	Purpose	Reference
`c4-receive.js`	External → Claude (queue incoming messages)	c4-receive
`c4-send.js`	Claude → External (route outgoing messages)	c4-send
`c4-control.js`	System control plane (heartbeat, maintenance)	c4-control
`c4-dispatcher.js`	PM2 daemon: polls pending queue, delivers to tmux	—
`c4-session-init.js`	Hook (session start): context + Memory Sync trigger	hooks
`c4-fetch.js`	Fetch conversations by id range or time	c4-fetch
`c4-db.js`	Database module and CLI for querying conversations and checkpoints	c4-db
`c4-checkpoint.js`	Create/query checkpoints (sync boundaries)	c4-checkpoint

Sending Messages

# Send to Telegram DM
cat <<'EOF' | node ~/zylos/.claude/skills/comm-bridge/scripts/c4-send.js telegram 8101553026
Hello! Quotes, $vars, **markdown** — all safe via stdin.
EOF

# Send to Lark group thread
cat <<'EOF' | node ~/zylos/.claude/skills/comm-bridge/scripts/c4-send.js lark "chat_xxx|type:group|root:msg_yyy"
Report ready.
EOF

Always pipe messages via stdin heredoc — never pass as CLI arguments. See c4-send for full reference. Treat the heredoc wrapper as fixed shell syntax: only the message body goes between the start line and the closing terminator line, and the terminator itself must never be copied into the actual outgoing message.

Database

SQLite at ~/zylos/comm-bridge/c4.db:

conversations: All messages (in/out) with priority, status, retry tracking
checkpoints: Recovery points with conversation id ranges
control_queue: System control messages (heartbeat, maintenance) with priority, ack deadlines, and status lifecycle

Read the full file on GitHub · 95 lines

Files

What ships with it

60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

3d ago Changed 22799d53a2d6
2mo ago First seen · 95 lines · 117 tokens per session scan A abd5d502709b

Subscribe to this mod's changes

comm-bridge is a skill published in the GitHub repository zylos-ai/zylos-core (1,160 stars, last pushed yesterday), licensed MIT. It adds 117 tokens to every session and 1,152 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

ai ai-worker own-your-data personal-ai-assistant self-evolving team-collaboration

comm-bridge next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
comm-bridgezylos-ai/zylos-core	Skill	1.2k	yesterday	MIT	A	117	Claude Code, Codex
imsgopenclaw/openclaw	Skill	394k	yesterday	MIT	A	37	Claude Code, Codex
gogopenclaw/openclaw	Skill	394k	yesterday	MIT	A	20	Claude Code, Codex
node-connectopenclaw/openclaw	Skill	394k	yesterday	MIT	A	39	Claude Code, Codex
crabbox-appsopenclaw/openclaw	Skill	394k	yesterday	MIT	A	39	Claude Code
node-inspect-debuggeropenclaw/openclaw	Skill	394k	yesterday	MIT	A	28	Claude Code, Codex
peekabooopenclaw/openclaw	Skill	394k	yesterday	MIT	A	17	Claude Code, Codex