rysweet Signal Chat Skill
Purpose
Hand an agent task off to a Signal group chat and drive the whole session from your phone. The skill starts a topic-scoped, bidirectional Signal chat: all agent output is posted to a fresh operator-only group, and every message you send in that group becomes the next agent prompt — with full prior session context preserved across turns.
It is a thin wrapper: the skill simply shells out to
amplihack signal chat "<topic>". All logic, security, and failure handling
live in that subcommand (see docs/SIGNAL_CHAT.md).
When This Skill Activates
- User wants to run/monitor/steer an agent task from Signal ("do this over Signal", "let me drive this from my phone").
- User wants an agent review or investigation delivered to a Signal group they can reply into.
- User types
/signal <topic>.
How It Works
The skill runs one command:
amplihack signal chat "<topic>"
That command:
- Verifies the local signal-cli daemon is on
127.0.0.1and the account is linked (reusingamplihack signal setup; guides you to link via QR if not). - Creates a fresh group
amplihack-<host>[-<tmux>]-<slug(topic)>and auto-accepts its message request on your linked device, so the group's messages reach your phone without a manual "Accept" tap (fail closed — if the accept fails, group creation fails). - Posts a first message announcing the topic, the effective tool
allowlist (blast radius), and the control phrases (
stop/kill/status). - Runs the first turn with the topic as the prompt and posts the reply.
- Loops: each accepted group message → one
copilot --session-id <uuid>turn (serialized, one at a time) → redacted, chunked output posted back.
Usage
/signal start a crusty-old-engineer review of PR 3967
expands to:
amplihack signal chat "start a crusty-old-engineer review of PR 3967"
Scoped write access (explicit)
Only investigation is allowed by default. To let the driven agent edit or run a specific command, add scoped tools:
amplihack signal chat "fix the failing lint" \
--allow-tool view --allow-tool grep --allow-tool glob \
--allow-tool edit --allow-tool 'shell(cargo fmt)'
Full tools (dangerous, explicit opt-in)
amplihack signal chat "do whatever it takes" --dangerous-all-tools
Control Phrases (in the group)
| Phrase | Effect |
|---|---|
status |
Post session id, current turn, allowlist, queue depth, membership status. |
stop |
Terminate the child agent immediately (even mid-turn), close the group, exit. |
kill |
Synonym for stop. |
Control phrases are parsed before a message is treated as a prompt and always pre-empt an in-flight turn.
Security Notes
- An accepted message == typing into the agent. The chat is
least-privilege by default (read-only tools) and fails closed:
membership is verified before every outbound post, the daemon must be
loopback-only, and every accepted prompt is audit-logged (redacted). Do not
pass
--dangerous-all-toolsunless you fully trust the group membership.
Prerequisites
- amplihack built with
--features signal. - A linked signal-cli daemon on this host (
amplihack signal setup). copilot(GitHub Copilot CLI) onPATH.
Related
- docs/SIGNAL_CHAT.md — full usage, security contract, configuration, and failure modes.
- docs/SIGNAL_ONBOARDING.md — linking and the local daemon.