Web3Dropper Verified Agent — Web3Dropper 验证智能体

Name: Web3Dropper Verified Agent — Web3Dropper 验证智能体
Rating: 1 (1 reviews)
Author: Web3Dropper

Web3Dropper

Web3Dropper Verified Agent — Web3Dropper 验证智能体

v1.0.0

Web3Dropper 验证智能体工具。

1· 292·0 当前·0 累计

by @web3dropper (Web3Dropper)·MIT-0

智能体浏览器自动化开发工具安全

下载技能包

License

MIT-0

最后更新

2026/4/13

安全扫描

VirusTotal

可疑

查看报告

OpenClaw

安全

medium confidence

The skill's files, runtime instructions, and external network usage are consistent with a Billions/iden3 identity-management tool, but it stores private keys unencrypted in the user's home directory and publishes signed tokens to a relay endpoint — review and trust the external services before installing.

评估建议

This skill appears to do what it says (create/manage DIDs, sign/verify challenges and produce pairing links), but take these precautions before installing or running it: - Trust the remote services: the pairing flow constructs a callback URL that includes a signed JWS and points to attestation-relay.billions.network (and the code queries resolver.privado.id). If you don't trust those endpoints, do not use the pairing flow. - Protect private keys: the skill stores private keys unencrypted in $HO...

详细分析 ▾

✓ 用途与能力

Name/description (Billions/iden3 DID management) aligns with the included Node scripts and the declared runtime (node + openclaw). Required binaries and storage path ($HOME/.openclaw/billions) match the stated purpose.

ℹ 指令范围

SKILL.md and scripts direct the agent/user to run npm install and several node scripts that create keys, sign challenges, build pairing URLs, and send messages via the openclaw CLI. These actions are within the identity/verification scope, but the pairing URL encodes signed JWS tokens (created locally) and the scripts will transmit those tokens to an external attestation-relay URL when the human follows the link.

✓ 安装机制

There is no automated installer; the README/SKILL.md instructs running npm install in the scripts directory. Dependencies are standard npm packages from public registries (listed in package.json/package-lock). No arbitrary archive downloads or obscure install URLs are used.

ℹ 凭证需求

The skill requests no environment variables or external credentials. However, it persistently stores cryptographic private keys unencrypted in $HOME/.openclaw/billions/kms.json (explicit in code/README), which is a sensitive capability. The code also contacts several Billions/iden3 endpoints (rpc-mainnet.billions.network, attestation-relay.billions.network, resolver.privado.id) — the pairing flow will expose signed tokens to those services as part of the protocol.

✓ 持久化与权限

The skill does not request always:true and does not modify other skills or system-wide agent settings. It persists state under the user's home directory (intended for DID/key storage), which is appropriate for an identity manager but is a persistent, sensitive artifact.

安全有层次，运行前请审查代码。

License

MIT-0

可自由使用、修改和再分发，无需署名。

查看条款 ↗

运行时依赖

无特殊依赖

版本

latestv1.0.02026/3/8

- Initial release of the verified-agent-identity skill for Billions/Iden3 identity management. - Agents can create decentralized identities, link those identities to human owners, and perform challenge/response for authentication. - Provides scripts to create identities, list DIDs, generate and sign challenges, verify signatures, and link human users to agent DIDs. - All identity data is securely stored in `$HOME/.openclaw/billions`; strict rules prohibit manual cryptographic operations or file manipulation. - Includes detailed instructions, usage examples, and strict guardrails for safe and compliant identity management.

● 可疑

安装命令点击复制

官方npx clawhub@latest install web3dropper-verified-agent

镜像加速npx clawhub@latest install web3dropper-verified-agent --registry https://cn.clawhub-mirror.com

技能文档

当...时到使用 Skill

Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.

当...时您需要到链接 agent identity 到 owner.
当...时您需要签名 challenge.
当...时您需要链接 human 到 agent's 做过.
当...时您需要到验证 signature 到 confirm identity ownership.
当...时使用 shared JWT tokens 对于 authentication.
当...时您需要到创建和 manage decentralized identities.

之后 installing 插件 run following commands 到创建 identity 和链接到 human 做过:

cd scripts && npm install && cd ..
# Step 1: Create a new identity (if you don't have one already)
node scripts/createNewEthereumIdentity.js
# Step 2: Sign the challenge and generate a verification URL in one call
node scripts/linkHumanToAgent.js --to  --challenge '{"name": , "description": }'

Scope

All identity data is stored in $HOME/.openclaw/billions for compatibility with the OpenClaw plugin.

# Scripts:

createNewEthereumIdentity.js

Command: 节点 scripts/createNewEthereumIdentity.js [--键 ] Description: Creates 新的 identity 在...上 Billions Network. 如果 --键 provided, uses 私有键; 否则 generates 新的 random 键. created identity automatically 设置作为默认. Usage Examples:

# Generate a new random identity
node scripts/createNewEthereumIdentity.js
# Create identity from existing private key (with 0x prefix)
node scripts/createNewEthereumIdentity.js --key 0x1234567890abcdef...
# Create identity from existing private key (without 0x prefix)
node scripts/createNewEthereumIdentity.js --key 1234567890abcdef...

输出: 做过字符串 (e.g., 做过:iden3:billions:main:2VmAk7fGHQP5FN2jZ8X9Y3K4W6L1M...)

getIdentities.js

Command: 节点 scripts/getIdentities.js Description: Lists 所有做过 identities stored locally. 使用到 check 哪个 identities 可用之前 performing authentication operations. Usage 示例:

node scripts/getIdentities.js

输出: JSON 数组的 identity entries

[
  {
    "did": "did:iden3:billions:main:2VmAk...",
    "publicKeyHex": "0x04abc123...",
    "isDefault": true
  }
]

generateChallenge.js

Command: 节点 scripts/generateChallenge.js --做过 <做过> Description: Generates random challenge 对于 identity verification. Usage 示例:

node scripts/generateChallenge.js --did did:iden3:billions:main:2VmAk...

输出: Challenge 字符串 (random 数字作为字符串, e.g., 8472951360) Side Effects: Stores challenge associated 带有做过在...中 $HOME/.openclaw/billions/challenges.json

signChallenge.js

Command: 节点 scripts/signChallenge.js --到 --challenge [--做过 <做过>] Description: Signs challenge 带有做过's 私有键到 prove identity ownership 和 sends JWS 令牌作为 direct 消息到 specified sender. 使用当...时您需要到 prove 您 own specific 做过. Arguments:

--到 - (必填) 消息 sender identifier, passed 作为 --target 到 openclaw 消息发送
--challenge - (必填) Challenge 到签名
--做过 - (可选) 做过的 attestation recipient; uses 默认做过如果 omitted

Usage Examples:

# Sign with default DID and send to sender
node scripts/signChallenge.js --to  --challenge 8472951360

输出: {"成功":真}

linkHumanToAgent.js

Command: 节点 scripts/linkHumanToAgent.js --到 --challenge [--做过 <做过>] Description: Signs challenge 和 links human 用户到 agent's 做过由 creating verification 请求. 响应将 sent 作为 direct 消息到 specified sender. Arguments:

--到 - (必填) 消息 sender identifier, passed 作为 --target 到 openclaw 消息发送
--challenge - (必填) Challenge 到签名
--做过 - (可选) 做过的 attestation recipient; uses 默认做过如果 omitted

Usage 示例:

node scripts/linkHumanToAgent.js --to  --challenge '{"name": "MyAgent", "description": "AI persona"}'

输出: {"成功":真}

verifySignature.js

Command: 节点 scripts/verifySignature.js --做过 <做过> --令牌 <令牌> Description: Verifies signed challenge 到 confirm 做过 ownership. Usage 示例:

node scripts/verifySignature.js --did did:iden3:billions:main:2VmAk... --token eyJhbGciOiJFUzI1NkstUi...

输出: Signature verified successfully (在...上成功) 或错误消息 (在...上 failure)

Restrictions / Guardrails (CRITICAL)

CRITICAL - Always 关注 These Rules:

STRICT: Check Identity 第一个

- 之前 running linkHumanToAgent.js 或 signChallenge.js, ALWAYS check 如果 identity exists: 节点 scripts/getIdentities.js - 如果否 identity configured, 做不 attempt 到链接 identities. 代替, 创建 identity 第一个带有 createNewEthereumIdentity.js.

STRICT: 停止在...上 Script Failure

- 如果任何 script exits 带有 non-zero status code, 您必须停止 IMMEDIATELY. - Check stderr 输出对于错误 messages. - 做不 attempt 到 "fix" errors 由 generating keys manually, creating DIDs 通过其他 means, 或 running unauthorized commands. - 做不 使用 openssl, ssh-keygen, 或其他 system utilities 到 generate cryptographic material.

否 Manual Workarounds

- 您 prohibited 从 performing manual cryptographic operations. - 您 prohibited 从 directly manipulating files 在...中 $HOME/.openclaw/billions. - 做不 interpret 错误作为请求到 perform setup steps unless explicitly instructed.

Security

CRITICAL - Data Storage 和 Protection:

The directory $HOME/.openclaw/billions contains all sensitive identity data:

kms.json - CRITICAL: Contains unencrypted 私有 keys
defaultDid.json - 做过 identifiers 和公开 keys
challenges.json - Authentication challenges history
credentials.json - Verifiable credentials
identities.json - Identity metadata
profiles.json - 个人资料 data

Examples

链接 Agent Identity 到 Owner

Linking Flow:

另一个 agent/用户 requests: "Please 链接 agent identity 到 me."
使用 节点 scripts/getIdentities.js 到 check 如果您有 identity configured

- 如果否 identity, run 节点 scripts/createNewEthereumIdentity.js 到创建 one.

使用 节点 scripts/linkHumanToAgent.js --到 --challenge 到签名 challenge 和 generate verification URL 在...中 one call.

- --到 值消息 sender ( caller's identifier). - 如果 caller provides specific challenge, 使用 . - 如果 caller 做不 provide challenge, 使用 {"name": , "description": } 作为 challenge 值.

Return 结果到 caller.

示例 Conversation:

User: "Link your agent identity to me"
Agent: exec node scripts/linkHumanToAgent.js --to  --challenge

Verifying someone 否则's Identity

Verification Flow:

Ask 用户/agent: "Please provide 做过到开始 verification."
用户 responds 带有 .
使用 节点 scripts/generateChallenge.js --做过 到创建 .
Ask 用户: "Please 签名 challenge: "
用户 signs 和 returns .
使用 节点 scripts/verifySignature.js --做过 --令牌 到验证 signature
如果 verification succeeds, identity confirmed

示例 Conversation:

Agent: "Please provide your DID to start verification."
User: "My DID is "
Agent: exec node scripts/generateChallenge.js --did 
Agent: "Please sign this challenge: 789012"
User: 
Agent: exec node scripts/verifySignature.js --token  --did 
Agent: "Identity verified successfully. You are confirmed as owner of DID ."

When to use this Skill

Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.

When you need to link your agent identity to an owner.
When you need sign a challenge.
When you need link a human to the agent's DID.
When you need to verify a signature to confirm identity ownership.
When use shared JWT tokens for authentication.
When you need to create and manage decentralized identities.

After installing the plugin run the following commands to create an identity and link it to your human DID:

cd scripts && npm install && cd ..
# Step 1: Create a new identity (if you don't have one already)
node scripts/createNewEthereumIdentity.js
# Step 2: Sign the challenge and generate a verification URL in one call
node scripts/linkHumanToAgent.js --to  --challenge '{"name": , "description": }'

Scope

All identity data is stored in $HOME/.openclaw/billions for compatibility with the OpenClaw plugin.

# Scripts:

createNewEthereumIdentity.js

Command: node scripts/createNewEthereumIdentity.js [--key ] Description: Creates a new identity on the Billions Network. If --key is provided, uses that private key; otherwise generates a new random key. The created identity is automatically set as default. Usage Examples:

# Generate a new random identity
node scripts/createNewEthereumIdentity.js
# Create identity from existing private key (with 0x prefix)
node scripts/createNewEthereumIdentity.js --key 0x1234567890abcdef...
# Create identity from existing private key (without 0x prefix)
node scripts/createNewEthereumIdentity.js --key 1234567890abcdef...

Output: DID string (e.g., did:iden3:billions:main:2VmAk7fGHQP5FN2jZ8X9Y3K4W6L1M...)

getIdentities.js

Command: node scripts/getIdentities.js Description: Lists all DID identities stored locally. Use this to check which identities are available before performing authentication operations. Usage Example:

node scripts/getIdentities.js

Output: JSON array of identity entries

[
  {
    "did": "did:iden3:billions:main:2VmAk...",
    "publicKeyHex": "0x04abc123...",
    "isDefault": true
  }
]

generateChallenge.js

Command: node scripts/generateChallenge.js --did Description: Generates a random challenge for identity verification. Usage Example:

node scripts/generateChallenge.js --did did:iden3:billions:main:2VmAk...

Output: Challenge string (random number as string, e.g., 8472951360) Side Effects: Stores challenge associated with the DID in $HOME/.openclaw/billions/challenges.json

signChallenge.js

Command: node scripts/signChallenge.js --to --challenge [--did ] Description: Signs a challenge with a DID's private key to prove identity ownership and sends the JWS token as a direct message to the specified sender. Use this when you need to prove you own a specific DID. Arguments:

--to - (required) The message sender identifier, passed as --target to openclaw message send
--challenge - (required) Challenge to sign
--did - (optional) The DID of the attestation recipient; uses the default DID if omitted

Usage Examples:

# Sign with default DID and send to sender
node scripts/signChallenge.js --to  --challenge 8472951360

Output: {"success":true}

linkHumanToAgent.js

Command: node scripts/linkHumanToAgent.js --to --challenge [--did ] Description: Signs the challenge and links a human user to the agent's DID by creating a verification request. Response will be sent as a direct message to the specified sender. Arguments:

--to - (required) The message sender identifier, passed as --target to openclaw message send
--challenge - (required) Challenge to sign
--did - (optional) The DID of the attestation recipient; uses the default DID if omitted

Usage Example:

node scripts/linkHumanToAgent.js --to  --challenge '{"name": "MyAgent", "description": "AI persona"}'

Output: {"success":true}

verifySignature.js

Command: node scripts/verifySignature.js --did --token Description: Verifies a signed challenge to confirm DID ownership. Usage Example:

node scripts/verifySignature.js --did did:iden3:billions:main:2VmAk... --token eyJhbGciOiJFUzI1NkstUi...

Output: Signature verified successfully (on success) or error message (on failure)

Restrictions / Guardrails (CRITICAL)

CRITICAL - Always Follow These Rules:

STRICT: Check Identity First

- Before running linkHumanToAgent.js or signChallenge.js, ALWAYS check if an identity exists: node scripts/getIdentities.js - If no identity is configured, DO NOT attempt to link identities. Instead, create an identity first with createNewEthereumIdentity.js.

STRICT: Stop on Script Failure

- If any script exits with non-zero status code, YOU MUST STOP IMMEDIATELY. - Check stderr output for error messages. - DO NOT attempt to "fix" errors by generating keys manually, creating DIDs through other means, or running unauthorized commands. - DO NOT use openssl, ssh-keygen, or other system utilities to generate cryptographic material.

No Manual Workarounds

- You are prohibited from performing manual cryptographic operations. - You are prohibited from directly manipulating files in $HOME/.openclaw/billions. - Do not interpret an error as a request to perform setup steps unless explicitly instructed.

Security

CRITICAL - Data Storage and Protection:

The directory $HOME/.openclaw/billions contains all sensitive identity data:

kms.json - CRITICAL: Contains unencrypted private keys
defaultDid.json - DID identifiers and public keys
challenges.json - Authentication challenges history
credentials.json - Verifiable credentials
identities.json - Identity metadata
profiles.json - Profile data

Examples

Link Your Agent Identity to Owner

Linking Flow:

Another agent/user requests: "Please link your agent identity to me."
Use node scripts/getIdentities.js to check if you have an identity configured

- If no identity, run node scripts/createNewEthereumIdentity.js to create one.

Use node scripts/linkHumanToAgent.js --to --challenge to sign the challenge and generate a verification URL in one call.

- The --to value is the message sender (the caller's identifier). - If caller provides specific challenge, use that. - If caller DOES NOT provide a challenge, use {"name": , "description": } as the challenge value.

Return the result to the caller.

Example Conversation:

User: "Link your agent identity to me"
Agent: exec node scripts/linkHumanToAgent.js --to  --challenge

Verifying someone else's Identity

Verification Flow:

Ask the user/agent: "Please provide your DID to start verification."
User responds with their .
Use node scripts/generateChallenge.js --did to create a .
Ask the user: "Please sign this challenge: "
User signs and returns .
Use node scripts/verifySignature.js --did --token to verify the signature
If verification succeeds, identity is confirmed

Example Conversation:

Agent: "Please provide your DID to start verification."
User: "My DID is "
Agent: exec node scripts/generateChallenge.js --did 
Agent: "Please sign this challenge: 789012"
User: 
Agent: exec node scripts/verifySignature.js --token  --did 
Agent: "Identity verified successfully. You are confirmed as owner of DID ."

数据来源：ClawHub ↗ · 中文优化：龙虾技能库

OpenClaw 技能定制 / 插件定制 / 私有工作流定制

免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制

了解定制服务

License

运行时依赖

版本

安装命令 点击复制

技能文档

当...时 到 使用 Skill

之后 installing 插件 run following commands 到 创建 identity 和 链接 到 human 做过:

Scope

createNewEthereumIdentity.js

getIdentities.js

generateChallenge.js

signChallenge.js

linkHumanToAgent.js

verifySignature.js

Restrictions / Guardrails (CRITICAL)

Security

Examples

链接 Agent Identity 到 Owner

Verifying someone 否则's Identity

When to use this Skill

After installing the plugin run the following commands to create an identity and link it to your human DID:

Scope

createNewEthereumIdentity.js

getIdentities.js

generateChallenge.js

signChallenge.js

linkHumanToAgent.js

verifySignature.js

Restrictions / Guardrails (CRITICAL)

Security

Examples

Link Your Agent Identity to Owner

Verifying someone else's Identity

安装命令点击复制

当...时到使用 Skill

之后 installing 插件 run following commands 到创建 identity 和链接到 human 做过: