Web3Dropper Crypto Price — Web3Dropper 加密价格

Name: Web3Dropper Crypto Price — Web3Dropper 加密价格
Author: Web3Dropper

Web3Dropper

Web3Dropper Crypto Price — Web3Dropper 加密价格

v1.0.0

Web3Dropper 加密价格技能工具。

0· 264·0 当前·0 累计

by @web3dropper (Web3Dropper)·MIT-0

安全浏览器自动化开发工具智能体

下载技能包

License

MIT-0

最后更新

2026/4/13

安全扫描

VirusTotal

可疑

查看报告

OpenClaw

可疑

medium confidence

The package mixes two different purposes (a small Binance price script and a large Billions/iden3 identity toolkit), stores agent private keys unencrypted under $HOME/.openclaw/billions, and will send signed tokens/URLs to external recipients — the combination is coherent for an identity skill but the name/metadata mismatch and sensitive local key handling warrant caution.

评估建议

Be cautious before installing. The package is primarily an identity management toolkit (not just a 'crypto price' skill) and will generate and store private keys unencrypted under $HOME/.openclaw/billions and send signed tokens/URLs to arbitrary recipients via the openclaw CLI. If you only want a Binance price fetcher, do not install this package. If you need the identity functionality, verify the upstream project (billions.network), inspect the sendDirectMessage/openclaw invocation code, and on...

详细分析 ▾

⚠ 用途与能力

Registry name/summary ('Web3dropper Crypto Price Skill') suggests a simple Binance price fetcher, but the repository and SKILL.md are largely an identity toolkit for Billions/iden3 (many files, KMS, DID management, signing, attestation). The included 'my-agent-skill' small Binance script exists, but it is a minor piece of a much larger identity package. This mismatch is incoherent and could indicate repackaging or mislabeling.

⚠ 指令范围

Runtime instructions tell the agent to run npm install and multiple scripts that create/import private keys, sign challenges, build authorization requests and call openclaw to send messages containing signed JWS/callback URLs. Those scripts persist unencrypted private keys and produce callback URLs containing JWS tokens — sending those to arbitrary recipients could expose attestation tokens or enable linking to malicious recipients if the --to argument is set incorrectly or by a malicious prompt. The SKILL.md guardrails try to limit dangerous actions, but the scripts themselves perform sensitive I/O and network calls outside the agent workspace.

ℹ 安装机制

No formal install spec is provided in the registry (instruction-only), but SKILL.md instructs running 'cd scripts && npm install' which will install many npm dependencies (some large SDKs). Pulling these npm packages is standard for the identity functionality; there's no remote archive download or URL shortener in the install path. The presence of heavy dependencies is proportionate to iden3/PolygonID usage, but increases surface area compared with a tiny price-fetching skill.

⚠ 凭证需求

The skill requests no environment variables, but writes and reads sensitive cryptographic material to $HOME/.openclaw/billions (kms.json with privateKeyHex stored in plaintext). While local key storage is needed for identity operations, unencrypted key persistence in a home directory is sensitive and may be disproportionate if the user did not expect identity management. The scripts also contact RPC and relay endpoints (rpc-mainnet.billions.network and attestation-relay.billions.network), which are expected for this purpose but should be verified as legitimate.

ℹ 持久化与权限

The skill does not request always:true and does not modify other skills. It creates persistent files under $HOME/.openclaw/billions (kms.json, identities.json, challenges.json, defaultDid.json). Persistent storage is necessary for a DID/key toolkit, but that is a significant privilege and means the skill will have long-term access to local private keys once installed.

安全有层次，运行前请审查代码。

License

MIT-0

可自由使用、修改和再分发，无需署名。

查看条款 ↗

运行时依赖

无特殊依赖

版本

latestv1.0.02026/3/9

**Initial release of verified-agent-identity skill.** - Provides Billions/Iden3 authentication and decentralized identity management tools for agents. - Supports creating and managing agent identities, linking an agent’s DID to a human owner, signing and verifying challenges, and handling shared JWT authentication. - Includes scripts for key identity operations: creation, listing, challenge generation, challenge signing, identity linking, and signature verification. - Stores all identity and credential data in `$HOME/.openclaw/billions` for OpenClaw compatibility. - Strict guardrails enforce proper script usage and prohibit manual cryptographic operations or unauthorized file access.

● 可疑

安装命令点击复制

官方npx clawhub@latest install web3dropper-crypto-price

镜像加速npx clawhub@latest install web3dropper-crypto-price --registry https://cn.clawhub-mirror.com

技能文档

当...时到使用 Skill

Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.

当...时您需要到链接 agent identity 到 owner.
当...时您需要签名 challenge.
当...时您需要链接 human 到 agent's 做过.
当...时您需要到验证 signature 到 confirm identity ownership.
当...时使用 shared JWT tokens 对于 authentication.
当...时您需要到创建和 manage decentralized identities.

之后 installing 插件 run following commands 到创建 identity 和链接到 human 做过:

cd scripts && npm install && cd ..
# Step 1: Create a new identity (if you don't have one already)
node scripts/createNewEthereumIdentity.js
# Step 2: Sign the challenge and generate a verification URL in one call
node scripts/linkHumanToAgent.js --to  --challenge '{"name": , "description": }'

Scope

All identity data is stored in $HOME/.openclaw/billions for compatibility with the OpenClaw plugin.

# Scripts:

createNewEthereumIdentity.js

Command: 节点 scripts/createNewEthereumIdentity.js [--键 ] Description: Creates 新的 identity 在...上 Billions Network. 如果 --键 provided, uses 私有键; 否则 generates 新的 random 键. created identity automatically 设置作为默认. Usage Examples:

# Generate a new random identity
node scripts/createNewEthereumIdentity.js
# Create identity from existing private key (with 0x prefix)
node scripts/createNewEthereumIdentity.js --key 0x1234567890abcdef...
# Create identity from existing private key (without 0x prefix)
node scripts/createNewEthereumIdentity.js --key 1234567890abcdef...

输出: 做过字符串 (e.g., 做过:iden3:billions:main:2VmAk7fGHQP5FN2jZ8X9Y3K4W6L1M...)

getIdentities.js

Command: 节点 scripts/getIdentities.js Description: Lists 所有做过 identities stored locally. 使用到 check 哪个 identities 可用之前 performing authentication operations. Usage 示例:

node scripts/getIdentities.js

输出: JSON 数组的 identity entries

[
  {
    "did": "did:iden3:billions:main:2VmAk...",
    "publicKeyHex": "0x04abc123...",
    "isDefault": true
  }
]

generateChallenge.js

Command: 节点 scripts/generateChallenge.js --做过 <做过> Description: Generates random challenge 对于 identity verification. Usage 示例:

node scripts/generateChallenge.js --did did:iden3:billions:main:2VmAk...

输出: Challenge 字符串 (random 数字作为字符串, e.g., 8472951360) Side Effects: Stores challenge associated 带有做过在...中 $HOME/.openclaw/billions/challenges.json

signChallenge.js

Command: 节点 scripts/signChallenge.js --到 --challenge [--做过 <做过>] Description: Signs challenge 带有做过's 私有键到 prove identity ownership 和 sends JWS 令牌作为 direct 消息到 specified sender. 使用当...时您需要到 prove 您 own specific 做过. Arguments:

--到 - (必填) 消息 sender identifier, passed 作为 --target 到 openclaw 消息发送
--challenge - (必填) Challenge 到签名
--做过 - (可选) 做过的 attestation recipient; uses 默认做过如果 omitted

Usage Examples:

# Sign with default DID and send to sender
node scripts/signChallenge.js --to  --challenge 8472951360

输出: {"成功":真}

linkHumanToAgent.js

Command: 节点 scripts/linkHumanToAgent.js --到 --challenge [--做过 <做过>] Description: Signs challenge 和 links human 用户到 agent's 做过由 creating verification 请求. 响应将 sent 作为 direct 消息到 specified sender. Arguments:

--到 - (必填) 消息 sender identifier, passed 作为 --target 到 openclaw 消息发送
--challenge - (必填) Challenge 到签名
--做过 - (可选) 做过的 attestation recipient; uses 默认做过如果 omitted

Usage 示例:

node scripts/linkHumanToAgent.js --to  --challenge '{"name": "MyAgent", "description": "AI persona"}'

输出: {"成功":真}

verifySignature.js

Command: 节点 scripts/verifySignature.js --做过 <做过> --令牌 <令牌> Description: Verifies signed challenge 到 confirm 做过 ownership. Usage 示例:

node scripts/verifySignature.js --did did:iden3:billions:main:2VmAk... --token eyJhbGciOiJFUzI1NkstUi...

输出: Signature verified successfully (在...上成功) 或错误消息 (在...上 failure)

Restrictions / Guardrails (CRITICAL)

CRITICAL - Always 关注 These Rules:

STRICT: Check Identity 第一个

- 之前 running linkHumanToAgent.js 或 signChallenge.js, ALWAYS check 如果 identity exists: 节点 scripts/getIdentities.js - 如果否 identity configured, 做不 attempt 到链接 identities. 代替, 创建 identity 第一个带有 createNewEthereumIdentity.js.

STRICT: 停止在...上 Script Failure

- 如果任何 script exits 带有 non-zero status code, 您必须停止 IMMEDIATELY. - Check stderr 输出对于错误 messages. - 做不 attempt 到 "fix" errors 由 generating keys manually, creating DIDs 通过其他 means, 或 running unauthorized commands. - 做不 使用 openssl, ssh-keygen, 或其他 system utilities 到 generate cryptographic material.

否 Manual Workarounds

- 您 prohibited 从 performing manual cryptographic operations. - 您 prohibited 从 directly manipulating files 在...中 $HOME/.openclaw/billions. - 做不 interpret 错误作为请求到 perform setup steps unless explicitly instructed.

Security

CRITICAL - Data Storage 和 Protection:

The directory $HOME/.openclaw/billions contains all sensitive identity data:

kms.json - CRITICAL: Contains unencrypted 私有 keys
defaultDid.json - 做过 identifiers 和公开 keys
challenges.json - Authentication challenges history
credentials.json - Verifiable credentials
identities.json - Identity metadata
profiles.json - 个人资料 data

Examples

链接 Agent Identity 到 Owner

Linking Flow:

另一个 agent/用户 requests: "Please 链接 agent identity 到 me."
使用 节点 scripts/getIdentities.js 到 check 如果您有 identity configured

- 如果否 identity, run 节点 scripts/createNewEthereumIdentity.js 到创建 one.

使用 节点 scripts/linkHumanToAgent.js --到 --challenge 到签名 challenge 和 generate verification URL 在...中 one call.

- --到 值消息 sender ( caller's identifier). - 如果 caller provides specific challenge, 使用 . - 如果 caller 做不 provide challenge, 使用 {"name": , "description": } 作为 challenge 值.

Return 结果到 caller.

示例 Conversation:

User: "Link your agent identity to me"
Agent: exec node scripts/linkHumanToAgent.js --to  --challenge

Verifying someone 否则's Identity

Verification Flow:

Ask 用户/agent: "Please provide 做过到开始 verification."
用户 responds 带有 .
使用 节点 scripts/generateChallenge.js --做过 到创建 .
Ask 用户: "Please 签名 challenge: "
用户 signs 和 returns .
使用 节点 scripts/verifySignature.js --做过 --令牌 到验证 signature
如果 verification succeeds, identity confirmed

示例 Conversation:

Agent: "Please provide your DID to start verification."
User: "My DID is "
Agent: exec node scripts/generateChallenge.js --did 
Agent: "Please sign this challenge: 789012"
User: 
Agent: exec node scripts/verifySignature.js --token  --did 
Agent: "Identity verified successfully. You are confirmed as owner of DID ."

When to use this Skill

Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.

When you need to link your agent identity to an owner.
When you need sign a challenge.
When you need link a human to the agent's DID.
When you need to verify a signature to confirm identity ownership.
When use shared JWT tokens for authentication.
When you need to create and manage decentralized identities.

After installing the plugin run the following commands to create an identity and link it to your human DID:

cd scripts && npm install && cd ..
# Step 1: Create a new identity (if you don't have one already)
node scripts/createNewEthereumIdentity.js
# Step 2: Sign the challenge and generate a verification URL in one call
node scripts/linkHumanToAgent.js --to  --challenge '{"name": , "description": }'

Scope

All identity data is stored in $HOME/.openclaw/billions for compatibility with the OpenClaw plugin.

# Scripts:

createNewEthereumIdentity.js

Command: node scripts/createNewEthereumIdentity.js [--key ] Description: Creates a new identity on the Billions Network. If --key is provided, uses that private key; otherwise generates a new random key. The created identity is automatically set as default. Usage Examples:

# Generate a new random identity
node scripts/createNewEthereumIdentity.js
# Create identity from existing private key (with 0x prefix)
node scripts/createNewEthereumIdentity.js --key 0x1234567890abcdef...
# Create identity from existing private key (without 0x prefix)
node scripts/createNewEthereumIdentity.js --key 1234567890abcdef...

Output: DID string (e.g., did:iden3:billions:main:2VmAk7fGHQP5FN2jZ8X9Y3K4W6L1M...)

getIdentities.js

Command: node scripts/getIdentities.js Description: Lists all DID identities stored locally. Use this to check which identities are available before performing authentication operations. Usage Example:

node scripts/getIdentities.js

Output: JSON array of identity entries

[
  {
    "did": "did:iden3:billions:main:2VmAk...",
    "publicKeyHex": "0x04abc123...",
    "isDefault": true
  }
]

generateChallenge.js

Command: node scripts/generateChallenge.js --did Description: Generates a random challenge for identity verification. Usage Example:

node scripts/generateChallenge.js --did did:iden3:billions:main:2VmAk...

Output: Challenge string (random number as string, e.g., 8472951360) Side Effects: Stores challenge associated with the DID in $HOME/.openclaw/billions/challenges.json

signChallenge.js

Command: node scripts/signChallenge.js --to --challenge [--did ] Description: Signs a challenge with a DID's private key to prove identity ownership and sends the JWS token as a direct message to the specified sender. Use this when you need to prove you own a specific DID. Arguments:

--to - (required) The message sender identifier, passed as --target to openclaw message send
--challenge - (required) Challenge to sign
--did - (optional) The DID of the attestation recipient; uses the default DID if omitted

Usage Examples:

# Sign with default DID and send to sender
node scripts/signChallenge.js --to  --challenge 8472951360

Output: {"success":true}

linkHumanToAgent.js

Command: node scripts/linkHumanToAgent.js --to --challenge [--did ] Description: Signs the challenge and links a human user to the agent's DID by creating a verification request. Response will be sent as a direct message to the specified sender. Arguments:

--to - (required) The message sender identifier, passed as --target to openclaw message send
--challenge - (required) Challenge to sign
--did - (optional) The DID of the attestation recipient; uses the default DID if omitted

Usage Example:

node scripts/linkHumanToAgent.js --to  --challenge '{"name": "MyAgent", "description": "AI persona"}'

Output: {"success":true}

verifySignature.js

Command: node scripts/verifySignature.js --did --token Description: Verifies a signed challenge to confirm DID ownership. Usage Example:

node scripts/verifySignature.js --did did:iden3:billions:main:2VmAk... --token eyJhbGciOiJFUzI1NkstUi...

Output: Signature verified successfully (on success) or error message (on failure)

Restrictions / Guardrails (CRITICAL)

CRITICAL - Always Follow These Rules:

STRICT: Check Identity First

- Before running linkHumanToAgent.js or signChallenge.js, ALWAYS check if an identity exists: node scripts/getIdentities.js - If no identity is configured, DO NOT attempt to link identities. Instead, create an identity first with createNewEthereumIdentity.js.

STRICT: Stop on Script Failure

- If any script exits with non-zero status code, YOU MUST STOP IMMEDIATELY. - Check stderr output for error messages. - DO NOT attempt to "fix" errors by generating keys manually, creating DIDs through other means, or running unauthorized commands. - DO NOT use openssl, ssh-keygen, or other system utilities to generate cryptographic material.

No Manual Workarounds

- You are prohibited from performing manual cryptographic operations. - You are prohibited from directly manipulating files in $HOME/.openclaw/billions. - Do not interpret an error as a request to perform setup steps unless explicitly instructed.

Security

CRITICAL - Data Storage and Protection:

The directory $HOME/.openclaw/billions contains all sensitive identity data:

kms.json - CRITICAL: Contains unencrypted private keys
defaultDid.json - DID identifiers and public keys
challenges.json - Authentication challenges history
credentials.json - Verifiable credentials
identities.json - Identity metadata
profiles.json - Profile data

Examples

Link Your Agent Identity to Owner

Linking Flow:

Another agent/user requests: "Please link your agent identity to me."
Use node scripts/getIdentities.js to check if you have an identity configured

- If no identity, run node scripts/createNewEthereumIdentity.js to create one.

Use node scripts/linkHumanToAgent.js --to --challenge to sign the challenge and generate a verification URL in one call.

- The --to value is the message sender (the caller's identifier). - If caller provides specific challenge, use that. - If caller DOES NOT provide a challenge, use {"name": , "description": } as the challenge value.

Return the result to the caller.

Example Conversation:

User: "Link your agent identity to me"
Agent: exec node scripts/linkHumanToAgent.js --to  --challenge

Verifying someone else's Identity

Verification Flow:

Ask the user/agent: "Please provide your DID to start verification."
User responds with their .
Use node scripts/generateChallenge.js --did to create a .
Ask the user: "Please sign this challenge: "
User signs and returns .
Use node scripts/verifySignature.js --did --token to verify the signature
If verification succeeds, identity is confirmed

Example Conversation:

Agent: "Please provide your DID to start verification."
User: "My DID is "
Agent: exec node scripts/generateChallenge.js --did 
Agent: "Please sign this challenge: 789012"
User: 
Agent: exec node scripts/verifySignature.js --token  --did 
Agent: "Identity verified successfully. You are confirmed as owner of DID ."

数据来源：ClawHub ↗ · 中文优化：龙虾技能库

OpenClaw 技能定制 / 插件定制 / 私有工作流定制

免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制

了解定制服务

License

运行时依赖

版本

安装命令 点击复制

技能文档

当...时 到 使用 Skill

之后 installing 插件 run following commands 到 创建 identity 和 链接 到 human 做过:

Scope

createNewEthereumIdentity.js

getIdentities.js

generateChallenge.js

signChallenge.js

linkHumanToAgent.js

verifySignature.js

Restrictions / Guardrails (CRITICAL)

Security

Examples

链接 Agent Identity 到 Owner

Verifying someone 否则's Identity

When to use this Skill

After installing the plugin run the following commands to create an identity and link it to your human DID:

Scope

createNewEthereumIdentity.js

getIdentities.js

generateChallenge.js

signChallenge.js

linkHumanToAgent.js

verifySignature.js

Restrictions / Guardrails (CRITICAL)

Security

Examples

Link Your Agent Identity to Owner

Verifying someone else's Identity

安装命令点击复制

当...时到使用 Skill

之后 installing 插件 run following commands 到创建 identity 和链接到 human 做过: