Verified Agent Identity — 验证智能体身份
v0.1.0验证智能体身份工具。
1· 209·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's code and instructions mostly match an identity-management purpose, but there are configuration inconsistencies and sensitive behaviors (notably unencrypted private key storage and third-party callbacks) that you should review before installing.
评估建议
What to consider before installing:
- This package creates and stores private keys unencrypted in $HOME/.openclaw/billions/kms.json (and other identity files). If you install, expect long-lived plaintext key material on disk. Consider running in a sandbox, using an encrypted KMS, or adjusting file permissions (and verify permissions are actually enforced).
- The skill will call external services (Billions RPC, attestation-relay, a DID resolver). The protocol embeds signed tokens into callback UR...详细分析 ▾
ℹ 用途与能力
The name, description, and scripts all implement decentralized identity (DID) creation, signing, linking, and verification for the Billions/iden3 ecosystem — this is coherent. Minor inconsistency: SKILL.md metadata declares required binaries (node, openclaw) but the registry 'Requirements' section earlier lists none; the runtime instructions also require running `npm install` in scripts. Those missing declarations are an information gap but not by themselves malicious.
ℹ 指令范围
Runtime instructions are limited to creating/listing identities, generating/signing/verifying challenges, and sending messages via the `openclaw` CLI. The scripts read/write files under $HOME/.openclaw/billions and call remote endpoints (RPC, resolver, attestation relay). The SKILL.md includes strict guardrails forbidding manual manipulation of those files, yet the code itself persists unencrypted keys and identity data — this is expected for the skill but worth noting as sensitive scope.
ℹ 安装机制
There is no formal install spec in the registry (instruction-only), but the README/SKILL.md instructs `cd scripts && npm install`. The package.json and package-lock.json use mainstream npm packages (iden3, polygonid, ethers, etc.), not arbitrary downloads. Installing dependencies via npm is moderate risk (supply-chain exposure); there are no obfuscated external downloads or URL shorteners.
⚠ 凭证需求
The skill does not request environment variables or external credentials, which is appropriate. However, it persistently stores private keys (kms.json) in plaintext JSON under $HOME/.openclaw/billions by default. The code does not explicitly set file permission mode; the README claims 'owner-readable only' but that is not enforced in code. The code also embeds and uses several external endpoints (rpc-mainnet.billions.network, attestation-relay.billions.network, wallet.billions.network, resolver.privado.id) and constructs callback URLs that include signed tokens — all expected for the protocol but they expose signed data to third parties. These practices are sensitive and deserve scrutiny relative to the stated purpose.
ℹ 持久化与权限
The skill does not request always:true or other elevated platform privileges. It persists cryptographic material and identity state under $HOME/.openclaw/billions and will keep a KMS and stored DIDs across runs; this is normal for an identity tool but increases the impact if the machine or skill is compromised.
⚠ scripts/shared/utils.js:158
Shell command execution detected (child_process).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/3/13
verified-agent-identity v0.1.0 - Initial release with support for Billions/Iden3 agent authentication and identity management. - Provides scripts to create, list, and link decentralized identities, sign and verify challenges, and manage identity data. - Enforces strict guardrails for identity handling and cryptographic key management. - Stores all identity data in $HOME/.openclaw/billions for OpenClaw compatibility. - Includes detailed usage instructions and security guidelines for all operations.
● 无害
安装命令 点击复制
官方npx clawhub@latest install verified-agent-identity-5
镜像加速npx clawhub@latest install verified-agent-identity-5 --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制