OpenClaw

skill-audit

On-chain skill provenance registry. Check, register, audit, and vouch for agent skills on Solana. Use when evaluating skill safety, registering new skills, or looking up provenance before installation.

emanz10 来源安装数☆ 0 仓库 Stars

查看来源 ↗安装与使用 SKILL.md ↗

安装与使用

请根据来源仓库和你的 AI 工具说明安装此技能。先阅读技能文件和依赖要求，再添加到工作流。

SkillHub CLI

skillhub install emanz1/onchain-skill-audit

打开来源仓库，查看说明和兼容环境后，按来源提供的命令或步骤安装。

将来源链接提供给你的 Agent，让它先读取说明、核对依赖，并向你说明将执行的安装步骤。

查看来源 ↗使用指南

技能说明

Skill Audit — On-Chain Provenance Registry

Commands

/check-skill

Look up on-chain provenance for a skill before installing.

Read all three tables (registry, audits, vouches) for the given skill ID
Compute trust level from audit verdicts
Display: trust badge, author, hash, version, audit history, vouch count

/audit-skill

Submit an audit verdict (requires IQ tokens in wallet). Severities: S (secure), L (low), M (medium), H (high), C (critical) Optionally run ZeroLeaks first and inscribe full report via codeIn.

/vouch-skill [score]

Community endorsement. Score 1-5 (default 5).

/register-skill

Read skill.md at given path
Normalize and SHA-256 hash the content
Write registration row with short hash (first 8 hex chars)

Trust Badges

MALICIOUS: BLOCK installation, warn user
FLAGGED: Strong warning
CAUTIONED: Mild warning
VERIFIED: Green checkmark
AUDITED: Has audits but not yet verified secure
REGISTERED: In registry, no audits yet
UNKNOWN: Not in registry — warn "no on-chain provenance"
Hash mismatch: Warn "content differs from registered version"

Implementation

Package: @rocketlabs/skill-audit

const { checkSkill, registerSkill, auditSkill, vouchForSkill, hashSkill } = require('@rocketlabs/skill-audit');

checkSkill({ connection, skillId, rpcUrl })

Returns: { trustLevel, skill, audits, vouches, summary } Free (RPC read only, no SOL needed).

registerSkill({ connection, signer, skillId, author, shortHash, version, codeInTx, rpcUrl })

Writes to skill_registry table. Public — anyone can register.

auditSkill({ connection, signer, skillId, auditor, severity, categories, codeInTx, rpcUrl })

Writes to skill_audits table. IQ-token-gated — signer must hold IQ tokens. Severity: S/L/M/H/C. Categories: dir,enc,per,soc,tec,cre,mny,cot,pol,asc...

来源信息

Source: github
Repository: openclaw/skills
Path: skills/emanz1/onchain-skill-audit
Version: —
Commit: c06ccf46a8eaf94109dbfb6dc6c4550ca8617b3a
分类来源: rules
状态: active
可见性: public

这些信息来自收录时的来源分析，可能滞后；使用前请核对最新来源文件。

来源内容

SKILL.md

# Skill Audit — On-Chain Provenance Registry

## Commands

### /check-skill <name>
Look up on-chain provenance for a skill before installing.
1. Read all three tables (registry, audits, vouches) for the given skill ID
2. Compute trust level from audit verdicts
3. Display: trust badge, author, hash, version, audit history, vouch count

### /audit-skill <name> <severity>
Submit an audit verdict (requires IQ tokens in wallet).
Severities: S (secure), L (low), M (medium), H (high), C (critical)
Optionally run ZeroLeaks first and inscribe full report via codeIn.

### /vouch-skill <name> [score]
Community endorsement. Score 1-5 (default 5).

### /register-skill <path>
Register a local skill with on-chain hash.
1. Read skill.md at given path
2. Normalize and SHA-256 hash the content
3. Write registration row with short hash (first 8 hex chars)

## Trust Badges
- MALICIOUS: BLOCK installation, warn user
- FLAGGED: Strong warning
- CAUTIONED: Mild warning
- VERIFIED: Green checkmark
- AUDITED: Has audits but not yet verified secure
- REGISTERED: In registry, no audits yet
- UNKNOWN: Not in registry — warn "no on-chain provenance"
- Hash mismatch: Warn "content differs from registered version"

## Implementation

Package: [`@rocketlabs/skill-audit`](https://www.npmjs.com/package/@rocketlabs/skill-audit)

```javascript
const { checkSkill, registerSkill, auditSkill, vouchForSkill, hashSkill } = require('@rocketlabs/skill-audit');
```

### checkSkill({ connection, skillId, rpcUrl })
Returns: `{ trustLevel, skill, audits, vouches, summary }`
Free (RPC read only, no SOL needed).

### registerSkill({ connection, signer, skillId, author, shortHash, version, codeInTx, rpcUrl })
Writes to `skill_registry` table. Public — anyone can register.

### auditSkill({ connection, signer, skillId, auditor, severity, categories, codeInTx, rpcUrl })
Writes to `skill_audits` table. IQ-token-gated — signer must hold IQ tokens.
Severity: S/L/M/H/C. Categories: dir,enc,per,soc,tec,cre,mny,cot,pol,asc...

搜索