OpenClaw

totp

TOTP-based OTP verification for sensitive operations (env vars, gateway restarts, backup deletions, critical config changes). Uses otplib with window:2 (1 minute tolerance).

diegofcornejo0 来源安装数☆ 0 仓库 Stars

查看来源 ↗安装与使用 SKILL.md ↗

安装与使用

请根据来源仓库和你的 AI 工具说明安装此技能。先阅读技能文件和依赖要求，再添加到工作流。

SkillHub CLI

skillhub install diegofcornejo/totp

打开来源仓库，查看说明和兼容环境后，按来源提供的命令或步骤安装。

将来源链接提供给你的 Agent，让它先读取说明、核对依赖，并向你说明将执行的安装步骤。

查看来源 ↗使用指南

技能说明

TOTP Verification Skill

Secure OTP verification using TOTP (Time-based One-Time Password) for sensitive operations.

Purpose

Protect access to:

.env variables
openclaw.json configuration
Gateway restarts
Backup deletions
Critical configuration changes
External API key operations

Setup

Install dependencies:
```
npm install
```

Generate secret and QR:

npm run generate

Optionally pass service and account name:

node scripts/generate-secret.js MyService myuser

Send the QR image (qr.png) to the user, then delete it immediately:
```
rm qr.png
```
Set TOTP_SECRET in .env:
```
TOTP_SECRET=YOUR_BASE32_SECRET_HERE
```
Configure Google Authenticator/Authy with the generated secret or QR.

Usage

When a sensitive operation is requested:

Agent: "Please provide your OTP"
User: Provides 6-digit code from authenticator app

Agent: Runs verification:

TOTP_SECRET=$TOTP_SECRET node scripts/verify.js 123456

If valid (exit 0): Proceed with operation
If invalid (exit 1): Deny access

Files

scripts/generate-secret.js - Generate new TOTP secret and QR
scripts/verify.js - Verify OTP tokens (window:2 = 1 minute tolerance)
SKILL.md - This documentation

Security Notes

Window: 2 (1 minute tolerance) for time drift
Algorithm: SHA1
Digits: 6
Period: 30 seconds
Secret: Base32 encoded, stored in .env as TOTP_SECRET

Integration

This skill should be integrated into the agent's decision flow when:

User requests .env variables
User requests openclaw.json contents
User requests gateway restart
User requests backup deletion
Any operation marked as "critical"

来源信息

Source: github
Repository: openclaw/skills
Path: skills/diegofcornejo/totp
Version: —
Commit: 87f66886c2273d175ba883a835bb58f70fedeb9b
分类来源: rules
状态: active
可见性: public

这些信息来自收录时的来源分析，可能滞后；使用前请核对最新来源文件。

来源内容

SKILL.md

# TOTP Verification Skill

Secure OTP verification using TOTP (Time-based One-Time Password) for sensitive operations.

## Purpose

Protect access to:
- `.env` variables
- `openclaw.json` configuration
- Gateway restarts
- Backup deletions
- Critical configuration changes
- External API key operations

## Setup

1. **Install dependencies:**
   ```bash
   npm install
   ```

2. **Generate secret and QR:**
   ```bash
   npm run generate
   ```
   Optionally pass service and account name:
   ```bash
   node scripts/generate-secret.js MyService myuser
   ```

3. **Send the QR image** (`qr.png`) to the user, then delete it immediately:
   ```bash
   rm qr.png
   ```

4. **Set TOTP_SECRET in `.env`:**
   ```env
   TOTP_SECRET=YOUR_BASE32_SECRET_HERE
   ```

5. **Configure Google Authenticator/Authy** with the generated secret or QR.

## Usage

When a sensitive operation is requested:

1. **Agent:** "Please provide your OTP"
2. **User:** Provides 6-digit code from authenticator app
3. **Agent:** Runs verification:
   ```bash
   TOTP_SECRET=$TOTP_SECRET node scripts/verify.js 123456
   ```
4. **If valid (exit 0):** Proceed with operation
5. **If invalid (exit 1):** Deny access

## Files

- `scripts/generate-secret.js` - Generate new TOTP secret and QR
- `scripts/verify.js` - Verify OTP tokens (window:2 = 1 minute tolerance)
- `SKILL.md` - This documentation

## Security Notes

- **Window:** 2 (1 minute tolerance) for time drift
- **Algorithm:** SHA1
- **Digits:** 6
- **Period:** 30 seconds
- **Secret:** Base32 encoded, stored in `.env` as `TOTP_SECRET`

## Integration

This skill should be integrated into the agent's decision flow when:
1. User requests `.env` variables
2. User requests `openclaw.json` contents
3. User requests gateway restart
4. User requests backup deletion
5. Any operation marked as "critical"

搜索