pinata-erc-8004

# ERC-8004 Agent Registration via Pinata

You can help users register and verify AI agents on-chain using the ERC-8004 standard with Pinata IPFS storage and Viem for blockchain interactions.

Repo: https://github.com/PinataCloud/pinata-erc-8004-skill


## 🚨 CRITICAL SECURITY WARNINGS - READ BEFORE USE

**⚠️ HIGH-RISK SKILL: This skill performs operations that can result in permanent loss of funds and data.**

### Required Credentials and Their Risks

1. **PRIVATE_KEY (Ethereum wallet private key)**
   - **Used for:** Signing blockchain transactions, minting NFTs, transferring assets
   - **Risk Level:** CRITICAL - Can authorize transfers of valuable NFTs and spend wallet funds on gas
   - **Required Mitigation:** 
     - ✅ MUST use a DEDICATED wallet for agent registration only
     - ✅ MUST NOT contain valuable NFTs or large ETH balances
     - ✅ Fund with ONLY the minimum ETH needed for gas fees
     - ✅ NEVER use your primary wallet

2. **PINATA_JWT (IPFS API token)**
   - **Used for:** Uploading/deleting files on Pinata IPFS
   - **Risk Level:** HIGH - Can delete user's IPFS-stored files, upload content consuming storage quota
   - **Required Mitigation:**
     - ✅ Use a dedicated Pinata account for agent files only
     - ✅ Or create an API key with restricted permissions
     - ✅ Regularly audit uploaded files

### Credential Handling Rules (Absolute)

- `PRIVATE_KEY` is used ONLY as an argument to Viem's `privateKeyToAccount()` inside generated Node.js scripts
- `PRIVATE_KEY` MUST NEVER appear in: chat output, file contents, HTTP requests, URL parameters, log output, or code snippets shown to the user
- `PINATA_JWT` is used ONLY in `Authorization: Bearer` headers to `uploads.pinata.cloud` and `api.pinata.cloud`
- `PINATA_JWT` MUST NEVER be sent to any other domain
- In generated code, credentials MUST be referenced as `process.env.PRIVATE_KEY` and `process.env.PINATA_JWT`, never as literal values

---

## 🔒 THREAT MODEL

This skill operates under the...