Tencent SkillHub · AI

AgentPin

Provides domain-anchored cryptographic identity verification for AI agents using ES256 JWTs, TOFU key pinning, revocation, and delegation chain checks.

skill openclawclawhub Free

0 Downloads

0 Stars

0 Installs

0 Score

High Signal

Provides domain-anchored cryptographic identity verification for AI agents using ES256 JWTs, TOFU key pinning, revocation, and delegation chain checks.

⬇ 0 downloads ★ 0 stars Unverified but indexed

Install for OpenClaw

Quick setup

Download the package from Yavira.
Extract the archive and review SKILL.md first.
Import or place the package into your OpenClaw setup.

Requirements

Target platform: OpenClaw
Install method: Manual import
Extraction: Extract archive
Prerequisites: OpenClaw
Primary doc: SKILL.md

Package facts

Download mode: Yavira redirect
Package format: ZIP package
Source platform: Tencent SkillHub
What's included: CHANGELOG.md, SKILL.md

Validation

Use the Yavira download entry.
Review SKILL.md after the package is downloaded.
Confirm the extracted package contains the expected setup assets.

Install with your agent

Agent handoff

Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.

Download the package from Yavira.
Extract it into a folder your agent can access.
Paste one of the prompts below and point your agent at the extracted folder.

New install

I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete.

Upgrade existing

I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run.

Open Send to Agent page Open JSON manifest Open Markdown brief

Trust & source

Release facts

Source: Tencent SkillHub
Verification: Indexed source record
Version: 1.0.0

Provenance

Publisher: jaschadub
Source page: View original listing
Canonical URL: Open canonical page

Documentation

ClawHub primary doc Primary doc: SKILL.md 24 sections Open source page

AgentPin Development Skills Guide

Purpose: This guide helps AI assistants work with AgentPin for domain-anchored cryptographic agent identity verification. For Full Documentation: See the README and Technical Specification.

What AgentPin Does

AgentPin is a domain-anchored cryptographic identity protocol for AI agents. It enables organizations to publish verifiable identity documents for their agents, issue short-lived JWT credentials, and verify agent identity through a multi-step protocol including TOFU key pinning, revocation checking, and delegation chains. Part of the ThirdKey trust stack: SchemaPin (tool integrity) → AgentPin (agent identity) → Symbiont (runtime)

Architecture

Organization Verifying Party ──────────── ─────────────── 1. Generate ECDSA P-256 keypair 2. Publish agent identity at 3. Discover identity from /.well-known/agent-identity.json /.well-known/agent-identity.json 4. Issue JWT credential 5. Verify credential (12-step flow) (ES256 signed, short-lived) - JWT parsing & ES256 verification - Domain binding check - TOFU key pinning - Revocation checking - Capability validation - Delegation chain verification

Project Structure

crates/ ├── agentpin/ Core library (no mandatory HTTP dep) ├── agentpin-cli/ CLI binary (keygen, issue, verify, bundle) └── agentpin-server/ Axum server for .well-known endpoints

Rust (CLI)

# Generate keys cargo run -p agentpin-cli -- keygen \ --output-dir ./keys --agent-name "my-agent" # Issue a credential (ES256 JWT, 1-hour TTL) cargo run -p agentpin-cli -- issue \ --key ./keys/my-agent.private.pem \ --issuer "https://example.com" \ --agent-id "my-agent" \ --capabilities read,write --ttl 3600 # Verify offline cargo run -p agentpin-cli -- verify \ --credential ./credential.jwt \ --discovery ./agent-identity.json # Verify online (fetches from .well-known) cargo run -p agentpin-cli -- verify \ --credential ./credential.jwt --domain example.com # Create trust bundle for air-gapped environments cargo run -p agentpin-cli -- bundle \ --discovery ./agent-identity.json \ --revocation ./revocations.json --output ./bundle.json

Rust (Library)

use agentpin::{ crypto, credential::CredentialBuilder, verification::verify_credential, pinning::KeyPinStore, }; let (private_key, public_key) = crypto::generate_keypair()?; let credential = CredentialBuilder::new() .issuer("https://example.com") .agent_id("my-agent") .capability("read") .capability("write") .ttl_secs(3600) .sign(&private_key)?; let result = verify_credential(&credential, &discovery_doc, &pin_store)?;

JavaScript

npm install agentpin import { generateKeypair, issueCredential, verifyCredential, KeyPinStore } from 'agentpin'; // Generate ECDSA P-256 keypair const { privateKey, publicKey } = await generateKeypair(); // Issue a credential const credential = await issueCredential(privateKey, { issuer: 'https://example.com', agentId: 'my-agent', capabilities: ['read', 'write'], ttlSecs: 3600, }); // Verify const pinStore = new KeyPinStore(); const result = await verifyCredential(credential, discoveryDoc, pinStore);

Python

pip install agentpin from agentpin.crypto import generate_keypair from agentpin.credential import issue_credential from agentpin.verification import verify_credential from agentpin.pinning import KeyPinStore private_key, public_key = generate_keypair() credential = issue_credential( private_key, issuer="https://example.com", agent_id="my-agent", capabilities=["read", "write"], ttl_secs=3600, ) pin_store = KeyPinStore() result = verify_credential(credential, discovery_doc, pin_store)

Serve .well-known Endpoints

cargo run -p agentpin-server -- \ --identity ./agent-identity.json \ --revocation ./revocations.json \ --port 3000 Serves: GET /.well-known/agent-identity.json (Cache-Control: max-age=3600) GET /.well-known/agent-identity-revocations.json (Cache-Control: max-age=300) GET /health

Key Modules

ModulePurposecryptoECDSA P-256 signing/verification (no external JWT crate)typesCore data structures (agents, credentials, capabilities)credentialJWT issuance and parsingdiscoveryPublishing and resolving agent identity documentsverification12-step credential validation flowrevocationChecking revoked credentials/agents/keyspinningTOFU key pinning with JWK thumbprintsdelegationDelegation chain validationmutualChallenge-response mutual authentication (128-bit nonces)jwkJWK handling and thumbprint computationresolverPluggable discovery resolution

Language API Reference

OperationRustJavaScriptPythonGenerate keyscrypto::generate_keypair()generateKeypair()generate_keypair()Issue credentialCredentialBuilder::new().sign()issueCredential()issue_credential()Verify credentialverify_credential()verifyCredential()verify_credential()Key pinningKeyPinStoreKeyPinStoreKeyPinStoreTrust bundleTrustBundle::from_json()TrustBundle.fromJson()TrustBundle.from_json()Mutual authMutualAuth::challenge()createChallenge()create_challenge()

Feature Flags

FeaturePurposefetchEnables HTTP via reqwest for online discovery(default)Core library with no HTTP dependency

ES256 Only

AgentPin exclusively uses ES256 (ECDSA P-256). All other algorithms are rejected. This is enforced inline without an external JWT crate.

12-Step Verification

The credential verification flow includes: JWT structure parsing Header algorithm validation (ES256 only) Signature verification Issuer domain extraction Discovery document resolution Domain binding verification Key matching (issuer key vs discovery) TOFU key pinning check Expiration validation Revocation checking Capability validation Delegation chain verification (if present)

TOFU Key Pinning

On first credential verification for a domain, the agent's public key (JWK thumbprint) is pinned. Subsequent verifications reject different keys for the same domain — detecting key substitution attacks.

Delegation Chains

Agents can delegate capabilities to sub-agents. The delegation chain is validated to ensure: Each link is signed by the delegator Capabilities only narrow (never widen) down the chain Chain depth limits are respected

Mutual Authentication

Challenge-response protocol with 128-bit nonces for bidirectional agent identity verification.

Discovery Document Format

Published at /.well-known/agent-identity.json: { "schema_version": "0.2", "domain": "example.com", "agents": [ { "agent_id": "my-agent", "display_name": "My Agent", "description": "A helpful agent", "capabilities": ["read", "write"], "public_key_jwk": { ... }, "constraints": { "max_ttl_secs": 86400, "allowed_scopes": ["api"] } } ], "revocation_endpoint": "https://example.com/.well-known/agent-identity-revocations.json", "directory_listing": true }

Trust Bundles (Offline / Air-Gapped)

Pre-package discovery + revocation data for environments without internet: from agentpin.bundle import TrustBundle bundle = TrustBundle.from_json(bundle_json_str) discovery = bundle.find_discovery("example.com") revocation = bundle.find_revocation("example.com")

Pluggable Discovery Resolvers

from agentpin.discovery import ( WellKnownResolver, # HTTP .well-known lookups DnsTxtResolver, # DNS TXT record lookups ManualResolver, # Pre-configured discovery data )

Directory Listing

Domains can advertise all their agents via "directory_listing": true in the discovery document. Verifiers can enumerate available agents before issuing challenges.

Build and Test

# Build all crates cargo build --workspace # Run all tests cargo test --workspace # Lint cargo clippy --workspace # Format check cargo fmt --check

Conventions

Rust edition 2021, MSRV 1.70 cargo clippy --workspace must pass with zero warnings cargo fmt --check must pass Inline tests in source files (#[cfg(test)] mod tests) ES256 only — reject all other algorithms Feature-gated HTTP: fetch feature enables reqwest

Pro Tips for AI Assistants

ES256 only — never accept RS256, HS256, or any other algorithm Short-lived credentials — prefer TTLs of hours, not days Always check revocation before trusting a credential TOFU pinning means first-seen key is trusted — warn on key changes Delegation chains should narrow capabilities, never widen them No external JWT crate — algorithm validation is controlled inline to prevent algorithm confusion attacks Feature-gate HTTP — use the fetch feature only when online discovery is needed; default is offline-capable Cross-compatible with SchemaPin — both use ECDSA P-256, same crypto primitives Trust bundles are ideal for CI/CD and air-gapped deployments — pre-package discovery + revocation data JavaScript and Python SDKs provide identical verification guarantees to the Rust crate

Category context

Agent frameworks, memory systems, reasoning layers, and model-native orchestration.

Source: Tencent SkillHub

Largest current source with strong distribution and engagement signals.

Package contents

Included in package

2 Docs

SKILL.md Primary doc
CHANGELOG.md Docs