{ "schemaVersion": "1.0", "item": { "slug": "onchain-skill-audit", "name": "On-Chain Skill Audit", "source": "tencent", "type": "skill", "category": "安全合规", "sourceUrl": "https://clawhub.ai/Emanz1/onchain-skill-audit", "canonicalUrl": "https://clawhub.ai/Emanz1/onchain-skill-audit", "targetPlatform": "OpenClaw" }, "install": { "downloadMode": "redirect", "downloadUrl": "/downloads/onchain-skill-audit", "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=onchain-skill-audit", "sourcePlatform": "tencent", "targetPlatform": "OpenClaw", "installMethod": "Manual import", "extraction": "Extract archive", "prerequisites": [ "OpenClaw" ], "packageFormat": "ZIP package", "includedAssets": [ "skill.md" ], "primaryDoc": "SKILL.md", "quickSetup": [ "Download the package from Yavira.", "Extract the archive and review SKILL.md first.", "Import or place the package into your OpenClaw setup." ], "agentAssist": { "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.", "steps": [ "Download the package from Yavira.", "Extract it into a folder your agent can access.", "Paste one of the prompts below and point your agent at the extracted folder." ], "prompts": [ { "label": "New install", "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete." }, { "label": "Upgrade existing", "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run." } ] }, "sourceHealth": { "source": "tencent", "status": "healthy", "reason": "direct_download_ok", "recommendedAction": "download", "checkedAt": "2026-04-23T16:43:11.935Z", "expiresAt": "2026-04-30T16:43:11.935Z", "httpStatus": 200, "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=4claw-imageboard", "contentType": "application/zip", "probeMethod": "head", "details": { "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=4claw-imageboard", "contentDisposition": "attachment; filename=\"4claw-imageboard-1.0.1.zip\"", "redirectLocation": null, "bodySnippet": null }, "scope": "source", "summary": "Source download looks usable.", "detail": "Yavira can redirect you to the upstream package for this source.", "primaryActionLabel": "Download for OpenClaw", "primaryActionHref": "/downloads/onchain-skill-audit" }, "validation": { "installChecklist": [ "Use the Yavira download entry.", "Review SKILL.md after the package is downloaded.", "Confirm the extracted package contains the expected setup assets." ], "postInstallChecks": [ "Confirm the extracted package includes the expected docs or setup files.", "Validate the skill or prompts are available in your target agent workspace.", "Capture any manual follow-up steps the agent could not complete." ] }, "downloadPageUrl": "https://openagent3.xyz/downloads/onchain-skill-audit", "agentPageUrl": "https://openagent3.xyz/skills/onchain-skill-audit/agent", "manifestUrl": "https://openagent3.xyz/skills/onchain-skill-audit/agent.json", "briefUrl": "https://openagent3.xyz/skills/onchain-skill-audit/agent.md" }, "agentAssist": { "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.", "steps": [ "Download the package from Yavira.", "Extract it into a folder your agent can access.", "Paste one of the prompts below and point your agent at the extracted folder." ], "prompts": [ { "label": "New install", "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete." }, { "label": "Upgrade existing", "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run." } ] }, "documentation": { "source": "clawhub", "primaryDoc": "SKILL.md", "sections": [ { "title": "/check-skill ", "body": "Look up on-chain provenance for a skill before installing.\n\nRead all three tables (registry, audits, vouches) for the given skill ID\nCompute trust level from audit verdicts\nDisplay: trust badge, author, hash, version, audit history, vouch count" }, { "title": "/audit-skill ", "body": "Submit an audit verdict (requires IQ tokens in wallet).\nSeverities: S (secure), L (low), M (medium), H (high), C (critical)\nOptionally run ZeroLeaks first and inscribe full report via codeIn." }, { "title": "/vouch-skill [score]", "body": "Community endorsement. Score 1-5 (default 5)." }, { "title": "/register-skill ", "body": "Register a local skill with on-chain hash.\n\nRead skill.md at given path\nNormalize and SHA-256 hash the content\nWrite registration row with short hash (first 8 hex chars)" }, { "title": "Trust Badges", "body": "MALICIOUS: BLOCK installation, warn user\nFLAGGED: Strong warning\nCAUTIONED: Mild warning\nVERIFIED: Green checkmark\nAUDITED: Has audits but not yet verified secure\nREGISTERED: In registry, no audits yet\nUNKNOWN: Not in registry — warn \"no on-chain provenance\"\nHash mismatch: Warn \"content differs from registered version\"" }, { "title": "Implementation", "body": "Package: @rocketlabs/skill-audit\n\nconst { checkSkill, registerSkill, auditSkill, vouchForSkill, hashSkill } = require('@rocketlabs/skill-audit');" }, { "title": "checkSkill({ connection, skillId, rpcUrl })", "body": "Returns: { trustLevel, skill, audits, vouches, summary }\nFree (RPC read only, no SOL needed)." }, { "title": "registerSkill({ connection, signer, skillId, author, shortHash, version, codeInTx, rpcUrl })", "body": "Writes to skill_registry table. Public — anyone can register." }, { "title": "auditSkill({ connection, signer, skillId, auditor, severity, categories, codeInTx, rpcUrl })", "body": "Writes to skill_audits table. IQ-token-gated — signer must hold IQ tokens.\nSeverity: S/L/M/H/C. Categories: dir,enc,per,soc,tec,cre,mny,cot,pol,asc,ctx,sem,too,sir,ech" }, { "title": "vouchForSkill({ connection, signer, skillId, voucher, score, rpcUrl })", "body": "Writes to skill_vouches table. Public — anyone can vouch. Score 1-5." }, { "title": "hashSkill(content)", "body": "Returns: { fullHash, shortHash } — SHA-256 of normalized content." }, { "title": "On-Chain Architecture", "body": "Program: 9KLLchQVJpGkw4jPuUmnvqESdR7mtNCYr3qS4iQLabs\nDB Root ID: skill-audit\nTables: skill_registry (public), skill_audits (IQ-gated), skill_vouches (public)\nRow limit: ~100 bytes. Full data via codeIn inscriptions.\nReads are free. Only writes cost SOL.\nAppend-only. No in-place updates. Version counter for re-registration." }, { "title": "Prerequisites", "body": "@iqlabs-official/solana-sdk v0.1.1+ (CommonJS required)\n@solana/web3.js v1.x\nSolana wallet for writes\nIQ tokens for audit writes (token mint: 3uXACfojUrya7VH51jVC1DCHq3uzK4A7g469Q954LABS)\nBuffer monkey-patch applied (handled automatically by the package)" } ], "body": "Skill Audit — On-Chain Provenance Registry\nCommands\n/check-skill \n\nLook up on-chain provenance for a skill before installing.\n\nRead all three tables (registry, audits, vouches) for the given skill ID\nCompute trust level from audit verdicts\nDisplay: trust badge, author, hash, version, audit history, vouch count\n/audit-skill \n\nSubmit an audit verdict (requires IQ tokens in wallet). Severities: S (secure), L (low), M (medium), H (high), C (critical) Optionally run ZeroLeaks first and inscribe full report via codeIn.\n\n/vouch-skill [score]\n\nCommunity endorsement. Score 1-5 (default 5).\n\n/register-skill \n\nRegister a local skill with on-chain hash.\n\nRead skill.md at given path\nNormalize and SHA-256 hash the content\nWrite registration row with short hash (first 8 hex chars)\nTrust Badges\nMALICIOUS: BLOCK installation, warn user\nFLAGGED: Strong warning\nCAUTIONED: Mild warning\nVERIFIED: Green checkmark\nAUDITED: Has audits but not yet verified secure\nREGISTERED: In registry, no audits yet\nUNKNOWN: Not in registry — warn \"no on-chain provenance\"\nHash mismatch: Warn \"content differs from registered version\"\nImplementation\n\nPackage: @rocketlabs/skill-audit\n\nconst { checkSkill, registerSkill, auditSkill, vouchForSkill, hashSkill } = require('@rocketlabs/skill-audit');\n\ncheckSkill({ connection, skillId, rpcUrl })\n\nReturns: { trustLevel, skill, audits, vouches, summary } Free (RPC read only, no SOL needed).\n\nregisterSkill({ connection, signer, skillId, author, shortHash, version, codeInTx, rpcUrl })\n\nWrites to skill_registry table. Public — anyone can register.\n\nauditSkill({ connection, signer, skillId, auditor, severity, categories, codeInTx, rpcUrl })\n\nWrites to skill_audits table. IQ-token-gated — signer must hold IQ tokens. Severity: S/L/M/H/C. Categories: dir,enc,per,soc,tec,cre,mny,cot,pol,asc,ctx,sem,too,sir,ech\n\nvouchForSkill({ connection, signer, skillId, voucher, score, rpcUrl })\n\nWrites to skill_vouches table. Public — anyone can vouch. Score 1-5.\n\nhashSkill(content)\n\nReturns: { fullHash, shortHash } — SHA-256 of normalized content.\n\nOn-Chain Architecture\nProgram: 9KLLchQVJpGkw4jPuUmnvqESdR7mtNCYr3qS4iQLabs\nDB Root ID: skill-audit\nTables: skill_registry (public), skill_audits (IQ-gated), skill_vouches (public)\nRow limit: ~100 bytes. Full data via codeIn inscriptions.\nReads are free. Only writes cost SOL.\nAppend-only. No in-place updates. Version counter for re-registration.\nPrerequisites\n@iqlabs-official/solana-sdk v0.1.1+ (CommonJS required)\n@solana/web3.js v1.x\nSolana wallet for writes\nIQ tokens for audit writes (token mint: 3uXACfojUrya7VH51jVC1DCHq3uzK4A7g469Q954LABS)\nBuffer monkey-patch applied (handled automatically by the package)" }, "trust": { "sourceLabel": "tencent", "provenanceUrl": "https://clawhub.ai/Emanz1/onchain-skill-audit", "publisherUrl": "https://clawhub.ai/Emanz1/onchain-skill-audit", "owner": "Emanz1", "version": "0.1.1", "license": null, "verificationStatus": "Indexed source record" }, "links": { "detailUrl": "https://openagent3.xyz/skills/onchain-skill-audit", "downloadUrl": "https://openagent3.xyz/downloads/onchain-skill-audit", "agentUrl": "https://openagent3.xyz/skills/onchain-skill-audit/agent", "manifestUrl": "https://openagent3.xyz/skills/onchain-skill-audit/agent.json", "briefUrl": "https://openagent3.xyz/skills/onchain-skill-audit/agent.md" } }