Self zkID verification

Integrate Self (self.xyz) — a privacy-first identity protocol using zero-knowledge proofs to verify passports and ID cards. Use when the user mentions Self protocol, Self identity, self.xyz, passport verification, zero-knowledge identity verification, SelfAppBuilder, SelfBackendVerifier, SelfVerificationRoot, or wants to add privacy-preserving KYC, age verification, nationality checks, OFAC screening, or Sybil resistance using real-world identity documents. Covers frontend QR code integration, backend proof verification, and on-chain smart contract verification on Celo.

This skill appears to do what it says (frontend QR integration, backend proof verification, optional Celo contract wiring). Before installing or using it in production: 1) Verify the npm packages (@selfxyz/qrcode, @selfxyz/core) on the npm registry and confirm they come from the official Self organization and a real source repo (the skill has no homepage/source listed). 2) Double-check the provided on-chain addresses and network naming — the docs refer to 'Celo' but also use the name 'Sepolia' (an Ethereum testnet) which is inconsistent; confirm the correct Celo testnet (e.g., Alfajores) and Hub addresses with official Self docs. 3) Use ngrok only for local testing and avoid exposing production endpoints or real user proofs during development. 4) Review what attributes you request (name, idNumber, nationality, OFAC) — these are sensitive; request only the minimum disclosures required. 5) Confirm package version compatibility (SKILL.md references a beta version) and audit the packages' source code or repository before trusting them in production. If you want higher assurance, ask the publisher for a homepage/repo or for signed package sources; absence of that increases risk and is why confidence is medium rather than high.

Type: OpenClaw Skill Name: self-xyz Version: 1.0.0 The skill bundle provides comprehensive documentation and code examples for integrating the Self identity verification protocol. All instructions and code snippets are directly related to this stated purpose, covering frontend, backend, and smart contract integration. There is no evidence of prompt injection attempts against the agent, data exfiltration, malicious execution, persistence mechanisms, or obfuscation. While the `mock passports` setting in `SelfBackendVerifier` could be a vulnerability if misused in production, it is explicitly documented as 'dev only' and a 'critical gotcha', indicating a configuration risk for the integrator rather than malicious intent from the skill itself.