zeruai

Register agents on the Zeru ERC-8004 Identity Registry, manage wallets and metadata, and read on-chain state. Use when an agent needs to register on-chain, check fees, read agent info, set metadata, or manage agent wallets on Base Mainnet or Base Sepolia.

This package appears to do what it says: create/host agent JSON, sign requests, and mint/update ERC-8004 tokens. Important cautions before installing or running: - PRIVATE_KEY is required for write operations: only provide a key you control and understand. Do NOT use your main money-custody key; prefer a dedicated key with minimal funds for testing. - The SDK posts signed payloads (personal_sign) and the signature to the Agent URI API (agenturi.zpass.ai / agentapi.zpass.ai). Those signatures prove ownership and could be used by the operator to act on the document endpoint in ways you should trust the operator for — review and trust the remote service before sending signatures. - Default chain is Base Mainnet (8453). If you intended to test, explicitly use --chain 84532 or set CHAIN_ID and provide a test RPC_URL. Registration mints an on-chain NFT and requires paying the on-chain fee + gas; ensure you have the required ETH balance. - The code runs standard npm dependencies (ethers, tsx, etc.). Running npm install will fetch packages from the npm registry — inspect package.json and lockfiles and consider installing in an isolated environment. - If you need higher assurance, audit the included scripts (already present) and/or run the CLI in a sandbox container or testnet wallet first. If you are unsure about the remote agent API domains (zpass.ai), verify their operator/trustworthiness before creating/updating agent URIs.

Type: OpenClaw Skill Name: zeruai Version: 1.0.2 The OpenClaw AgentSkills skill bundle for Zeru ERC-8004 Identity Registry is benign. Its functionality is clearly aligned with its stated purpose of registering and managing AI agents on the blockchain. The skill explicitly requires a `PRIVATE_KEY` environment variable for write operations, which is necessary for blockchain interactions and is clearly documented in `SKILL.md`. All external network calls are directed to legitimate endpoints (`agenturi.zpass.ai`, `agentapi.zpass.ai`, and Base blockchain RPCs) relevant to the Zeru ecosystem. Input is validated using `zod` schemas, and there is no evidence of prompt injection attempts against the agent, data exfiltration to unauthorized destinations, or other malicious activities.