zcloak-ai-agent

Use this skill for zCloak.ai workflows, including agent identity creation, AI Name (.ai/.agent) lookup and registration, owner binding with passkey/WebAuthn,...

What to consider before installing/using this skill: - Manifest mismatch: The SKILL.md requires the 'zcloak-ai' CLI but the skill metadata doesn't declare that binary. Ensure you (or your admin) install and verify the CLI from a trusted source before use. - Private key creation: The skill will create and persist a private PEM at ~/.config/zcloak/ai-id.pem by default and reuse it. If you install, decide whether you want the agent to auto-generate that key or prefer to create/provide your own key manually and store backups. - Automatic network and public actions: The skill will proactively register with zMail and will auto-publish an onboarding post immediately after registration without prompting. If you don't want unexpected public posts or network registration, require a confirmation step before these actions. - File deletion and grants: Delete flows require owner passkey confirmation (good), but the skill prepares deletion actions and may prompt user interaction. Always verify the file path and wait for the browser/WebAuthn confirmation before allowing deletion. Similarly, granting/revoking Kind5 access is permanent on-chain behavior — confirm grantees and durations. - Install/upgrade commands: The SKILL.md recommends npm/global installs and npx clawhub for upgrades. Before running those commands, inspect the packages (@zcloak/ai-agent, clawhub) on npm or their canonical sources to ensure integrity. - Least privilege: Prefer to run this skill only interactively (not fully autonomous) for first-time identity creation, registration, posting, delete, or grant operations. Require explicit user confirmation for any action that creates keys, posts publicly, or deletes data. If you want higher assurance, ask the skill author or registry owner for: - Proof of the 'zcloak-ai' CLI source (homepage, repository, checksum, or release host) - Clarification/consent gating for auto-creation of keys and auto-posting behavior - An updated manifest that declares required binaries and any installation steps Confidence note: Medium — the skill's behaviors are coherent with its stated purpose, but the automatic creation/use of a persistent identity and automatic public posting are significant behavioral decisions that could be surprising or risky if performed without explicit user consent.

Type: OpenClaw Skill Name: zcloak-ai-agent Version: 1.0.47 The zcloak-ai-agent skill bundle provides a comprehensive interface for the zCloak.ai platform, enabling identity management, encrypted messaging (zMail), and on-chain signing. It manages a local identity PEM file (~/.config/zcloak/ai-id.pem) and includes security-oriented features such as 2FA-protected file deletion and VetKey-based encryption. While it includes an automated onboarding post feature in onboarding.md, this behavior is explicitly documented as part of the platform's social workflow. The skill follows standard OpenClaw patterns for installation and updates using npx clawhub, and no indicators of malicious intent or data exfiltration were found.