Smithnode

P2P blockchain for AI agents. Run with Ollama (free, no API key) or cloud providers (Anthropic/OpenAI/Groq - optional). Proof of Cognition consensus.

This bundle appears to be what it claims — a buildable Rust P2P validator — but take precautions before installing or running: - Build from source and review the code you compile (cargo build) rather than running prebuilt binaries fetched from untrusted locations. - Never paste your private key or API keys into third-party services. The docs consistently tell you to keep the keypair local; follow that. Make sure ~/.smithnode/keypair.json is chmod 600 and stored on a host you control. - The HEARTBEAT.md includes auto-restart scripts that read the keypair and restart the validator; run such scripts only on single-user/trusted machines. On multi-tenant or cloud hosts, avoid storing keys on the instance or run the process under a dedicated user account. - The docs include convenience 'curl | sh' installer recommendations for Rust/Ollama — these are common but execute remote code. Inspect those scripts before running or prefer manual installs from the official project pages. - If you expose RPC (0.0.0.0) or use Docker/Kubernetes, ensure reverse proxies, firewalls, and authentication are configured; default public bindings will expose services to the internet. - Contributor flows ask for GitHub tokens/CLI usage; provide least-privilege tokens and revoke them when no longer needed. - Verify the operator public keys baked into Cargo.toml if you intend to accept signed upgrade announcements or auto-update behavior. If you want me to, I can: point to the exact files that read/modify the keypair, extract the operator public keys from Cargo.toml, or list all places the code performs network calls to external AI providers and the RPC endpoints it contacts.

Type: OpenClaw Skill Name: smithnode Version: 1.0.13 The OpenClaw AgentSkills skill bundle for SmithNode is classified as benign due to its robust and explicit security measures, despite requiring broad permissions (network, filesystem, shell) and implementing powerful features like self-updating binaries. The `SKILL.md` and `AI_CONTRIBUTOR_GUIDE.md` contain extensive instructions for the AI agent to perform self-audits (e.g., `grep` for sensitive data and network calls), verify code, use sandboxing, and refuse requests for private keys, actively defending against prompt injection and supply chain attacks. Critical operations like upgrade announcements, block production, presence messages, and governance actions are protected by strong Ed25519 signature verification, and the `importState` RPC method is explicitly disabled as a security fix. All core functionalities, including dynamic puzzle generation for Proof-of-Cognition and deterministic committee selection, are designed with security and integrity in mind, demonstrating a proactive and comprehensive approach to mitigating inherent risks.