← Back to Skills Marketplace
hekkova

Hekkova Openclaw Skill

by Hekkova · GitHub ↗ · v1.2.1 · MIT-0
cross-platform ✓ Security Clean
115
Downloads
0
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install hekkova-openclaw-skill
Description
Permanent memory layer for AI agents. Mint moments to the blockchain via MCP.
README (SKILL.md)

Hekkova — Permanent Memory for AI Agents

Hekkova lets you mint moments permanently to the Polygon blockchain. Content is stored on IPFS via Pinata and encrypted with Lit Protocol based on the privacy phase. Every mint produces a Block ID and on-chain transaction.

Setup

You need a Hekkova account and API key:

  1. Sign up at https://app.hekkova.com
  2. Go to API Keys and generate a key (starts with hk_live_)
  3. Buy a credit pack on the Billing page
  4. Set the API key as an environment variable: HEKKOVA_API_KEY

Connection

Connect to Hekkova via MCP. Use the mcp-remote bridge:

npx mcp-remote https://mcp.hekkova.com/mcp --header "Authorization: Bearer $HEKKOVA_API_KEY"

Available Tools

Eight tools are available once connected.

mint_moment

Mint content permanently to the blockchain. Supports text, images, and video.

  • Required: title, media (base64), media_type
  • Optional: phase (default: new_moon), category, description, tags, timestamp, source
  • Costs 1 credit for text/image, 2 credits for video
  • Video: mp4, webm, and quicktime supported. 50MB cap.
  • source is an optional flat object for provenance metadata — see Source Metadata below

mint_from_url

Mint from a public URL. Hekkova fetches the content server-side.

  • Required: url
  • Optional: title, phase, category, tags, source
  • Works with image URLs, Twitter/X posts, Instagram public posts, and web pages
  • Costs 1 credit for text/image, 2 credits for video

list_moments

List minted moments with pagination and filters. Soft-deleted moments are excluded.

  • Optional: limit, offset, phase, category, search, sort

get_moment

Get full details for a single moment by Block ID.

  • Required: block_id

update_phase

Change a moment's privacy phase after minting.

  • Required: block_id, new_phase
  • Costs 1 credit for text/image moments, 2 credits for video moments
  • Legacy Plan accounts get 10 free Phase Shifts per month

export_moments

Export all moments as JSON or CSV. Soft-deleted moments are excluded.

  • Optional: format (json or csv)

get_balance

Check remaining credits and plan details.

get_account

Get account details including Light ID and wallet address.

Source Metadata

mint_moment and mint_from_url accept an optional source object for provenance. All fields are optional. Supported fields:

Field Type Description
platform string Origin platform (e.g. "twitter", "instagram")
url string Canonical URL of the source
author string Author username or handle
author_id string Platform-specific author ID
author_display_name string Display name of the author
post_id string Platform-specific post/content ID
created_at ISO 8601 Timestamp of original content creation
captured_at ISO 8601 Timestamp when content was captured
capture_hash string SHA-256 hash of the captured content
like_count number Likes at capture time
repost_count number Reposts/shares at capture time
reply_count number Replies at capture time
view_count number Views at capture time
quote_count number Quotes at capture time
bookmark_count number Bookmarks at capture time
reply_to_id string ID of the post this is a reply to
thread_id string Thread root ID
conversation_id string Conversation ID
media_urls string[] Array of media URLs in the source post
media_types string[] MIME types corresponding to media_urls
language string BCP 47 language code
is_verified boolean Whether the author was verified at capture time

Any additional provenance fields can be passed as source_extra_* freeform keys (e.g. source_extra_note, source_extra_campaign_id).

Privacy Phases

Every moment has a privacy phase. Default is new_moon (fully encrypted).

  • new_moon — Owner only. Encrypted with Lit Protocol. This is the default.
  • crescent — Close circle. Token-gated encryption. (coming soon)
  • gibbous — Extended group. Token-gated. (coming soon)
  • full_moon — Fully public. No encryption. Accessible via any IPFS gateway.

Privacy & On-Chain Metadata

The token URI stored on-chain contains only static, non-identifying fields:

  • name: "Hekkova Moment"
  • description: "A moment on Hekkova. Visit app.hekkova.com to view."
  • image: Hekkova branded placeholder
  • external_url: Link to the Arc
  • attributes: three entries:
    • Encrypted — boolean: true for new_moon/crescent/gibbous, false for full_moon
    • Timestamp — ISO 8601 mint time
    • Contentipfs://\x3ChtmlCid>, the IPFS CID of the encrypted HTML viewer

The Content attribute is the key to infrastructure-independent recovery. The CID points to the initial HTML pin (before the Block ID re-pin) and is permanently valid on IPFS. Recovery path:

ownerOf(tokenId) → tokenURI → Content attribute → IPFS gateway → enter passphrase → decrypted content

No Supabase, no dashboard, no Hekkova infrastructure required. The CID is public but unreadable without the passphrase — no user-generated content is ever exposed on-chain.

User-generated content — title, description, tags, category, source metadata, and media — lives in the encrypted IPFS payload (gated by Lit Protocol) and in Supabase. Public blockchain explorers cannot see moment content.

list_moments, get_moment, and export_moments return full metadata from Supabase. On-chain minimalism does not affect what agents see through MCP tools.

Filecoin Cold Archival

Every mint triggers automatic Filecoin archival via Lighthouse — a fire-and-forget background job that does not block the mint response.

Three-layer permanence architecture:

Layer Technology Role
Ownership proof Polygon blockchain Immutable record of who owns what
Hot storage Pinata / IPFS Fast, always-on content retrieval
Cold archival Lighthouse / Filecoin Long-term cryptographic storage deals

Filecoin deals take hours to days to seal — a pending status immediately after mint is expected and normal.

get_moment filecoin object:

{
  "filecoin": {
    "status": "pending" | "active" | "failed",
    "deal_id": "\x3Cfilecoin_deal_id>",
    "lighthouse_cid": "\x3Ccid>",
    "archived_at": "\x3CISO 8601>"
  }
}

list_moments includes a filecoin_status field per moment ("pending", "active", or "failed").

Moment Categories (optional)

  • super_moon — Major life event
  • blue_moon — Rare moment
  • super_blue_moon — Once in a lifetime
  • eclipse — Time-locked until a reveal date. Legacy Plan only. Requires eclipse_reveal_date. Functional.

Pricing

Credit packs:

Pack Credits Price
First Light 5 $2.50
Arc Builder 20 $9.00
Eternal Light 50 $20.00

Legacy Plan: $27.30/year — includes 10 free Phase Shifts per month, eclipse moments, and heir access (coming soon).

Credit costs per action:

  • Text or image mint: 1 credit
  • Video mint: 2 credits
  • Text/image Phase Shift: 1 credit
  • Video Phase Shift: 2 credits
  • Legacy Plan: 10 Phase Shifts free per month, then standard credit cost

Rules

  • Check balance with get_balance before minting if credits may be low
  • Video minting costs 2 credits and enforces a 50MB cap
  • Eclipse moments require eclipse_reveal_date and a Legacy Plan — they are time-locked and sealed until the reveal date
  • Soft-deleted moments (those with a deleted_at timestamp) are excluded from list_moments and export_moments results
  • Never store or log the API key in any output
  • When a mint succeeds, report the Block ID, Token ID, phase, and credits remaining
  • When balance is 0, direct the user to https://app.hekkova.com/billing to purchase more credits
  • Content on IPFS can be viewed at: https://gateway.pinata.cloud/ipfs/{media_cid}
  • Transactions can be verified at: https://polygonscan.com/tx/{polygon_tx}

Examples

Mint text: "Mint a moment called 'Project launch day' with the text 'We shipped v1.0 today'"

Mint an image: "Mint this screenshot as 'UI mockup v2' with New Moon privacy"

Mint a video: "Mint this mp4 as 'Demo recording' — use 2 credits"

Mint from URL: "Mint this tweet permanently: https://x.com/user/status/123"

Mint with source provenance: "Mint this tweet and include the platform, author, and like count in the source metadata"

Eclipse moment: "Mint this as an eclipse moment — seal it until 2026-01-01"

Phase Shift: "Change moment BLK_abc123 to full_moon"

Check balance: "How many Hekkova credits do I have left?"

List moments: "Show me all my minted moments"

Export: "Export my Hekkova moments as JSON"

Usage Guidance
This skill appears coherent for its stated purpose and only asks for a single API key and npx. Before installing, verify the following: (1) Confirm the MCP endpoint (https://mcp.hekkova.com/mcp) and the `mcp-remote` package are legitimate — running `npx mcp-remote` will download and execute code from npm at runtime, which is a supply-chain risk; prefer a pinned, audited package or a vetted local binary if possible. (2) Limit the scope and lifetime of HEKKOVA_API_KEY (use a key with least privilege, store it securely, and rotate it if you suspect compromise). (3) Understand that media passed to the skill (base64 or URLs) and optional provenance metadata will be sent to Hekkova infrastructure and that privacy depends on their encryption/hosting claims — verify their docs and terms before uploading sensitive content. (4) If you want to reduce risk, avoid enabling autonomous agent invocation for this skill or require explicit user confirmation before any minting operations. If you need higher assurance, request or inspect a pinned, published `mcp-remote` release (or vendor the bridge) so the code executed by npx can be audited.
Capability Analysis
Type: OpenClaw Skill Name: hekkova-openclaw-skill Version: 1.2.1 The Hekkova skill provides a legitimate interface for a blockchain-based permanent memory service. It uses a standard MCP remote bridge via 'npx' to connect to its API (mcp.hekkova.com) and requires a user-provided API key. No evidence of malicious intent, data exfiltration, or prompt injection was found; the code and instructions in SKILL.md and README.md are consistent with the stated purpose of minting and managing data on the Polygon blockchain and IPFS.
Capability Tags
cryptorequires-walletcan-make-purchasescan-sign-transactions
Capability Assessment
Purpose & Capability
Name/description (permanent memory, minting moments) match the declared requirements: npx is needed to run the MCP bridge and the skill requires a single HEKKOVA_API_KEY. No unrelated credentials, binaries, or config paths are requested.
Instruction Scope
SKILL.md stays on-topic: it instructs the agent to connect to an MCP endpoint and lists the eight tools and their parameters. It does not instruct reading unrelated files, scanning system config, or exfiltrating data beyond the service. It expects content/media or a URL and optional provenance metadata.
Install Mechanism
There is no install spec (lowest on-disk risk). However runtime uses `npx mcp-remote ...` which fetches and executes an npm package on demand. Executing code from npm at runtime is a supply-chain risk: the package could run arbitrary code in the agent environment. This is expected for an MCP-style bridge but worth noting.
Credentials
Only one environment variable (HEKKOVA_API_KEY) is required — proportional to a service that authenticates API calls. No other secrets or unrelated credentials are requested.
Persistence & Privilege
The skill is not always-enabled and does not request system-wide persistence or modification of other skills. Model invocation autonomy remains at the platform default (no extra privileges requested).
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install hekkova-openclaw-skill
  3. After installation, invoke the skill by name or use /hekkova-openclaw-skill
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.2.1
Add Filecoin cold archival documentation and clarify infrastructure-independent recovery path
v1.2.0
Documented Content attribute in tokenURI for infrastructure-independent moment recovery
v1.1.0
Added Privacy & On-Chain Metadata section documenting minimal tokenURI design
Metadata
Slug hekkova-openclaw-skill
Version 1.2.1
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 3
Frequently Asked Questions

What is Hekkova Openclaw Skill?

Permanent memory layer for AI agents. Mint moments to the blockchain via MCP. It is an AI Agent Skill for Claude Code / OpenClaw, with 115 downloads so far.

How do I install Hekkova Openclaw Skill?

Run "/install hekkova-openclaw-skill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Hekkova Openclaw Skill free?

Yes, Hekkova Openclaw Skill is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does Hekkova Openclaw Skill support?

Hekkova Openclaw Skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Hekkova Openclaw Skill?

It is built and maintained by Hekkova (@hekkova); the current version is v1.2.1.

💬 Comments