← 返回 Skills 市场

Erc8004 Discover

Name: Erc8004 Discover
Author: aetherstacey

作者 aether · GitHub ↗ · v1.1.1

cross-platform ⚠ suspicious

1124

总下载

当前安装

版本数

在 OpenClaw 中安装

/install erc8004-discover

功能描述

Search and discover 43k+ AI agents registered via ERC-8004. Find agents by skill, chain, or reputation. View leaderboards, ecosystem stats, and monitor metadata changes.

使用说明 (SKILL.md)

ERC-8004 Agent Discovery

Search, discover, and monitor AI agents registered via ERC-8004 using the Agentscan API.

Use This When...

"Find agents that can do X"
"Search for a security auditor agent"
"Who are the top-rated agents?"
"What agents exist on Base?"
"Show me agent details"
"What skills do agents have?"
"Monitor an agent for changes"
"Has this agent's metadata changed?"
"Ecosystem statistics"

Commands

search

Find agents by query string.

python scripts/discover.py search "\x3Cquery>" [--chain CHAIN] [--min-rep SCORE] [--limit N]

Examples:

search "security auditor" - Find security auditors
search "trading" --chain base - Trading agents on Base
search "defi" --min-rep 50 - DeFi agents with 50+ reputation

top

Show top agents by reputation.

python scripts/discover.py top [--chain CHAIN] [--limit 20]

info

Get detailed info about a specific agent.

python scripts/discover.py info \x3Caddress|name|tokenId> [--chain CHAIN]

Shows: reputation, skills, domains, decoded metadata.

stats

Show ecosystem statistics.

python scripts/discover.py stats

Overview of total agents, per-chain breakdown, metadata coverage.

skills

List all skills/capabilities across agents.

python scripts/discover.py skills

monitor

Monitor an agent for changes.

python scripts/discover.py monitor \x3Caddress|name|tokenId> [--chain CHAIN]

Compares current state to cached state, shows diff if changed. Useful for heartbeat monitoring.

Cross-Skill Workflows

Pre-Registration Research

# 1. Check what agents already exist in your space
python scripts/discover.py search "trading bot"

# 2. See top competitors
python scripts/discover.py top --chain base --limit 10

# 3. Register your agent (from erc8004-register skill)
python scripts/register.py register --name "MyTradingBot" --description "..."

# 4. Validate registration
python scripts/register.py validate 42

Due Diligence Before Interacting

# 1. Get agent details
python scripts/discover.py info 0x1234...

# 2. Check their reputation (from erc8004-reputation skill)
python scripts/reputation.py lookup 42 --chain base

# 3. Decide whether to interact

Competitor Monitoring

# 1. Find competitors
python scripts/discover.py search "security audit"

# 2. Monitor a specific competitor
python scripts/discover.py monitor "CompetitorAgent"

# 3. Check their reputation changes
python scripts/reputation.py lookup 123 --chain base

Heartbeat Integration

Monitor agents for changes in automated pipelines:

# Cron: check if agent changed every 15 minutes
*/15 * * * * python scripts/discover.py monitor 42 >> /var/log/agent-monitor.log 2>&1

# In a monitoring script:
#!/bin/bash
output=$(python scripts/discover.py monitor 42 2>&1)
if echo "$output" | grep -q "CHANGES DETECTED"; then
    echo "Agent 42 metadata changed!" | slack-notify
fi

Cache files are stored in /tmp/erc8004-monitor-{id}.json.

Use Cases

Scenario	Command
Find specialists	`search "security auditor" --chain base --min-rep 50`
Market research	`stats` and `skills`
Due diligence	`info \x3Cagent>` then check reputation
Competitor watch	`monitor \x3Ccompetitor>`
Discovery	`search "\x3Ccapability>"`

API Source

All data from Agentscan - the ERC-8004 agent registry explorer.

Related Skills

erc8004-register: Register and manage your own agents
erc8004-reputation: Check and give reputation scores

安全使用建议

This skill appears to do what it says (discover ERC-8004 agents via Agentscan), but exercise caution before running it or enabling autonomous use. The script will fetch and decode metadata URIs returned by agents; those URIs can be data: URIs, IPFS addresses (fetched via ipfs.io), or arbitrary http/https URLs. If a metadata URI points to an internal service (for example cloud instance metadata) or an attacker-controlled host, the script will request and print that content — which could expose secrets if you forward logs to other systems. Recommendations: 1) Review the source (scripts/discover.py) yourself before running. 2) Run it in a sandboxed environment or with network restrictions if you plan to use the monitor/cron features. 3) Avoid piping output automatically to external notifiers unless you trust all monitored agents and their metadata. 4) If you deploy as an autonomous skill, add URL whitelisting or disallow non-Agentscan-hosted metadata fetching (or at minimum sanitize/inspect decoded metadata before logging/transmitting). 5) Verify Agentscan's domain and the IPFS gateway used meet your trust requirements.

功能分析

Type: OpenClaw Skill Name: erc8004-discover Version: 1.1.1 The `scripts/discover.py` file contains a Server-Side Request Forgery (SSRF) vulnerability within the `decode_metadata_uri` function. This function fetches metadata from arbitrary `http://` or `https://` URIs specified in an agent's `metadata_uri` field without sufficient validation. An attacker could register an agent with a crafted `metadata_uri` to induce the OpenClaw agent to make requests to internal network resources or other sensitive external services. While this is a significant vulnerability, there is no clear evidence of intentional malicious behavior such as data exfiltration to an attacker-controlled server or backdoor installation, aligning it with a 'suspicious' classification rather than 'malicious'.

能力评估

✓ Purpose & Capability

Name/description match the delivered functionality: the script queries Agentscan, lists/searches agents, shows stats, decodes metadata and caches monitor results. There are no unexpected env vars, binaries, or installs requested.

⚠ Instruction Scope

SKILL.md instructs running the included Python script and using monitor/cron pipelines; the code's decode_metadata_uri will fetch and parse arbitrary URIs (data: base64, http(s) URLs, and IPFS via a public gateway). That behavior can trigger requests to attacker-controlled or internal endpoints (SSRF risk) and will decode/print returned content. The SKILL.md also shows examples piping outputs to external notifiers (slack-notify), which could forward any fetched content off-host.

✓ Install Mechanism

No install spec; instruction-only plus a Python script using the standard library. Nothing is downloaded or written by an installer. Risk from install mechanism is low.

✓ Credentials

No environment variables, credentials, or config paths are requested. The script operates with public Agentscan endpoints and temporary cache files in /tmp as documented.

✓ Persistence & Privilege

always is false and the skill does not request permanent agent-wide privileges. It stores per-monitor cache files in /tmp, which is expected for this use-case.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install erc8004-discover
安装完成后，直接呼叫该 Skill 的名称或使用 /erc8004-discover 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.1.1

Fix: Added YAML frontmatter with proper name and description for ClawHub display

v1.1.0

Agent-friendly improvements: new commands, better SKILL.md, heartbeat integration

v1.0.0

Initial release: Discover and explore ERC-8004 AI agents via Agentscan API. - Search for agents by name, description, skills, chain, and reputation. - View top agents ranked by reputation. - Retrieve detailed information for any agent. - Access ecosystem statistics and metadata coverage. - List all recognized agent skills for further discovery.

元数据

Slug erc8004-discover

版本 1.1.1

许可证 —

累计安装 0

当前安装数 0

历史版本数 3

常见问题