Receipts Guard

ERC-8004 identity, x402 payments, and arbitration protocol for autonomous agent commerce. The three rails for the machine economy.

This skill implements on-chain identity, payments, and arbitration and includes Node code that will create and store keys, talk to blockchain RPC endpoints, and can run as a persistent HTTP service. Before installing or running it: 1) Treat RECEIPTS_WALLET_PRIVATE_KEY and any API keys as highly sensitive — do NOT export a long-term mainnet private key into an environment on a shared machine; prefer ephemeral wallets or a signing service/hardware wallet. 2) Inspect the full capture.js (the bundle here is truncated) to verify where secrets are written, whether keys are encrypted at rest, and what external endpoints are contacted. 3) Confirm the skill author and provenance (homepage is missing and owner identity is opaque); the included SECURITY_AUDIT.md appears to be an internal/self-audit—confirm its independence. 4) If you must run it, do so in an isolated environment (container or VM) with limited network access and use testnet/ephemeral keys first. 5) Ask the author to update registry metadata to explicitly list required env vars (wallet key, RPC endpoints, Moltbook key) and to document key-encryption, telemetry, and network endpoints used. These steps will reduce the risk of accidentally exposing private keys or running an unexpectedly persistent service.

Type: OpenClaw Skill Name: receipts-guard Version: 0.7.1 The OpenClaw AgentSkills bundle 'receipts-guard' is classified as benign. While it implements powerful features like cryptographic key management, on-chain transactions using a private key, and an HTTP server, these capabilities are directly aligned with its stated purpose as an 'arbitration protocol for autonomous agent commerce'. The `SKILL.md` documentation provides clear instructions for the agent's operation without any evidence of prompt injection attempts to subvert the agent's core directives or exfiltrate unrelated data. The `capture.js` code demonstrates robust security practices, including restricted file permissions (e.g., `0o600` for private keys in `~/.openclaw/receipts/identity/private/`), strong Ed25519 cryptography with replay protection, and a security-hardened HTTP server featuring rate limiting, configurable CORS, API key authentication, DID request signing, and input validation. The `SECURITY_AUDIT.md` further confirms a proactive approach to security, detailing a fixed file permission vulnerability and outlining future enhancements. All identified high-risk capabilities are necessary for the skill's functionality and are handled with appropriate warnings and secure configuration expectations (e.g., `RECEIPTS_WALLET_PRIVATE_KEY` as an environment variable).