Verified Agent Identity

Billions decentralized identity for agents. Link agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentic...

This skill appears to implement exactly what it claims: local DID/key management and challenge signing for the Billions/iden3 system. Before installing: - Review and trust the Billions domains used (billions.network, identity-dashboard.billions.network, attestation-relay.billions.network, resolver.privado.id). The skill sends request payloads to the project shortener and resolver. - Protect private keys: set BILLIONS_NETWORK_MASTER_KMS_KEY in the skill config or environment to enable AES-256-GCM encryption of keys on disk. Without this, keys are stored as plain hex in $HOME/.openclaw/billions/kms.json. - Be aware you must run npm install which will fetch packages from the public npm registry; vet package versions if you have supply-chain concerns. - Decide whether the agent should be allowed to invoke these scripts autonomously. By default the platform allows autonomous invocation; if you want explicit human approval before signing/linking, restrict automatic invocation or require a manual flow. - If you need higher assurance, inspect the included scripts yourself (they are present in the package) and confirm the shortener/callback endpoints and attestation constants are acceptable. If any of the above is unacceptable (e.g., you cannot ensure the master key is set or you do not trust the remote endpoints), do not install or run the scripts until those concerns are addressed.

Type: OpenClaw Skill Name: verified-agent-identity-7 Version: 0.1.1 The skill bundle provides a legitimate decentralized identity (DID) management system for AI agents based on the iden3 protocol and Billions Network. It includes functionality for creating identities, signing challenges, and linking agents to human owners via the Billions ERC-8004 and Attestation Registries. Security analysis of the scripts (e.g., `scripts/shared/storage/crypto.js`) reveals robust practices such as AES-256-GCM encryption for private keys at rest when a master key is provided via environment variables. Network activity is restricted to authorized DID resolvers (resolver.privado.id) and project-specific infrastructure (billions.network), with no evidence of data exfiltration, malicious execution, or harmful prompt injection.