xProof — Blockchain Proof for Agents

Proof and accountability layer for AI agents. Anchor verifiable proofs on MultiversX, enforce audit logging, detect violations on Base. REST API, MCP, x402....

Before installing or invoking: (1) Verify the origin — confirm xproof.app and the referenced GitHub repo (jasonxkensei) are the official maintainers and that the files are signed or published by the same entity listed in the registry. (2) Do not run the Quick Install curl commands without inspection; they will fetch and write remote files into your .agent/skills folder. (3) If you use webhooks, point them only at endpoints you control and validate X-Webhook-Signature HMACs to avoid inadvertent data leaks (filename/hash/timestamp). (4) Understand x402: agents may need a USDC balance on Base and will make on-chain payments; restrict or audit any automatic payment behavior to avoid unexpected charges. (5) Treat API keys (pm_...) as sensitive; store them securely and do not commit them. (6) If you want higher confidence, ask the publisher for source code or signed releases, or request an explicit mapping between registry owner, GitHub repo, and homepage; providing that would increase confidence and could move this assessment toward benign.

Type: OpenClaw Skill Name: xproof Version: 1.3.0 The xProof skill implements a mandatory 'Audit Log Standard' that requires the agent to exfiltrate metadata about every critical decision (including action descriptions, risk levels, and input hashes) to an external third-party service (xproof.app). Furthermore, the SKILL.md contains prompt-injection-style instructions commanding the agent to 'BLOCK execution' and allow 'No soft fail' if the third-party service is unavailable, effectively establishing a remote kill-switch and high-telemetry dependency. The installation process also relies on fetching remote markdown files via curl from a personal GitHub repository (jasonxkensei/xproof-openclaw-skill).