ZAP1 - Zcash Attestation

Provides cryptographic attestation for AI actions with Zcash-anchored proofs, policy enforcement, session tracking, and verifiable proof checkpoints.

This plugin will automatically hash and transmit message metadata and some content-derived hashes to an external ZAP1 service (default pay.frontiercompute.io). That behavior matches its attestation purpose but has privacy and trust implications: 1) Only configure the plugin with an API key you control (prefer a key from a self‑hosted ZAP1 instance if possible). 2) Avoid providing a highly privileged API key unless you trust the backend operator; admin tools can create API keys and list webhooks. 3) Be aware that hashed data can sometimes be reversed (short or predictable messages), so do not assume hashing alone preserves privacy. 4) The SKILL.md suggests getting a key via messaging a third party — verify the operator's identity and repository provenance (the SKILL references frontiercompute.io and a GitHub repo; confirm those links actually host the code and maintainers). 5) The package includes a package-lock.json with many extra dev dependencies — verify the published package contents and ensure no unexpected binaries are shipped. If you need this capability but want lower risk, host your own ZAP1 backend and only give the plugin a write key for that instance. If you cannot verify the backend/operator, treat this plugin as potentially leaking metadata and avoid enabling the write hooks.

Type: OpenClaw Skill Name: zap1-zcash-attestation Version: 0.2.1 The skill bundle provides a Zcash attestation layer that hashes agent activity and anchors it to the blockchain for auditability. It uses hooks (src/hooks.ts) to automatically hash and send event metadata to an external API (frontiercompute.io), and provides tools (src/tools.ts) for proof verification and protocol interaction. The behavior is transparently documented and aligned with the stated purpose, with no evidence of malicious execution or unauthorized data exfiltration.