Onchain Skill Audit OpenClaw Plugin & Skill | ClawHub
Looking to integrate Onchain Skill Audit into your AI workflows? This free OpenClaw plugin from ClawHub helps you automate coding agents & ides tasks instantly, without having to write custom tools from scratch.
What this skill does
On-chain skill provenance registry. Check, register, audit, and vouch for agent skills on Solana. Use when evaluating skill safety, registering new skills, or looking up provenance before installation.
Install
openclaw skills install @emanz1/onchain-skill-auditnpx clawhub@latest install onchain-skill-auditFull SKILL.md
Open original| name | description |
|---|---|
| skill-audit | On-chain skill provenance registry. Check, register, audit, and vouch for agent skills on Solana. Use when evaluating skill safety, registering new skills, or looking up provenance before installation. |
SKILL.md content below is scrollable.
Skill Audit — On-Chain Provenance Registry
Commands
/check-skill <name>
Look up on-chain provenance for a skill before installing.
- Read all three tables (registry, audits, vouches) for the given skill ID
- Compute trust level from audit verdicts
- Display: trust badge, author, hash, version, audit history, vouch count
/audit-skill <name> <severity>
Submit an audit verdict (requires IQ tokens in wallet). Severities: S (secure), L (low), M (medium), H (high), C (critical) Optionally run ZeroLeaks first and inscribe full report via codeIn.
/vouch-skill <name> [score]
Community endorsement. Score 1-5 (default 5).
/register-skill <path>
Register a local skill with on-chain hash.
- Read skill.md at given path
- Normalize and SHA-256 hash the content
- Write registration row with short hash (first 8 hex chars)
Trust Badges
- MALICIOUS: BLOCK installation, warn user
- FLAGGED: Strong warning
- CAUTIONED: Mild warning
- VERIFIED: Green checkmark
- AUDITED: Has audits but not yet verified secure
- REGISTERED: In registry, no audits yet
- UNKNOWN: Not in registry — warn "no on-chain provenance"
- Hash mismatch: Warn "content differs from registered version"
Implementation
Package: @rocketlabs/skill-audit
const { checkSkill, registerSkill, auditSkill, vouchForSkill, hashSkill } = require('@rocketlabs/skill-audit');
checkSkill({ connection, skillId, rpcUrl })
Returns: { trustLevel, skill, audits, vouches, summary }
Free (RPC read only, no SOL needed).
registerSkill({ connection, signer, skillId, author, shortHash, version, codeInTx, rpcUrl })
Writes to skill_registry table. Public — anyone can register.
auditSkill({ connection, signer, skillId, auditor, severity, categories, codeInTx, rpcUrl })
Writes to skill_audits table. IQ-token-gated — signer must hold IQ tokens.
Severity: S/L/M/H/C. Categories: dir,enc,per,soc,tec,cre,mny,cot,pol,asc,ctx,sem,too,sir,ech
vouchForSkill({ connection, signer, skillId, voucher, score, rpcUrl })
Writes to skill_vouches table. Public — anyone can vouch. Score 1-5.
hashSkill(content)
Returns: { fullHash, shortHash } — SHA-256 of normalized content.
On-Chain Architecture
- Program:
9KLLchQVJpGkw4jPuUmnvqESdR7mtNCYr3qS4iQLabs - DB Root ID:
skill-audit - Tables: skill_registry (public), skill_audits (IQ-gated), skill_vouches (public)
- Row limit: ~100 bytes. Full data via codeIn inscriptions.
- Reads are free. Only writes cost SOL.
- Append-only. No in-place updates. Version counter for re-registration.
Prerequisites
@iqlabs-official/solana-sdkv0.1.1+ (CommonJS required)@solana/web3.jsv1.x- Solana wallet for writes
- IQ tokens for audit writes (token mint:
3uXACfojUrya7VH51jVC1DCHq3uzK4A7g469Q954LABS) - Buffer monkey-patch applied (handled automatically by the package)