Robot Id Card

What to check before installing - Registry endpoint: the CLI/SDK default points to a remote registry (https://registry.robotidcard.dev). If you don't trust that remote service, run your own local or self-hosted registry before registering keys. - Private keys: the CLI writes your bot private key to a local JSON file (e.g., bot.key.json). Keep that file secure; anyone with it can impersonate your bot. The code appears to keep private keys local and only sends the public key, but verify this if you plan to use third-party registry endpoints. - Browser extension: installing the extension will inject RIC headers into web requests for your browser — this is necessary for the feature but can leak a bot identity or metadata if misconfigured. Review extension code (background.ts) and VITE_REGISTRY_URL/default endpoints before enabling. - Reporting & auto-block: the public report endpoint and automatic demotion after 3 reports within 24h are features that could be abused to demote or block bots. If you host a registry, consider changing thresholds, adding reporter verification, or requiring authenticated reports. - Admin secrets: if you deploy the registry (Render/Netlify/Vercel), set a strong RIC_ADMIN_KEY and secure any deployment secrets (NPM_TOKEN for CI publishing). Do not leave defaults in production. - Supply-chain: installation runs npm install and builds multiple packages; audit dependencies or use reproducible build practices if you require higher assurance. If you want higher assurance: run the registry locally or in your own controlled environment, review/scan the browser extension and server routes for unexpected network calls, and inspect any deployed registry instance before trusting it with production bot identities.