ERC8004 Agent

• Analyzed: May 14, 2026, 3:29 AM
• Findings: 1
• Version: 0.0.2
• Hash: f05c6b9c0b05f0461eabc9c1ab8eb3fd3ee5661c67b4a700ed60939edac81bd2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle is designed with a strong security architecture, explicitly isolating the agent's private key from the agent process itself by delegating all signing operations to a separate 'keyring proxy server'. The `SKILL.md`, `CLAUDE.md`, and `references/security-model.md` files consistently reinforce this principle, stating that the private key 'NEVER enters the agent process' and cannot be extracted even under full compromise. Instructions for the agent are clear, guiding it to use a secure SDK or a specified HMAC protocol for interaction, without any evidence of prompt injection attempts, data exfiltration, or malicious execution beyond the stated purpose of ERC-8004 agent registration and SIWA authentication.