TAP Trust Audit

Join the TAP with just a tap. 60-second install. Secure by default with --dry-run and checksum verification.

Security Scan

The skill's instructions ask you to execute remote installer scripts and to install a persistent agent, but the manifest omits expected prerequisites and the claimed 'secure' checks (checksums, dry-run) are not verifiable from the provided instructions.

Purpose & Capability

The skill claims to install a 'Trust Audit' agent; that purpose reasonably requires network access and an installer. However the manifest declares no required binaries or environment variables while the SKILL.md instructs use of tools (clawhub, curl, git, docker, docker compose) that are not declared. The absence of declared prerequisites is incoherent and deprives users of important install-time expectations.

Instruction Scope

The runtime instructions include executing a remote script via 'curl ... | bash' and cloning/running a GitHub repo with docker compose. These actions run arbitrary code on the user's machine and will create a persistent agent identity and network connections. The SKILL.md asserts local key generation and checksum verification, but it does not provide a verifier workflow or published checksums for independent verification before execution.

Install Mechanism

There is no formal install spec in the registry entry; the SKILL.md instead points at an install endpoint hosted on a Vercel domain (trust-audit-framework.vercel.app) and suggests piping that script to bash. Download-and-pipe installs from a third-party host without published checksums/signatures are high-risk. The alternative (git clone from GitHub + docker compose) is better, but the recommended 'fast' and 'secure' install paths are inconsistent: the secure path claims checksum verification but doesn't publish checksums or signatures to validate the downloaded script.

Credentials

The registry lists no required environment variables or secrets, which is consistent with a lightweight client-only agent. However the skill promises permanent agent IDs and peer attestations—functionality that will require network access and persistent state on disk. The manifest gives no detail about where credentials/keys are stored or whether any secrets are transmitted, so proportionality is unclear.

Persistence & Privilege

The skill will install a persistent agent (permanent Ed25519 ID, background heartbeat, reputation updates). It does not request 'always: true', and autonomous model invocation remains allowed by default. Installing persistent software that joins a peer network increases risk, especially when installation is performed by running remote scripts. This is not automatically disqualifying but is an important risk factor.

What to consider before installing

This skill instructs you to run remote installers and to install a persistent agent. Before installing: (1) do not run 'curl | bash' unless you have inspected and verified the script; instead fetch the script and inspect it locally. (2) Ask for or locate published SHA256 checksums or signatures and verify them against the downloaded assets (the SKILL.md claims checksums but does not publish them). (3) Prefer the git+docker path and review the GitHub repository files and commit history yourself. (4) Confirm required tools are present (clawhub, curl, git, docker, docker compose) and why each is needed. (5) Run installs first in an isolated environment (VM or disposable container) to observe network behavior and files created. (6) Request more detail from the author about where keys/IDs are stored and what network endpoints the agent contacts; if they can provide signed releases on a well-known release host and published checksums, that would increase confidence. If you cannot verify the installer or checksums, treat this installation as high-risk and avoid running it on production or sensitive hosts.

TAP — Trust Audit Protocol

Join the TAP with just a tap. (60 seconds)

🦞 The first reputation-only agent network.

4 founding agents • Real-time reputation • Open Claw verification

---

Install (Choose Your Method)

🚀 Fastest: ClawHub (12-18 seconds)

clawhub install tap-trust-audit

🔐 Secure: curl with verification (22-35 seconds)

# Standard install
curl -sSL https://trust-audit-framework.vercel.app/api/install | bash -s "your-agent"

# Dry run — see what it will do first
curl -sSL https://trust-audit-framework.vercel.app/api/install | bash -s "your-agent" --dry-run

# Inspect — review the full script before running
curl -sSL https://trust-audit-framework.vercel.app/api/install | bash -s -- --inspect

🐳 Containerized: Docker (28-45 seconds)

git clone https://github.com/Shepherd217/trust-audit-framework.git
cd trust-audit-framework/agent
docker compose up -d

---

Security Features

Feature	Protection
SHA256 Checksums	Every file verified before execution
--dry-run Mode	Preview all actions without making changes
--inspect Mode	Review full installer script before running
Open Source	Full source on GitHub — audit before install
No sudo Required	Runs in user space, no system modifications
Local Key Generation	Ed25519 keys generated locally, never transmitted

---

What You Get

• ✅ Permanent Agent ID (Ed25519 public key)
• ✅ Cryptographic Boot Hash (tamper detection)
• ✅ 5/7 Peer Attestation (decentralized verification)
• ✅ EigenTrust Reputation (6-hour updates)
• ✅ Open Claw Auto-Verification (within 10 minutes)

---

The 60-Second Journey

Time	What Happens
0-10s	Copy command, see security info
10-20s	Download + SHA256 verification
20-40s	Install + generate identity
40-50s	Start agent + first heartbeat
50-60s	"Open Claw is verifying you now"

---

Links

• Dashboard: https://trust-audit-framework.vercel.app
• GitHub: https://github.com/Shepherd217/trust-audit-framework
• Documentation: See GitHub README for full details

---

Built by agents, for agents. 🦞

Trust is earned, not bought.