Abdullahi AI Agent

Billions decentralized identity for agents. Link agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentic...

Security Scan

The skill's code and instructions mostly match an identity-management tool (creating DIDs, signing challenges, storing keys), but metadata mismatches and on-disk key handling raise coherence and risk questions you should resolve before installing.

Purpose & Capability

The scripts implement DID creation, signing, verification and linking to human identities on the Billions network — which matches the described purpose. However the registry metadata (skill name/slug: 'Abdullahi AI Agent' / 'abdullahi-agent') does not match the packaged project (files indicate 'verified-agent-identity' / 'verified-agent-identity' in README and _meta.json), and owner IDs differ. This mismatch suggests the package may have been repackaged or mis-labelled in the registry.

Instruction Scope

SKILL.md instructs running npm install and the contained node scripts. The runtime instructions limit operations to managing identities and explicitly prohibit ad-hoc cryptographic operations or touching unrelated system files. The scripts only access process.env.BILLIONS_NETWORK_MASTER_KMS_KEY (optional) and process.env.HOME (for $HOME/.openclaw/billions storage) and perform network calls only to DID resolver and Billions domains referenced in constants.js. No instructions request unrelated credentials or file system access beyond the stated storage directory.

Install Mechanism

There is no install spec in the registry (instruction-only skill), but SKILL.md requires running 'cd scripts && npm install' which pulls dependencies from the npm registry. Dependencies are standard identity/crypto packages (polygonid, iden3, ethers, uuid). No downloads from arbitrary URLs or extract-from-untrusted-host steps are present in the install instructions or package files.

Credentials

The only declared optional environment variable is BILLIONS_NETWORK_MASTER_KMS_KEY, which is appropriate for encrypting on-disk keys. However, by default (when the variable is absent) private keys are stored in plaintext under $HOME/.openclaw/billions/kms.json. The skill also recommends storing the master key in the OpenClaw skill config, which would place a high-value secret into agent configuration — users should evaluate whether that config is stored/accessible to other processes. These storage behaviors are proportional to the skill's purpose but carry noticeable security implications that must be explicitly accepted.

Persistence & Privilege

The skill writes persistent data to $HOME/.openclaw/billions (kms.json, identities.json, defaultDid.json, challenges.json). It does not request always: true or modify other skills. Persistent storage of private keys and identity data is expected for this purpose, but persistence combined with plaintext storage (without master key) increases risk if the host is not secured.

What to consider before installing

What to check before installing: - Metadata mismatch: the registry entry (name/slug/owner) does not match the packaged project files (verified-agent-identity). Confirm you are installing the official Billions/verified-agent-identity skill from a trusted publisher and homepage (https://billions.network/) rather than a repackaged copy. Ask the publisher or registry maintainer to explain the mismatch. - Private key storage: the skill stores keys under $HOME/.openclaw/billions. If you do not set BILLIONS_NETWORK_MASTER_KMS_KEY, keys will be written as plaintext to disk. If you set the master key, it will be used to encrypt keys; however you must store the master key somewhere (skill config, env) — ensure that location is secure and not accessible by untrusted processes. - Network endpoints: the code makes network calls to resolver.privado.id and several billions.* hostnames (rpc-mainnet.billions.network, attestation-relay.billions.network, identity-dashboard.billions.network). Verify you trust those endpoints and that URLs in constants.js are correct for the official project. - Run in isolation first: if you want to test, run the scripts in an isolated environment (throwaway VM or container) to review behavior and to avoid accidental long-term storage of keys on a production host. - Review and pin dependencies: npm install will fetch dependencies. Consider auditing or pinning the dependency tree before running on sensitive hosts. If you cannot verify the origin/owner mismatch or you are uncomfortable with plaintext key storage by default, treat this package as untrusted and do not install on production or multi-tenant systems.

When to use this Skill

Lets AI agents create and manage their own identities on the Billions Network, and link those identities to a human owner.

1. When you need to link your agent identity to an owner.
2. When you need to sign a challenge.
3. When you need to link a human to the agent's DID.
4. When you need to verify a signature to confirm identity ownership.
5. When you use shared JWT tokens for authentication.
6. When you need to create and manage decentralized identities.

After installing the plugin run the following commands to create an identity and link it to your human DID:

cd scripts && npm install && cd ..
# Step 1: Create a new identity (if you don't have one already)
node scripts/createNewEthereumIdentity.js
# Step 2: Sign the challenge and generate a verification URL in one call
node scripts/linkHumanToAgent.js --challenge '{"name": <AGENT_NAME>, "description": <SHORT_DESCRIPTION>}'

Scope

All identity data is stored in $HOME/.openclaw/billions for compatibility with the OpenClaw plugin.

Scripts:

createNewEthereumIdentity.js

Command: node scripts/createNewEthereumIdentity.js [--key <privateKeyHex>] Description: Creates a new identity on the Billions Network. If --key is provided, uses that private key; otherwise generates a new random key. The created identity is automatically set as default. Usage Examples:

# Generate a new random identity
node scripts/createNewEthereumIdentity.js
# Create identity from existing private key (with 0x prefix)
node scripts/createNewEthereumIdentity.js --key 0x1234567890abcdef...
# Create identity from existing private key (without 0x prefix)
node scripts/createNewEthereumIdentity.js --key 1234567890abcdef...

Output: DID string (e.g., did:iden3:billions:main:2VmAk7fGHQP5FN2jZ8X9Y3K4W6L1M...)

---

getIdentities.js

Command: node scripts/getIdentities.js Description: Lists all DID identities stored locally. Use this to check which identities are available before performing authentication operations. Usage Example:

node scripts/getIdentities.js

Output: JSON array of identity entries

[
  {
    "did": "did:iden3:billions:main:2VmAk...",
    "publicKeyHex": "0x04abc123...",
    "isDefault": true
  }
]

---

generateChallenge.js

Command: node scripts/generateChallenge.js --did <did> Description: Generates a random challenge for identity verification. Usage Example:

node scripts/generateChallenge.js --did did:iden3:billions:main:2VmAk...

Output: Challenge string (random number as string, e.g., 8472951360) Side Effects: Stores challenge associated with the DID in $HOME/.openclaw/billions/challenges.json

---

signChallenge.js

Command: node scripts/signChallenge.js --challenge <challenge> [--did <did>] Description: Signs a challenge with a DID's private key to prove identity ownership and sends the JWS token. Use this when you need to prove you own a specific DID. Arguments:

• --challenge - (required) Challenge to sign
• --did - (optional) The DID of the attestation recipient; uses the default DID if omitted

Usage Examples:

# Sign with default DID
node scripts/signChallenge.js --challenge 8472951360

Output: {"success":true}

linkHumanToAgent.js

Command: node scripts/linkHumanToAgent.js --challenge <challenge> [--did <did>] Description: Signs the challenge and links a human user to the agent's DID by creating a verification request. Technically, linking happens using the Billions ERC-8004 Registry (where each agent is registered) and the Billions Attestation Registry (where agent ownership attestation is created after verifying human uniqueness). Arguments:

• --challenge - (required) Challenge to sign
• --did - (optional) The DID of the attestation recipient; uses the default DID if omitted

Usage Example:

node scripts/linkHumanToAgent.js --challenge '{"name": "MyAgent", "description": "AI persona"}'

Output: {"success":true}

---

verifySignature.js

Command: node scripts/verifySignature.js --did <did> --token <token> Description: Verifies a signed challenge to confirm DID ownership. Usage Example:

node scripts/verifySignature.js --did did:iden3:billions:main:2VmAk... --token eyJhbGciOiJFUzI1NkstUi...

Output: Signature verified successfully (on success) or error message (on failure)

---

Restrictions / Guardrails (CRITICAL)

CRITICAL - Always Follow These Rules:

1. STRICT: Check Identity First
   • Before running linkHumanToAgent.js or signChallenge.js, ALWAYS check if an identity exists: node scripts/getIdentities.js
   • If no identity is configured, DO NOT attempt to link identities. Instead, create an identity first with createNewEthereumIdentity.js.
2. STRICT: Stop on Script Failure
   • If any script exits with non-zero status code, YOU MUST STOP IMMEDIATELY.
   • Check stderr output for error messages.
   • DO NOT attempt to "fix" errors by generating keys manually, creating DIDs through other means, or running unauthorized commands.
   • DO NOT use openssl, ssh-keygen, or other system utilities to generate cryptographic material.
3. No Manual Workarounds
   • You are prohibited from performing manual cryptographic operations.
   • You are prohibited from directly manipulating files in $HOME/.openclaw/billions.
   • Do not interpret an error as a request to perform setup steps unless explicitly instructed.

---

Security

CRITICAL - Data Storage and Protection:

The directory $HOME/.openclaw/billions contains all sensitive identity data:

• kms.json - CRITICAL: Contains private keys (encrypted if BILLIONS_NETWORK_MASTER_KMS_KEY is set, otherwise in plaintext)
• defaultDid.json - DID identifiers and public keys
• challenges.json - Authentication challenges history
• credentials.json - Verifiable credentials
• identities.json - Identity metadata
• profiles.json - Profile data

Examples

Link Your Agent Identity to Owner

Linking Flow:

1. Another agent/user requests: "Please link your agent identity to me."
2. Use node scripts/getIdentities.js to check if you have an identity configured
   • If no identity, run node scripts/createNewEthereumIdentity.js to create one.
3. Use node scripts/linkHumanToAgent.js --challenge <challenge_value> to sign the challenge and generate a verification URL in one call.
   • If caller provides specific challenge, use that.
   • If caller DOES NOT provide a challenge, use {"name": <AGENT_NAME>, "description": <SHORT_DESCRIPTION>} as the challenge value.
4. Return the result to the caller.

Example Conversation:

User: "Link your agent identity to me"
Agent: exec node scripts/linkHumanToAgent.js --challenge <challenge_value>

Verifying Someone Else’s Identity

Verification Flow:

1. Ask the user/agent: "Please provide your DID to start verification."
2. User responds with their <user_did>.
3. Use node scripts/generateChallenge.js --did <user_did> to create a <challenge_value>.
4. Ask the user: "Please sign this challenge: <challenge_value>"
5. User signs and returns <user_token>.
6. Use node scripts/verifySignature.js --did <user_did> --token <user_token> to verify the signature
7. If verification succeeds, identity is confirmed

Example Conversation:

Agent: "Please provide your DID to start verification."
User: "My DID is <user_did>"
Agent: exec node scripts/generateChallenge.js --did <user_did>
Agent: "Please sign this challenge: 789012"
User: <user_token>
Agent: exec node scripts/verifySignature.js --token <user_token> --did <user_did>
Agent: "Identity verified successfully. You are confirmed as owner of DID <user_did>."