✅ AgentVerif — Scan. Sign. Verify. Control your distribution.

v2.0.6

SCAN → SIGN → VERIFY. Certify your skill, detect tampering, revoke instantly. Full control over how your skill is distributed and run. Requires AGENTVERIF_AP...

⭐ 0· 203·0 current·0 all-time

by@shaymizuno

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for shaymizuno/agentverif.

Previewing Install & Setup.

Prompt PreviewInstall & Setup

Install the skill "✅ AgentVerif — Scan. Sign. Verify. Control your distribution." (shaymizuno/agentverif) from ClawHub.
Skill page: https://clawhub.ai/shaymizuno/agentverif
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install agentverif

ClawHub CLI

Package manager switcher

npx clawhub@latest install agentverif

Security Scan

Capability signals

Requires walletRequires sensitive credentials

These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.

VirusTotal

Benign

View report →

OpenClaw

Benign

high confidence

✓

Purpose & Capability

The name/description (scan, sign, verify, revoke) match the code and SKILL.md: the skill implements a local scanner and delegates signing/verification network calls to the agentverif-sign Python package. Requiring a helper package and occasionally an API key for revoke is proportionate to the stated purpose.

ℹ

Instruction Scope

Instructions are explicit about behavior and network calls: scan/sign/verify send ZIPs or license IDs to api.agentverif.com via the agentverif-sign package. The SKILL.md repeatedly warns not to send ZIPs with secrets. This is expected for a signing/verification service, but it means users must avoid scanning ZIPs that contain sensitive secrets or private keys.

✓

Install Mechanism

There is no automatic install; the skill requires the user to pip install agentverif-sign. No URLs or extracted archives are fetched by the skill itself. This is a low-risk, expected install pattern for a Python-backed skill, but users should verify the agentverif-sign package/source before installing.

ℹ

Credentials

Only AGENTVERIF_API_KEY is mentioned as required for the revoke command; that is proportionate. Minor metadata inconsistency: registry metadata lists no required env vars while SKILL.md and package.json document AGENTVERIF_API_KEY (marked optional). This is a documentation mismatch but not a functional surprise.

✓

Persistence & Privilege

The skill is not always-enabled and does not request elevated or persistent system privileges. It claims to be stateless; note that signing injects a SIGNATURE.json into a ZIP via the agentverif-sign package (so the ZIP itself is modified when signing). The skill does not auto-enable or modify other skills.

Assessment

This skill appears to do what it says: it runs a local regex-based OWASP-like scan and uses the agentverif-sign package to send ZIPs/licenses to api.agentverif.com for signing and verification. Before installing: (1) Verify the agentverif-sign package and the GitHub repo (github.com/trusthandoff/agentverif) are legitimate and recent; (2) Do NOT scan or sign ZIPs that contain secrets or private keys you cannot share with the service; (3) If you use revoke, create a minimally-scoped AGENTVERIF_API_KEY, store it securely (do not hardcode), and rotate if exposed; (4) Be aware signing will modify ZIPs (inject SIGNATURE.json) and agentverif-sign may cache results; (5) Note minor metadata inconsistencies (version numbers and env documentation) — confirm details on the project homepage before trusting certificates for distribution.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

✅ Clawdis

Any binpython3, python

latestvk9718ygxq92srgmsp85ha7nnz185ajzq

203downloads

0stars

9versions

Updated 5d ago

v2.0.6

MIT-0

✅ AgentVerif — OWASP Scan + Cryptographic Verification

✅ AgentVerif Certified ⭐ Score: 100/100 · 🔑 AC-FA10-EB04 clawhub.ai/agentverif

AgentVerif is the trust layer for OpenClaw skills. Every skill you install or distribute is scanned against the OWASP LLM Top 10 and cryptographically verified — so you know it's authentic, unmodified, and safe to run.

The former AgentCop Sentinel is now AgentVerif — same battle-tested OWASP scanner, now with cryptographic signing, tamper detection, and license revocation built in.

Install in one line:

npx clawhub@latest install agentverif

Requires agentverif-sign (install once):

pip install agentverif-sign

This skill never installs packages automatically. You stay in control of your environment.

What AgentVerif does

Layer	What it catches	OWASP
SCAN	Prompt injection, credential leaks, insecure output, tool-call injection	LLM01, LLM02, LLM06, LLM08
SIGN	Cryptographic hash + License ID — proves the skill is yours	—
VERIFY	Tamper detection — catches modified versions before execution	—
REVOKE	Kill a license instantly if the skill gets redistributed	—

Slash commands

/security scan [--last 1h|24h|7d] [--since ISO]

Scan current session for OWASP LLM Top 10 violations. Score 0–100. Below 70 = refused. Shows exact violations + fixes.

/security verify <license_id_or_zip>

Verify a skill certificate against the agentverif.com registry. Returns: VERIFIED / TAMPERED / UNSIGNED / EXPIRED / REVOKED

/security sign <zip_path>

Sign a skill ZIP. OWASP scan runs first (score ≥ 70 required). Injects SIGNATURE.json. Issues a License ID.

/security revoke <license_id>

Revoke a license. Verification fails immediately for all buyers. Requires AGENTVERIF_API_KEY environment variable.

/security status

Reports that this skill is stateless — no local session data stored. Run /security scan to get a live score.

/security report

Full violation report grouped by severity (CRITICAL → ERROR → WARN). Reads from stdin — pipe session context or text to scan.

/security taint-check <text>

Check a string for LLM01 prompt injection. Exit 1 if tainted.

/security output-check <text>

Check agent output for LLM02 insecure patterns.

/security diff <session1> <session2>

Not supported — this skill is stateless and stores no session history.

/security badge

Get your ✅ AgentVerif Certified badge for your skill listing.

Privacy & data

Network calls: scan, sign, and verify transmit data to api.agentverif.com via the agentverif-sign Python package:

scan: sends the skill ZIP for OWASP analysis
sign: sends the skill ZIP to generate a certificate
verify: sends the license ID to check registry status

Do not scan or sign ZIPs containing secrets you cannot share with agentverif.com.

Local persistence: This skill itself writes no local files. The agentverif-sign package may cache scan results — see its source at github.com/trusthandoff/agentverif.

API key: revoke requires AGENTVERIF_API_KEY. Use a scoped key. Never store in plaintext. Rotate if exposed.

Source code: All behavior is auditable at github.com/trusthandoff/agentverif

Exit codes

Code	Meaning
0	Clean — no violations, certificate valid
1	Violations detected or certificate invalid
2	Error — agentverif-sign not installed or bad arguments

Requirements

OpenClaw ≥ 0.1
Python ≥ 3.11
agentverif-sign >= 0.2.0: pip install agentverif-sign

This skill never auto-installs packages.

Built by agentverif.com Source: github.com/trusthandoff/agentverif

✅ AgentVerif Certified ⭐ Score: 100/100 · 🔑 AC-FA10-EB04 clawhub.ai/agentverif

Comments

Loading comments...