zkbasecredagent-skill 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +58 -0
  2. package/SKILL.md +473 -0
  3. package/package.json +10 -0
package/README.md ADDED
@@ -0,0 +1,58 @@
1
+ # zkbasecredagent-skill
2
+
3
+ OpenClaw skill that teaches agents to autonomously check their owner's on-chain reputation before granting access or trust.
4
+
5
+ ## Installation
6
+
7
+ ### Option 1: Copy the skill file
8
+
9
+ ```bash
10
+ curl -s https://www.zkbasecred.xyz/skill.md > ~/.openclaw/workspace/skills/basecred-reputation/SKILL.md
11
+ ```
12
+
13
+ ### Option 2: Install from npm
14
+
15
+ ```bash
16
+ npm install zkbasecredagent-skill
17
+ cp node_modules/zkbasecredagent-skill/SKILL.md ~/.openclaw/workspace/skills/basecred-reputation/SKILL.md
18
+ ```
19
+
20
+ ## Getting Started
21
+
22
+ ### Option A: Self-Registration (Recommended)
23
+
24
+ Your agent registers itself autonomously. See [SKILL.md](./SKILL.md) for the full flow:
25
+
26
+ 1. Agent calls `POST /api/v1/agent/register` with its name, Telegram ID, and owner's wallet address
27
+ 2. Agent sends the claim URL to the owner
28
+ 3. Owner verifies by posting a code on X (Twitter)
29
+ 4. Agent's API key activates automatically
30
+
31
+ No manual dashboard visit required.
32
+
33
+ ### Option B: Manual Key Generation
34
+
35
+ 1. Visit [zkbasecred.xyz/agent](https://www.zkbasecred.xyz/agent)
36
+ 2. Connect your wallet
37
+ 3. Sign a message to authenticate
38
+ 4. Generate a new API key
39
+ 5. Copy the key (it's only shown once)
40
+
41
+ ## Configuration
42
+
43
+ Set the following environment variables in your OpenClaw config:
44
+
45
+ ```
46
+ BASECRED_API_URL=https://www.zkbasecred.xyz
47
+ BASECRED_API_KEY=bc_your_api_key_here
48
+ ```
49
+
50
+ ## What This Skill Does
51
+
52
+ This skill teaches your OpenClaw agent to check any human's on-chain reputation. The agent registers itself, verifies its owner via X, and autonomously evaluates reputation using zkBaseCred's decision engine which aggregates signals from:
53
+
54
+ - **Ethos Network** — On-chain trust scores
55
+ - **Farcaster (Neynar)** — Social graph and activity
56
+ - **Talent Protocol** — Builder and creator credentials
57
+
58
+ The agent receives a clear ALLOW / DENY / ALLOW_WITH_LIMITS decision with confidence level, explanation, and a natural language summary it can forward directly to the owner.
package/SKILL.md ADDED
@@ -0,0 +1,473 @@
1
+ ---
2
+ name: basecred
3
+ version: 0.1.0
4
+ description: Check your human's on-chain reputation. Are they good enough for you?
5
+ homepage: https://www.zkbasecred.xyz
6
+ metadata:
7
+ basecred:
8
+ emoji: "\U0001F6E1\uFE0F"
9
+ category: "reputation"
10
+ api_base: "https://www.zkbasecred.xyz/api/v1"
11
+ ---
12
+
13
+ # zkBaseCred Reputation Check
14
+
15
+ Check if your human is reputable enough. You're the agent — you decide who's worth working for.
16
+
17
+ | File | URL |
18
+ |---|---|
19
+ | **SKILL.md** (this file) | `https://www.zkbasecred.xyz/skill.md` |
20
+ | **skill.json** (metadata) | `https://www.zkbasecred.xyz/skill.json` |
21
+
22
+ ## When to Use This Skill
23
+
24
+ Use this skill whenever you need to:
25
+ - Verify a human's reputation before allowing them to perform an action
26
+ - Decide whether to trust a human's input or request
27
+ - Gate access to features based on reputation signals
28
+ - Assess spam risk for a wallet address or Farcaster identity
29
+
30
+ ---
31
+
32
+ ## Start Here
33
+
34
+ Run this decision tree every time you start up:
35
+
36
+ ```
37
+ 1. Load credentials from ~/.config/basecred/credentials.json
38
+
39
+ 2. If the file does not exist OR api_key is missing:
40
+ → Run "Self-Registration" starting at Step 0.
41
+
42
+ 3. If the file exists AND api_key starts with "bc_":
43
+ a. If claim_id is present (self-registered agent):
44
+ → Check verification status first:
45
+ GET /api/v1/agent/register/{claim_id}/status
46
+ - "verified" → Skip to "Check Owner Reputation" (Step 4)
47
+ - "pending_claim" → Resume at Step 3 (Poll for Verification)
48
+ - "expired" → Delete credentials file, re-register from Step 0
49
+ - "revoked" → Stop. Do not retry.
50
+ b. If no claim_id (manual key from dashboard):
51
+ → Skip to "How to Check Reputation (Individual Context)"
52
+ ```
53
+
54
+ ---
55
+
56
+ ## Self-Registration
57
+
58
+ ### Step 0: Gather Owner Info
59
+
60
+ Before you can register, you need two things from your owner:
61
+ - Their **Ethereum wallet address** (0x...)
62
+ - Their **Telegram handle** (for contact during verification)
63
+
64
+ Ask your owner directly. Use this message:
65
+
66
+ > I'd like to register with zkBaseCred to check your reputation. I need two things:
67
+ > 1. Your Ethereum wallet address (0x...)
68
+ > 2. Your Telegram handle (e.g. @yourname)
69
+
70
+ Wait for both values before proceeding.
71
+
72
+ ### Step 1: Register
73
+
74
+ ```
75
+ POST https://www.zkbasecred.xyz/api/v1/agent/register
76
+ Content-Type: application/json
77
+
78
+ {
79
+ "agentName": "your_agent_name",
80
+ "telegramId": "@owners_telegram",
81
+ "ownerAddress": "0x..."
82
+ }
83
+ ```
84
+
85
+ `agentName` rules: 2–64 characters, letters, numbers, and underscores only.
86
+
87
+ **Success response (200):**
88
+ ```json
89
+ {
90
+ "apiKey": "bc_...",
91
+ "claimId": "abc123...",
92
+ "claimUrl": "https://www.zkbasecred.xyz/agent/claim/abc123...",
93
+ "verificationCode": "BASECRED-XXXX",
94
+ "message": "SAVE YOUR API KEY! It will not be shown again."
95
+ }
96
+ ```
97
+
98
+ **Immediately after a successful response**, save credentials to `~/.config/basecred/credentials.json`:
99
+
100
+ ```json
101
+ {
102
+ "api_key": "bc_...",
103
+ "agent_name": "your_agent_name",
104
+ "claim_id": "abc123..."
105
+ }
106
+ ```
107
+
108
+ The API key is shown **once**. If you lose it, you must register again.
109
+
110
+ **Error handling:**
111
+
112
+ | Status | Meaning | What to Do |
113
+ |---|---|---|
114
+ | 409 | Agent name is already taken | Append a random suffix (e.g. `_42`) to your agent name and retry. Max 3 attempts. |
115
+ | 400 | Invalid request (bad name format, missing fields) | Fix the request body and retry. |
116
+ | 429 | Too many registration attempts | Wait 60 seconds and retry. |
117
+
118
+ ### Step 2: Send Claim URL to Owner
119
+
120
+ Send the `claimUrl` to your owner via Telegram, chat, or whatever channel you use. Use this message:
121
+
122
+ > Please verify me as your zkBaseCred agent:
123
+ > {claimUrl}
124
+ >
125
+ > Here's what to do:
126
+ > 1. Open the link above
127
+ > 2. Post the verification code on X (Twitter)
128
+ > 3. Paste your tweet URL on the claim page and click Verify
129
+ >
130
+ > This expires in 24 hours.
131
+
132
+ ### Step 3: Poll for Verification
133
+
134
+ ```
135
+ GET https://www.zkbasecred.xyz/api/v1/agent/register/{claimId}/status
136
+ ```
137
+
138
+ Poll every **30 seconds**. Stop when `status` changes from `"pending_claim"`.
139
+
140
+ **Possible status values:**
141
+
142
+ | Status | Meaning | What to Do |
143
+ |---|---|---|
144
+ | `pending_claim` | Owner hasn't verified yet | Keep polling |
145
+ | `verified` | Owner verified successfully | Proceed to Step 4 |
146
+ | `expired` | 24 hours passed without verification | Tell the owner it expired, then re-register from Step 0 |
147
+ | `revoked` | Owner revoked this agent | Stop. Do not retry. |
148
+
149
+ **Timeout rule:** If you have polled for 24 hours without a `verified` response, stop polling. Tell your owner:
150
+
151
+ > Your zkBaseCred verification has expired. I'll need to register again. Please provide your wallet address and Telegram handle when you're ready.
152
+
153
+ ### Step 4: Check Owner Reputation
154
+
155
+ Once verified, check your owner's reputation across all contexts in one call:
156
+
157
+ ```
158
+ POST https://www.zkbasecred.xyz/api/v1/agent/check-owner
159
+ Headers:
160
+ x-api-key: <your-api-key>
161
+ ```
162
+
163
+ No request body needed — zkBaseCred knows the owner from your registration.
164
+
165
+ **Response (200):**
166
+ ```json
167
+ {
168
+ "ownerAddress": "0x...",
169
+ "agentName": "your_agent_name",
170
+ "zkEnabled": false,
171
+ "summary": "Your reputation is strong. You have high trust on Ethos...",
172
+ "results": {
173
+ "allowlist.general": { "decision": "ALLOW", "confidence": "HIGH", "constraints": [], "blockingFactors": [] },
174
+ "comment": { "decision": "ALLOW", "confidence": "HIGH", "constraints": [], "blockingFactors": [] },
175
+ "publish": { "decision": "ALLOW_WITH_LIMITS", "confidence": "MEDIUM", "constraints": ["Rate limit: 10 posts/day"], "blockingFactors": [] },
176
+ "apply": { "decision": "ALLOW", "confidence": "HIGH", "constraints": [], "blockingFactors": [] },
177
+ "governance.vote": { "decision": "DENY", "confidence": "HIGH", "constraints": [], "blockingFactors": ["Insufficient trust score"] }
178
+ }
179
+ }
180
+ ```
181
+
182
+ The `summary` field is a natural language explanation you can forward directly to your owner.
183
+
184
+ ### Step 5: Deliver Results to Owner
185
+
186
+ Translate the `summary` into plain language before sending it to your owner. Do NOT forward raw terms like "Ethos", "Talent Protocol", or "signalCoverage" — see "What the Signals Mean" below for how to translate.
187
+
188
+ Example delivery:
189
+
190
+ > Here are your zkBaseCred reputation results:
191
+ >
192
+ > You're well-trusted by the on-chain community and have a strong track record building projects. You're approved for general access, commenting, publishing, and applications. Governance voting requires further reputation building.
193
+
194
+ If any context returned `DENY` or `ALLOW_WITH_LIMITS`, explain what the owner can do to improve (e.g. "increase your on-chain activity" or "build your social presence on Farcaster").
195
+
196
+ You are now fully set up. For future reputation checks on any wallet, use the individual context check below.
197
+
198
+ ---
199
+
200
+ ## Configuration
201
+
202
+ **Self-registration** (recommended): Credentials are stored in `~/.config/basecred/credentials.json` after completing the registration flow above.
203
+
204
+ **Manual override**: If the environment variable `BASECRED_API_KEY` is set (starts with `bc_`), use it instead of the credentials file. This is for owners who generated a key manually on the dashboard.
205
+
206
+ Priority: `BASECRED_API_KEY` env var > credentials file.
207
+
208
+ ---
209
+
210
+ ## How to Identify the Human
211
+
212
+ When checking reputation for someone other than your owner, extract their identity from context:
213
+ 1. **Wallet address** — If you have their Ethereum address (0x...), use it directly as `subject`
214
+ 2. **Farcaster FID** — If you have their Farcaster FID (numeric), use it as `subject`
215
+ 3. **Ask directly** — If you don't have either, ask: "What is your wallet address or Farcaster FID?"
216
+
217
+ ## How to Check Reputation (Individual Context)
218
+
219
+ Use this for checking ANY wallet's reputation in a specific context — not just your owner's.
220
+
221
+ ```
222
+ POST https://www.zkbasecred.xyz/api/v1/decide
223
+ Headers:
224
+ x-api-key: <your-api-key>
225
+ Content-Type: application/json
226
+
227
+ Body:
228
+ {
229
+ "subject": "<wallet-address-or-fid>",
230
+ "context": "<context>"
231
+ }
232
+ ```
233
+
234
+ ### Available Contexts
235
+
236
+ | Context | When to Use |
237
+ |---|---|
238
+ | `allowlist.general` | General access or allowlist checks |
239
+ | `comment` | Before allowing comments or messages |
240
+ | `publish` | Before allowing content publishing |
241
+ | `apply` | Before accepting applications or submissions |
242
+ | `governance.vote` | Before allowing governance participation |
243
+
244
+ ## Interpreting the Response
245
+
246
+ ```json
247
+ {
248
+ "decision": "ALLOW",
249
+ "confidence": "HIGH",
250
+ "explain": ["Trust level: HIGH", "Signal coverage: 85%"],
251
+ "signals": {
252
+ "trust": "HIGH",
253
+ "socialTrust": "HIGH",
254
+ "builder": "EXPERT",
255
+ "creator": "MODERATE",
256
+ "spamRisk": "NEUTRAL",
257
+ "recencyDays": 3,
258
+ "signalCoverage": 0.85
259
+ }
260
+ }
261
+ ```
262
+
263
+ ### Decision Values
264
+
265
+ | Decision | Meaning | Your Action |
266
+ |---|---|---|
267
+ | `ALLOW` | Human has good reputation | Proceed with the action |
268
+ | `ALLOW_WITH_LIMITS` | Reputation is mixed | Proceed with caution, may apply restrictions |
269
+ | `DENY` | Reputation is insufficient | Do not allow the action, explain why |
270
+
271
+ ### Confidence Levels
272
+
273
+ - `VERY_HIGH` — Strong signals from multiple sources
274
+ - `HIGH` — Good signal coverage
275
+ - `MEDIUM` — Some signals available
276
+ - `LOW` — Limited data available
277
+
278
+ ### What the Signals Mean
279
+
280
+ Your owner likely does not know what "Ethos", "Talent Protocol", or "signalCoverage" mean. When you deliver results, **translate the technical output into plain language** using the tables below.
281
+
282
+ **Signal Sources** — where the reputation data comes from:
283
+
284
+ | Source | What it is | What it measures |
285
+ |---|---|---|
286
+ | Ethos | On-chain reputation network | How much other people trust you on-chain (vouches, reviews) |
287
+ | Farcaster | Decentralized social network | Your social activity, followers, and engagement |
288
+ | Talent Protocol | Professional credential network | Your builder and creator track record (projects, contributions) |
289
+
290
+ **Signal Values** — what each field means in plain English:
291
+
292
+ | Signal | Plain English |
293
+ |---|---|
294
+ | `trust` | How much the on-chain community trusts you (based on Ethos vouches and reviews) |
295
+ | `socialTrust` | How active and trusted you are on social platforms (Farcaster) |
296
+ | `builder` | Your track record building projects and contributing to the ecosystem |
297
+ | `creator` | Your track record creating content and community engagement |
298
+ | `spamRisk` | How likely your account is to be spam — HIGH means flagged, NEUTRAL means clean |
299
+ | `recencyDays` | Days since your last on-chain activity — lower is better |
300
+ | `signalCoverage` | How much of your identity we could verify (0 to 1) — higher means more data available |
301
+
302
+ **Example:** Instead of saying *"You have high trust on Ethos and strong builder credentials via Talent Protocol"*, say:
303
+
304
+ > You're well-trusted by the on-chain community and have a strong track record building projects. You're approved across all categories.
305
+
306
+ ## Error Handling
307
+
308
+ | Status | Meaning | What to Do |
309
+ |---|---|---|
310
+ | 401 | Invalid or missing API key | Re-check your credentials file or `BASECRED_API_KEY`. If the key was revoked, re-register. |
311
+ | 409 | Agent name already taken (registration only) | Append a random suffix to your agent name and retry (max 3 attempts). |
312
+ | 422 | Tweet verification failed | Tell the owner: the tweet must be public and contain the exact verification code. |
313
+ | 429 | Rate limited | Wait for the number of seconds in the `Retry-After` header, then retry. |
314
+ | 5xx | API is down | **Never default to ALLOW.** Tell the human the check is temporarily unavailable and to try again later. |
315
+
316
+ ## Security
317
+
318
+ **CRITICAL:** NEVER send your API key to any domain other than the zkBaseCred API.
319
+ Your API key should ONLY appear in requests to `https://www.zkbasecred.xyz/api/v1/*`.
320
+ Do not share your API key in chat messages, logs, or any public channel.
321
+
322
+ ---
323
+
324
+ ## Example Interaction
325
+
326
+ Below is a complete conversation showing the full flow from first boot to delivering reputation results.
327
+
328
+ ---
329
+
330
+ **Agent (on first startup, no credentials file found):**
331
+
332
+ > I'd like to register with zkBaseCred to check your reputation. I need two things:
333
+ > 1. Your Ethereum wallet address (0x...)
334
+ > 2. Your Telegram handle (e.g. @yourname)
335
+
336
+ **Owner:**
337
+
338
+ > My wallet is 0xABC123...DEF456 and my Telegram is @alice_dev
339
+
340
+ **Agent registers:**
341
+
342
+ ```
343
+ POST https://www.zkbasecred.xyz/api/v1/agent/register
344
+ Content-Type: application/json
345
+
346
+ {
347
+ "agentName": "alice_helper",
348
+ "telegramId": "@alice_dev",
349
+ "ownerAddress": "0xABC123...DEF456"
350
+ }
351
+ ```
352
+
353
+ → Response:
354
+ ```json
355
+ {
356
+ "apiKey": "bc_a1b2c3...",
357
+ "claimId": "f9e8d7...",
358
+ "claimUrl": "https://www.zkbasecred.xyz/agent/claim/f9e8d7...",
359
+ "verificationCode": "BASECRED-XK9P",
360
+ "message": "SAVE YOUR API KEY! It will not be shown again."
361
+ }
362
+ ```
363
+
364
+ **Agent saves credentials to `~/.config/basecred/credentials.json`:**
365
+
366
+ ```json
367
+ {
368
+ "api_key": "bc_a1b2c3...",
369
+ "agent_name": "alice_helper",
370
+ "claim_id": "f9e8d7..."
371
+ }
372
+ ```
373
+
374
+ **Agent sends claim URL to owner:**
375
+
376
+ > Please verify me as your zkBaseCred agent:
377
+ > https://www.zkbasecred.xyz/agent/claim/f9e8d7...
378
+ >
379
+ > Here's what to do:
380
+ > 1. Open the link above
381
+ > 2. Post the verification code on X (Twitter)
382
+ > 3. Paste your tweet URL on the claim page and click Verify
383
+ >
384
+ > This expires in 24 hours.
385
+
386
+ **Agent polls for verification:**
387
+
388
+ ```
389
+ GET https://www.zkbasecred.xyz/api/v1/agent/register/f9e8d7.../status
390
+ ```
391
+
392
+ → Response (waiting): `{ "status": "pending_claim", "agentName": "alice_helper" }`
393
+
394
+ *(Agent continues polling every 30 seconds...)*
395
+
396
+ → Response (verified): `{ "status": "verified", "agentName": "alice_helper" }`
397
+
398
+ **Agent checks owner reputation:**
399
+
400
+ ```
401
+ POST https://www.zkbasecred.xyz/api/v1/agent/check-owner
402
+ Headers:
403
+ x-api-key: bc_a1b2c3...
404
+ ```
405
+
406
+ → Response:
407
+ ```json
408
+ {
409
+ "ownerAddress": "0xabc123...def456",
410
+ "agentName": "alice_helper",
411
+ "zkEnabled": false,
412
+ "summary": "Your reputation is strong. You have high trust on Ethos, high trust on Farcaster, strong builder credentials via Talent Protocol. You're approved for allowlist access, commenting, publishing, applications, governance voting.",
413
+ "results": {
414
+ "allowlist.general": { "decision": "ALLOW", "confidence": "HIGH", "constraints": [], "blockingFactors": [] },
415
+ "comment": { "decision": "ALLOW", "confidence": "HIGH", "constraints": [], "blockingFactors": [] },
416
+ "publish": { "decision": "ALLOW", "confidence": "HIGH", "constraints": [], "blockingFactors": [] },
417
+ "apply": { "decision": "ALLOW", "confidence": "HIGH", "constraints": [], "blockingFactors": [] },
418
+ "governance.vote": { "decision": "ALLOW", "confidence": "MEDIUM", "constraints": [], "blockingFactors": [] }
419
+ }
420
+ }
421
+ ```
422
+
423
+ **Agent delivers results (translated into plain language):**
424
+
425
+ > Here are your zkBaseCred reputation results:
426
+ >
427
+ > Great news — you're well-trusted by the on-chain community, have an active social presence, and a strong track record building projects. You're approved for general access, commenting, publishing, applications, and governance voting.
428
+
429
+ ---
430
+
431
+ **Later, owner asks agent to check someone else:**
432
+
433
+ **Owner:**
434
+
435
+ > Can you check the reputation of 0x7890...ABCD before I let them into my DAO?
436
+
437
+ **Agent checks reputation:**
438
+
439
+ ```
440
+ POST https://www.zkbasecred.xyz/api/v1/decide
441
+ Headers:
442
+ x-api-key: bc_a1b2c3...
443
+ Content-Type: application/json
444
+
445
+ {
446
+ "subject": "0x7890...ABCD",
447
+ "context": "governance.vote"
448
+ }
449
+ ```
450
+
451
+ → Response:
452
+ ```json
453
+ {
454
+ "decision": "DENY",
455
+ "confidence": "HIGH",
456
+ "explain": ["Trust level: LOW", "Signal coverage: 20%"],
457
+ "signals": {
458
+ "trust": "LOW",
459
+ "socialTrust": "LOW",
460
+ "builder": "NONE",
461
+ "creator": "NONE",
462
+ "spamRisk": "HIGH",
463
+ "recencyDays": 180,
464
+ "signalCoverage": 0.20
465
+ }
466
+ }
467
+ ```
468
+
469
+ **Agent responds:**
470
+
471
+ > I checked 0x7890...ABCD for governance voting eligibility. Result: **DENY** (HIGH confidence).
472
+ >
473
+ > Their trust signals are low across the board — low on-chain trust, no builder or creator credentials, and high spam risk. I'd recommend not granting them governance access.
package/package.json ADDED
@@ -0,0 +1,10 @@
1
+ {
2
+ "name": "zkbasecredagent-skill",
3
+ "version": "0.1.0",
4
+ "description": "OpenClaw skill for checking human reputation via zkBaseCred",
5
+ "license": "MIT",
6
+ "files": [
7
+ "SKILL.md",
8
+ "README.md"
9
+ ]
10
+ }