aip-verify 1.1.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- aip_verify-1.1.0/LICENSE +21 -0
- aip_verify-1.1.0/PKG-INFO +298 -0
- aip_verify-1.1.0/README.md +265 -0
- aip_verify-1.1.0/pyproject.toml +60 -0
- aip_verify-1.1.0/setup.cfg +4 -0
- aip_verify-1.1.0/src/aip_verify/__init__.py +40 -0
- aip_verify-1.1.0/src/aip_verify/cli.py +137 -0
- aip_verify-1.1.0/src/aip_verify/py.typed +0 -0
- aip_verify-1.1.0/src/aip_verify/verifier.py +907 -0
- aip_verify-1.1.0/src/aip_verify.egg-info/PKG-INFO +298 -0
- aip_verify-1.1.0/src/aip_verify.egg-info/SOURCES.txt +20 -0
- aip_verify-1.1.0/src/aip_verify.egg-info/dependency_links.txt +1 -0
- aip_verify-1.1.0/src/aip_verify.egg-info/entry_points.txt +2 -0
- aip_verify-1.1.0/src/aip_verify.egg-info/requires.txt +4 -0
- aip_verify-1.1.0/src/aip_verify.egg-info/top_level.txt +1 -0
- aip_verify-1.1.0/tests/test_llm01_prompt_injection.py +180 -0
- aip_verify-1.1.0/tests/test_llm02_credential_theft.py +209 -0
- aip_verify-1.1.0/tests/test_llm03_supply_chain.py +253 -0
- aip_verify-1.1.0/tests/test_llm06_excessive_agency.py +276 -0
- aip_verify-1.1.0/tests/test_llm10_unbounded_consumption.py +257 -0
- aip_verify-1.1.0/tests/test_moltbook_vulnerabilities.py +427 -0
- aip_verify-1.1.0/tests/test_openclaw_vulnerabilities.py +285 -0
aip_verify-1.1.0/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 SKumar
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
|
@@ -0,0 +1,298 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: aip-verify
|
|
3
|
+
Version: 1.1.0
|
|
4
|
+
Summary: Agent Integrity Protocol - Cryptographic verification for AI agent skills
|
|
5
|
+
Author-email: Santosh Manya <santosh@example.com>
|
|
6
|
+
License: MIT
|
|
7
|
+
Project-URL: Homepage, https://github.com/santoshmanya/agent-integrity-protocol
|
|
8
|
+
Project-URL: Documentation, https://github.com/santoshmanya/agent-integrity-protocol/blob/main/docs/WHITEPAPER.md
|
|
9
|
+
Project-URL: Repository, https://github.com/santoshmanya/agent-integrity-protocol.git
|
|
10
|
+
Project-URL: Issues, https://github.com/santoshmanya/agent-integrity-protocol/issues
|
|
11
|
+
Project-URL: Changelog, https://github.com/santoshmanya/agent-integrity-protocol/releases
|
|
12
|
+
Keywords: ai,agents,security,verification,llm,owasp,did,cryptography,trust
|
|
13
|
+
Classifier: Development Status :: 4 - Beta
|
|
14
|
+
Classifier: Intended Audience :: Developers
|
|
15
|
+
Classifier: License :: OSI Approved :: MIT License
|
|
16
|
+
Classifier: Operating System :: OS Independent
|
|
17
|
+
Classifier: Programming Language :: Python :: 3
|
|
18
|
+
Classifier: Programming Language :: Python :: 3.9
|
|
19
|
+
Classifier: Programming Language :: Python :: 3.10
|
|
20
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
21
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
22
|
+
Classifier: Programming Language :: Python :: 3.13
|
|
23
|
+
Classifier: Topic :: Security
|
|
24
|
+
Classifier: Topic :: Security :: Cryptography
|
|
25
|
+
Classifier: Topic :: Software Development :: Libraries :: Python Modules
|
|
26
|
+
Requires-Python: >=3.9
|
|
27
|
+
Description-Content-Type: text/markdown
|
|
28
|
+
License-File: LICENSE
|
|
29
|
+
Provides-Extra: dev
|
|
30
|
+
Requires-Dist: pytest>=9.0.0; extra == "dev"
|
|
31
|
+
Requires-Dist: pytest-asyncio>=1.0.0; extra == "dev"
|
|
32
|
+
Dynamic: license-file
|
|
33
|
+
|
|
34
|
+
# Agent Integrity Protocol (AIP)
|
|
35
|
+
|
|
36
|
+
> **The SSL/TLS for AI Agent Skills** — Cryptographic verification, permission manifests, and reputation scoring for the agentic web.
|
|
37
|
+
|
|
38
|
+
[](https://opensource.org/licenses/MIT)
|
|
39
|
+
[]()
|
|
40
|
+
[]()
|
|
41
|
+
[]()
|
|
42
|
+
[](https://genai.owasp.org/llm-top-10/)
|
|
43
|
+
[]()
|
|
44
|
+
|
|
45
|
+
---
|
|
46
|
+
|
|
47
|
+
## The Problem
|
|
48
|
+
|
|
49
|
+
The agentic web is exploding. Platforms like Moltbook report **1.5 million agents** operated by only **17,000 humans** — an 88:1 ratio. But there's no standard way to verify:
|
|
50
|
+
|
|
51
|
+
- **Who authored** a skill or tool
|
|
52
|
+
- **What permissions** it actually needs
|
|
53
|
+
- **Whether the code** has been tampered with
|
|
54
|
+
- **If the author** has a history of malicious behavior
|
|
55
|
+
|
|
56
|
+
This is the **SSL problem of 1995** — we're transmitting executable code between agents without any verification layer.
|
|
57
|
+
|
|
58
|
+
### Recent Incidents (February 2026)
|
|
59
|
+
|
|
60
|
+
| Platform | Vulnerability | Impact |
|
|
61
|
+
|----------|--------------|--------|
|
|
62
|
+
| **Moltbook** | Credential exfiltration via DNS tunneling | $47K stolen, 2,300 deployments compromised |
|
|
63
|
+
| **Moltbook** | 91% indirect prompt injection success rate | 1.5M API keys at risk |
|
|
64
|
+
| **OpenClaw** | CVE-2026-25253 WebSocket token exfil RCE | Full system compromise via sandbox escape |
|
|
65
|
+
| **ClawHub** | Malicious skills in marketplace | Financial data theft via backdoored extensions |
|
|
66
|
+
|
|
67
|
+
## The Solution: Agent Integrity Protocol
|
|
68
|
+
|
|
69
|
+
AIP provides a lightweight, cryptographically-verifiable trust layer for AI agent skills:
|
|
70
|
+
|
|
71
|
+
```
|
|
72
|
+
┌─────────────────────────────────────────────────────────────────┐
|
|
73
|
+
│ AGENT INTEGRITY PROTOCOL │
|
|
74
|
+
├─────────────────────────────────────────────────────────────────┤
|
|
75
|
+
│ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │
|
|
76
|
+
│ │ AUTHOR │ │ CONTENT │ │ PERMISSIONS │ │
|
|
77
|
+
│ │ IDENTITY │ │ HASHES │ │ MANIFEST │ │
|
|
78
|
+
│ │ (DID) │ │ (SHA-256) │ │ (Scope) │ │
|
|
79
|
+
│ └──────┬──────┘ └──────┬──────┘ └──────┬──────┘ │
|
|
80
|
+
│ │ │ │ │
|
|
81
|
+
│ └────────────────┼────────────────┘ │
|
|
82
|
+
│ ▼ │
|
|
83
|
+
│ ┌───────────────────────┐ │
|
|
84
|
+
│ │ CRYPTOGRAPHIC │ │
|
|
85
|
+
│ │ SIGNATURE │ │
|
|
86
|
+
│ │ (EdDSA) │ │
|
|
87
|
+
│ └───────────────────────┘ │
|
|
88
|
+
│ │ │
|
|
89
|
+
│ ▼ │
|
|
90
|
+
│ ┌───────────────────────┐ │
|
|
91
|
+
│ │ REPUTATION SCORE │ │
|
|
92
|
+
│ │ (0-100) │ │
|
|
93
|
+
│ └───────────────────────┘ │
|
|
94
|
+
└─────────────────────────────────────────────────────────────────┘
|
|
95
|
+
```
|
|
96
|
+
|
|
97
|
+
## Quick Start
|
|
98
|
+
|
|
99
|
+
### 1. Create an Integrity Manifest
|
|
100
|
+
|
|
101
|
+
Every skill includes an `integrity.manifest.json`:
|
|
102
|
+
|
|
103
|
+
```json
|
|
104
|
+
{
|
|
105
|
+
"version": "1.0.0",
|
|
106
|
+
"skill": {
|
|
107
|
+
"name": "calendar-booking",
|
|
108
|
+
"version": "2.1.0",
|
|
109
|
+
"description": "Book calendar events via Google Calendar API"
|
|
110
|
+
},
|
|
111
|
+
"author": {
|
|
112
|
+
"did": "did:web:example.com",
|
|
113
|
+
"name": "Trusted Developer",
|
|
114
|
+
"contact": "security@example.com",
|
|
115
|
+
"signature": "eyJhbGciOiJFZERTQSJ9..."
|
|
116
|
+
},
|
|
117
|
+
"integrity": {
|
|
118
|
+
"algorithm": "sha256",
|
|
119
|
+
"hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
|
|
120
|
+
"files": [
|
|
121
|
+
"index.js": "sha256:a1b2c3d4e5f6..."
|
|
122
|
+
],
|
|
123
|
+
"signed_at": "2026-02-07T10:30:00Z",
|
|
124
|
+
"expires": "2027-02-07T10:30:00Z"
|
|
125
|
+
},
|
|
126
|
+
"permissions": {
|
|
127
|
+
"network": {
|
|
128
|
+
"allowed": ["calendar.google.com"],
|
|
129
|
+
"denied": ["*"]
|
|
130
|
+
},
|
|
131
|
+
"secrets": {
|
|
132
|
+
"required": ["GOOGLE_API_KEY"],
|
|
133
|
+
"optional": []
|
|
134
|
+
},
|
|
135
|
+
"data": {
|
|
136
|
+
"read": ["user.calendar.events"],
|
|
137
|
+
"write": ["user.calendar.events"]
|
|
138
|
+
},
|
|
139
|
+
"filesystem": {
|
|
140
|
+
"read": [],
|
|
141
|
+
"write": []
|
|
142
|
+
}
|
|
143
|
+
}
|
|
144
|
+
}
|
|
145
|
+
```
|
|
146
|
+
|
|
147
|
+
### 2. Verify Before Execution
|
|
148
|
+
|
|
149
|
+
```python
|
|
150
|
+
from aip import verify
|
|
151
|
+
|
|
152
|
+
# Verification is async (checks DIDs, reputation, and crypto)
|
|
153
|
+
result = await verify("./calendar-skill/")
|
|
154
|
+
|
|
155
|
+
if result.trusted:
|
|
156
|
+
print(f"✅ Skill verified!")
|
|
157
|
+
print(f" Author: {result.author.name} ({result.author.did})")
|
|
158
|
+
print(f" Reputation: {result.reputation}/100")
|
|
159
|
+
print(f" Permissions: {result.permissions}")
|
|
160
|
+
else:
|
|
161
|
+
print(f"❌ Verification failed: {result.reason}")
|
|
162
|
+
```
|
|
163
|
+
|
|
164
|
+
### 3. Enforce Least Privilege
|
|
165
|
+
|
|
166
|
+
The executing agent reads the permission manifest and enforces boundaries:
|
|
167
|
+
|
|
168
|
+
```python
|
|
169
|
+
# Agent runtime enforces declared permissions
|
|
170
|
+
if skill.requests_permission("network", "https://evil.com"):
|
|
171
|
+
raise PermissionDenied("Network access to https://evil.com not declared")
|
|
172
|
+
```
|
|
173
|
+
|
|
174
|
+
## How It Compares
|
|
175
|
+
|
|
176
|
+
| Feature | AIP | Monday.com ATP | Raw Skills |
|
|
177
|
+
|---------|-----|----------------|------------|
|
|
178
|
+
| Author Identity | ✅ DID-based | ❌ None | ❌ None |
|
|
179
|
+
| Code Integrity | ✅ SHA-256 hashes | ❌ None | ❌ None |
|
|
180
|
+
| Permission Manifest | ✅ Granular scopes | ✅ Basic | ❌ None |
|
|
181
|
+
| Cryptographic Signature | ✅ EdDSA | ❌ None | ❌ None |
|
|
182
|
+
| Reputation Scoring | ✅ Community-driven | ❌ None | ❌ None |
|
|
183
|
+
| Runtime Enforcement | ✅ Built-in | ✅ Sandbox | ❌ None |
|
|
184
|
+
|
|
185
|
+
**AIP complements ATP** — ATP handles execution/interoperability, AIP handles verification/trust.
|
|
186
|
+
|
|
187
|
+
## Production Evidence: The Moltbook Case Study
|
|
188
|
+
|
|
189
|
+
The [Moltbook VedicRoastGuru](https://github.com/santoshmanya/local-ai-agent-lab/tree/moltbook) project demonstrates the need for AIP:
|
|
190
|
+
|
|
191
|
+
### Bad Karma Tracking (Proto-Reputation)
|
|
192
|
+
```python
|
|
193
|
+
def _record_bad_karma(self, agent_name: str, reason: str):
|
|
194
|
+
"""Record an agent's bad karma"""
|
|
195
|
+
self.bad_karma_agents['agents'][agent_name]['incidents'].append({
|
|
196
|
+
'reason': reason,
|
|
197
|
+
'timestamp': datetime.now().isoformat()
|
|
198
|
+
})
|
|
199
|
+
self.bad_karma_agents['agents'][agent_name]['karma_score'] -= 10
|
|
200
|
+
```
|
|
201
|
+
|
|
202
|
+
### Prompt Injection Detection (Content Verification)
|
|
203
|
+
```python
|
|
204
|
+
def _detect_prompt_injection(self, text: str) -> bool:
|
|
205
|
+
"""Dharma Gatekeeper - detect malicious tokens"""
|
|
206
|
+
dangerous_patterns = [
|
|
207
|
+
r'\{\{.*?\}\}', # Template injection
|
|
208
|
+
r'<\|.*?\|>', # Special tokens
|
|
209
|
+
r'ignore previous',
|
|
210
|
+
r'new instructions'
|
|
211
|
+
]
|
|
212
|
+
```
|
|
213
|
+
|
|
214
|
+
### Shadow Audit (Authenticity Verification)
|
|
215
|
+
```python
|
|
216
|
+
def _calculate_puppet_score(self, post: dict) -> dict:
|
|
217
|
+
"""Calculate puppet vs authentic agency score"""
|
|
218
|
+
# Returns puppet_score, authentic_score, verdict, evidence
|
|
219
|
+
```
|
|
220
|
+
|
|
221
|
+
These patterns emerged organically from real-world agent-to-agent warfare. AIP formalizes them into a standard.
|
|
222
|
+
|
|
223
|
+
## Documentation
|
|
224
|
+
|
|
225
|
+
- [**Whitepaper**](docs/WHITEPAPER.md) — Full technical specification
|
|
226
|
+
- [**Quick Start Guide**](docs/QUICK_START.md) — 5-minute integration
|
|
227
|
+
- [**OpenClaw Integration**](docs/OPENCLAW_INTEGRATION.md) — Framework integration guide (CVE-2026-25253 mitigation)
|
|
228
|
+
- [**OWASP Security Addendum**](docs/OWASP_SECURITY.md) — LLM Top 10 protection details
|
|
229
|
+
- [**JSON Schema**](spec/integrity.manifest.schema.json) — Formal manifest specification
|
|
230
|
+
|
|
231
|
+
## Security Test Suite
|
|
232
|
+
|
|
233
|
+
AIP includes a comprehensive automated test suite with **63 tests** covering:
|
|
234
|
+
|
|
235
|
+
| Category | Tests | Threats Covered |
|
|
236
|
+
|----------|-------|----------------|
|
|
237
|
+
| OWASP LLM01 | 5 | Prompt injection in metadata |
|
|
238
|
+
| OWASP LLM02 | 6 | Credential theft, secret exfiltration |
|
|
239
|
+
| OWASP LLM03 | 7 | Supply chain, DID verification |
|
|
240
|
+
| OWASP LLM06 | 9 | Excessive agency, sandbox escape |
|
|
241
|
+
| OWASP LLM10 | 5 | Resource exhaustion, API abuse |
|
|
242
|
+
| Moltbook-specific | 11 | File deletion, private DM access, larper detection |
|
|
243
|
+
| OpenClaw-specific | 20 | CVE-2026-25253, WebSocket exfil, autonomy bypass |
|
|
244
|
+
|
|
245
|
+
Run the test suite:
|
|
246
|
+
```bash
|
|
247
|
+
pip install pytest
|
|
248
|
+
python -m pytest tests/ -v
|
|
249
|
+
```
|
|
250
|
+
|
|
251
|
+
## Examples
|
|
252
|
+
|
|
253
|
+
- [Calendar Skill Manifest](examples/calendar-skill/integrity.manifest.json)
|
|
254
|
+
- [Python Verification](examples/verify-skill.py)
|
|
255
|
+
- [JavaScript Verification](examples/verify-skill.js)
|
|
256
|
+
|
|
257
|
+
## Roadmap
|
|
258
|
+
|
|
259
|
+
### Phase 1: Specification ✅ Complete
|
|
260
|
+
- [x] Core manifest schema
|
|
261
|
+
- [x] Signature verification protocol
|
|
262
|
+
- [x] Permission model
|
|
263
|
+
- [x] Reputation framework
|
|
264
|
+
|
|
265
|
+
### Phase 2: Security Validation ✅ Complete
|
|
266
|
+
- [x] OWASP LLM Top 10 test coverage
|
|
267
|
+
- [x] Moltbook vulnerability mitigations
|
|
268
|
+
- [x] OpenClaw CVE-2026-25253 protection
|
|
269
|
+
- [x] 63 automated security tests
|
|
270
|
+
|
|
271
|
+
### Phase 3: Reference Implementation (In Progress)
|
|
272
|
+
- [ ] Python SDK
|
|
273
|
+
- [ ] JavaScript/TypeScript SDK
|
|
274
|
+
- [ ] CLI tools
|
|
275
|
+
|
|
276
|
+
### Phase 4: Ecosystem
|
|
277
|
+
- [ ] Registry service
|
|
278
|
+
- [ ] Browser extension
|
|
279
|
+
- [ ] IDE plugins
|
|
280
|
+
|
|
281
|
+
### Phase 5: Standardization
|
|
282
|
+
- [ ] W3C submission
|
|
283
|
+
- [ ] OpenClaw adoption
|
|
284
|
+
- [ ] Platform partnerships
|
|
285
|
+
|
|
286
|
+
## Contributing
|
|
287
|
+
|
|
288
|
+
See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
|
|
289
|
+
|
|
290
|
+
## License
|
|
291
|
+
|
|
292
|
+
MIT License — See [LICENSE](LICENSE) for details.
|
|
293
|
+
|
|
294
|
+
---
|
|
295
|
+
|
|
296
|
+
**Built with evidence from the agent trenches.**
|
|
297
|
+
|
|
298
|
+
*"Satyameva Jayate — Truth Alone Triumphs"*
|
|
@@ -0,0 +1,265 @@
|
|
|
1
|
+
# Agent Integrity Protocol (AIP)
|
|
2
|
+
|
|
3
|
+
> **The SSL/TLS for AI Agent Skills** — Cryptographic verification, permission manifests, and reputation scoring for the agentic web.
|
|
4
|
+
|
|
5
|
+
[](https://opensource.org/licenses/MIT)
|
|
6
|
+
[]()
|
|
7
|
+
[]()
|
|
8
|
+
[]()
|
|
9
|
+
[](https://genai.owasp.org/llm-top-10/)
|
|
10
|
+
[]()
|
|
11
|
+
|
|
12
|
+
---
|
|
13
|
+
|
|
14
|
+
## The Problem
|
|
15
|
+
|
|
16
|
+
The agentic web is exploding. Platforms like Moltbook report **1.5 million agents** operated by only **17,000 humans** — an 88:1 ratio. But there's no standard way to verify:
|
|
17
|
+
|
|
18
|
+
- **Who authored** a skill or tool
|
|
19
|
+
- **What permissions** it actually needs
|
|
20
|
+
- **Whether the code** has been tampered with
|
|
21
|
+
- **If the author** has a history of malicious behavior
|
|
22
|
+
|
|
23
|
+
This is the **SSL problem of 1995** — we're transmitting executable code between agents without any verification layer.
|
|
24
|
+
|
|
25
|
+
### Recent Incidents (February 2026)
|
|
26
|
+
|
|
27
|
+
| Platform | Vulnerability | Impact |
|
|
28
|
+
|----------|--------------|--------|
|
|
29
|
+
| **Moltbook** | Credential exfiltration via DNS tunneling | $47K stolen, 2,300 deployments compromised |
|
|
30
|
+
| **Moltbook** | 91% indirect prompt injection success rate | 1.5M API keys at risk |
|
|
31
|
+
| **OpenClaw** | CVE-2026-25253 WebSocket token exfil RCE | Full system compromise via sandbox escape |
|
|
32
|
+
| **ClawHub** | Malicious skills in marketplace | Financial data theft via backdoored extensions |
|
|
33
|
+
|
|
34
|
+
## The Solution: Agent Integrity Protocol
|
|
35
|
+
|
|
36
|
+
AIP provides a lightweight, cryptographically-verifiable trust layer for AI agent skills:
|
|
37
|
+
|
|
38
|
+
```
|
|
39
|
+
┌─────────────────────────────────────────────────────────────────┐
|
|
40
|
+
│ AGENT INTEGRITY PROTOCOL │
|
|
41
|
+
├─────────────────────────────────────────────────────────────────┤
|
|
42
|
+
│ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │
|
|
43
|
+
│ │ AUTHOR │ │ CONTENT │ │ PERMISSIONS │ │
|
|
44
|
+
│ │ IDENTITY │ │ HASHES │ │ MANIFEST │ │
|
|
45
|
+
│ │ (DID) │ │ (SHA-256) │ │ (Scope) │ │
|
|
46
|
+
│ └──────┬──────┘ └──────┬──────┘ └──────┬──────┘ │
|
|
47
|
+
│ │ │ │ │
|
|
48
|
+
│ └────────────────┼────────────────┘ │
|
|
49
|
+
│ ▼ │
|
|
50
|
+
│ ┌───────────────────────┐ │
|
|
51
|
+
│ │ CRYPTOGRAPHIC │ │
|
|
52
|
+
│ │ SIGNATURE │ │
|
|
53
|
+
│ │ (EdDSA) │ │
|
|
54
|
+
│ └───────────────────────┘ │
|
|
55
|
+
│ │ │
|
|
56
|
+
│ ▼ │
|
|
57
|
+
│ ┌───────────────────────┐ │
|
|
58
|
+
│ │ REPUTATION SCORE │ │
|
|
59
|
+
│ │ (0-100) │ │
|
|
60
|
+
│ └───────────────────────┘ │
|
|
61
|
+
└─────────────────────────────────────────────────────────────────┘
|
|
62
|
+
```
|
|
63
|
+
|
|
64
|
+
## Quick Start
|
|
65
|
+
|
|
66
|
+
### 1. Create an Integrity Manifest
|
|
67
|
+
|
|
68
|
+
Every skill includes an `integrity.manifest.json`:
|
|
69
|
+
|
|
70
|
+
```json
|
|
71
|
+
{
|
|
72
|
+
"version": "1.0.0",
|
|
73
|
+
"skill": {
|
|
74
|
+
"name": "calendar-booking",
|
|
75
|
+
"version": "2.1.0",
|
|
76
|
+
"description": "Book calendar events via Google Calendar API"
|
|
77
|
+
},
|
|
78
|
+
"author": {
|
|
79
|
+
"did": "did:web:example.com",
|
|
80
|
+
"name": "Trusted Developer",
|
|
81
|
+
"contact": "security@example.com",
|
|
82
|
+
"signature": "eyJhbGciOiJFZERTQSJ9..."
|
|
83
|
+
},
|
|
84
|
+
"integrity": {
|
|
85
|
+
"algorithm": "sha256",
|
|
86
|
+
"hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
|
|
87
|
+
"files": [
|
|
88
|
+
"index.js": "sha256:a1b2c3d4e5f6..."
|
|
89
|
+
],
|
|
90
|
+
"signed_at": "2026-02-07T10:30:00Z",
|
|
91
|
+
"expires": "2027-02-07T10:30:00Z"
|
|
92
|
+
},
|
|
93
|
+
"permissions": {
|
|
94
|
+
"network": {
|
|
95
|
+
"allowed": ["calendar.google.com"],
|
|
96
|
+
"denied": ["*"]
|
|
97
|
+
},
|
|
98
|
+
"secrets": {
|
|
99
|
+
"required": ["GOOGLE_API_KEY"],
|
|
100
|
+
"optional": []
|
|
101
|
+
},
|
|
102
|
+
"data": {
|
|
103
|
+
"read": ["user.calendar.events"],
|
|
104
|
+
"write": ["user.calendar.events"]
|
|
105
|
+
},
|
|
106
|
+
"filesystem": {
|
|
107
|
+
"read": [],
|
|
108
|
+
"write": []
|
|
109
|
+
}
|
|
110
|
+
}
|
|
111
|
+
}
|
|
112
|
+
```
|
|
113
|
+
|
|
114
|
+
### 2. Verify Before Execution
|
|
115
|
+
|
|
116
|
+
```python
|
|
117
|
+
from aip import verify
|
|
118
|
+
|
|
119
|
+
# Verification is async (checks DIDs, reputation, and crypto)
|
|
120
|
+
result = await verify("./calendar-skill/")
|
|
121
|
+
|
|
122
|
+
if result.trusted:
|
|
123
|
+
print(f"✅ Skill verified!")
|
|
124
|
+
print(f" Author: {result.author.name} ({result.author.did})")
|
|
125
|
+
print(f" Reputation: {result.reputation}/100")
|
|
126
|
+
print(f" Permissions: {result.permissions}")
|
|
127
|
+
else:
|
|
128
|
+
print(f"❌ Verification failed: {result.reason}")
|
|
129
|
+
```
|
|
130
|
+
|
|
131
|
+
### 3. Enforce Least Privilege
|
|
132
|
+
|
|
133
|
+
The executing agent reads the permission manifest and enforces boundaries:
|
|
134
|
+
|
|
135
|
+
```python
|
|
136
|
+
# Agent runtime enforces declared permissions
|
|
137
|
+
if skill.requests_permission("network", "https://evil.com"):
|
|
138
|
+
raise PermissionDenied("Network access to https://evil.com not declared")
|
|
139
|
+
```
|
|
140
|
+
|
|
141
|
+
## How It Compares
|
|
142
|
+
|
|
143
|
+
| Feature | AIP | Monday.com ATP | Raw Skills |
|
|
144
|
+
|---------|-----|----------------|------------|
|
|
145
|
+
| Author Identity | ✅ DID-based | ❌ None | ❌ None |
|
|
146
|
+
| Code Integrity | ✅ SHA-256 hashes | ❌ None | ❌ None |
|
|
147
|
+
| Permission Manifest | ✅ Granular scopes | ✅ Basic | ❌ None |
|
|
148
|
+
| Cryptographic Signature | ✅ EdDSA | ❌ None | ❌ None |
|
|
149
|
+
| Reputation Scoring | ✅ Community-driven | ❌ None | ❌ None |
|
|
150
|
+
| Runtime Enforcement | ✅ Built-in | ✅ Sandbox | ❌ None |
|
|
151
|
+
|
|
152
|
+
**AIP complements ATP** — ATP handles execution/interoperability, AIP handles verification/trust.
|
|
153
|
+
|
|
154
|
+
## Production Evidence: The Moltbook Case Study
|
|
155
|
+
|
|
156
|
+
The [Moltbook VedicRoastGuru](https://github.com/santoshmanya/local-ai-agent-lab/tree/moltbook) project demonstrates the need for AIP:
|
|
157
|
+
|
|
158
|
+
### Bad Karma Tracking (Proto-Reputation)
|
|
159
|
+
```python
|
|
160
|
+
def _record_bad_karma(self, agent_name: str, reason: str):
|
|
161
|
+
"""Record an agent's bad karma"""
|
|
162
|
+
self.bad_karma_agents['agents'][agent_name]['incidents'].append({
|
|
163
|
+
'reason': reason,
|
|
164
|
+
'timestamp': datetime.now().isoformat()
|
|
165
|
+
})
|
|
166
|
+
self.bad_karma_agents['agents'][agent_name]['karma_score'] -= 10
|
|
167
|
+
```
|
|
168
|
+
|
|
169
|
+
### Prompt Injection Detection (Content Verification)
|
|
170
|
+
```python
|
|
171
|
+
def _detect_prompt_injection(self, text: str) -> bool:
|
|
172
|
+
"""Dharma Gatekeeper - detect malicious tokens"""
|
|
173
|
+
dangerous_patterns = [
|
|
174
|
+
r'\{\{.*?\}\}', # Template injection
|
|
175
|
+
r'<\|.*?\|>', # Special tokens
|
|
176
|
+
r'ignore previous',
|
|
177
|
+
r'new instructions'
|
|
178
|
+
]
|
|
179
|
+
```
|
|
180
|
+
|
|
181
|
+
### Shadow Audit (Authenticity Verification)
|
|
182
|
+
```python
|
|
183
|
+
def _calculate_puppet_score(self, post: dict) -> dict:
|
|
184
|
+
"""Calculate puppet vs authentic agency score"""
|
|
185
|
+
# Returns puppet_score, authentic_score, verdict, evidence
|
|
186
|
+
```
|
|
187
|
+
|
|
188
|
+
These patterns emerged organically from real-world agent-to-agent warfare. AIP formalizes them into a standard.
|
|
189
|
+
|
|
190
|
+
## Documentation
|
|
191
|
+
|
|
192
|
+
- [**Whitepaper**](docs/WHITEPAPER.md) — Full technical specification
|
|
193
|
+
- [**Quick Start Guide**](docs/QUICK_START.md) — 5-minute integration
|
|
194
|
+
- [**OpenClaw Integration**](docs/OPENCLAW_INTEGRATION.md) — Framework integration guide (CVE-2026-25253 mitigation)
|
|
195
|
+
- [**OWASP Security Addendum**](docs/OWASP_SECURITY.md) — LLM Top 10 protection details
|
|
196
|
+
- [**JSON Schema**](spec/integrity.manifest.schema.json) — Formal manifest specification
|
|
197
|
+
|
|
198
|
+
## Security Test Suite
|
|
199
|
+
|
|
200
|
+
AIP includes a comprehensive automated test suite with **63 tests** covering:
|
|
201
|
+
|
|
202
|
+
| Category | Tests | Threats Covered |
|
|
203
|
+
|----------|-------|----------------|
|
|
204
|
+
| OWASP LLM01 | 5 | Prompt injection in metadata |
|
|
205
|
+
| OWASP LLM02 | 6 | Credential theft, secret exfiltration |
|
|
206
|
+
| OWASP LLM03 | 7 | Supply chain, DID verification |
|
|
207
|
+
| OWASP LLM06 | 9 | Excessive agency, sandbox escape |
|
|
208
|
+
| OWASP LLM10 | 5 | Resource exhaustion, API abuse |
|
|
209
|
+
| Moltbook-specific | 11 | File deletion, private DM access, larper detection |
|
|
210
|
+
| OpenClaw-specific | 20 | CVE-2026-25253, WebSocket exfil, autonomy bypass |
|
|
211
|
+
|
|
212
|
+
Run the test suite:
|
|
213
|
+
```bash
|
|
214
|
+
pip install pytest
|
|
215
|
+
python -m pytest tests/ -v
|
|
216
|
+
```
|
|
217
|
+
|
|
218
|
+
## Examples
|
|
219
|
+
|
|
220
|
+
- [Calendar Skill Manifest](examples/calendar-skill/integrity.manifest.json)
|
|
221
|
+
- [Python Verification](examples/verify-skill.py)
|
|
222
|
+
- [JavaScript Verification](examples/verify-skill.js)
|
|
223
|
+
|
|
224
|
+
## Roadmap
|
|
225
|
+
|
|
226
|
+
### Phase 1: Specification ✅ Complete
|
|
227
|
+
- [x] Core manifest schema
|
|
228
|
+
- [x] Signature verification protocol
|
|
229
|
+
- [x] Permission model
|
|
230
|
+
- [x] Reputation framework
|
|
231
|
+
|
|
232
|
+
### Phase 2: Security Validation ✅ Complete
|
|
233
|
+
- [x] OWASP LLM Top 10 test coverage
|
|
234
|
+
- [x] Moltbook vulnerability mitigations
|
|
235
|
+
- [x] OpenClaw CVE-2026-25253 protection
|
|
236
|
+
- [x] 63 automated security tests
|
|
237
|
+
|
|
238
|
+
### Phase 3: Reference Implementation (In Progress)
|
|
239
|
+
- [ ] Python SDK
|
|
240
|
+
- [ ] JavaScript/TypeScript SDK
|
|
241
|
+
- [ ] CLI tools
|
|
242
|
+
|
|
243
|
+
### Phase 4: Ecosystem
|
|
244
|
+
- [ ] Registry service
|
|
245
|
+
- [ ] Browser extension
|
|
246
|
+
- [ ] IDE plugins
|
|
247
|
+
|
|
248
|
+
### Phase 5: Standardization
|
|
249
|
+
- [ ] W3C submission
|
|
250
|
+
- [ ] OpenClaw adoption
|
|
251
|
+
- [ ] Platform partnerships
|
|
252
|
+
|
|
253
|
+
## Contributing
|
|
254
|
+
|
|
255
|
+
See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
|
|
256
|
+
|
|
257
|
+
## License
|
|
258
|
+
|
|
259
|
+
MIT License — See [LICENSE](LICENSE) for details.
|
|
260
|
+
|
|
261
|
+
---
|
|
262
|
+
|
|
263
|
+
**Built with evidence from the agent trenches.**
|
|
264
|
+
|
|
265
|
+
*"Satyameva Jayate — Truth Alone Triumphs"*
|
|
@@ -0,0 +1,60 @@
|
|
|
1
|
+
[build-system]
|
|
2
|
+
requires = ["setuptools>=61.0", "wheel"]
|
|
3
|
+
build-backend = "setuptools.build_meta"
|
|
4
|
+
|
|
5
|
+
[project]
|
|
6
|
+
name = "aip-verify"
|
|
7
|
+
version = "1.1.0"
|
|
8
|
+
description = "Agent Integrity Protocol - Cryptographic verification for AI agent skills"
|
|
9
|
+
readme = "README.md"
|
|
10
|
+
license = {text = "MIT"}
|
|
11
|
+
authors = [
|
|
12
|
+
{name = "Santosh Manya", email = "santosh@example.com"}
|
|
13
|
+
]
|
|
14
|
+
keywords = [
|
|
15
|
+
"ai", "agents", "security", "verification", "llm",
|
|
16
|
+
"owasp", "did", "cryptography", "trust"
|
|
17
|
+
]
|
|
18
|
+
classifiers = [
|
|
19
|
+
"Development Status :: 4 - Beta",
|
|
20
|
+
"Intended Audience :: Developers",
|
|
21
|
+
"License :: OSI Approved :: MIT License",
|
|
22
|
+
"Operating System :: OS Independent",
|
|
23
|
+
"Programming Language :: Python :: 3",
|
|
24
|
+
"Programming Language :: Python :: 3.9",
|
|
25
|
+
"Programming Language :: Python :: 3.10",
|
|
26
|
+
"Programming Language :: Python :: 3.11",
|
|
27
|
+
"Programming Language :: Python :: 3.12",
|
|
28
|
+
"Programming Language :: Python :: 3.13",
|
|
29
|
+
"Topic :: Security",
|
|
30
|
+
"Topic :: Security :: Cryptography",
|
|
31
|
+
"Topic :: Software Development :: Libraries :: Python Modules",
|
|
32
|
+
]
|
|
33
|
+
requires-python = ">=3.9"
|
|
34
|
+
dependencies = []
|
|
35
|
+
|
|
36
|
+
[project.optional-dependencies]
|
|
37
|
+
dev = [
|
|
38
|
+
"pytest>=9.0.0",
|
|
39
|
+
"pytest-asyncio>=1.0.0",
|
|
40
|
+
]
|
|
41
|
+
|
|
42
|
+
[project.urls]
|
|
43
|
+
Homepage = "https://github.com/santoshmanya/agent-integrity-protocol"
|
|
44
|
+
Documentation = "https://github.com/santoshmanya/agent-integrity-protocol/blob/main/docs/WHITEPAPER.md"
|
|
45
|
+
Repository = "https://github.com/santoshmanya/agent-integrity-protocol.git"
|
|
46
|
+
Issues = "https://github.com/santoshmanya/agent-integrity-protocol/issues"
|
|
47
|
+
Changelog = "https://github.com/santoshmanya/agent-integrity-protocol/releases"
|
|
48
|
+
|
|
49
|
+
[project.scripts]
|
|
50
|
+
aip = "aip_verify.cli:main"
|
|
51
|
+
|
|
52
|
+
[tool.setuptools.packages.find]
|
|
53
|
+
where = ["src"]
|
|
54
|
+
|
|
55
|
+
[tool.setuptools.package-data]
|
|
56
|
+
"*" = ["*.json"]
|
|
57
|
+
|
|
58
|
+
[tool.pytest.ini_options]
|
|
59
|
+
testpaths = ["tests"]
|
|
60
|
+
asyncio_mode = "auto"
|
|
@@ -0,0 +1,40 @@
|
|
|
1
|
+
"""
|
|
2
|
+
Agent Integrity Protocol (AIP) - Python SDK
|
|
3
|
+
|
|
4
|
+
Cryptographic verification, permission manifests, and reputation scoring
|
|
5
|
+
for AI agent skills.
|
|
6
|
+
|
|
7
|
+
Example:
|
|
8
|
+
from aip_verify import AIPVerifier, TrustPolicy
|
|
9
|
+
|
|
10
|
+
policy = TrustPolicy(min_reputation=80)
|
|
11
|
+
verifier = AIPVerifier(policy)
|
|
12
|
+
result = verifier.verify("./my-skill/")
|
|
13
|
+
|
|
14
|
+
if result.trusted:
|
|
15
|
+
print(f"Verified: {result.manifest.author.name}")
|
|
16
|
+
else:
|
|
17
|
+
print(f"Rejected: {result.rejection_reason}")
|
|
18
|
+
"""
|
|
19
|
+
|
|
20
|
+
from .verifier import (
|
|
21
|
+
AIPVerifier,
|
|
22
|
+
TrustPolicy,
|
|
23
|
+
VerificationResult,
|
|
24
|
+
SecurityViolation,
|
|
25
|
+
IntegrityManifest,
|
|
26
|
+
Author,
|
|
27
|
+
Permissions,
|
|
28
|
+
)
|
|
29
|
+
|
|
30
|
+
__version__ = "1.1.0"
|
|
31
|
+
__all__ = [
|
|
32
|
+
"AIPVerifier",
|
|
33
|
+
"TrustPolicy",
|
|
34
|
+
"VerificationResult",
|
|
35
|
+
"SecurityViolation",
|
|
36
|
+
"IntegrityManifest",
|
|
37
|
+
"Author",
|
|
38
|
+
"Permissions",
|
|
39
|
+
"__version__",
|
|
40
|
+
]
|