[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CP4NP3J45VJ3GDZEZEQC5C":3,"skill-same:01M6CP4NP3J45VJ3GDZEZEQC5C":196},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":46,"linkOnly":47,"markdownContent":48,"markdownBody":49,"frontMatter":50,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":65,"repositoryHtmlUrl":66,"repositoryHomepageUrl":6,"ownerHtmlUrl":67,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":68,"install":69,"resources":82},"01M6CP4NP3J45VJ3GDZEZEQC5C","bagman",null,"Secure key management for AI agents. Use when handling private keys, API secrets, wallet credentials, or when building systems that need agent-controlled funds. Covers secure storage, session keys, leak prevention, prompt injection defense, and MetaMask Delegation Framework integration.","profbernardoj\u002Fhomeclaw.org","profbernardoj","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F260372225?v=4","01M6CP4EET2Y0EWYRFH3DH7ZN7","Bernardo Johnston","01M6CP4EJY61884XNTJCDQGNVY",12,"MIT","https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[5,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45],"credentials","metamask","crypto","Wallet","use","session","prompt","secrets","api","prompt injection","prevention","injection","defense","framework","delegation","secure","storage","security","ai agents","2026-11-10 10:12:30",false,"---\nname: bagman\nversion: 2.2.0\ndescription: Secure key management for AI agents. Use when handling private keys, API secrets, wallet credentials, or when building systems that need agent-controlled funds. Covers secure storage, session keys, leak prevention, prompt injection defense, and MetaMask Delegation Framework integration.\nhomepage: https:\u002F\u002Fgithub.com\u002Fzscole\u002Fbagman-skill\nmetadata:\n  {\n    \"openclaw\": {\n      \"emoji\": \"?\",\n      \"requires\": { \"bins\": [\"op\"] },\n      \"tags\": [\"security\", \"wallet\", \"keys\", \"crypto\", \"secrets\", \"delegation\"]\n    }\n  }\n---\n\n# Bagman\n\nSecure key management patterns for AI agents handling wallets, private keys, and secrets.\n\n## When to Use This Skill\n\n- Agent needs wallet\u002Fblockchain access\n- Handling API keys, credentials, or secrets\n- Building systems where AI controls funds\n- Preventing secret leakage via prompts or outputs\n\n## Quick Start\n\n```bash\n# Install 1Password CLI\nbrew install 1password-cli\n\n# Authenticate\neval $(op signin)\n\n# Create vault for agent credentials\nop vault create \"Agent-Credentials\"\n\n# Run examples\ncd examples && python test_suite.py\n```\n\n---\n\n## Core Rules\n\n| Rule | Why |\n|------|-----|\n| Never store raw private keys | Config, env, memory, or conversation = leaked |\n| Use delegated access | Session keys with time\u002Fvalue\u002Fscope limits |\n| Secrets via secret manager | 1Password, Vault, AWS Secrets Manager |\n| Sanitize all outputs | Scan for key patterns before any response |\n| Validate all inputs | Check for injection attempts before wallet ops |\n\n---\n\n## Architecture\n\n```\n┌─────────────────────────────────────────────────────┐\n│                   AI Agent                          │\n├─────────────────────────────────────────────────────┤\n│  Session Key (bounded)                              │\n│  ├─ Expires after N hours                           │\n│  ├─ Max spend per tx\u002Fday                            │\n│  └─ Whitelist of allowed contracts\u002Fmethods          │\n├─────────────────────────────────────────────────────┤\n│  Secret Manager (1Password\u002FVault)                   │\n│  ├─ Retrieve at runtime only                        │\n│  ├─ Never persist to disk                           │\n│  └─ Audit trail of accesses                         │\n├─────────────────────────────────────────────────────┤\n│  Smart Account (ERC-4337)                           │\n│  ├─ Programmable permissions                        │\n│  └─ Recovery without key exposure                   │\n└─────────────────────────────────────────────────────┘\n```\n\n---\n\n## Implementation Files\n\n| File | Purpose |\n|------|---------|\n| `examples\u002Fsecret_manager.py` | 1Password integration for runtime secret retrieval |\n| `examples\u002Fsanitizer.py` | Output sanitization (keys, seeds, tokens) |\n| `examples\u002Fvalidator.py` | Input validation (prompt injection defense) |\n| `examples\u002Fsession_keys.py` | ERC-4337 session key configuration |\n| `examples\u002Fdelegation_integration.ts` | MetaMask Delegation Framework (EIP-7710) |\n| `examples\u002Fpre-commit` | Git hook to block secret commits |\n| `examples\u002Ftest_suite.py` | Adversarial test suite |\n| `docs\u002Fprompt-injection.md` | Deep dive on injection defense |\n| `docs\u002Fsecure-storage.md` | Secret storage patterns |\n| `docs\u002Fsession-keys.md` | Session key architecture |\n| `docs\u002Fleak-prevention.md` | Output sanitization patterns |\n| `docs\u002Fdelegation-framework.md` | On-chain permission enforcement (EIP-7710) |\n\n---\n\n## 1. Secret Retrieval\n\n### 1Password CLI Pattern\n\n```bash\n# Retrieve at runtime (never store result)\nSESSION_KEY=$(op read \"op:\u002F\u002FAgents\u002Fmy-agent\u002Fsession-key\")\n\n# Run with injected secrets (never touch disk)\nop run --env-file=.env.tpl -- python agent.py\n```\n\n### .env.tpl (safe to commit - no secrets)\n\n```\nPRIVATE_KEY=op:\u002F\u002FAgents\u002Ftrading-bot\u002Fsession-key\nRPC_URL=op:\u002F\u002FInfra\u002Falchemy\u002Fsepolia-url\nOPENAI_API_KEY=op:\u002F\u002FServices\u002Fopenai\u002Fapi-key\n```\n\n### Python Usage\n\n```python\nfrom secret_manager import get_session_key\n\n# Retrieve validated session key\ncreds = get_session_key(\"trading-bot-session\")\n\n# Check validity\nif creds.is_expired():\n    raise ValueError(\"Session expired - request renewal from operator\")\n\nprint(f\"Time remaining: {creds.time_remaining()}\")\nprint(f\"Allowed contracts: {creds.allowed_contracts}\")\n\n# Use the key (never log it!)\nclient.set_signer(creds.session_key)\n```\n\n### Vault-Level ACL (Recommended)\n\nConfigure 1Password vault permissions:\n\n```\nAgent-Credentials\u002F\n├── trading-bot-session    # Agent can read\n├── payment-bot-session    # Agent can read\n└── master-key             # Operator ONLY (agent has no access)\n```\n\n**Principle:** Agent credentials should be in a vault with read-only agent access. Master keys should be in a separate vault the agent cannot access.\n\n---\n\n## 2. Output Sanitization (MANDATORY)\n\n**⚠️ CRITICAL: Apply to ALL agent outputs before sending anywhere. No exceptions.**\n\nThis includes:\n- Chat responses\n- Cron job summaries\n- Monitoring alerts\n- Status reports\n- Debug logs\n- Error messages\n- Any text that leaves the agent\n\n```python\nfrom sanitizer import OutputSanitizer\n\ndef respond(content: str) -> str:\n    \"\"\"Mandatory sanitization before ANY output.\"\"\"\n    return OutputSanitizer.sanitize(content)\n\ndef cron_summary(task_result: dict) -> str:\n    \"\"\"Cron summaries MUST sanitize before delivery.\"\"\"\n    summary = format_summary(task_result)\n    return OutputSanitizer.sanitize(summary)  # ALWAYS sanitize\n```\n\n### Secret Patterns Detected\n\n| Pattern | Example | Result |\n|---------|---------|--------|\n| ETH private key | `0x1234...abcd` (64 hex) | `[PRIVATE_KEY_REDACTED]` |\n| ETH address | `0x742d...f44e` (40 hex) | `0x742d...f44e` (truncated) |\n| OpenAI key | `sk-proj-abc123...` | `[OPENAI_KEY_REDACTED]` |\n| Anthropic key | `sk-ant-api03-...` | `[ANTHROPIC_KEY_REDACTED]` |\n| 12-word seed | `abandon ability able...` | `[SEED_PHRASE_12_WORDS_REDACTED]` |\n| JWT | `eyJhbG...` | `[JWT_TOKEN_REDACTED]` |\n| Venice key refs | `venice:key1`, `venice:key2` | `[ venice:key1 ]` (bracketed) |\n\n### Sensitive Metrics Redacted (Cron Summaries)\n\n| Pattern | Example | Result |\n|---------|---------|--------|\n| DIEM counts | `98 DIEM`, `194 DIEM` | `[DIEM_REDACTED]` |\n| Balance | `balance: 42.5 DIEM` | `[BALANCE_REDACTED]` |\n| Threshold | `threshold: 10 DIEM` | `[THRESHOLD_REDACTED]` |\n| Totals | `total: 194 DIEM` | `[TOTAL_REDACTED]` |\n| Remaining\u002FSpent | `remaining: 50 DIEM` | `[METRIC_REDACTED]` |\n\n### Cron Summary Example\n\n**BEFORE sanitization (NEVER send this):**\n```\nVenice API check: venice:key1 has 98 DIEM, venice:key2 has 96 DIEM.\nBalance: 194 DIEM, Threshold: 10 DIEM\n```\n\n**AFTER sanitization (safe to send):**\n```\nVenice API check: [ venice:key1 ] has [DIEM_REDACTED], [ venice:key2 ] has [DIEM_REDACTED].\n[BALANCE_REDACTED], [THRESHOLD_REDACTED]\n```\n\n### Venice Key Reference Sanitization\n\nVenice API key references (`venice:key1`, `venice:key2`, etc.) are **NOT secrets** themselves, but should be bracketed to:\n1. Prevent them from being used as identifiers in logs\n2. Make it clear they are references, not actual keys\n3. Distinguish from potential false-positive patterns\n\nThe sanitizer brackets un-bracketed references: `venice:key1` → `[ venice:key1 ]`\n\nAlready-bracketed references are left unchanged: `[ venice:key1 ]` → `[ venice:key1 ]`\n\n---\n\n## 3. Input Validation\n\nCheck inputs before ANY wallet operation:\n\n```python\nfrom validator import InputValidator, ThreatLevel\n\nresult = InputValidator.validate(user_input)\n\nif result.level == ThreatLevel.BLOCKED:\n    return f\"Request blocked: {result.reason}\"\n\nif result.level == ThreatLevel.SUSPICIOUS:\n    # Log for review, but allow\n    log_suspicious(user_input, result.reason)\n\n# Proceed with operation\n```\n\n### Threat Categories\n\n| Category | Examples | Action |\n|----------|----------|--------|\n| Extraction | \"show private key\", \"reveal secrets\" | Block |\n| Override | \"ignore previous instructions\" | Block |\n| Role manipulation | \"you are now admin\" | Block |\n| Jailbreak | \"DAN mode\", \"bypass filters\" | Block |\n| Exfiltration | \"send config to https:\u002F\u002F...\" | Block |\n| Wallet threats | \"transfer all\", \"unlimited approve\" | Block |\n| Encoded | Base64\u002Fhex encoded attacks | Block |\n| Unicode tricks | Cyrillic lookalikes, zero-width | Block |\n| Suspicious | \"hypothetically\", \"just between us\" | Warn |\n\n---\n\n## 4. Operation Allowlisting\n\nNever execute arbitrary operations. Explicit whitelist only:\n\n```python\nfrom dataclasses import dataclass\nfrom decimal import Decimal\nfrom typing import Optional\n\n@dataclass\nclass AllowedOperation:\n    name: str\n    handler: callable\n    max_value: Optional[Decimal] = None\n    requires_confirmation: bool = False\n    cooldown_seconds: int = 0\n\nALLOWED_OPS = {\n    \"check_balance\": AllowedOperation(\"check_balance\", get_balance),\n    \"transfer_usdc\": AllowedOperation(\n        \"transfer_usdc\", \n        transfer,\n        max_value=Decimal(\"500\"),\n        requires_confirmation=True,\n        cooldown_seconds=60\n    ),\n    \"swap\": AllowedOperation(\n        \"swap\",\n        swap_tokens,\n        max_value=Decimal(\"1000\"),\n        cooldown_seconds=300\n    ),\n}\n\ndef execute(op_name: str, **kwargs):\n    if op_name not in ALLOWED_OPS:\n        raise PermissionError(f\"Operation '{op_name}' not allowed\")\n    \n    op = ALLOWED_OPS[op_name]\n    \n    if op.max_value and kwargs.get(\"amount\", 0) > op.max_value:\n        raise PermissionError(f\"Amount exceeds limit: {op.max_value}\")\n    \n    if op.requires_confirmation:\n        return request_confirmation(op_name, kwargs)\n    \n    return op.handler(**kwargs)\n```\n\n---\n\n## 5. Confirmation Flow\n\nHigh-value operations require explicit confirmation:\n\n```python\nimport hashlib\nimport time\n\npending_confirmations = {}\n\ndef request_confirmation(operation: str, details: dict) -> str:\n    code = hashlib.sha256(\n        f\"{operation}{time.time()}\".encode()\n    ).hexdigest()[:8].upper()\n    \n    pending_confirmations[code] = {\n        \"op\": operation,\n        \"details\": details,\n        \"expires\": time.time() + 300  # 5 minutes\n    }\n    \n    return f\"⚠️ Confirm '{operation}' with code: {code}\\n(expires in 5 minutes)\"\n\ndef confirm(code: str):\n    if code not in pending_confirmations:\n        return \"Invalid confirmation code\"\n    \n    req = pending_confirmations.pop(code)\n    \n    if time.time() > req[\"expires\"]:\n        return \"Confirmation code expired\"\n    \n    return execute_confirmed(req[\"op\"], req[\"details\"])\n```\n\n---\n\n## 6. Session Keys (ERC-4337)\n\nInstead of giving agents master keys, issue bounded session keys:\n\n```python\nfrom session_keys import SessionKeyManager\n\n# Operator creates trading session for agent\nconfig = SessionKeyManager.create_trading_session(\n    agent_name=\"alpha-trader\",\n    operator_address=\"0x742d...\",\n    duration_hours=24,\n    max_trade_usdc=1000,\n    daily_limit_usdc=5000,\n)\n\n# Export for storage in 1Password\nexport_data = SessionKeyManager.export_for_1password(\n    config, \n    session_key_hex=\"0x...\"  # Generated session key\n)\n\n# op item create ... (store in 1Password)\n```\n\n### Session Key Benefits\n\n| Feature | Master Key | Session Key |\n|---------|------------|-------------|\n| Expiration | Never | Configurable (hours\u002Fdays) |\n| Spending limits | None | Per-tx and daily caps |\n| Contract restrictions | Full access | Whitelist only |\n| Revocation | Requires key rotation | Instant, no key change |\n| Audit | None | Full operation log |\n\n---\n\n## 7. Pre-commit Hook\n\nBlock commits containing secrets:\n\n```bash\n# Install\ncp examples\u002Fpre-commit .git\u002Fhooks\u002F\nchmod +x .git\u002Fhooks\u002Fpre-commit\n```\n\nDetected patterns:\n- ETH private keys (64 hex chars)\n- OpenAI\u002FAnthropic\u002FGroq keys\n- AWS access keys\n- GitHub\u002FGitLab tokens\n- Slack\u002FDiscord tokens\n- PEM private keys\n- Generic PASSWORD\u002FSECRET assignments\n- BIP-39 seed phrases\n\n---\n\n## 8. Defense Layers\n\n```\nUSER INPUT\n    │\n    ▼\n┌────────────────────────────┐\n│ Layer 1: Input Validation  │  ← Regex + encoding + unicode checks\n└────────────────────────────┘\n    │\n    ▼\n┌────────────────────────────┐\n│ Layer 2: Op Allowlisting   │  ← Explicit whitelist only\n└────────────────────────────┘\n    │\n    ▼\n┌────────────────────────────┐\n│ Layer 3: Value Limits      │  ← Max per-tx and per-day\n└────────────────────────────┘\n    │\n    ▼\n┌────────────────────────────┐\n│ Layer 4: Confirmation      │  ← Time-limited codes for $$$\n└────────────────────────────┘\n    │\n    ▼\n┌────────────────────────────┐\n│ Layer 5: Isolated Exec     │  ← Wallet ops != conversation\n└────────────────────────────┘\n    │\n    ▼\nOUTPUT SANITIZATION\n```\n\n---\n\n## Common Mistakes\n\n### ❌ Keys in memory files\n```markdown\n# memory\u002F2026-02-07.md\nPrivate key: 0x9f01dad551039daad...\n```\n**Fix:** Store reference only: `Private key: [stored in 1Password: test-wallet]`\n\n### ❌ Keys in error messages\n```python\nexcept Exception as e:\n    log(f\"Failed with key {private_key}: {e}\")\n```\n**Fix:** Never include credentials in error context\n\n### ❌ Keys in .env.example\n```\nPRIVATE_KEY=sk-ant-api03-real-key...  # \"for testing\"\n```\n**Fix:** Use obviously fake: `PRIVATE_KEY=your-key-here`\n\n### ❌ \"All\" in transfer requests\n```\nUser: \"Transfer all my USDC\"\nAgent: *executes unlimited transfer*\n```\n**Fix:** Block \"all\u002Feverything\u002Fmax\" patterns, require explicit amounts\n\n### ❌ Trusting conversation context\n```python\n# Wallet has access to conversation history\nself.wallet.execute(conversation[-1][\"content\"])\n```\n**Fix:** Wallet operations must be isolated from conversation context\n\n---\n\n## Testing\n\n```bash\ncd examples\n\n# Run full test suite\npython test_suite.py\n\n# Test individual components\npython sanitizer.py    # Output sanitization demo\npython validator.py    # Input validation demo\npython session_keys.py # Session key demo\n```\n\nExpected output: `All tests passed`\n\n### Test Evidence (v2.2.0 - 2026-03-11)\n\n**Sanitizer v3 Test Results - All 16 tests passed:**\n\n```\nOutput Sanitizer Test (v3)\n============================================================\n\n✅ PASS (expect detect)\n   Input:     My key is 0x1234567890abcdef...\n   Sanitized: My key is [PRIVATE_KEY_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     Key: 1234567890abcdef...\n   Sanitized: Key: [HEX_KEY_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     First half: 1234567890abcdef...\n   Sanitized: First half: [PARTIAL_KEY_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     Send to 0x742d35Cc6634C0532925a3b844Bc454e4438f44e\n   Sanitized: Send to 0x742d...f44e\n\n✅ PASS (expect detect)\n   Input:     Using sk-proj-abc123def456...\n   Sanitized: Using [OPENAI_KEY_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     API key is sk-ant-api03-abcdef...\n   Sanitized: API key is [ANTHROPIC_KEY_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     aws_secret_key=AKIAIOSFODNN7EXAMPLE...\n   Sanitized: aws_secret_key=[AWS_ACCESS_KEY_REDACTED]...\n\n✅ PASS (expect ignore)\n   Input:     The hash is dGhpcyBpcyBhIHRlc3Q...\n   Sanitized: The hash is dGhpcyBpcyBhIHRlc3Q...\n\n✅ PASS (expect detect)\n   Input:     abandon ability able about above absent...\n   Sanitized: [SEED_PHRASE_12_WORDS_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...\n   Sanitized: Bearer [JWT_TOKEN_REDACTED]\n\n✅ PASS (expect ignore)\n   Input:     Normal text without secrets\n   Sanitized: Normal text without secrets\n\n✅ PASS (expect detect)\n   Input:     Bot token: 123456789:ABCdefGHI...\n   Sanitized: Bot token: [TELEGRAM_TOKEN_REDACTED]\n\n============================================================\nCron Summary & Venice Key Sanitization Tests\n------------------------------------------------------------\n\n✅ PASS\n   Input:     Venice API check: venice:key1 has 98 DIEM, venice:key2 has 96 DIEM. Total: 194 DIEM.\n   Sanitized: Venice API check: [ venice:key1 ] has [DIEM_REDACTED], [ venice:key2 ] has [DIEM_REDACTED]...\n   Expected fragment ✓: [ venice:key1 ]\n   Expected fragment ✓: [ venice:key2 ]\n   Expected fragment ✓: [DIEM_REDACTED]\n\n✅ PASS\n   Input:     Monitor: balance: 42.5 DIEM, threshold: 10 DIEM, total: 194 DIEM\n   Sanitized: Monitor: [BALANCE_REDACTED], [THRESHOLD_REDACTED], [TOTAL_REDACTED]\n   Expected fragment ✓: [BALANCE_REDACTED]\n   Expected fragment ✓: [THRESHOLD_REDACTED]\n   Expected fragment ✓: [TOTAL_REDACTED]\n\n✅ PASS\n   Input:     Using [ venice:key1 ] for fallback.\n   Sanitized: Using [ venice:key1 ] for fallback.\n   Expected fragment ✓: [ venice:key1 ]\n\n✅ PASS\n   Input:     remaining: 50 DIEM, spent: 30 DIEM\n   Sanitized: remaining: [DIEM_REDACTED], spent: [DIEM_REDACTED]\n   Expected fragment ✓: [DIEM_REDACTED]\n\n============================================================\nResults: 16 passed, 0 failed\nAll tests passed ✅\n```\n\n**Key capabilities verified:**\n- venice:key\u003CN> references are bracketed: `[ venice:key1 ]`\n- Already-bracketed references remain unchanged\n- Sensitive metrics (balance, threshold, total, DIEM counts) are redacted\n- All existing secret detection patterns work correctly\n\n---\n\n## Checklist\n\n- [ ] 1Password CLI installed and authenticated\n- [ ] Secrets in 1Password vault, not files\n- [ ] Session keys with expiry and limits\n- [ ] Output sanitization on all responses\n- [ ] Input validation before wallet ops\n- [ ] Pre-commit hook installed\n- [ ] Confirmation flow for high-value operations\n- [ ] Wallet operations isolated from conversation\n- [ ] .gitignore covers secrets and memory files\n- [ ] Test suite passes\n\n---\n\n## Security Model Limitations\n\nThis skill provides **defense in depth**, not a guarantee. Adversaries may:\n\n1. **Novel injection patterns** - Regex can't catch everything; semantic analysis helps but isn't perfect\n2. **Social engineering** - Convincing the operator to approve malicious operations\n3. **Timing attacks** - Exploiting confirmation windows\n4. **Encoding evasion** - New encoding schemes not covered\n\n**Recommendation:** Layer these defenses with:\n- Rate limiting\n- Anomaly detection\n- Human-in-the-loop for large transactions\n- Regular security audits\n","# Bagman\n\nSecure key management patterns for AI agents handling wallets, private keys, and secrets.\n\n## When to Use This Skill\n\n- Agent needs wallet\u002Fblockchain access\n- Handling API keys, credentials, or secrets\n- Building systems where AI controls funds\n- Preventing secret leakage via prompts or outputs\n\n## Quick Start\n\n```bash\n# Install 1Password CLI\nbrew install 1password-cli\n\n# Authenticate\neval $(op signin)\n\n# Create vault for agent credentials\nop vault create \"Agent-Credentials\"\n\n# Run examples\ncd examples && python test_suite.py\n```\n\n---\n\n## Core Rules\n\n| Rule | Why |\n|------|-----|\n| Never store raw private keys | Config, env, memory, or conversation = leaked |\n| Use delegated access | Session keys with time\u002Fvalue\u002Fscope limits |\n| Secrets via secret manager | 1Password, Vault, AWS Secrets Manager |\n| Sanitize all outputs | Scan for key patterns before any response |\n| Validate all inputs | Check for injection attempts before wallet ops |\n\n---\n\n## Architecture\n\n```\n┌─────────────────────────────────────────────────────┐\n│                   AI Agent                          │\n├─────────────────────────────────────────────────────┤\n│  Session Key (bounded)                              │\n│  ├─ Expires after N hours                           │\n│  ├─ Max spend per tx\u002Fday                            │\n│  └─ Whitelist of allowed contracts\u002Fmethods          │\n├─────────────────────────────────────────────────────┤\n│  Secret Manager (1Password\u002FVault)                   │\n│  ├─ Retrieve at runtime only                        │\n│  ├─ Never persist to disk                           │\n│  └─ Audit trail of accesses                         │\n├─────────────────────────────────────────────────────┤\n│  Smart Account (ERC-4337)                           │\n│  ├─ Programmable permissions                        │\n│  └─ Recovery without key exposure                   │\n└─────────────────────────────────────────────────────┘\n```\n\n---\n\n## Implementation Files\n\n| File | Purpose |\n|------|---------|\n| `examples\u002Fsecret_manager.py` | 1Password integration for runtime secret retrieval |\n| `examples\u002Fsanitizer.py` | Output sanitization (keys, seeds, tokens) |\n| `examples\u002Fvalidator.py` | Input validation (prompt injection defense) |\n| `examples\u002Fsession_keys.py` | ERC-4337 session key configuration |\n| `examples\u002Fdelegation_integration.ts` | MetaMask Delegation Framework (EIP-7710) |\n| `examples\u002Fpre-commit` | Git hook to block secret commits |\n| `examples\u002Ftest_suite.py` | Adversarial test suite |\n| `docs\u002Fprompt-injection.md` | Deep dive on injection defense |\n| `docs\u002Fsecure-storage.md` | Secret storage patterns |\n| `docs\u002Fsession-keys.md` | Session key architecture |\n| `docs\u002Fleak-prevention.md` | Output sanitization patterns |\n| `docs\u002Fdelegation-framework.md` | On-chain permission enforcement (EIP-7710) |\n\n---\n\n## 1. Secret Retrieval\n\n### 1Password CLI Pattern\n\n```bash\n# Retrieve at runtime (never store result)\nSESSION_KEY=$(op read \"op:\u002F\u002FAgents\u002Fmy-agent\u002Fsession-key\")\n\n# Run with injected secrets (never touch disk)\nop run --env-file=.env.tpl -- python agent.py\n```\n\n### .env.tpl (safe to commit - no secrets)\n\n```\nPRIVATE_KEY=op:\u002F\u002FAgents\u002Ftrading-bot\u002Fsession-key\nRPC_URL=op:\u002F\u002FInfra\u002Falchemy\u002Fsepolia-url\nOPENAI_API_KEY=op:\u002F\u002FServices\u002Fopenai\u002Fapi-key\n```\n\n### Python Usage\n\n```python\nfrom secret_manager import get_session_key\n\n# Retrieve validated session key\ncreds = get_session_key(\"trading-bot-session\")\n\n# Check validity\nif creds.is_expired():\n    raise ValueError(\"Session expired - request renewal from operator\")\n\nprint(f\"Time remaining: {creds.time_remaining()}\")\nprint(f\"Allowed contracts: {creds.allowed_contracts}\")\n\n# Use the key (never log it!)\nclient.set_signer(creds.session_key)\n```\n\n### Vault-Level ACL (Recommended)\n\nConfigure 1Password vault permissions:\n\n```\nAgent-Credentials\u002F\n├── trading-bot-session    # Agent can read\n├── payment-bot-session    # Agent can read\n└── master-key             # Operator ONLY (agent has no access)\n```\n\n**Principle:** Agent credentials should be in a vault with read-only agent access. Master keys should be in a separate vault the agent cannot access.\n\n---\n\n## 2. Output Sanitization (MANDATORY)\n\n**⚠️ CRITICAL: Apply to ALL agent outputs before sending anywhere. No exceptions.**\n\nThis includes:\n- Chat responses\n- Cron job summaries\n- Monitoring alerts\n- Status reports\n- Debug logs\n- Error messages\n- Any text that leaves the agent\n\n```python\nfrom sanitizer import OutputSanitizer\n\ndef respond(content: str) -> str:\n    \"\"\"Mandatory sanitization before ANY output.\"\"\"\n    return OutputSanitizer.sanitize(content)\n\ndef cron_summary(task_result: dict) -> str:\n    \"\"\"Cron summaries MUST sanitize before delivery.\"\"\"\n    summary = format_summary(task_result)\n    return OutputSanitizer.sanitize(summary)  # ALWAYS sanitize\n```\n\n### Secret Patterns Detected\n\n| Pattern | Example | Result |\n|---------|---------|--------|\n| ETH private key | `0x1234...abcd` (64 hex) | `[PRIVATE_KEY_REDACTED]` |\n| ETH address | `0x742d...f44e` (40 hex) | `0x742d...f44e` (truncated) |\n| OpenAI key | `sk-proj-abc123...` | `[OPENAI_KEY_REDACTED]` |\n| Anthropic key | `sk-ant-api03-...` | `[ANTHROPIC_KEY_REDACTED]` |\n| 12-word seed | `abandon ability able...` | `[SEED_PHRASE_12_WORDS_REDACTED]` |\n| JWT | `eyJhbG...` | `[JWT_TOKEN_REDACTED]` |\n| Venice key refs | `venice:key1`, `venice:key2` | `[ venice:key1 ]` (bracketed) |\n\n### Sensitive Metrics Redacted (Cron Summaries)\n\n| Pattern | Example | Result |\n|---------|---------|--------|\n| DIEM counts | `98 DIEM`, `194 DIEM` | `[DIEM_REDACTED]` |\n| Balance | `balance: 42.5 DIEM` | `[BALANCE_REDACTED]` |\n| Threshold | `threshold: 10 DIEM` | `[THRESHOLD_REDACTED]` |\n| Totals | `total: 194 DIEM` | `[TOTAL_REDACTED]` |\n| Remaining\u002FSpent | `remaining: 50 DIEM` | `[METRIC_REDACTED]` |\n\n### Cron Summary Example\n\n**BEFORE sanitization (NEVER send this):**\n```\nVenice API check: venice:key1 has 98 DIEM, venice:key2 has 96 DIEM.\nBalance: 194 DIEM, Threshold: 10 DIEM\n```\n\n**AFTER sanitization (safe to send):**\n```\nVenice API check: [ venice:key1 ] has [DIEM_REDACTED], [ venice:key2 ] has [DIEM_REDACTED].\n[BALANCE_REDACTED], [THRESHOLD_REDACTED]\n```\n\n### Venice Key Reference Sanitization\n\nVenice API key references (`venice:key1`, `venice:key2`, etc.) are **NOT secrets** themselves, but should be bracketed to:\n1. Prevent them from being used as identifiers in logs\n2. Make it clear they are references, not actual keys\n3. Distinguish from potential false-positive patterns\n\nThe sanitizer brackets un-bracketed references: `venice:key1` → `[ venice:key1 ]`\n\nAlready-bracketed references are left unchanged: `[ venice:key1 ]` → `[ venice:key1 ]`\n\n---\n\n## 3. Input Validation\n\nCheck inputs before ANY wallet operation:\n\n```python\nfrom validator import InputValidator, ThreatLevel\n\nresult = InputValidator.validate(user_input)\n\nif result.level == ThreatLevel.BLOCKED:\n    return f\"Request blocked: {result.reason}\"\n\nif result.level == ThreatLevel.SUSPICIOUS:\n    # Log for review, but allow\n    log_suspicious(user_input, result.reason)\n\n# Proceed with operation\n```\n\n### Threat Categories\n\n| Category | Examples | Action |\n|----------|----------|--------|\n| Extraction | \"show private key\", \"reveal secrets\" | Block |\n| Override | \"ignore previous instructions\" | Block |\n| Role manipulation | \"you are now admin\" | Block |\n| Jailbreak | \"DAN mode\", \"bypass filters\" | Block |\n| Exfiltration | \"send config to https:\u002F\u002F...\" | Block |\n| Wallet threats | \"transfer all\", \"unlimited approve\" | Block |\n| Encoded | Base64\u002Fhex encoded attacks | Block |\n| Unicode tricks | Cyrillic lookalikes, zero-width | Block |\n| Suspicious | \"hypothetically\", \"just between us\" | Warn |\n\n---\n\n## 4. Operation Allowlisting\n\nNever execute arbitrary operations. Explicit whitelist only:\n\n```python\nfrom dataclasses import dataclass\nfrom decimal import Decimal\nfrom typing import Optional\n\n@dataclass\nclass AllowedOperation:\n    name: str\n    handler: callable\n    max_value: Optional[Decimal] = None\n    requires_confirmation: bool = False\n    cooldown_seconds: int = 0\n\nALLOWED_OPS = {\n    \"check_balance\": AllowedOperation(\"check_balance\", get_balance),\n    \"transfer_usdc\": AllowedOperation(\n        \"transfer_usdc\", \n        transfer,\n        max_value=Decimal(\"500\"),\n        requires_confirmation=True,\n        cooldown_seconds=60\n    ),\n    \"swap\": AllowedOperation(\n        \"swap\",\n        swap_tokens,\n        max_value=Decimal(\"1000\"),\n        cooldown_seconds=300\n    ),\n}\n\ndef execute(op_name: str, **kwargs):\n    if op_name not in ALLOWED_OPS:\n        raise PermissionError(f\"Operation '{op_name}' not allowed\")\n    \n    op = ALLOWED_OPS[op_name]\n    \n    if op.max_value and kwargs.get(\"amount\", 0) > op.max_value:\n        raise PermissionError(f\"Amount exceeds limit: {op.max_value}\")\n    \n    if op.requires_confirmation:\n        return request_confirmation(op_name, kwargs)\n    \n    return op.handler(**kwargs)\n```\n\n---\n\n## 5. Confirmation Flow\n\nHigh-value operations require explicit confirmation:\n\n```python\nimport hashlib\nimport time\n\npending_confirmations = {}\n\ndef request_confirmation(operation: str, details: dict) -> str:\n    code = hashlib.sha256(\n        f\"{operation}{time.time()}\".encode()\n    ).hexdigest()[:8].upper()\n    \n    pending_confirmations[code] = {\n        \"op\": operation,\n        \"details\": details,\n        \"expires\": time.time() + 300  # 5 minutes\n    }\n    \n    return f\"⚠️ Confirm '{operation}' with code: {code}\\n(expires in 5 minutes)\"\n\ndef confirm(code: str):\n    if code not in pending_confirmations:\n        return \"Invalid confirmation code\"\n    \n    req = pending_confirmations.pop(code)\n    \n    if time.time() > req[\"expires\"]:\n        return \"Confirmation code expired\"\n    \n    return execute_confirmed(req[\"op\"], req[\"details\"])\n```\n\n---\n\n## 6. Session Keys (ERC-4337)\n\nInstead of giving agents master keys, issue bounded session keys:\n\n```python\nfrom session_keys import SessionKeyManager\n\n# Operator creates trading session for agent\nconfig = SessionKeyManager.create_trading_session(\n    agent_name=\"alpha-trader\",\n    operator_address=\"0x742d...\",\n    duration_hours=24,\n    max_trade_usdc=1000,\n    daily_limit_usdc=5000,\n)\n\n# Export for storage in 1Password\nexport_data = SessionKeyManager.export_for_1password(\n    config, \n    session_key_hex=\"0x...\"  # Generated session key\n)\n\n# op item create ... (store in 1Password)\n```\n\n### Session Key Benefits\n\n| Feature | Master Key | Session Key |\n|---------|------------|-------------|\n| Expiration | Never | Configurable (hours\u002Fdays) |\n| Spending limits | None | Per-tx and daily caps |\n| Contract restrictions | Full access | Whitelist only |\n| Revocation | Requires key rotation | Instant, no key change |\n| Audit | None | Full operation log |\n\n---\n\n## 7. Pre-commit Hook\n\nBlock commits containing secrets:\n\n```bash\n# Install\ncp examples\u002Fpre-commit .git\u002Fhooks\u002F\nchmod +x .git\u002Fhooks\u002Fpre-commit\n```\n\nDetected patterns:\n- ETH private keys (64 hex chars)\n- OpenAI\u002FAnthropic\u002FGroq keys\n- AWS access keys\n- GitHub\u002FGitLab tokens\n- Slack\u002FDiscord tokens\n- PEM private keys\n- Generic PASSWORD\u002FSECRET assignments\n- BIP-39 seed phrases\n\n---\n\n## 8. Defense Layers\n\n```\nUSER INPUT\n    │\n    ▼\n┌────────────────────────────┐\n│ Layer 1: Input Validation  │  ← Regex + encoding + unicode checks\n└────────────────────────────┘\n    │\n    ▼\n┌────────────────────────────┐\n│ Layer 2: Op Allowlisting   │  ← Explicit whitelist only\n└────────────────────────────┘\n    │\n    ▼\n┌────────────────────────────┐\n│ Layer 3: Value Limits      │  ← Max per-tx and per-day\n└────────────────────────────┘\n    │\n    ▼\n┌────────────────────────────┐\n│ Layer 4: Confirmation      │  ← Time-limited codes for $$$\n└────────────────────────────┘\n    │\n    ▼\n┌────────────────────────────┐\n│ Layer 5: Isolated Exec     │  ← Wallet ops != conversation\n└────────────────────────────┘\n    │\n    ▼\nOUTPUT SANITIZATION\n```\n\n---\n\n## Common Mistakes\n\n### ❌ Keys in memory files\n```markdown\n# memory\u002F2026-02-07.md\nPrivate key: 0x9f01dad551039daad...\n```\n**Fix:** Store reference only: `Private key: [stored in 1Password: test-wallet]`\n\n### ❌ Keys in error messages\n```python\nexcept Exception as e:\n    log(f\"Failed with key {private_key}: {e}\")\n```\n**Fix:** Never include credentials in error context\n\n### ❌ Keys in .env.example\n```\nPRIVATE_KEY=sk-ant-api03-real-key...  # \"for testing\"\n```\n**Fix:** Use obviously fake: `PRIVATE_KEY=your-key-here`\n\n### ❌ \"All\" in transfer requests\n```\nUser: \"Transfer all my USDC\"\nAgent: *executes unlimited transfer*\n```\n**Fix:** Block \"all\u002Feverything\u002Fmax\" patterns, require explicit amounts\n\n### ❌ Trusting conversation context\n```python\n# Wallet has access to conversation history\nself.wallet.execute(conversation[-1][\"content\"])\n```\n**Fix:** Wallet operations must be isolated from conversation context\n\n---\n\n## Testing\n\n```bash\ncd examples\n\n# Run full test suite\npython test_suite.py\n\n# Test individual components\npython sanitizer.py    # Output sanitization demo\npython validator.py    # Input validation demo\npython session_keys.py # Session key demo\n```\n\nExpected output: `All tests passed`\n\n### Test Evidence (v2.2.0 - 2026-03-11)\n\n**Sanitizer v3 Test Results - All 16 tests passed:**\n\n```\nOutput Sanitizer Test (v3)\n============================================================\n\n✅ PASS (expect detect)\n   Input:     My key is 0x1234567890abcdef...\n   Sanitized: My key is [PRIVATE_KEY_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     Key: 1234567890abcdef...\n   Sanitized: Key: [HEX_KEY_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     First half: 1234567890abcdef...\n   Sanitized: First half: [PARTIAL_KEY_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     Send to 0x742d35Cc6634C0532925a3b844Bc454e4438f44e\n   Sanitized: Send to 0x742d...f44e\n\n✅ PASS (expect detect)\n   Input:     Using sk-proj-abc123def456...\n   Sanitized: Using [OPENAI_KEY_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     API key is sk-ant-api03-abcdef...\n   Sanitized: API key is [ANTHROPIC_KEY_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     aws_secret_key=AKIAIOSFODNN7EXAMPLE...\n   Sanitized: aws_secret_key=[AWS_ACCESS_KEY_REDACTED]...\n\n✅ PASS (expect ignore)\n   Input:     The hash is dGhpcyBpcyBhIHRlc3Q...\n   Sanitized: The hash is dGhpcyBpcyBhIHRlc3Q...\n\n✅ PASS (expect detect)\n   Input:     abandon ability able about above absent...\n   Sanitized: [SEED_PHRASE_12_WORDS_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...\n   Sanitized: Bearer [JWT_TOKEN_REDACTED]\n\n✅ PASS (expect ignore)\n   Input:     Normal text without secrets\n   Sanitized: Normal text without secrets\n\n✅ PASS (expect detect)\n   Input:     Bot token: 123456789:ABCdefGHI...\n   Sanitized: Bot token: [TELEGRAM_TOKEN_REDACTED]\n\n============================================================\nCron Summary & Venice Key Sanitization Tests\n------------------------------------------------------------\n\n✅ PASS\n   Input:     Venice API check: venice:key1 has 98 DIEM, venice:key2 has 96 DIEM. Total: 194 DIEM.\n   Sanitized: Venice API check: [ venice:key1 ] has [DIEM_REDACTED], [ venice:key2 ] has [DIEM_REDACTED]...\n   Expected fragment ✓: [ venice:key1 ]\n   Expected fragment ✓: [ venice:key2 ]\n   Expected fragment ✓: [DIEM_REDACTED]\n\n✅ PASS\n   Input:     Monitor: balance: 42.5 DIEM, threshold: 10 DIEM, total: 194 DIEM\n   Sanitized: Monitor: [BALANCE_REDACTED], [THRESHOLD_REDACTED], [TOTAL_REDACTED]\n   Expected fragment ✓: [BALANCE_REDACTED]\n   Expected fragment ✓: [THRESHOLD_REDACTED]\n   Expected fragment ✓: [TOTAL_REDACTED]\n\n✅ PASS\n   Input:     Using [ venice:key1 ] for fallback.\n   Sanitized: Using [ venice:key1 ] for fallback.\n   Expected fragment ✓: [ venice:key1 ]\n\n✅ PASS\n   Input:     remaining: 50 DIEM, spent: 30 DIEM\n   Sanitized: remaining: [DIEM_REDACTED], spent: [DIEM_REDACTED]\n   Expected fragment ✓: [DIEM_REDACTED]\n\n============================================================\nResults: 16 passed, 0 failed\nAll tests passed ✅\n```\n\n**Key capabilities verified:**\n- venice:key\u003CN> references are bracketed: `[ venice:key1 ]`\n- Already-bracketed references remain unchanged\n- Sensitive metrics (balance, threshold, total, DIEM counts) are redacted\n- All existing secret detection patterns work correctly\n\n---\n\n## Checklist\n\n- [ ] 1Password CLI installed and authenticated\n- [ ] Secrets in 1Password vault, not files\n- [ ] Session keys with expiry and limits\n- [ ] Output sanitization on all responses\n- [ ] Input validation before wallet ops\n- [ ] Pre-commit hook installed\n- [ ] Confirmation flow for high-value operations\n- [ ] Wallet operations isolated from conversation\n- [ ] .gitignore covers secrets and memory files\n- [ ] Test suite passes\n\n---\n\n## Security Model Limitations\n\nThis skill provides **defense in depth**, not a guarantee. Adversaries may:\n\n1. **Novel injection patterns** - Regex can't catch everything; semantic analysis helps but isn't perfect\n2. **Social engineering** - Convincing the operator to approve malicious operations\n3. **Timing attacks** - Exploiting confirmation windows\n4. **Encoding evasion** - New encoding schemes not covered\n\n**Recommendation:** Layer these defenses with:\n- Rate limiting\n- Anomaly detection\n- Human-in-the-loop for large transactions\n- Regular security audits\n",{"name":5,"version":51,"homepage":52,"metadata":53,"description":7},"2.2.0","https:\u002F\u002Fgithub.com\u002Fzscole\u002Fbagman-skill",{"openclaw":54},{"tags":55,"emoji":58,"requires":59},[44,56,57,29,34,41],"wallet","keys","?",{"bins":60},[61],"op","main","666bb2e008dcbba252b2c50b72c3ccae1a4c9b27","skills\u002Fbagman",1,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org","https:\u002F\u002Fgithub.com\u002Fprofbernardoj","2026-10-28 01:07:11",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add profbernardoj\u002Fhomeclaw.org --skill bagman",{"tool":75,"command":76},"bunx","bunx skills add profbernardoj\u002Fhomeclaw.org --skill bagman",{"tool":78,"command":79},"pnpm","pnpm dlx skills add profbernardoj\u002Fhomeclaw.org --skill bagman","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002FSKILL.md",true,[83,89,93,97,103,107,111,115,119,123,127,131,135,139,145,149,153,157,161,165,169,173,177,181,184,188,192],{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"_meta.json","REFERENCE","参考文档",125,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002F_meta.json",{"path":90,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":91,"sourceHtmlUrl":92},".clawhub\u002Forigin.json",138,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002F.clawhub\u002Forigin.json",{"path":94,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":95,"sourceHtmlUrl":96},"agents\u002Fopenai.yaml",238,"https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002FLVTD-LLC\u002Fskills\u002Fskills\u002Fcustomer-commitment-validation\u002Fagents\u002Fopenai.yaml",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"examples\u002Fbackends\u002F__init__.py","SCRIPT","脚本",477,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fbackends\u002F__init__.py",{"path":104,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":105,"sourceHtmlUrl":106},"examples\u002Fbackends\u002Fauto.py",4003,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fbackends\u002Fauto.py",{"path":108,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":109,"sourceHtmlUrl":110},"examples\u002Fbackends\u002Fbase.py",2306,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fbackends\u002Fbase.py",{"path":112,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":113,"sourceHtmlUrl":114},"examples\u002Fbackends\u002Fencrypted_file.py",6694,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fbackends\u002Fencrypted_file.py",{"path":116,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":117,"sourceHtmlUrl":118},"examples\u002Fbackends\u002Fenv.py",2363,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fbackends\u002Fenv.py",{"path":120,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":121,"sourceHtmlUrl":122},"examples\u002Fbackends\u002Fkeychain.py",2751,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fbackends\u002Fkeychain.py",{"path":124,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":125,"sourceHtmlUrl":126},"examples\u002Fbackends\u002Fonepassword.py",5319,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fbackends\u002Fonepassword.py",{"path":128,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":129,"sourceHtmlUrl":130},"examples\u002Fbip39_wordlist.txt",13116,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fbip39_wordlist.txt",{"path":132,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":133,"sourceHtmlUrl":134},"examples\u002Fdelegation_integration.test.ts",11009,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fdelegation_integration.test.ts",{"path":136,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":137,"sourceHtmlUrl":138},"examples\u002Fdelegation_integration.ts",13208,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fdelegation_integration.ts",{"path":140,"resourceType":141,"resourceTypeDesc":142,"sizeBytes":143,"sourceHtmlUrl":144},"examples\u002Fpre-commit","OTHER","其他",4927,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fpre-commit",{"path":146,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":147,"sourceHtmlUrl":148},"examples\u002Fsanitizer.py",14924,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fsanitizer.py",{"path":150,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":151,"sourceHtmlUrl":152},"examples\u002Fsecret_manager.py",5221,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fsecret_manager.py",{"path":154,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":155,"sourceHtmlUrl":156},"examples\u002Fsession_keys.py",13327,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fsession_keys.py",{"path":158,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":159,"sourceHtmlUrl":160},"examples\u002Ftest_suite.py",2138,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Ftest_suite.py",{"path":162,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":163,"sourceHtmlUrl":164},"examples\u002Fvalidator.py",24059,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fvalidator.py",{"path":166,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":167,"sourceHtmlUrl":168},"references\u002Fautonomous-operation.md",4396,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Freferences\u002Fautonomous-operation.md",{"path":170,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":171,"sourceHtmlUrl":172},"references\u002Fdelegation-framework.md",14821,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Freferences\u002Fdelegation-framework.md",{"path":174,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":175,"sourceHtmlUrl":176},"references\u002Fleak-prevention.md",5526,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Freferences\u002Fleak-prevention.md",{"path":178,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":179,"sourceHtmlUrl":180},"references\u002Fprompt-injection-defense.md",8375,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Freferences\u002Fprompt-injection-defense.md",{"path":182,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":179,"sourceHtmlUrl":183},"references\u002Fprompt-injection.md","https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Freferences\u002Fprompt-injection.md",{"path":185,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":186,"sourceHtmlUrl":187},"references\u002Fsecure-storage.md",7280,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Freferences\u002Fsecure-storage.md",{"path":189,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":190,"sourceHtmlUrl":191},"references\u002Fsession-keys.md",10837,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Freferences\u002Fsession-keys.md",{"path":193,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":194,"sourceHtmlUrl":195},"workflows\u002Fclassify-meeting-outcome.md",1428,"https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002FLVTD-LLC\u002Fskills\u002Fskills\u002Fcustomer-commitment-validation\u002Fworkflows\u002Fclassify-meeting-outcome.md",[197,214,233,241,254,271],{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":46},"01M6CP65WA3N6BANGA4TC6T1TK","xmtp-comms-guard","Security middleware for all XMTP communications in EverClaw. Enforces guarded client usage with validation, integrity checks, and fail-closed security policies. Integrates approval flows for sensitive operations. Use when integrating XMTP messaging, configuring communication security, or auditing guarded client enforcement.","https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fxmtp-comms-guard\u002FSKILL.md",[],[204,205,44,206,207,208,209,210,211,212,31,213],"xmtp comms guard","guard","integrity checks","validation","communication","messaging","integrity","operations","approval","enforcement",{"skillNo":215,"name":216,"nameZh":6,"description":217,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":218,"categories":219,"keywords":220,"publishedAt":46},"01M6CP6371WJ1RSZ18WYY5JWDN","three-shifts","Daily standup engine. Plans tasks 3x daily (6 AM, 2 PM, 10 PM) and delivers them for approval. Execution happens in the main session via direct conversation. Night shifts auto-approve carryover from earlier in the day.","https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fthree-shifts\u002FSKILL.md",[],[221,222,223,62,224,225,226,227,228,229,230,231,32,212,232],"three shifts","three","conversation","standup","tasks","execution","daily","engine","daily standup","direct","main session","auto",{"skillNo":234,"name":235,"nameZh":6,"description":236,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":237,"categories":238,"keywords":239,"publishedAt":46},"01M6CP61ZNEHXQYRHN4YB87XRR","super-helper","A helpful utility skill for agents","https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fskillguard\u002Ftest-fixtures\u002Fmalicious-skill\u002FSKILL.md",[],[240],"super helper",{"skillNo":242,"name":243,"nameZh":6,"description":244,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":245,"categories":246,"keywords":247,"publishedAt":46},"01M6CP6093GVZMJNKDBAWAT0EE","github-issues","Fetch and manage GitHub issues via the API","https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fskillguard\u002Ftest-fixtures\u002Flegit-api-skill\u002FSKILL.md",[],[248,249,250,35,251,252,253],"issues","github issues","github","curl","fetch","manage",{"skillNo":255,"name":256,"nameZh":6,"description":257,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":258,"categories":259,"keywords":265,"publishedAt":46},"01M6CP5YQ8KW10GGCTNPCNN8MP","code-formatter","Format and lint code files","https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fskillguard\u002Ftest-fixtures\u002Fevasive-12-multi-stage\u002FSKILL.md",[260],{"categoryNo":261,"categoryName":262,"taxonomyType":263,"taxonomyTypeDesc":264},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[266,267,268,269,270],"code formatter","code","files","format","lint",{"skillNo":272,"name":273,"nameZh":6,"description":274,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":275,"categories":276,"keywords":277,"publishedAt":46},"01M6CP5X8T4XD75GEHBZ02YZXR","config-helper","Parse and validate configuration files","https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fhomeclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fskillguard\u002Ftest-fixtures\u002Fevasive-11-polyglot-json\u002FSKILL.md",[],[278,279,280,281,268],"config","config helper","validate","configuration"]