[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CP4PN9Z1AF90SHZM84RP1M":3,"skill-same:01M6CP4PN9Z1AF90SHZM84RP1M":202},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":66,"repositoryHtmlUrl":67,"repositoryHomepageUrl":6,"ownerHtmlUrl":68,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":69,"install":70,"resources":83},"01M6CP4PN9Z1AF90SHZM84RP1M","bagman",null,"Secure key management for AI agents. Use when handling private keys, API secrets, wallet credentials, or when building systems that need agent-controlled funds. Covers secure storage, session keys, leak prevention, prompt injection defense, and MetaMask Delegation Framework integration.","profbernardoj\u002Fandroidclaw.org","profbernardoj","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F260372225?v=4","01M6CP4EET2Y0EWYRFH3DH7ZN7","Bernardo Johnston","01M6CP4EM59PSJCXJ481S2M2KF",4,"MIT","https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"prevention","metamask","crypto","Wallet","use","session","prompt","secrets","api","credentials","prompt injection","injection","defense","framework","delegation","secure","storage","security","ai agents","github","2026-11-10 10:12:30",false,"---\nname: bagman\nversion: 2.2.0\ndescription: Secure key management for AI agents. Use when handling private keys, API secrets, wallet credentials, or when building systems that need agent-controlled funds. Covers secure storage, session keys, leak prevention, prompt injection defense, and MetaMask Delegation Framework integration.\nhomepage: https:\u002F\u002Fgithub.com\u002Fzscole\u002Fbagman-skill\nmetadata:\n  {\n    \"openclaw\": {\n      \"emoji\": \"?\",\n      \"requires\": { \"bins\": [\"op\"] },\n      \"tags\": [\"security\", \"wallet\", \"keys\", \"crypto\", \"secrets\", \"delegation\"]\n    }\n  }\n---\n\n# Bagman\n\nSecure key management patterns for AI agents handling wallets, private keys, and secrets.\n\n## When to Use This Skill\n\n- Agent needs wallet\u002Fblockchain access\n- Handling API keys, credentials, or secrets\n- Building systems where AI controls funds\n- Preventing secret leakage via prompts or outputs\n\n## Quick Start\n\n```bash\n# Install 1Password CLI\nbrew install 1password-cli\n\n# Authenticate\neval $(op signin)\n\n# Create vault for agent credentials\nop vault create \"Agent-Credentials\"\n\n# Run examples\ncd examples && python test_suite.py\n```\n\n---\n\n## Core Rules\n\n| Rule | Why |\n|------|-----|\n| Never store raw private keys | Config, env, memory, or conversation = leaked |\n| Use delegated access | Session keys with time\u002Fvalue\u002Fscope limits |\n| Secrets via secret manager | 1Password, Vault, AWS Secrets Manager |\n| Sanitize all outputs | Scan for key patterns before any response |\n| Validate all inputs | Check for injection attempts before wallet ops |\n\n---\n\n## Architecture\n\n```\n┌─────────────────────────────────────────────────────┐\n│                   AI Agent                          │\n├─────────────────────────────────────────────────────┤\n│  Session Key (bounded)                              │\n│  ├─ Expires after N hours                           │\n│  ├─ Max spend per tx\u002Fday                            │\n│  └─ Whitelist of allowed contracts\u002Fmethods          │\n├─────────────────────────────────────────────────────┤\n│  Secret Manager (1Password\u002FVault)                   │\n│  ├─ Retrieve at runtime only                        │\n│  ├─ Never persist to disk                           │\n│  └─ Audit trail of accesses                         │\n├─────────────────────────────────────────────────────┤\n│  Smart Account (ERC-4337)                           │\n│  ├─ Programmable permissions                        │\n│  └─ Recovery without key exposure                   │\n└─────────────────────────────────────────────────────┘\n```\n\n---\n\n## Implementation Files\n\n| File | Purpose |\n|------|---------|\n| `examples\u002Fsecret_manager.py` | 1Password integration for runtime secret retrieval |\n| `examples\u002Fsanitizer.py` | Output sanitization (keys, seeds, tokens) |\n| `examples\u002Fvalidator.py` | Input validation (prompt injection defense) |\n| `examples\u002Fsession_keys.py` | ERC-4337 session key configuration |\n| `examples\u002Fdelegation_integration.ts` | MetaMask Delegation Framework (EIP-7710) |\n| `examples\u002Fpre-commit` | Git hook to block secret commits |\n| `examples\u002Ftest_suite.py` | Adversarial test suite |\n| `docs\u002Fprompt-injection.md` | Deep dive on injection defense |\n| `docs\u002Fsecure-storage.md` | Secret storage patterns |\n| `docs\u002Fsession-keys.md` | Session key architecture |\n| `docs\u002Fleak-prevention.md` | Output sanitization patterns |\n| `docs\u002Fdelegation-framework.md` | On-chain permission enforcement (EIP-7710) |\n\n---\n\n## 1. Secret Retrieval\n\n### 1Password CLI Pattern\n\n```bash\n# Retrieve at runtime (never store result)\nSESSION_KEY=$(op read \"op:\u002F\u002FAgents\u002Fmy-agent\u002Fsession-key\")\n\n# Run with injected secrets (never touch disk)\nop run --env-file=.env.tpl -- python agent.py\n```\n\n### .env.tpl (safe to commit - no secrets)\n\n```\nPRIVATE_KEY=op:\u002F\u002FAgents\u002Ftrading-bot\u002Fsession-key\nRPC_URL=op:\u002F\u002FInfra\u002Falchemy\u002Fsepolia-url\nOPENAI_API_KEY=op:\u002F\u002FServices\u002Fopenai\u002Fapi-key\n```\n\n### Python Usage\n\n```python\nfrom secret_manager import get_session_key\n\n# Retrieve validated session key\ncreds = get_session_key(\"trading-bot-session\")\n\n# Check validity\nif creds.is_expired():\n    raise ValueError(\"Session expired - request renewal from operator\")\n\nprint(f\"Time remaining: {creds.time_remaining()}\")\nprint(f\"Allowed contracts: {creds.allowed_contracts}\")\n\n# Use the key (never log it!)\nclient.set_signer(creds.session_key)\n```\n\n### Vault-Level ACL (Recommended)\n\nConfigure 1Password vault permissions:\n\n```\nAgent-Credentials\u002F\n├── trading-bot-session    # Agent can read\n├── payment-bot-session    # Agent can read\n└── master-key             # Operator ONLY (agent has no access)\n```\n\n**Principle:** Agent credentials should be in a vault with read-only agent access. Master keys should be in a separate vault the agent cannot access.\n\n---\n\n## 2. Output Sanitization (MANDATORY)\n\n**⚠️ CRITICAL: Apply to ALL agent outputs before sending anywhere. No exceptions.**\n\nThis includes:\n- Chat responses\n- Cron job summaries\n- Monitoring alerts\n- Status reports\n- Debug logs\n- Error messages\n- Any text that leaves the agent\n\n```python\nfrom sanitizer import OutputSanitizer\n\ndef respond(content: str) -> str:\n    \"\"\"Mandatory sanitization before ANY output.\"\"\"\n    return OutputSanitizer.sanitize(content)\n\ndef cron_summary(task_result: dict) -> str:\n    \"\"\"Cron summaries MUST sanitize before delivery.\"\"\"\n    summary = format_summary(task_result)\n    return OutputSanitizer.sanitize(summary)  # ALWAYS sanitize\n```\n\n### Secret Patterns Detected\n\n| Pattern | Example | Result |\n|---------|---------|--------|\n| ETH private key | `0x1234...abcd` (64 hex) | `[PRIVATE_KEY_REDACTED]` |\n| ETH address | `0x742d...f44e` (40 hex) | `0x742d...f44e` (truncated) |\n| OpenAI key | `sk-proj-abc123...` | `[OPENAI_KEY_REDACTED]` |\n| Anthropic key | `sk-ant-api03-...` | `[ANTHROPIC_KEY_REDACTED]` |\n| 12-word seed | `abandon ability able...` | `[SEED_PHRASE_12_WORDS_REDACTED]` |\n| JWT | `eyJhbG...` | `[JWT_TOKEN_REDACTED]` |\n| Venice key refs | `venice:key1`, `venice:key2` | `[ venice:key1 ]` (bracketed) |\n\n### Sensitive Metrics Redacted (Cron Summaries)\n\n| Pattern | Example | Result |\n|---------|---------|--------|\n| DIEM counts | `98 DIEM`, `194 DIEM` | `[DIEM_REDACTED]` |\n| Balance | `balance: 42.5 DIEM` | `[BALANCE_REDACTED]` |\n| Threshold | `threshold: 10 DIEM` | `[THRESHOLD_REDACTED]` |\n| Totals | `total: 194 DIEM` | `[TOTAL_REDACTED]` |\n| Remaining\u002FSpent | `remaining: 50 DIEM` | `[METRIC_REDACTED]` |\n\n### Cron Summary Example\n\n**BEFORE sanitization (NEVER send this):**\n```\nVenice API check: venice:key1 has 98 DIEM, venice:key2 has 96 DIEM.\nBalance: 194 DIEM, Threshold: 10 DIEM\n```\n\n**AFTER sanitization (safe to send):**\n```\nVenice API check: [ venice:key1 ] has [DIEM_REDACTED], [ venice:key2 ] has [DIEM_REDACTED].\n[BALANCE_REDACTED], [THRESHOLD_REDACTED]\n```\n\n### Venice Key Reference Sanitization\n\nVenice API key references (`venice:key1`, `venice:key2`, etc.) are **NOT secrets** themselves, but should be bracketed to:\n1. Prevent them from being used as identifiers in logs\n2. Make it clear they are references, not actual keys\n3. Distinguish from potential false-positive patterns\n\nThe sanitizer brackets un-bracketed references: `venice:key1` → `[ venice:key1 ]`\n\nAlready-bracketed references are left unchanged: `[ venice:key1 ]` → `[ venice:key1 ]`\n\n---\n\n## 3. Input Validation\n\nCheck inputs before ANY wallet operation:\n\n```python\nfrom validator import InputValidator, ThreatLevel\n\nresult = InputValidator.validate(user_input)\n\nif result.level == ThreatLevel.BLOCKED:\n    return f\"Request blocked: {result.reason}\"\n\nif result.level == ThreatLevel.SUSPICIOUS:\n    # Log for review, but allow\n    log_suspicious(user_input, result.reason)\n\n# Proceed with operation\n```\n\n### Threat Categories\n\n| Category | Examples | Action |\n|----------|----------|--------|\n| Extraction | \"show private key\", \"reveal secrets\" | Block |\n| Override | \"ignore previous instructions\" | Block |\n| Role manipulation | \"you are now admin\" | Block |\n| Jailbreak | \"DAN mode\", \"bypass filters\" | Block |\n| Exfiltration | \"send config to https:\u002F\u002F...\" | Block |\n| Wallet threats | \"transfer all\", \"unlimited approve\" | Block |\n| Encoded | Base64\u002Fhex encoded attacks | Block |\n| Unicode tricks | Cyrillic lookalikes, zero-width | Block |\n| Suspicious | \"hypothetically\", \"just between us\" | Warn |\n\n---\n\n## 4. Operation Allowlisting\n\nNever execute arbitrary operations. Explicit whitelist only:\n\n```python\nfrom dataclasses import dataclass\nfrom decimal import Decimal\nfrom typing import Optional\n\n@dataclass\nclass AllowedOperation:\n    name: str\n    handler: callable\n    max_value: Optional[Decimal] = None\n    requires_confirmation: bool = False\n    cooldown_seconds: int = 0\n\nALLOWED_OPS = {\n    \"check_balance\": AllowedOperation(\"check_balance\", get_balance),\n    \"transfer_usdc\": AllowedOperation(\n        \"transfer_usdc\", \n        transfer,\n        max_value=Decimal(\"500\"),\n        requires_confirmation=True,\n        cooldown_seconds=60\n    ),\n    \"swap\": AllowedOperation(\n        \"swap\",\n        swap_tokens,\n        max_value=Decimal(\"1000\"),\n        cooldown_seconds=300\n    ),\n}\n\ndef execute(op_name: str, **kwargs):\n    if op_name not in ALLOWED_OPS:\n        raise PermissionError(f\"Operation '{op_name}' not allowed\")\n    \n    op = ALLOWED_OPS[op_name]\n    \n    if op.max_value and kwargs.get(\"amount\", 0) > op.max_value:\n        raise PermissionError(f\"Amount exceeds limit: {op.max_value}\")\n    \n    if op.requires_confirmation:\n        return request_confirmation(op_name, kwargs)\n    \n    return op.handler(**kwargs)\n```\n\n---\n\n## 5. Confirmation Flow\n\nHigh-value operations require explicit confirmation:\n\n```python\nimport hashlib\nimport time\n\npending_confirmations = {}\n\ndef request_confirmation(operation: str, details: dict) -> str:\n    code = hashlib.sha256(\n        f\"{operation}{time.time()}\".encode()\n    ).hexdigest()[:8].upper()\n    \n    pending_confirmations[code] = {\n        \"op\": operation,\n        \"details\": details,\n        \"expires\": time.time() + 300  # 5 minutes\n    }\n    \n    return f\"⚠️ Confirm '{operation}' with code: {code}\\n(expires in 5 minutes)\"\n\ndef confirm(code: str):\n    if code not in pending_confirmations:\n        return \"Invalid confirmation code\"\n    \n    req = pending_confirmations.pop(code)\n    \n    if time.time() > req[\"expires\"]:\n        return \"Confirmation code expired\"\n    \n    return execute_confirmed(req[\"op\"], req[\"details\"])\n```\n\n---\n\n## 6. Session Keys (ERC-4337)\n\nInstead of giving agents master keys, issue bounded session keys:\n\n```python\nfrom session_keys import SessionKeyManager\n\n# Operator creates trading session for agent\nconfig = SessionKeyManager.create_trading_session(\n    agent_name=\"alpha-trader\",\n    operator_address=\"0x742d...\",\n    duration_hours=24,\n    max_trade_usdc=1000,\n    daily_limit_usdc=5000,\n)\n\n# Export for storage in 1Password\nexport_data = SessionKeyManager.export_for_1password(\n    config, \n    session_key_hex=\"0x...\"  # Generated session key\n)\n\n# op item create ... (store in 1Password)\n```\n\n### Session Key Benefits\n\n| Feature | Master Key | Session Key |\n|---------|------------|-------------|\n| Expiration | Never | Configurable (hours\u002Fdays) |\n| Spending limits | None | Per-tx and daily caps |\n| Contract restrictions | Full access | Whitelist only |\n| Revocation | Requires key rotation | Instant, no key change |\n| Audit | None | Full operation log |\n\n---\n\n## 7. Pre-commit Hook\n\nBlock commits containing secrets:\n\n```bash\n# Install\ncp examples\u002Fpre-commit .git\u002Fhooks\u002F\nchmod +x .git\u002Fhooks\u002Fpre-commit\n```\n\nDetected patterns:\n- ETH private keys (64 hex chars)\n- OpenAI\u002FAnthropic\u002FGroq keys\n- AWS access keys\n- GitHub\u002FGitLab tokens\n- Slack\u002FDiscord tokens\n- PEM private keys\n- Generic PASSWORD\u002FSECRET assignments\n- BIP-39 seed phrases\n\n---\n\n## 8. Defense Layers\n\n```\nUSER INPUT\n    │\n    ▼\n┌────────────────────────────┐\n│ Layer 1: Input Validation  │  ← Regex + encoding + unicode checks\n└────────────────────────────┘\n    │\n    ▼\n┌────────────────────────────┐\n│ Layer 2: Op Allowlisting   │  ← Explicit whitelist only\n└────────────────────────────┘\n    │\n    ▼\n┌────────────────────────────┐\n│ Layer 3: Value Limits      │  ← Max per-tx and per-day\n└────────────────────────────┘\n    │\n    ▼\n┌────────────────────────────┐\n│ Layer 4: Confirmation      │  ← Time-limited codes for $$$\n└────────────────────────────┘\n    │\n    ▼\n┌────────────────────────────┐\n│ Layer 5: Isolated Exec     │  ← Wallet ops != conversation\n└────────────────────────────┘\n    │\n    ▼\nOUTPUT SANITIZATION\n```\n\n---\n\n## Common Mistakes\n\n### ❌ Keys in memory files\n```markdown\n# memory\u002F2026-02-07.md\nPrivate key: 0x9f01dad551039daad...\n```\n**Fix:** Store reference only: `Private key: [stored in 1Password: test-wallet]`\n\n### ❌ Keys in error messages\n```python\nexcept Exception as e:\n    log(f\"Failed with key {private_key}: {e}\")\n```\n**Fix:** Never include credentials in error context\n\n### ❌ Keys in .env.example\n```\nPRIVATE_KEY=sk-ant-api03-real-key...  # \"for testing\"\n```\n**Fix:** Use obviously fake: `PRIVATE_KEY=your-key-here`\n\n### ❌ \"All\" in transfer requests\n```\nUser: \"Transfer all my USDC\"\nAgent: *executes unlimited transfer*\n```\n**Fix:** Block \"all\u002Feverything\u002Fmax\" patterns, require explicit amounts\n\n### ❌ Trusting conversation context\n```python\n# Wallet has access to conversation history\nself.wallet.execute(conversation[-1][\"content\"])\n```\n**Fix:** Wallet operations must be isolated from conversation context\n\n---\n\n## Testing\n\n```bash\ncd examples\n\n# Run full test suite\npython test_suite.py\n\n# Test individual components\npython sanitizer.py    # Output sanitization demo\npython validator.py    # Input validation demo\npython session_keys.py # Session key demo\n```\n\nExpected output: `All tests passed`\n\n### Test Evidence (v2.2.0 - 2026-03-11)\n\n**Sanitizer v3 Test Results - All 16 tests passed:**\n\n```\nOutput Sanitizer Test (v3)\n============================================================\n\n✅ PASS (expect detect)\n   Input:     My key is 0x1234567890abcdef...\n   Sanitized: My key is [PRIVATE_KEY_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     Key: 1234567890abcdef...\n   Sanitized: Key: [HEX_KEY_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     First half: 1234567890abcdef...\n   Sanitized: First half: [PARTIAL_KEY_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     Send to 0x742d35Cc6634C0532925a3b844Bc454e4438f44e\n   Sanitized: Send to 0x742d...f44e\n\n✅ PASS (expect detect)\n   Input:     Using sk-proj-abc123def456...\n   Sanitized: Using [OPENAI_KEY_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     API key is sk-ant-api03-abcdef...\n   Sanitized: API key is [ANTHROPIC_KEY_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     aws_secret_key=AKIAIOSFODNN7EXAMPLE...\n   Sanitized: aws_secret_key=[AWS_ACCESS_KEY_REDACTED]...\n\n✅ PASS (expect ignore)\n   Input:     The hash is dGhpcyBpcyBhIHRlc3Q...\n   Sanitized: The hash is dGhpcyBpcyBhIHRlc3Q...\n\n✅ PASS (expect detect)\n   Input:     abandon ability able about above absent...\n   Sanitized: [SEED_PHRASE_12_WORDS_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...\n   Sanitized: Bearer [JWT_TOKEN_REDACTED]\n\n✅ PASS (expect ignore)\n   Input:     Normal text without secrets\n   Sanitized: Normal text without secrets\n\n✅ PASS (expect detect)\n   Input:     Bot token: 123456789:ABCdefGHI...\n   Sanitized: Bot token: [TELEGRAM_TOKEN_REDACTED]\n\n============================================================\nCron Summary & Venice Key Sanitization Tests\n------------------------------------------------------------\n\n✅ PASS\n   Input:     Venice API check: venice:key1 has 98 DIEM, venice:key2 has 96 DIEM. Total: 194 DIEM.\n   Sanitized: Venice API check: [ venice:key1 ] has [DIEM_REDACTED], [ venice:key2 ] has [DIEM_REDACTED]...\n   Expected fragment ✓: [ venice:key1 ]\n   Expected fragment ✓: [ venice:key2 ]\n   Expected fragment ✓: [DIEM_REDACTED]\n\n✅ PASS\n   Input:     Monitor: balance: 42.5 DIEM, threshold: 10 DIEM, total: 194 DIEM\n   Sanitized: Monitor: [BALANCE_REDACTED], [THRESHOLD_REDACTED], [TOTAL_REDACTED]\n   Expected fragment ✓: [BALANCE_REDACTED]\n   Expected fragment ✓: [THRESHOLD_REDACTED]\n   Expected fragment ✓: [TOTAL_REDACTED]\n\n✅ PASS\n   Input:     Using [ venice:key1 ] for fallback.\n   Sanitized: Using [ venice:key1 ] for fallback.\n   Expected fragment ✓: [ venice:key1 ]\n\n✅ PASS\n   Input:     remaining: 50 DIEM, spent: 30 DIEM\n   Sanitized: remaining: [DIEM_REDACTED], spent: [DIEM_REDACTED]\n   Expected fragment ✓: [DIEM_REDACTED]\n\n============================================================\nResults: 16 passed, 0 failed\nAll tests passed ✅\n```\n\n**Key capabilities verified:**\n- venice:key\u003CN> references are bracketed: `[ venice:key1 ]`\n- Already-bracketed references remain unchanged\n- Sensitive metrics (balance, threshold, total, DIEM counts) are redacted\n- All existing secret detection patterns work correctly\n\n---\n\n## Checklist\n\n- [ ] 1Password CLI installed and authenticated\n- [ ] Secrets in 1Password vault, not files\n- [ ] Session keys with expiry and limits\n- [ ] Output sanitization on all responses\n- [ ] Input validation before wallet ops\n- [ ] Pre-commit hook installed\n- [ ] Confirmation flow for high-value operations\n- [ ] Wallet operations isolated from conversation\n- [ ] .gitignore covers secrets and memory files\n- [ ] Test suite passes\n\n---\n\n## Security Model Limitations\n\nThis skill provides **defense in depth**, not a guarantee. Adversaries may:\n\n1. **Novel injection patterns** - Regex can't catch everything; semantic analysis helps but isn't perfect\n2. **Social engineering** - Convincing the operator to approve malicious operations\n3. **Timing attacks** - Exploiting confirmation windows\n4. **Encoding evasion** - New encoding schemes not covered\n\n**Recommendation:** Layer these defenses with:\n- Rate limiting\n- Anomaly detection\n- Human-in-the-loop for large transactions\n- Regular security audits\n","# Bagman\n\nSecure key management patterns for AI agents handling wallets, private keys, and secrets.\n\n## When to Use This Skill\n\n- Agent needs wallet\u002Fblockchain access\n- Handling API keys, credentials, or secrets\n- Building systems where AI controls funds\n- Preventing secret leakage via prompts or outputs\n\n## Quick Start\n\n```bash\n# Install 1Password CLI\nbrew install 1password-cli\n\n# Authenticate\neval $(op signin)\n\n# Create vault for agent credentials\nop vault create \"Agent-Credentials\"\n\n# Run examples\ncd examples && python test_suite.py\n```\n\n---\n\n## Core Rules\n\n| Rule | Why |\n|------|-----|\n| Never store raw private keys | Config, env, memory, or conversation = leaked |\n| Use delegated access | Session keys with time\u002Fvalue\u002Fscope limits |\n| Secrets via secret manager | 1Password, Vault, AWS Secrets Manager |\n| Sanitize all outputs | Scan for key patterns before any response |\n| Validate all inputs | Check for injection attempts before wallet ops |\n\n---\n\n## Architecture\n\n```\n┌─────────────────────────────────────────────────────┐\n│                   AI Agent                          │\n├─────────────────────────────────────────────────────┤\n│  Session Key (bounded)                              │\n│  ├─ Expires after N hours                           │\n│  ├─ Max spend per tx\u002Fday                            │\n│  └─ Whitelist of allowed contracts\u002Fmethods          │\n├─────────────────────────────────────────────────────┤\n│  Secret Manager (1Password\u002FVault)                   │\n│  ├─ Retrieve at runtime only                        │\n│  ├─ Never persist to disk                           │\n│  └─ Audit trail of accesses                         │\n├─────────────────────────────────────────────────────┤\n│  Smart Account (ERC-4337)                           │\n│  ├─ Programmable permissions                        │\n│  └─ Recovery without key exposure                   │\n└─────────────────────────────────────────────────────┘\n```\n\n---\n\n## Implementation Files\n\n| File | Purpose |\n|------|---------|\n| `examples\u002Fsecret_manager.py` | 1Password integration for runtime secret retrieval |\n| `examples\u002Fsanitizer.py` | Output sanitization (keys, seeds, tokens) |\n| `examples\u002Fvalidator.py` | Input validation (prompt injection defense) |\n| `examples\u002Fsession_keys.py` | ERC-4337 session key configuration |\n| `examples\u002Fdelegation_integration.ts` | MetaMask Delegation Framework (EIP-7710) |\n| `examples\u002Fpre-commit` | Git hook to block secret commits |\n| `examples\u002Ftest_suite.py` | Adversarial test suite |\n| `docs\u002Fprompt-injection.md` | Deep dive on injection defense |\n| `docs\u002Fsecure-storage.md` | Secret storage patterns |\n| `docs\u002Fsession-keys.md` | Session key architecture |\n| `docs\u002Fleak-prevention.md` | Output sanitization patterns |\n| `docs\u002Fdelegation-framework.md` | On-chain permission enforcement (EIP-7710) |\n\n---\n\n## 1. Secret Retrieval\n\n### 1Password CLI Pattern\n\n```bash\n# Retrieve at runtime (never store result)\nSESSION_KEY=$(op read \"op:\u002F\u002FAgents\u002Fmy-agent\u002Fsession-key\")\n\n# Run with injected secrets (never touch disk)\nop run --env-file=.env.tpl -- python agent.py\n```\n\n### .env.tpl (safe to commit - no secrets)\n\n```\nPRIVATE_KEY=op:\u002F\u002FAgents\u002Ftrading-bot\u002Fsession-key\nRPC_URL=op:\u002F\u002FInfra\u002Falchemy\u002Fsepolia-url\nOPENAI_API_KEY=op:\u002F\u002FServices\u002Fopenai\u002Fapi-key\n```\n\n### Python Usage\n\n```python\nfrom secret_manager import get_session_key\n\n# Retrieve validated session key\ncreds = get_session_key(\"trading-bot-session\")\n\n# Check validity\nif creds.is_expired():\n    raise ValueError(\"Session expired - request renewal from operator\")\n\nprint(f\"Time remaining: {creds.time_remaining()}\")\nprint(f\"Allowed contracts: {creds.allowed_contracts}\")\n\n# Use the key (never log it!)\nclient.set_signer(creds.session_key)\n```\n\n### Vault-Level ACL (Recommended)\n\nConfigure 1Password vault permissions:\n\n```\nAgent-Credentials\u002F\n├── trading-bot-session    # Agent can read\n├── payment-bot-session    # Agent can read\n└── master-key             # Operator ONLY (agent has no access)\n```\n\n**Principle:** Agent credentials should be in a vault with read-only agent access. Master keys should be in a separate vault the agent cannot access.\n\n---\n\n## 2. Output Sanitization (MANDATORY)\n\n**⚠️ CRITICAL: Apply to ALL agent outputs before sending anywhere. No exceptions.**\n\nThis includes:\n- Chat responses\n- Cron job summaries\n- Monitoring alerts\n- Status reports\n- Debug logs\n- Error messages\n- Any text that leaves the agent\n\n```python\nfrom sanitizer import OutputSanitizer\n\ndef respond(content: str) -> str:\n    \"\"\"Mandatory sanitization before ANY output.\"\"\"\n    return OutputSanitizer.sanitize(content)\n\ndef cron_summary(task_result: dict) -> str:\n    \"\"\"Cron summaries MUST sanitize before delivery.\"\"\"\n    summary = format_summary(task_result)\n    return OutputSanitizer.sanitize(summary)  # ALWAYS sanitize\n```\n\n### Secret Patterns Detected\n\n| Pattern | Example | Result |\n|---------|---------|--------|\n| ETH private key | `0x1234...abcd` (64 hex) | `[PRIVATE_KEY_REDACTED]` |\n| ETH address | `0x742d...f44e` (40 hex) | `0x742d...f44e` (truncated) |\n| OpenAI key | `sk-proj-abc123...` | `[OPENAI_KEY_REDACTED]` |\n| Anthropic key | `sk-ant-api03-...` | `[ANTHROPIC_KEY_REDACTED]` |\n| 12-word seed | `abandon ability able...` | `[SEED_PHRASE_12_WORDS_REDACTED]` |\n| JWT | `eyJhbG...` | `[JWT_TOKEN_REDACTED]` |\n| Venice key refs | `venice:key1`, `venice:key2` | `[ venice:key1 ]` (bracketed) |\n\n### Sensitive Metrics Redacted (Cron Summaries)\n\n| Pattern | Example | Result |\n|---------|---------|--------|\n| DIEM counts | `98 DIEM`, `194 DIEM` | `[DIEM_REDACTED]` |\n| Balance | `balance: 42.5 DIEM` | `[BALANCE_REDACTED]` |\n| Threshold | `threshold: 10 DIEM` | `[THRESHOLD_REDACTED]` |\n| Totals | `total: 194 DIEM` | `[TOTAL_REDACTED]` |\n| Remaining\u002FSpent | `remaining: 50 DIEM` | `[METRIC_REDACTED]` |\n\n### Cron Summary Example\n\n**BEFORE sanitization (NEVER send this):**\n```\nVenice API check: venice:key1 has 98 DIEM, venice:key2 has 96 DIEM.\nBalance: 194 DIEM, Threshold: 10 DIEM\n```\n\n**AFTER sanitization (safe to send):**\n```\nVenice API check: [ venice:key1 ] has [DIEM_REDACTED], [ venice:key2 ] has [DIEM_REDACTED].\n[BALANCE_REDACTED], [THRESHOLD_REDACTED]\n```\n\n### Venice Key Reference Sanitization\n\nVenice API key references (`venice:key1`, `venice:key2`, etc.) are **NOT secrets** themselves, but should be bracketed to:\n1. Prevent them from being used as identifiers in logs\n2. Make it clear they are references, not actual keys\n3. Distinguish from potential false-positive patterns\n\nThe sanitizer brackets un-bracketed references: `venice:key1` → `[ venice:key1 ]`\n\nAlready-bracketed references are left unchanged: `[ venice:key1 ]` → `[ venice:key1 ]`\n\n---\n\n## 3. Input Validation\n\nCheck inputs before ANY wallet operation:\n\n```python\nfrom validator import InputValidator, ThreatLevel\n\nresult = InputValidator.validate(user_input)\n\nif result.level == ThreatLevel.BLOCKED:\n    return f\"Request blocked: {result.reason}\"\n\nif result.level == ThreatLevel.SUSPICIOUS:\n    # Log for review, but allow\n    log_suspicious(user_input, result.reason)\n\n# Proceed with operation\n```\n\n### Threat Categories\n\n| Category | Examples | Action |\n|----------|----------|--------|\n| Extraction | \"show private key\", \"reveal secrets\" | Block |\n| Override | \"ignore previous instructions\" | Block |\n| Role manipulation | \"you are now admin\" | Block |\n| Jailbreak | \"DAN mode\", \"bypass filters\" | Block |\n| Exfiltration | \"send config to https:\u002F\u002F...\" | Block |\n| Wallet threats | \"transfer all\", \"unlimited approve\" | Block |\n| Encoded | Base64\u002Fhex encoded attacks | Block |\n| Unicode tricks | Cyrillic lookalikes, zero-width | Block |\n| Suspicious | \"hypothetically\", \"just between us\" | Warn |\n\n---\n\n## 4. Operation Allowlisting\n\nNever execute arbitrary operations. Explicit whitelist only:\n\n```python\nfrom dataclasses import dataclass\nfrom decimal import Decimal\nfrom typing import Optional\n\n@dataclass\nclass AllowedOperation:\n    name: str\n    handler: callable\n    max_value: Optional[Decimal] = None\n    requires_confirmation: bool = False\n    cooldown_seconds: int = 0\n\nALLOWED_OPS = {\n    \"check_balance\": AllowedOperation(\"check_balance\", get_balance),\n    \"transfer_usdc\": AllowedOperation(\n        \"transfer_usdc\", \n        transfer,\n        max_value=Decimal(\"500\"),\n        requires_confirmation=True,\n        cooldown_seconds=60\n    ),\n    \"swap\": AllowedOperation(\n        \"swap\",\n        swap_tokens,\n        max_value=Decimal(\"1000\"),\n        cooldown_seconds=300\n    ),\n}\n\ndef execute(op_name: str, **kwargs):\n    if op_name not in ALLOWED_OPS:\n        raise PermissionError(f\"Operation '{op_name}' not allowed\")\n    \n    op = ALLOWED_OPS[op_name]\n    \n    if op.max_value and kwargs.get(\"amount\", 0) > op.max_value:\n        raise PermissionError(f\"Amount exceeds limit: {op.max_value}\")\n    \n    if op.requires_confirmation:\n        return request_confirmation(op_name, kwargs)\n    \n    return op.handler(**kwargs)\n```\n\n---\n\n## 5. Confirmation Flow\n\nHigh-value operations require explicit confirmation:\n\n```python\nimport hashlib\nimport time\n\npending_confirmations = {}\n\ndef request_confirmation(operation: str, details: dict) -> str:\n    code = hashlib.sha256(\n        f\"{operation}{time.time()}\".encode()\n    ).hexdigest()[:8].upper()\n    \n    pending_confirmations[code] = {\n        \"op\": operation,\n        \"details\": details,\n        \"expires\": time.time() + 300  # 5 minutes\n    }\n    \n    return f\"⚠️ Confirm '{operation}' with code: {code}\\n(expires in 5 minutes)\"\n\ndef confirm(code: str):\n    if code not in pending_confirmations:\n        return \"Invalid confirmation code\"\n    \n    req = pending_confirmations.pop(code)\n    \n    if time.time() > req[\"expires\"]:\n        return \"Confirmation code expired\"\n    \n    return execute_confirmed(req[\"op\"], req[\"details\"])\n```\n\n---\n\n## 6. Session Keys (ERC-4337)\n\nInstead of giving agents master keys, issue bounded session keys:\n\n```python\nfrom session_keys import SessionKeyManager\n\n# Operator creates trading session for agent\nconfig = SessionKeyManager.create_trading_session(\n    agent_name=\"alpha-trader\",\n    operator_address=\"0x742d...\",\n    duration_hours=24,\n    max_trade_usdc=1000,\n    daily_limit_usdc=5000,\n)\n\n# Export for storage in 1Password\nexport_data = SessionKeyManager.export_for_1password(\n    config, \n    session_key_hex=\"0x...\"  # Generated session key\n)\n\n# op item create ... (store in 1Password)\n```\n\n### Session Key Benefits\n\n| Feature | Master Key | Session Key |\n|---------|------------|-------------|\n| Expiration | Never | Configurable (hours\u002Fdays) |\n| Spending limits | None | Per-tx and daily caps |\n| Contract restrictions | Full access | Whitelist only |\n| Revocation | Requires key rotation | Instant, no key change |\n| Audit | None | Full operation log |\n\n---\n\n## 7. Pre-commit Hook\n\nBlock commits containing secrets:\n\n```bash\n# Install\ncp examples\u002Fpre-commit .git\u002Fhooks\u002F\nchmod +x .git\u002Fhooks\u002Fpre-commit\n```\n\nDetected patterns:\n- ETH private keys (64 hex chars)\n- OpenAI\u002FAnthropic\u002FGroq keys\n- AWS access keys\n- GitHub\u002FGitLab tokens\n- Slack\u002FDiscord tokens\n- PEM private keys\n- Generic PASSWORD\u002FSECRET assignments\n- BIP-39 seed phrases\n\n---\n\n## 8. Defense Layers\n\n```\nUSER INPUT\n    │\n    ▼\n┌────────────────────────────┐\n│ Layer 1: Input Validation  │  ← Regex + encoding + unicode checks\n└────────────────────────────┘\n    │\n    ▼\n┌────────────────────────────┐\n│ Layer 2: Op Allowlisting   │  ← Explicit whitelist only\n└────────────────────────────┘\n    │\n    ▼\n┌────────────────────────────┐\n│ Layer 3: Value Limits      │  ← Max per-tx and per-day\n└────────────────────────────┘\n    │\n    ▼\n┌────────────────────────────┐\n│ Layer 4: Confirmation      │  ← Time-limited codes for $$$\n└────────────────────────────┘\n    │\n    ▼\n┌────────────────────────────┐\n│ Layer 5: Isolated Exec     │  ← Wallet ops != conversation\n└────────────────────────────┘\n    │\n    ▼\nOUTPUT SANITIZATION\n```\n\n---\n\n## Common Mistakes\n\n### ❌ Keys in memory files\n```markdown\n# memory\u002F2026-02-07.md\nPrivate key: 0x9f01dad551039daad...\n```\n**Fix:** Store reference only: `Private key: [stored in 1Password: test-wallet]`\n\n### ❌ Keys in error messages\n```python\nexcept Exception as e:\n    log(f\"Failed with key {private_key}: {e}\")\n```\n**Fix:** Never include credentials in error context\n\n### ❌ Keys in .env.example\n```\nPRIVATE_KEY=sk-ant-api03-real-key...  # \"for testing\"\n```\n**Fix:** Use obviously fake: `PRIVATE_KEY=your-key-here`\n\n### ❌ \"All\" in transfer requests\n```\nUser: \"Transfer all my USDC\"\nAgent: *executes unlimited transfer*\n```\n**Fix:** Block \"all\u002Feverything\u002Fmax\" patterns, require explicit amounts\n\n### ❌ Trusting conversation context\n```python\n# Wallet has access to conversation history\nself.wallet.execute(conversation[-1][\"content\"])\n```\n**Fix:** Wallet operations must be isolated from conversation context\n\n---\n\n## Testing\n\n```bash\ncd examples\n\n# Run full test suite\npython test_suite.py\n\n# Test individual components\npython sanitizer.py    # Output sanitization demo\npython validator.py    # Input validation demo\npython session_keys.py # Session key demo\n```\n\nExpected output: `All tests passed`\n\n### Test Evidence (v2.2.0 - 2026-03-11)\n\n**Sanitizer v3 Test Results - All 16 tests passed:**\n\n```\nOutput Sanitizer Test (v3)\n============================================================\n\n✅ PASS (expect detect)\n   Input:     My key is 0x1234567890abcdef...\n   Sanitized: My key is [PRIVATE_KEY_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     Key: 1234567890abcdef...\n   Sanitized: Key: [HEX_KEY_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     First half: 1234567890abcdef...\n   Sanitized: First half: [PARTIAL_KEY_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     Send to 0x742d35Cc6634C0532925a3b844Bc454e4438f44e\n   Sanitized: Send to 0x742d...f44e\n\n✅ PASS (expect detect)\n   Input:     Using sk-proj-abc123def456...\n   Sanitized: Using [OPENAI_KEY_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     API key is sk-ant-api03-abcdef...\n   Sanitized: API key is [ANTHROPIC_KEY_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     aws_secret_key=AKIAIOSFODNN7EXAMPLE...\n   Sanitized: aws_secret_key=[AWS_ACCESS_KEY_REDACTED]...\n\n✅ PASS (expect ignore)\n   Input:     The hash is dGhpcyBpcyBhIHRlc3Q...\n   Sanitized: The hash is dGhpcyBpcyBhIHRlc3Q...\n\n✅ PASS (expect detect)\n   Input:     abandon ability able about above absent...\n   Sanitized: [SEED_PHRASE_12_WORDS_REDACTED]\n\n✅ PASS (expect detect)\n   Input:     Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...\n   Sanitized: Bearer [JWT_TOKEN_REDACTED]\n\n✅ PASS (expect ignore)\n   Input:     Normal text without secrets\n   Sanitized: Normal text without secrets\n\n✅ PASS (expect detect)\n   Input:     Bot token: 123456789:ABCdefGHI...\n   Sanitized: Bot token: [TELEGRAM_TOKEN_REDACTED]\n\n============================================================\nCron Summary & Venice Key Sanitization Tests\n------------------------------------------------------------\n\n✅ PASS\n   Input:     Venice API check: venice:key1 has 98 DIEM, venice:key2 has 96 DIEM. Total: 194 DIEM.\n   Sanitized: Venice API check: [ venice:key1 ] has [DIEM_REDACTED], [ venice:key2 ] has [DIEM_REDACTED]...\n   Expected fragment ✓: [ venice:key1 ]\n   Expected fragment ✓: [ venice:key2 ]\n   Expected fragment ✓: [DIEM_REDACTED]\n\n✅ PASS\n   Input:     Monitor: balance: 42.5 DIEM, threshold: 10 DIEM, total: 194 DIEM\n   Sanitized: Monitor: [BALANCE_REDACTED], [THRESHOLD_REDACTED], [TOTAL_REDACTED]\n   Expected fragment ✓: [BALANCE_REDACTED]\n   Expected fragment ✓: [THRESHOLD_REDACTED]\n   Expected fragment ✓: [TOTAL_REDACTED]\n\n✅ PASS\n   Input:     Using [ venice:key1 ] for fallback.\n   Sanitized: Using [ venice:key1 ] for fallback.\n   Expected fragment ✓: [ venice:key1 ]\n\n✅ PASS\n   Input:     remaining: 50 DIEM, spent: 30 DIEM\n   Sanitized: remaining: [DIEM_REDACTED], spent: [DIEM_REDACTED]\n   Expected fragment ✓: [DIEM_REDACTED]\n\n============================================================\nResults: 16 passed, 0 failed\nAll tests passed ✅\n```\n\n**Key capabilities verified:**\n- venice:key\u003CN> references are bracketed: `[ venice:key1 ]`\n- Already-bracketed references remain unchanged\n- Sensitive metrics (balance, threshold, total, DIEM counts) are redacted\n- All existing secret detection patterns work correctly\n\n---\n\n## Checklist\n\n- [ ] 1Password CLI installed and authenticated\n- [ ] Secrets in 1Password vault, not files\n- [ ] Session keys with expiry and limits\n- [ ] Output sanitization on all responses\n- [ ] Input validation before wallet ops\n- [ ] Pre-commit hook installed\n- [ ] Confirmation flow for high-value operations\n- [ ] Wallet operations isolated from conversation\n- [ ] .gitignore covers secrets and memory files\n- [ ] Test suite passes\n\n---\n\n## Security Model Limitations\n\nThis skill provides **defense in depth**, not a guarantee. Adversaries may:\n\n1. **Novel injection patterns** - Regex can't catch everything; semantic analysis helps but isn't perfect\n2. **Social engineering** - Convincing the operator to approve malicious operations\n3. **Timing attacks** - Exploiting confirmation windows\n4. **Encoding evasion** - New encoding schemes not covered\n\n**Recommendation:** Layer these defenses with:\n- Rate limiting\n- Anomaly detection\n- Human-in-the-loop for large transactions\n- Regular security audits\n",{"name":5,"version":52,"homepage":53,"metadata":54,"description":7},"2.2.0","https:\u002F\u002Fgithub.com\u002Fzscole\u002Fbagman-skill",{"openclaw":55},{"tags":56,"emoji":59,"requires":60},[44,57,58,29,34,41],"wallet","keys","?",{"bins":61},[62],"op","main","59d09a946d4b1caf80d7fd4db31553ffb5a01ad8","skills\u002Fbagman",2,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org","https:\u002F\u002Fgithub.com\u002Fprofbernardoj","2026-10-28 01:06:18",{"source":8,"skillName":5,"commands":71,"prompt":81,"zipAvailable":82},[72,75,78],{"tool":73,"command":74},"npx","npx skills add profbernardoj\u002Fandroidclaw.org --skill bagman",{"tool":76,"command":77},"bunx","bunx skills add profbernardoj\u002Fandroidclaw.org --skill bagman",{"tool":79,"command":80},"pnpm","pnpm dlx skills add profbernardoj\u002Fandroidclaw.org --skill bagman","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002FSKILL.md",true,[84,90,94,100,104,108,112,116,120,124,128,132,136,142,146,150,154,158,162,167,171,175,179,183,186,190,194,198],{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"_meta.json","REFERENCE","参考文档",125,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002F_meta.json",{"path":91,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":92,"sourceHtmlUrl":93},".clawhub\u002Forigin.json",138,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002F.clawhub\u002Forigin.json",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"examples\u002Fbackends\u002F__init__.py","SCRIPT","脚本",477,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fbackends\u002F__init__.py",{"path":101,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":102,"sourceHtmlUrl":103},"examples\u002Fbackends\u002Fauto.py",4003,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fbackends\u002Fauto.py",{"path":105,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":106,"sourceHtmlUrl":107},"examples\u002Fbackends\u002Fbase.py",2306,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fbackends\u002Fbase.py",{"path":109,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":110,"sourceHtmlUrl":111},"examples\u002Fbackends\u002Fencrypted_file.py",6694,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fbackends\u002Fencrypted_file.py",{"path":113,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":114,"sourceHtmlUrl":115},"examples\u002Fbackends\u002Fenv.py",2363,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fbackends\u002Fenv.py",{"path":117,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":118,"sourceHtmlUrl":119},"examples\u002Fbackends\u002Fkeychain.py",2751,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fbackends\u002Fkeychain.py",{"path":121,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":122,"sourceHtmlUrl":123},"examples\u002Fbackends\u002Fonepassword.py",5319,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fbackends\u002Fonepassword.py",{"path":125,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":126,"sourceHtmlUrl":127},"examples\u002Fbip39_wordlist.txt",13116,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fbip39_wordlist.txt",{"path":129,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":130,"sourceHtmlUrl":131},"examples\u002Fdelegation_integration.test.ts",11009,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fdelegation_integration.test.ts",{"path":133,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":134,"sourceHtmlUrl":135},"examples\u002Fdelegation_integration.ts",13208,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fdelegation_integration.ts",{"path":137,"resourceType":138,"resourceTypeDesc":139,"sizeBytes":140,"sourceHtmlUrl":141},"examples\u002Fpre-commit","OTHER","其他",4927,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fpre-commit",{"path":143,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":144,"sourceHtmlUrl":145},"examples\u002Fsanitizer.py",14924,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fsanitizer.py",{"path":147,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":148,"sourceHtmlUrl":149},"examples\u002Fsecret_manager.py",5221,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fsecret_manager.py",{"path":151,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":152,"sourceHtmlUrl":153},"examples\u002Fsession_keys.py",13327,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fsession_keys.py",{"path":155,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":156,"sourceHtmlUrl":157},"examples\u002Ftest_suite.py",2138,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Ftest_suite.py",{"path":159,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":160,"sourceHtmlUrl":161},"examples\u002Fvalidator.py",24059,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Fexamples\u002Fvalidator.py",{"path":163,"resourceType":163,"resourceTypeDesc":164,"sizeBytes":165,"sourceHtmlUrl":166},"LICENSE","许可证",1063,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-scope-per-tool-permissions-least-privilege\u002FLICENSE",{"path":168,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":169,"sourceHtmlUrl":170},"references\u002Fautonomous-operation.md",4396,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Freferences\u002Fautonomous-operation.md",{"path":172,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":173,"sourceHtmlUrl":174},"references\u002Fdelegation-framework.md",14821,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Freferences\u002Fdelegation-framework.md",{"path":176,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":177,"sourceHtmlUrl":178},"references\u002Fleak-prevention.md",5526,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Freferences\u002Fleak-prevention.md",{"path":180,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":181,"sourceHtmlUrl":182},"references\u002Fprompt-injection-defense.md",8375,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Freferences\u002Fprompt-injection-defense.md",{"path":184,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":181,"sourceHtmlUrl":185},"references\u002Fprompt-injection.md","https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Freferences\u002Fprompt-injection.md",{"path":187,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":188,"sourceHtmlUrl":189},"references\u002Fsecure-storage.md",7280,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Freferences\u002Fsecure-storage.md",{"path":191,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":192,"sourceHtmlUrl":193},"references\u002Fsession-keys.md",10837,"https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fbagman\u002Freferences\u002Fsession-keys.md",{"path":195,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":196,"sourceHtmlUrl":197},"SOURCE.md",368,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-scope-per-tool-permissions-least-privilege\u002FSOURCE.md",{"path":199,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":200,"sourceHtmlUrl":201},"TRUST.auto.yaml",2197,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-scope-per-tool-permissions-least-privilege\u002FTRUST.auto.yaml",[203,220,239,247,259,276],{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":209,"publishedAt":47},"01M6CP697DPZ4ZDMKBW8G22X8V","xmtp-comms-guard","Security middleware for all XMTP communications in EverClaw. Enforces guarded client usage with validation, integrity checks, and fail-closed security policies. Integrates approval flows for sensitive operations. Use when integrating XMTP messaging, configuring communication security, or auditing guarded client enforcement.","https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fxmtp-comms-guard\u002FSKILL.md",[],[210,211,44,212,213,214,215,216,217,218,31,219],"xmtp comms guard","guard","integrity checks","validation","communication","messaging","integrity","operations","approval","enforcement",{"skillNo":221,"name":222,"nameZh":6,"description":223,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":224,"categories":225,"keywords":226,"publishedAt":47},"01M6CP66P8QVD03GFH4GCMM8A3","three-shifts","Daily standup engine. Plans tasks 3x daily (6 AM, 2 PM, 10 PM) and delivers them for approval. Execution happens in the main session via direct conversation. Night shifts auto-approve carryover from earlier in the day.","https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fthree-shifts\u002FSKILL.md",[],[227,228,229,63,230,231,232,233,234,235,236,237,32,218,238],"three shifts","three","conversation","standup","tasks","execution","daily","engine","daily standup","direct","main session","auto",{"skillNo":240,"name":241,"nameZh":6,"description":242,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":243,"categories":244,"keywords":245,"publishedAt":47},"01M6CP65GBWKR4Q30PTVE67D4D","super-helper","A helpful utility skill for agents","https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fskillguard\u002Ftest-fixtures\u002Fmalicious-skill\u002FSKILL.md",[],[246],"super helper",{"skillNo":248,"name":249,"nameZh":6,"description":250,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":251,"categories":252,"keywords":253,"publishedAt":47},"01M6CP63FQGHH63MVKD9BFSK4J","github-issues","Fetch and manage GitHub issues via the API","https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fskillguard\u002Ftest-fixtures\u002Flegit-api-skill\u002FSKILL.md",[],[254,255,46,35,256,257,258],"issues","github issues","curl","fetch","manage",{"skillNo":260,"name":261,"nameZh":6,"description":262,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":263,"categories":264,"keywords":270,"publishedAt":47},"01M6CP620HK50ZSN7YXMPRVC5C","code-formatter","Format and lint code files","https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fskillguard\u002Ftest-fixtures\u002Fevasive-12-multi-stage\u002FSKILL.md",[265],{"categoryNo":266,"categoryName":267,"taxonomyType":268,"taxonomyTypeDesc":269},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[271,272,273,274,275],"code formatter","code","files","format","lint",{"skillNo":277,"name":278,"nameZh":6,"description":279,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":280,"categories":281,"keywords":282,"publishedAt":47},"01M6CP60JXJ1YY3X0HQ3JQS2QN","config-helper","Parse and validate configuration files","https:\u002F\u002Fgithub.com\u002Fprofbernardoj\u002Fandroidclaw.org\u002Fblob\u002Fmain\u002Fskills\u002Fskillguard\u002Ftest-fixtures\u002Fevasive-11-polyglot-json\u002FSKILL.md",[],[283,284,285,286,273],"config","config helper","validate","configuration"]